-- Pandora FMS - the Flexible Monitoring System
-- ============================================
-- Copyright (c) 2014-2023 Pandora FMS
-- Please see http://www.pandorafms.com 

-- Database Data for Pandora FMS NG

-- PLEASE NO NOT USE MULTILINE COMMENTS 
-- Because Pandora Installer don't understand them
-- and fails creating database !!!

-- Dumping data for table `talert_commands`
--

INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (1,'eMail','Internal&#x20;type','This&#x20;alert&#x20;send&#x20;an&#x20;email&#x20;using&#x20;internal&#x20;Server&#x20;SMTP&#x20;capabilities&#x20;&#40;defined&#x20;in&#x20;each&#x20;server,&#x20;using:&#x0d;&#x0a;_field1_&#x20;as&#x20;destination&#x20;email&#x20;address,&#x20;and&#x0d;&#x0a;_field2_&#x20;as&#x20;subject&#x20;for&#x20;message.&#x20;&#x0d;&#x0a;_field3_&#x20;as&#x20;text&#x20;of&#x20;message.&#x20;&#x0d;&#x0a;_field4_&#x20;as&#x20;content&#x20;type&#x20;&#40;plain/text&#x20;or&#x20;html/text&#41;.',1,'[\"Destination&#x20;address\",\"Subject\",\"Text\",\"Content&#x20;Type\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"_html_editor_\",\"_content_type_\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (2,'Internal&#x20;Audit','Internal&#x20;type','This&#x20;alert&#x20;save&#x20;alert&#x20;in&#x20;internal&#x20;audit&#x20;system.&#x20;Fields&#x20;are&#x20;static&#x20;and&#x20;only&#x20;_field1_&#x20;is&#x20;used.',1,'[\"Description\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (3,'Monitoring&#x20;Event','Internal&#x20;type','This&#x20;alert&#x20;create&#x20;an&#x20;special&#x20;event&#x20;into&#x20;event&#x20;manager.',1,'[\"Event&#x20;name\",\"Event&#x20;type\",\"Source\",\"Agent&#x20;name&#x20;or&#x20;_agent_\",\"Event&#x20;severity\",\"ID&#x20;extra\",\"Tags&#x20;separated&#x20;by&#x20;commas\",\"Comments\",\"\",\"\"]','[\"\",\"alert_ceased,Alert&#x20;ceased;alert_fired,Alert&#x20;fired;alert_manual_validation,Alert&#x20;manual&#x20;validation;alert_recovered,Alert&#x20;recovered;configuration_change,Configuration&#x20;change&#x20;;error,Error;critical,Monitor&#x20;Critical;normal,Monitor&#x20;Normal;going_unknown,Monitor\",\"\",\"\",\"4,Critical;1,Informational;0,Maintenance;6,Major;5,Minor;2,Normal;3,Warning\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (4,'Alertlog','echo&#x20;_timestamp_&#x20;pandora&#x20;_agent_&#x20;_data_&#x20;_field1_&#x20;_field2_&#x20;&gt;&gt;&#x20;/var/log/pandora/pandora_alert.log','This&#x20;is&#x20;a&#x20;default&#x20;alert&#x20;to&#x20;write&#x20;alerts&#x20;in&#x20;a&#x20;standard&#x20;ASCII&#x20;&#x20;plaintext&#x20;log&#x20;file&#x20;in&#x20;/var/log/pandora/pandora_alert.log&#x0d;&#x0a;',0,'[\"Log&#x20;Info&#x20;1\",\"Log&#x20;Info&#x20;2\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (5,'SNMP&#x20;Trap','/usr/bin/snmptrap&#x20;-v&#x20;1&#x20;-c&#x20;_field1_&#x20;_field2_&#x20;_field3_&#x20;_field4_','Send&#x20;a&#x20;SNMPTRAP&#x20;to&#x20;192.168.0.4.&#x20;Please&#x20;review&#x20;config&#x20;and&#x20;adapt&#x20;to&#x20;your&#x20;needs,&#x20;this&#x20;is&#x20;only&#x20;a&#x20;sample,&#x20;not&#x20;functional&#x20;itself.',0,'[\"Community\",\"Destination&#x20;address\",\"OID\",\"Source&#x20;address\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (6,'Syslog','logger&#x20;-p&#x20;daemon.alert&#x20;Pandora&#x20;Alert&#x20;_agent_&#x20;_data_&#x20;_field1_&#x20;_field2_','Uses&#x20;field1&#x20;and&#x20;field2&#x20;to&#x20;generate&#x20;Syslog&#x20;alert&#x20;in&#x20;facility&#x20;daemon&#x20;with&#x20;&quot;alert&quot;&#x20;level.',0,'[\"Log&#x20;Info&#x20;1\",\"Log&#x20;Info&#x20;2\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (7,'Sound Alert','/usr/bin/play /usr/share/sounds/alarm.wav','',0,NULL,NULL);
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (8,'Jabber&#x20;Alert','echo&#x20;_field3_&#x20;|&#x20;sendxmpp&#x20;-r&#x20;_field1_&#x20;--chatroom&#x20;_field2_','Send&#x20;jabber&#x20;alert&#x20;to&#x20;chat&#x20;room&#x20;in&#x20;a&#x20;predefined&#x20;server&#x20;&#40;configure&#x20;first&#x20;.sendxmpprc&#x20;file&#41;.&#x20;Uses&#x20;field3&#x20;as&#x20;text&#x20;message,&#x20;field1&#x20;as&#x20;useralias&#x20;for&#x20;source&#x20;message,&#x20;and&#x20;field2&#x20;for&#x20;chatroom&#x20;name',0,'[\"User&#x20;alias\",\"Chatroom&#x20;name\",\"Message\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (9,'SMS','sendsms&#x20;_field1_&#x20;_field2_','Send&#x20;SMS&#x20;using&#x20;the&#x20;standard&#x20;SMS&#x20;device,&#x20;using&#x20;smstools.&#x20;&#x20;Uses&#x20;field2&#x20;as&#x20;text&#x20;message,&#x20;field1&#x20;as&#x20;destination&#x20;phone&#x20;&#40;include&#x20;international&#x20;prefix!&#41;',0,'[\"Destination&#x20;number\",\"Message\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (10,'Validate&#x20;Event','Internal&#x20;type','This&#x20;alert&#x20;validate&#x20;the&#x20;events&#x20;matched&#x20;with&#x20;a&#x20;module&#x20;given&#x20;the&#x20;agent&#x20;name&#x20;&#40;_field1_&#41;&#x20;and&#x20;module&#x20;name&#x20;&#40;_field2_&#41;',1,'[\"Agent&#x20;name\",\"Module&#x20;name\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (12,'Remote&#x20;agent&#x20;control','/usr/share/pandora_server/util/udp_client.pl&#x20;_address_&#x20;41122&#x20;&quot;_field1_&quot;','This&#x20;command&#x20;is&#x20;used&#x20;to&#x20;send&#x20;commands&#x20;to&#x20;the&#x20;agents&#x20;with&#x20;the&#x20;UDP&#x20;server&#x20;enabled.&#x20;The&#x20;UDP&#x20;server&#x20;is&#x20;used&#x20;to&#x20;order&#x20;agents&#x20;&#40;Windows&#x20;and&#x20;UNIX&#41;&#x20;to&#x20;&quot;refresh&quot;&#x20;the&#x20;agent&#x20;execution:&#x20;that&#x20;means,&#x20;to&#x20;force&#x20;the&#x20;agent&#x20;to&#x20;execute&#x20;and&#x20;send&#x20;data',0,'[\"Command\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (13,'Generate&#x20;Notification','Internal&#x20;type','This&#x20;command&#x20;allows&#x20;you&#x20;to&#x20;send&#x20;an&#x20;internal&#x20;notification&#x20;to&#x20;any&#x20;user&#x20;or&#x20;group.',1,'[\"Destination&#x20;user\",\"Destination&#x20;group\",\"Title\",\"Message\",\"Link\",\"Criticity\",\"\",\"\",\"\",\"\",\"\"]','[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (14,'Send&#x20;report&#x20;by&#x20;e-mail','Internal&#x20;type','This&#x20;command&#x20;allows&#x20;you&#x20;to&#x20;send&#x20;a&#x20;report&#x20;by&#x20;email.',1,'[\"Report\",\"e-mail&#x20;address\",\"Subject\",\"Text\",\"Report&#x20;type\",\"\",\"\",\"\",\"\",\"\"]','[\"_reports_\",\"\",\"\",\"_html_editor_\",\"xml,XML;pdf,PDF;json,JSON;csv,CSV\",\"\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (15,'Send&#x20;report&#x20;by&#x20;e-mail&#x20;(from&#x20;template)','Internal&#x20;type','This&#x20;command&#x20;allows&#x20;you&#x20;to&#x20;send&#x20;a&#x20;report&#x20;generated&#x20;from&#x20;a&#x20;template&#x20;by&#x20;email.',1,'[\"Template\",\"Regexp&#x20;agent&#x20;filter\",\"e-mail&#x20;address\",\"Subject\",\"Text\",\"Report&#x20;type\",\"\",\"\",\"\",\"\"]','[\"_report_templates_\",\"\",\"\",\"\",\"_html_editor_\",\"xml,XML;pdf,PDF;json,JSON;csv,CSV\",\"\",\"\",\"\",\"\"]');
INSERT INTO `talert_commands` (`id`, `name`, `command`, `description`, `internal`, `fields_descriptions`, `fields_values`) VALUES (16,'Pandora&#x20;ITSM&#x20;Ticket','Internal&#x20;type','Create&#x20;a&#x20;ticket&#x20;in&#x20;Pandora&#x20;ITSM',1,'["Ticket&#x20;title","Ticket&#x20;group&#x20;ID","Ticket&#x20;priority","Ticket&#x20;owner","Ticket&#x20;type","Ticket&#x20;status","Ticket&#x20;description","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_"]','["", "_ITSM_groups_", "_ITSM_priorities_","_ITSM_users_","_ITSM_types_","_ITSM_status_","_html_editor_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_","_custom_field_ITSM_"]');

--
-- Dumping data for table `tconfig`
--

LOCK TABLES `tconfig` WRITE;
INSERT INTO `tconfig` (`token`, `value`) VALUES 
('cron_extension_installed','1'),
('cron_extension_sql_version','1'),
('cron_last_run','0'),
('language','en_GB'),
('block_size','20'),
('days_purge','45'),
('days_delete_unknown','0'),
('days_delete_not_initialized','7'),
('days_compact','0'),
('days_autodisable_deletion','30'),
('graph_res','5'),
('step_compact','1'),
('db_scheme_first_version', '7.0NG'),
('db_scheme_version','7.0NG'),
('db_scheme_build','PD230303'),
('show_unknown','0'),
('show_lastalerts','1'),
('style','pandora'),
('graph_image_height', '250'),
('graph_color1', '#1d7773'),
('graph_color2', '#82b92d'),
('graph_color3', '#fa4143'),
('graph_color4', '#c0d7ea'),
('graph_color5', '#f3712a'),
('graph_color6', '#7151cb'),
('graph_color7', '#287ca2'),
('graph_color8', '#42aa8b'),
('graph_color9', '#d54f6b'),
('graph_color10', '#f9c64e'),
('trap2agent', '0'),
('date_format', 'F j, Y, g:i a'),
('event_view_hr', 8),
('loginhash_pwd', ''),
('trap2agent', 0),
('prominent_time', 'comparation'),
('timesource', 'system'),
('realtimestats', '1'),
('stats_interval', '60'),
('activate_gis', '0'),
('activate_netflow', '0'),
('activate_sflow', '0'),
('timezone', 'Europe/Berlin'),
('string_purge', 7),
('audit_purge', 15),
('trap_purge', 7),
('event_purge', 7),
('gis_purge', 7),
('big_operation_step_datos_purge', '100'),
('small_operation_step_datos_purge', '1000'),
('sound_alert', 'include/sounds/air_shock_alarm.wav'),
('sound_critical', 'include/sounds/Star_Trek_emergency_simulation.wav'),
('sound_warning', 'include/sounds/negativebeep.wav'),
('netflow_interval', '3600'),
('netflow_daemon', '/usr/bin/nfcapd'),
('netflow_nfdump', '/usr/bin/nfdump'),
('netflow_max_resolution', '50'),
('sflow_interval', '3600'),
('sflow_daemon', '/usr/bin/sfcapd'),
('sflow_nfdump', '/usr/bin/nfdump'),
('sflow_max_resolution', '50'),
('event_fields', 'mini_severity,evento,estado,agent_name,timestamp'),
('status_monitor_fields', 'policy,agent,data_type,module_name,server_type,interval,status,last_status_change,graph,warn,data,timestamp'),
('list_ACL_IPs_for_API', '127.0.0.1'),
('enable_pass_policy', 0),
('pass_size', 4),
('pass_needs_numbers', 0),
('pass_needs_symbols', 0),
('pass_expire', 0),
('first_login', 0),
('mins_fail_pass', 5),
('number_attempts', 5),
('enable_pass_policy_admin', 1),
('enable_pass_history', 0),
('compare_pass', 3),
('meta_style', 'meta_pandora'),
('enable_refr', 0),
('meta_num_elements', 100),
('update_manager_installed', 1),
('num_files_attachment', 500),
('show_vc', 1),
('inventory_changes_blacklist', '1,2,20,21'),
('custom_report_front', 0),
('custom_report_front_font', 'Lato-Regular.ttf'),
('custom_report_front_logo', 'images/pandora_logo_white.jpg'),
('custom_report_front_header', ''),
('custom_report_front_footer', ''),
('MR', 65),
('identification_reminder', 1),
('identification_reminder_timestamp', 0),
('current_package', 773),
('post_process_custom_values', '{"0.00000038580247":"Seconds&#x20;to&#x20;months","0.00000165343915":"Seconds&#x20;to&#x20;weeks","0.00001157407407":"Seconds&#x20;to&#x20;days","0.01666666666667":"Seconds&#x20;to&#x20;minutes","0.00000000093132":"Bytes&#x20;to&#x20;Gigabytes","0.00000095367432":"Bytes&#x20;to&#x20;Megabytes","0.00097656250000":"Bytes&#x20;to&#x20;Kilobytes","0.00000001653439":"Timeticks&#x20;to&#x20;weeks","0.00000011574074":"Timeticks&#x20;to&#x20;days"}'),
('custom_docs_logo', 'default_docs.png'),
('custom_support_logo', 'default_support.png'),
('custom_logo_white_bg_preview', 'pandora_logo_head_white_bg.png'),
('ITSM_enabled', 0),
('integria_pass', ''),
('ITSM_hostname', ''),
('default_group', ''),
('default_criticity', ''),
('default_creator', ''),
('default_owner', ''),
('incident_type', ''),
('incident_status', ''),
('incident_title', ''),
('incident_content', ''),
('cr_default_group', ''),
('cr_default_criticity', ''),
('cr_default_creator', ''),
('cr_default_owner', ''),
('cr_incident_type', ''),
('cr_incident_status', ''),
('cr_incident_title', ''),
('cr_incident_content', ''),
('sample_agent', '0'),
('gotty', '/usr/bin/gotty'),
('custom_module_units', '{"bytes":"bytes","entries":"entries","files":"files","hits":"hits","sessions":"sessions","users":"users","ºC":"ºC","ºF":"ºF"}'),
('server_unique_identifier', replace(uuid(),'-','')),
('lts_name', '');
UNLOCK TABLES;

--
-- Dumping data for table `tconfig_os`
--

LOCK TABLES `tconfig_os` WRITE;
INSERT INTO `tconfig_os` (`id_os`, `name`, `description`, `icon_name`, `previous_name`) VALUES 
(1,'Linux','Linux: All versions','linux@os.svg', ''),
(2,'Solaris','Sun Solaris','solaris@os.svg', ''),
(3,'AIX','IBM AIX','aix@os.svg', ''),
(4,'BSD','OpenBSD, FreeBSD and Others','freebsd@os.svg', ''),
(5,'HP-UX','HP-UX Unix OS','HP@os.svg', ''),
(7,'Cisco','CISCO IOS','cisco@os.svg', ''),
(8,'MacOS','MAC OS','apple@os.svg', ''),
(9,'Windows','Microsoft Windows OS','windows@os.svg', ''),
(10,'Other','Other SO','other-OS@os.svg', ''),
(11,'Network','Network Agent','network-server@os.svg', ''),
(12,'Web Server','Web Server/Application','network-server@os.svg', ''),
(13,'Sensor','Hardware Agent (Sensor)','network-server@os.svg', ''),
(14,'Embedded','Embedded device running an agent','embedded@os.svg', ''),
(15,'Android','Android agent','android@os.svg', ''),
(16, 'VMware', 'VMware Architecture', 'vmware@os.svg', ''),
(17, 'Router', 'Generic router', 'routers@os.svg', ''),
(18, 'Switch', 'Generic switch', 'switch@os.svg', ''),
(19, 'Satellite', 'Satellite agent', 'satellite@os.svg', ''),
(20, 'Mainframe', 'Mainframe agent', 'mainframe@os.svg', ''),
(100, 'Cluster', 'Cluster agent', 'cluster@os.svg', '');
UNLOCK TABLES;


--
-- Dumping data for table `tgrupo`
--

LOCK TABLES `tgrupo` WRITE;
INSERT INTO `tgrupo` (`id_grupo`, `nombre`, `icon`, `parent`, `propagate`, `disabled`, `custom_id`, `id_skin`, `other`) VALUES 
(2,'Servers','servers@groups.svg',0,0,0,'',1,''),
(4,'Firewalls','firewall@groups.svg',0,0,0,'',1,''),
(8,'Databases','database@groups.svg',0,0,0,'',1,''),
(9,'Network','network@groups.svg',0,0,0,'',1,''),
(10,'Unknown','unknown@groups.svg',0,0,0,'',1,''),
(11,'Workstations','workstation@groups.svg',0,0,0,'',1,''),
(12,'Applications','applications@groups.svg',0,0,0,'',1,''),
(13,'Web','web@groups.svg',0,0,0,'',1,'');
UNLOCK TABLES;


--
-- Dumping data for table `tlanguage`
--



LOCK TABLES `tlanguage` WRITE;
INSERT INTO `tlanguage` VALUES ('en_GB','English (UK)');
INSERT INTO `tlanguage` VALUES ('es','Español');
INSERT INTO `tlanguage` VALUES ('fr','Français');
INSERT INTO `tlanguage` VALUES ('ja','日本語');
INSERT INTO `tlanguage` VALUES ('ru','Русский');
INSERT INTO `tlanguage` VALUES ('zh_CN','简化字');
INSERT INTO `tlanguage` VALUES ('ca','Catalan');

UNLOCK TABLES;

--
-- Dumping data for table `tlink`
--


LOCK TABLES `tlink` WRITE;
INSERT INTO `tlink` VALUES
(1,'Documentation','https://pandorafms.com/manual'),
(2,'Get support','https://pandorafms.com/en/technical-support/'),
(3,'Report a bug','https://github.com/pandorafms/pandorafms/issues'),
(4,'Suggest new feature','https://pandorafms.com/community/beta-program/'),
(5,'Module library','https://pandorafms.com/library/');

UNLOCK TABLES;

--
-- Dumping data for table `tmodule_group`
--

LOCK TABLES `tmodule_group` WRITE;
INSERT INTO `tmodule_group` VALUES 
(1,'General'),
(2,'Networking'),
(3,'Application'),
(4,'System'),
(5,'Miscellaneous'),
(6,'Performance'),
(7,'Database'),
(8,'Enviromental'),
(9,'Users');

UNLOCK TABLES;

--
-- Dumping data for table `torigen`
--

INSERT INTO `torigen` VALUES 
('Operating System event'),
('Firewall records'),
('Database event'),
('Application data'),
('Logfiles'),
('Other data source'),
('Monitoring Event'),
('User report'),
('Unknown source');

--
-- Dumping data for table `ttipo_modulo`
--

-- Identifiers 30 and 31 are reserved for Enterprise data types
INSERT INTO `ttipo_modulo` VALUES
(1,'generic_data',0,'Generic numeric','data-server@svg.svg'),
(2,'generic_proc',1,'Generic boolean','generic-boolean@svg.svg'),
(3,'generic_data_string',2,'Generic string','generic-string@svg.svg'),
(4,'generic_data_inc',0,'Generic numeric incremental','data-server@svg.svg'),
(5,'generic_data_inc_abs',0,'Generic numeric incremental (absolute)','data-server@svg.svg'),
(6,'remote_icmp_proc',4,'Remote ICMP network agent, boolean data','ICMP-network-boolean-data@svg.svg'),
(7,'remote_icmp',3,'Remote ICMP network agent (latency)','ICMP-network-latency@svg.svg'),
(8,'remote_tcp',3,'Remote TCP network agent, numeric data','TCP-network-numeric-data@svg.svg'),
(9,'remote_tcp_proc',4,'Remote TCP network agent, boolean data','TCP-network-boolean-data@svg.svg'),
(10,'remote_tcp_string',5,'Remote TCP network agent, alphanumeric data','TCP-network-alphanumeric-data@svg.svg'),
(11,'remote_tcp_inc',3,'Remote TCP network agent, incremental data','TCP-network-incremental-data@svg.svg'),
(15,'remote_snmp',3,'Remote SNMP network agent, numeric data','SNMP-network-numeric-data@svg.svg'),
(16,'remote_snmp_inc',3,'Remote SNMP network agent, incremental data','SNMP-network-incremental-data@svg.svg'),
(17,'remote_snmp_string',5,'Remote SNMP network agent, alphanumeric data','SNMP-network-alphanumeric-data@svg.svg'),
(18,'remote_snmp_proc',4,'Remote SNMP network agent, boolean data','SNMP-network-incremental-data@svg.svg'),
(21,'async_proc', 7, 'Asyncronous proc data', 'asynchronus-data@svg.svg'),
(22,'async_data', 6, 'Asyncronous numeric data', 'asynchronus-data@svg.svg'),
(23,'async_string', 8, 'Asyncronous string data', 'asynchronus-data@svg.svg'),
(25,'web_analysis', 8, 'Web analysis data', 'wux@svg.svg'),
(30,'web_data',9,'Remote HTTP module to check latency','server-web@svg.svg'),
(31,'web_proc',9,'Remote HTTP module to check server response','web-analisys-data@svg.svg'),
(32,'web_content_data',9,'Remote HTTP module to retrieve numeric data','server-web@svg.svg'),
(33,'web_content_string',9,'Remote HTTP module to retrieve string data','server-web@svg.svg'),
(34,'remote_cmd', 10, 'Remote execution, numeric data', 'remote-execution-numeric-data@svg.svg'),
(35,'remote_cmd_proc', 10, 'Remote execution, boolean data', 'remote-execution-boolean-data@svg.svg'),
(36,'remote_cmd_string', 10, 'Remote execution, alphanumeric data', 'remote-execution-alphanumeric-data@svg.svg'),
(37,'remote_cmd_inc', 10, 'Remote execution, incremental data', 'remote-execution-incremental-data@svg.svg'),
(38,'web_server_status_code_string',9,'Remote HTTP module to check server status code','server-web@svg.svg'),
(100,'keep_alive',-1,'KeepAlive','keepalive@svg.svg');

--
-- Dumping data for table `tmodule_inventory`
--

INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (1,1,'CPU','CPU','/usr/bin/perl','Model;Company;Speed','IyEvdXNyL2Jpbi9wZXJsDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KIyBwYW5kb3JhX2NwdS5wbA0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMNCiMgQ29weXJpZ2h0IChjKSAyMDA4IFJhbW9uIE5vdm9hLCBybm92b2FAYXJ0aWNhLmVzDQojICAgICAgICAgICAoYykgMjAwOCBBcnRpY2EgU29sdWNpb25lcyBUZWNub2xvZ2ljYXMgUy5MDQojDQojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3INCiMgbW9kaWZ5IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UNCiMgYXMgcHVibGlzaGVkIGJ5IHRoZSBGcmVlIFNvZnR3YXJlIEZvdW5kYXRpb247IHZlcnNpb24gMi4NCiMNCiMgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsDQojIGJ1dCBXSVRIT1VUIEFOWSBXQVJSQU5UWTsgd2l0aG91dCBldmVuIHRoZSBpbXBsaWVkIHdhcnJhbnR5IG9mDQojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUNCiMgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4NCiMgWW91IHNob3VsZCBoYXZlIHJlY2VpdmVkIGEgY29weSBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UNCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUNCiMgRm91bmRhdGlvbiwgSW5jLiwgNTEgRnJhbmtsaW4gU3RyZWV0LCBGaWZ0aCBGbG9vciwgQm9zdG9uLCBNQSAgMDIxMTAtMTMwMSwgVVNBLg0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMNCg0KdXNlIHN0cmljdDsNCnVzZSB3YXJuaW5nczsNCg0KIyBDaGVjayBmb3Igc3NoDQpteSAkc3NoX2NsaWVudCA9ICJzc2giOw0KaWYgKHN5c3RlbSgiJHNzaF9jbGllbnQgLXYgPiAvZGV2L251bGwgMj4mMSIpID4+IDggIT0gMjU1KSB7DQoJcHJpbnQgIltlcnJvcl0gJHNzaF9jbGllbnQgbm90IGZvdW5kLlxuIjsNCglleGl0IDE7DQp9DQoNCmlmICgkI0FSR1YgPCAxKSB7DQoJcHJpbnQgIlVzYWdlOiAkMCA8dGFyZ2V0IGlwPiA8dXNlcm5hbWU+XG4iOw0KCWV4aXQgMTsNCn0NCg0KbXkgJHRhcmdldF9pcCA9ICRBUkdWWzBdOw0KbXkgJHVzZXJuYW1lID0gJEFSR1ZbMV07DQoNCiMgUmV0cmlldmUgQ1BVIGRhdGENCm15ICgkbW9kZWwsICR2ZW5kb3IsICRzcGVlZCk7DQpteSBAY3B1X2luZm8gPSBgJHNzaF9jbGllbnQgJHVzZXJuYW1lXEAkdGFyZ2V0X2lwICJjYXQgL3Byb2MvY3B1aW5mbyJgOw0KZm9yZWFjaCBteSAkbGluZSAoQGNwdV9pbmZvKSB7DQoJaWYgKCRsaW5lID1+IC9tb2RlbCBuYW1lXHMrOlxzKyguKikvKSB7DQoJCSRtb2RlbCA9ICQxOw0KCX0gZWxzaWYgKCRsaW5lID1+IC92ZW5kb3JfaWRccys6XHMrKC4qKS8pIHsNCgkJJHZlbmRvciA9ICQxOw0KCX0gZWxzaWYgKCRsaW5lID1+IC9jcHUgTUh6XHMrOlxzKyguKikvKSB7DQoJCSRzcGVlZCA9ICQxOw0KCX0NCn0NCiANCnJldHVybiAxIGlmICgkbW9kZWwgZXEgJycgfHwgJHZlbmRvciBlcSAnJyB8fCAkc3BlZWQgZXEgJycpOw0KcHJpbnQgIiRtb2RlbDskdmVuZG9yOyIgLiBzcHJpbnRmICgiJS4wZiIsICRzcGVlZCkgLiAiIE1IelxuIjsNCg0KZXhpdCAwOw0K',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (2,9,'CPU','CPU','/usr/bin/perl','Name;Speed;Description','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9jcHUucGwKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBDb3B5cmlnaHQgKGMpIDIwMDggUmFtb24gTm92b2EsIHJub3ZvYUBhcnRpY2EuZXMKIyAgICAgICAgICAgKGMpIDIwMDgtMjAyMSBBcnRpY2EgU29sdWNpb25lcyBUZWNub2xvZ2ljYXMgUy5MCiMKIyBUaGlzIHByb2dyYW0gaXMgZnJlZSBzb2Z0d2FyZTsgeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQgYW5kL29yCiMgbW9kaWZ5IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UKIyBhcyBwdWJsaXNoZWQgYnkgdGhlIEZyZWUgU29mdHdhcmUgRm91bmRhdGlvbjsgdmVyc2lvbiAyLgojCiMgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsCiMgYnV0IFdJVEhPVVQgQU5ZIFdBUlJBTlRZOyB3aXRob3V0IGV2ZW4gdGhlIGltcGxpZWQgd2FycmFudHkgb2YKIyBNRVJDSEFOVEFCSUxJVFkgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuICBTZWUgdGhlCiMgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4KIyBZb3Ugc2hvdWxkIGhhdmUgcmVjZWl2ZWQgYSBjb3B5IG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFsb25nIHdpdGggdGhpcyBwcm9ncmFtOyBpZiBub3QsIHdyaXRlIHRvIHRoZSBGcmVlIFNvZnR3YXJlCiMgRm91bmRhdGlvbiwgSW5jLiwgNTEgRnJhbmtsaW4gU3RyZWV0LCBGaWZ0aCBGbG9vciwgQm9zdG9uLCBNQSAgMDIxMTAtMTMwMSwgVVNBLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKCnVubGVzcygtZSAkd21pX2NsaWVudCkgewoJcHJpbnQgIltlcnJvcl0gJHdtaV9jbGllbnQgbm90IGZvdW5kLlxuIjsKCWV4aXQgMTsKfQoKaWYgKCQjQVJHViAhPSAyKSB7CglwcmludCAiVXNhZ2U6ICQwIDx0YXJnZXQgaXA+IDx1c2VybmFtZT4gPHBhc3N3b3JkPlxuIjsKCWV4aXQgMTsKfQoKbXkgJHRhcmdldF9pcCA9ICRBUkdWWzBdOwpteSAkdXNlcm5hbWUgPSAkQVJHVlsxXTsKbXkgJHBhc3N3b3JkID0gJEFSR1ZbMl07CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFNVQiBydW5fcXVlcnkgKCR3cWxfcXVlcnkpCiMgUnVucyB0aGUgZ2l2ZW4gV1FMIHF1ZXJ5IGFuZCByZXR1cm5zIHRoZSByZXN1bHQgYXMgYW4gYXJyYXkgb2YgaGFzaGVzLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcnVuX3F1ZXJ5IHsKCW15ICR3cWxfcXVlcnkgPSAkX1swXTsKCW15IEByZXN1bHQgPSB7fTsKCgkkd3FsX3F1ZXJ5ID1+ICdzLyIvXCcvZyc7CgoJIyBSdW4gdGhlIERDT00vV01JIGNsaWVudAoJbXkgJG91dHB1dCA9IGAkd21pX2NsaWVudCAtVSAnJHVzZXJuYW1lJyUnJHBhc3N3b3JkJyAvLyR0YXJnZXRfaXAgXCIkd3FsX3F1ZXJ5XCIgMj4vZGV2L251bGxgOwoKCW15IEBsaW5lcyA9IHNwbGl0KC9cbi8sICRvdXRwdXQpOwoJIyBIZWFkZXIsIGRlc2NyaXB0aW9uLCByZXN1bHRzCglpZiAoJCNsaW5lcyA8IDIpIHsKCQlleGl0IDE7Cgl9CgoJIyBEcm9wIHRoZSBoZWFkZXIKCXNoaWZ0IChAbGluZXMpOwoJCgkjIEdldCBjb2x1bW4gbmFtZXMKCW15IEBjb2x1bW5fbmFtZXMgPSBzcGxpdCgvXHwvLCBzaGlmdCAoQGxpbmVzKSk7CgoJIyBHZXQgcm93IGRhdGEKCW15ICRpZHggPSAwOwoJZm9yIChteSAkaSA9IDA7ICRpIDw9ICQjbGluZXM7ICRpKyspIHsKCgkJIyBDaGVjayBmb3IgZXJyb3JzCgkJaWYgKCRsaW5lc1skaV0gPX4gbS9eRVJST1IvKSB7CgkJCWV4aXQgMTsKCQl9CgoJCSMgQmxhY2sgbGlzdAoJCWlmICgkbGluZXNbJGldID1+IG0vRmlsZSAxLykgewoJCQluZXh0OwoJCX0KCgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSAkbW9kdWxlX2l0ZW0gPSAkX1swXTsKCW15ICRtb2R1bGVfZGF0YSA9ICRfWzFdOwoJbXkgJG1vZHVsZV9kZXNjcmlwdGlvbiA9ICRfWzJdOwoJbXkgQGRhdGEgPSBAeyRfWzNdfTsKCW15ICRyZXN1bHQ7CgoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkKCQkkcmVzdWx0ID0gJyc7CgoJCSMgSXRlbQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfaXRlbX0gLiAiOyI7CgkJfQoKCQkjIERhdGEKCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2RhdGF9IC4gIiBNaHo7IjsKCQl9CgoJCSMgRGVzY3JpcHRpb24KCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGVzY3JpcHRpb259KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0gLiAiOyI7CgkJfQoKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCA9IHJ1bl9xdWVyeSgiU0VMRUNUIE5hbWUsIE1heENsb2NrU3BlZWQsIERlc2NyaXB0aW9uIEZST00gV2luMzJfUHJvY2Vzc29yIik7CnByaW50X21vZHVsZWRhdGEgKCJOYW1lIiwgIk1heENsb2NrU3BlZWQiLCAiRGVzY3JpcHRpb24iLCBcQHJlc3VsdCk7CmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (3,1,'RAM','Memory modules','','Model;Size','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (4,9,'RAM','Memory modules','/usr/bin/perl','Slot;Size;Speed','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9yYW0ucGwKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBDb3B5cmlnaHQgKGMpIDIwMDggUmFtb24gTm92b2EsIHJub3ZvYUBhcnRpY2EuZXMKIyAgICAgICAgICAgKGMpIDIwMDgtMjAyMSBBcnRpY2EgU29sdWNpb25lcyBUZWNub2xvZ2ljYXMgUy5MCiMKIyBUaGlzIHByb2dyYW0gaXMgZnJlZSBzb2Z0d2FyZTsgeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQgYW5kL29yCiMgbW9kaWZ5IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UKIyBhcyBwdWJsaXNoZWQgYnkgdGhlIEZyZWUgU29mdHdhcmUgRm91bmRhdGlvbjsgdmVyc2lvbiAyLgojCiMgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsCiMgYnV0IFdJVEhPVVQgQU5ZIFdBUlJBTlRZOyB3aXRob3V0IGV2ZW4gdGhlIGltcGxpZWQgd2FycmFudHkgb2YKIyBNRVJDSEFOVEFCSUxJVFkgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuICBTZWUgdGhlCiMgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4KIyBZb3Ugc2hvdWxkIGhhdmUgcmVjZWl2ZWQgYSBjb3B5IG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFsb25nIHdpdGggdGhpcyBwcm9ncmFtOyBpZiBub3QsIHdyaXRlIHRvIHRoZSBGcmVlIFNvZnR3YXJlCiMgRm91bmRhdGlvbiwgSW5jLiwgNTEgRnJhbmtsaW4gU3RyZWV0LCBGaWZ0aCBGbG9vciwgQm9zdG9uLCBNQSAgMDIxMTAtMTMwMSwgVVNBLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKCnVubGVzcygtZSAkd21pX2NsaWVudCkgewoJcHJpbnQgIltlcnJvcl0gJHdtaV9jbGllbnQgbm90IGZvdW5kLlxuIjsKCWV4aXQgMTsKfQoKaWYgKCQjQVJHViAhPSAyKSB7CglwcmludCAiVXNhZ2U6ICQwIDx0YXJnZXQgaXA+IDx1c2VybmFtZT4gPHBhc3N3b3JkPlxuIjsKCWV4aXQgMTsKfQoKbXkgJHRhcmdldF9pcCA9ICRBUkdWWzBdOwpteSAkdXNlcm5hbWUgPSAkQVJHVlsxXTsKbXkgJHBhc3N3b3JkID0gJEFSR1ZbMl07CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFNVQiBydW5fcXVlcnkgKCR3cWxfcXVlcnkpCiMgUnVucyB0aGUgZ2l2ZW4gV1FMIHF1ZXJ5IGFuZCByZXR1cm5zIHRoZSByZXN1bHQgYXMgYW4gYXJyYXkgb2YgaGFzaGVzLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcnVuX3F1ZXJ5IHsKCW15ICR3cWxfcXVlcnkgPSAkX1swXTsKCW15IEByZXN1bHQgPSB7fTsKCgkkd3FsX3F1ZXJ5ID1+ICdzLyIvXCcvZyc7CgoJIyBSdW4gdGhlIERDT00vV01JIGNsaWVudAoJbXkgJG91dHB1dCA9IGAkd21pX2NsaWVudCAtVSAnJHVzZXJuYW1lJyUnJHBhc3N3b3JkJyAvLyR0YXJnZXRfaXAgXCIkd3FsX3F1ZXJ5XCIgMj4vZGV2L251bGxgOwoKCW15IEBsaW5lcyA9IHNwbGl0KC9cbi8sICRvdXRwdXQpOwoJIyBIZWFkZXIsIGRlc2NyaXB0aW9uLCByZXN1bHRzCglpZiAoJCNsaW5lcyA8IDIpIHsKCQlleGl0IDE7Cgl9CgoJIyBEcm9wIHRoZSBoZWFkZXIKCXNoaWZ0IChAbGluZXMpOwoJCgkjIEdldCBjb2x1bW4gbmFtZXMKCW15IEBjb2x1bW5fbmFtZXMgPSBzcGxpdCgvXHwvLCBzaGlmdCAoQGxpbmVzKSk7CgoJIyBHZXQgcm93IGRhdGEKCW15ICRpZHggPSAwOwoJZm9yIChteSAkaSA9IDA7ICRpIDw9ICQjbGluZXM7ICRpKyspIHsKCgkJIyBDaGVjayBmb3IgZXJyb3JzCgkJaWYgKCRsaW5lc1skaV0gPX4gbS9eRVJST1IvKSB7CgkJCWV4aXQgMTsKCQl9CgoJCSMgQmxhY2sgbGlzdAoJCWlmICgkbGluZXNbJGldID1+IG0vRmlsZSAxLykgewoJCQluZXh0OwoJCX0KCgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSAkbW9kdWxlX2l0ZW0gPSAkX1swXTsKCW15ICRtb2R1bGVfZGF0YSA9ICRfWzFdOwoJbXkgJG1vZHVsZV9kZXNjcmlwdGlvbiA9ICRfWzJdOwoJbXkgQGRhdGEgPSBAeyRfWzNdfTsKCW15ICRyZXN1bHQ7CgoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkKCQkkcmVzdWx0ID0gJyc7CgoJCSMgSXRlbQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfaXRlbX0gLiAnOyc7CgkJfQoKCQkjIERhdGEKCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0pKSB7CgkJCSRyZXN1bHQgLj0gJyAnIC4gc3ByaW50ZigiJS4xZiIsICRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSAvIDEwNDg1NzYpIC4gIiBNQnl0ZXM7IjsKCQl9CgoJCSMgRGVzY3JpcHRpb24KCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGVzY3JpcHRpb259KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn07CgkJfQoKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCA9IHJ1bl9xdWVyeSgiU0VMRUNUIFRhZywgQ2FwYWNpdHksIE5hbWUgRlJPTSBXaW4zMl9QaHlzaWNhbE1lbW9yeSIpOwpwcmludF9tb2R1bGVkYXRhICgiVGFnIiwgIkNhcGFjaXR5IiwgIk5hbWUiLCBcQHJlc3VsdCk7CmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (5,1,'Video','Video cards','','Controller;Model;Company','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (6,9,'Video','Video cards','/usr/bin/perl','Name;vRAM;ID','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV92aWRlby5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAwOCBSYW1vbiBOb3ZvYSwgcm5vdm9hQGFydGljYS5lcwojICAgICAgICAgICAoYykgMjAwOC0yMDIxIEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgp1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwoKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCgkjIERyb3AgdGhlIGhlYWRlcgoJc2hpZnQgKEBsaW5lcyk7CgkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoKCQkjIENoZWNrIGZvciBlcnJvcnMKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL15FUlJPUi8pIHsKCQkJZXhpdCAxOwoJCX0KCgkJIyBCbGFjayBsaXN0CgkJaWYgKCRsaW5lc1skaV0gPX4gbS9GaWxlIDEvKSB7CgkJCW5leHQ7CgkJfQoKCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15ICRtb2R1bGVfaXRlbSA9ICRfWzBdOwoJbXkgJG1vZHVsZV9kYXRhID0gJF9bMV07CglteSAkbW9kdWxlX2Rlc2NyaXB0aW9uID0gJF9bMl07CglteSBAZGF0YSA9IEB7JF9bM119OwoJbXkgJHJlc3VsdDsKCglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCQoJCSRyZXN1bHQgPSAnJzsKCgkJIyBJdGVtCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2l0ZW19KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSAuICc7JzsKCQl9CgoJCSMgRGF0YQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSkpIHsKCQkJJHJlc3VsdCAuPSAnICcgLiBzcHJpbnRmKCIlLjFmIiwgJGVsZW1lbnQtPnskbW9kdWxlX2RhdGF9IC8gMTA0ODU3NikgLiAiIE1CeXRlczsiOwoJCX0KCgkJIyBEZXNjcmlwdGlvbgoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0pKSB7CgkJCSRyZXN1bHQgLj0gJyAnIC4gJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufTsKCQl9CgoJCXByaW50ICRyZXN1bHQgLiAiXG4iOwkKCX0KfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBNYWluCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgpteSBAcmVzdWx0ID0gcnVuX3F1ZXJ5KCJTRUxFQ1QgQ2FwdGlvbiwgQWRhcHRlclJBTSwgVmlkZW9Qcm9jZXNzb3IgRlJPTSBXaW4zMl9WaWRlb0NvbnRyb2xsZXIiKTsKcHJpbnRfbW9kdWxlZGF0YSAoIkNhcHRpb24iLCAiQWRhcHRlclJBTSIsICJWaWRlb1Byb2Nlc3NvciIsIFxAcmVzdWx0KTsKZXhpdCAwOwo=',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (7,1,'NIC','Network Interface Cards','','Device;Model;Company;MACAddress','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (8,9,'NIC','Network Interface Cards','/usr/bin/perl','Caption;MACAddress;IPAddress','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9uaWMucGwKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBDb3B5cmlnaHQgKGMpIDIwMDggUmFtb24gTm92b2EsIHJub3ZvYUBhcnRpY2EuZXMKIyAgICAgICAgICAgKGMpIDIwMDgtMjAyMSBBcnRpY2EgU29sdWNpb25lcyBUZWNub2xvZ2ljYXMgUy5MCiMKIyBUaGlzIHByb2dyYW0gaXMgZnJlZSBzb2Z0d2FyZTsgeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQgYW5kL29yCiMgbW9kaWZ5IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UKIyBhcyBwdWJsaXNoZWQgYnkgdGhlIEZyZWUgU29mdHdhcmUgRm91bmRhdGlvbjsgdmVyc2lvbiAyLgojCiMgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsCiMgYnV0IFdJVEhPVVQgQU5ZIFdBUlJBTlRZOyB3aXRob3V0IGV2ZW4gdGhlIGltcGxpZWQgd2FycmFudHkgb2YKIyBNRVJDSEFOVEFCSUxJVFkgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuICBTZWUgdGhlCiMgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4KIyBZb3Ugc2hvdWxkIGhhdmUgcmVjZWl2ZWQgYSBjb3B5IG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFsb25nIHdpdGggdGhpcyBwcm9ncmFtOyBpZiBub3QsIHdyaXRlIHRvIHRoZSBGcmVlIFNvZnR3YXJlCiMgRm91bmRhdGlvbiwgSW5jLiwgNTEgRnJhbmtsaW4gU3RyZWV0LCBGaWZ0aCBGbG9vciwgQm9zdG9uLCBNQSAgMDIxMTAtMTMwMSwgVVNBLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKCnVubGVzcygtZSAkd21pX2NsaWVudCkgewoJcHJpbnQgIltlcnJvcl0gJHdtaV9jbGllbnQgbm90IGZvdW5kLlxuIjsKCWV4aXQgMTsKfQoKaWYgKCQjQVJHViAhPSAyKSB7CglwcmludCAiVXNhZ2U6ICQwIDx0YXJnZXQgaXA+IDx1c2VybmFtZT4gPHBhc3N3b3JkPlxuIjsKCWV4aXQgMTsKfQoKbXkgJHRhcmdldF9pcCA9ICRBUkdWWzBdOwpteSAkdXNlcm5hbWUgPSAkQVJHVlsxXTsKbXkgJHBhc3N3b3JkID0gJEFSR1ZbMl07CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFNVQiBydW5fcXVlcnkgKCR3cWxfcXVlcnkpCiMgUnVucyB0aGUgZ2l2ZW4gV1FMIHF1ZXJ5IGFuZCByZXR1cm5zIHRoZSByZXN1bHQgYXMgYW4gYXJyYXkgb2YgaGFzaGVzLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcnVuX3F1ZXJ5IHsKCW15ICR3cWxfcXVlcnkgPSAkX1swXTsKCW15IEByZXN1bHQgPSB7fTsKCgkkd3FsX3F1ZXJ5ID1+ICdzLyIvXCcvZyc7CgoJIyBSdW4gdGhlIERDT00vV01JIGNsaWVudAoJbXkgJG91dHB1dCA9IGAkd21pX2NsaWVudCAtVSAnJHVzZXJuYW1lJyUnJHBhc3N3b3JkJyAvLyR0YXJnZXRfaXAgXCIkd3FsX3F1ZXJ5XCIgMj4vZGV2L251bGxgOwoKCW15IEBsaW5lcyA9IHNwbGl0KC9cbi8sICRvdXRwdXQpOwoJIyBIZWFkZXIsIGRlc2NyaXB0aW9uLCByZXN1bHRzCglpZiAoJCNsaW5lcyA8IDIpIHsKCQlleGl0IDE7Cgl9CgoJIyBEcm9wIHRoZSBoZWFkZXIKCXNoaWZ0IChAbGluZXMpOwoJCgkjIEdldCBjb2x1bW4gbmFtZXMKCW15IEBjb2x1bW5fbmFtZXMgPSBzcGxpdCgvXHwvLCBzaGlmdCAoQGxpbmVzKSk7CgoJIyBHZXQgcm93IGRhdGEKCW15ICRpZHggPSAwOwoJZm9yIChteSAkaSA9IDA7ICRpIDw9ICQjbGluZXM7ICRpKyspIHsKCgkJIyBDaGVjayBmb3IgZXJyb3JzCgkJaWYgKCRsaW5lc1skaV0gPX4gbS9eRVJST1IvKSB7CgkJCWV4aXQgMTsKCQl9CgoJCSMgQmxhY2sgbGlzdAoJCWlmICgkbGluZXNbJGldID1+IG0vRmlsZSAxLykgewoJCQluZXh0OwoJCX0KCgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSAkbW9kdWxlX2l0ZW0gPSAkX1swXTsKCW15ICRtb2R1bGVfZGF0YSA9ICRfWzFdOwoJbXkgJG1vZHVsZV9kZXNjcmlwdGlvbiA9ICRfWzJdOwoJbXkgQGRhdGEgPSBAeyRfWzNdfTsKCW15ICRyZXN1bHQ7CgoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkKCQkkcmVzdWx0ID0gJyc7CgoJCSMgSXRlbQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfaXRlbX0gLiAnOyc7CgkJfQoKCQkjIERhdGEKCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2RhdGF9IC4gJzsnOwoJCX0KCgkJIyBEZXNjcmlwdGlvbgoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufTsKCQl9CgoJCXByaW50ICRyZXN1bHQgLiAiXG4iOwkKCX0KfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBNYWluCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgpteSBAcmVzdWx0ID0gcnVuX3F1ZXJ5KCJTRUxFQ1QgQ2FwdGlvbiwgTUFDQWRkcmVzcywgSVBBZGRyZXNzIEZST00gV2luMzJfTmV0d29ya0FkYXB0ZXJDb25maWd1cmF0aW9uIik7CnByaW50X21vZHVsZWRhdGEgKCJDYXB0aW9uIiwgIk1BQ0FkZHJlc3MiLCAiSVBBZGRyZXNzIiwgXEByZXN1bHQpOwpleGl0IDA7Cg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (9,1,'HD','Hard drives','','Type;Model;Size','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (10,9,'HD','Hard drives','/usr/bin/perl','Model;Size;ID','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9oZC5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAwOCBSYW1vbiBOb3ZvYSwgcm5vdm9hQGFydGljYS5lcwojICAgICAgICAgICAoYykgMjAwOC0yMDIxIEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgp1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwoKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCgkjIERyb3AgdGhlIGhlYWRlcgoJc2hpZnQgKEBsaW5lcyk7CgkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoKCQkjIENoZWNrIGZvciBlcnJvcnMKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL15FUlJPUi8pIHsKCQkJZXhpdCAxOwoJCX0KCgkJIyBCbGFjayBsaXN0CgkJaWYgKCRsaW5lc1skaV0gPX4gbS9GaWxlIDEvKSB7CgkJCW5leHQ7CgkJfQoKCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15ICRtb2R1bGVfaXRlbSA9ICRfWzBdOwoJbXkgJG1vZHVsZV9kYXRhID0gJF9bMV07CglteSAkbW9kdWxlX2Rlc2NyaXB0aW9uID0gJF9bMl07CglteSBAZGF0YSA9IEB7JF9bM119OwoJbXkgJHJlc3VsdDsKCglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCQoJCSRyZXN1bHQgPSAnJzsKCgkJIyBJdGVtCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2l0ZW19KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSAuICc7JzsKCQl9CgoJCSMgRGF0YQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSkpIHsKCQkJJHJlc3VsdCAuPSAnICcgLiBzcHJpbnRmKCIlLjFmIiwgJGVsZW1lbnQtPnskbW9kdWxlX2RhdGF9IC8gMTA3Mzc0MTgyNCkgLiAiIEdCeXRlczsiOwoJCX0KCgkJIyBEZXNjcmlwdGlvbgoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0pKSB7CgkJCSRyZXN1bHQgLj0gJyAoJyAuICRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0gLiAiKSI7CgkJfQoKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCA9IHJ1bl9xdWVyeSgiU0VMRUNUIE1vZGVsLCBTaXplLCBTeXN0ZW1OYW1lIEZST00gV2luMzJfRGlza0RyaXZlIik7CnByaW50X21vZHVsZWRhdGEgKCJNb2RlbCIsICJTaXplIiwgIlN5c3RlbU5hbWUiLCBcQHJlc3VsdCk7CQpleGl0IDA7Cg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (11,1,'CDROM','CD-ROM drives','','Type;Model;Features','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (12,9,'CDROM','CD-ROM drives','/usr/bin/perl','Name;Description;Drive;ID','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9jZHJvbS5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAwOCBSYW1vbiBOb3ZvYSwgcm5vdm9hQGFydGljYS5lcwojICAgICAgICAgICAoYykgMjAwOC0yMDIxIEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgp1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwoKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCgkjIERyb3AgdGhlIGhlYWRlcgoJc2hpZnQgKEBsaW5lcyk7CgkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoKCQkjIENoZWNrIGZvciBlcnJvcnMKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL15FUlJPUi8pIHsKCQkJZXhpdCAxOwoJCX0KCgkJIyBCbGFjayBsaXN0CgkJaWYgKCRsaW5lc1skaV0gPX4gbS9GaWxlIDEvKSB7CgkJCW5leHQ7CgkJfQoKCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15ICRtb2R1bGVfaXRlbSA9ICRfWzBdOwoJbXkgJG1vZHVsZV9kYXRhID0gJF9bMV07CglteSAkbW9kdWxlX2Rlc2NyaXB0aW9uID0gJF9bMl07CglteSBAZGF0YSA9IEB7JF9bM119OwoJbXkgJHJlc3VsdDsKCglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCQoJCSRyZXN1bHQgPSAnJzsKCgkJIyBJdGVtCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2l0ZW19KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSAuICc7JzsKCQl9CgoJCSMgRGF0YQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0gLiAnOyc7CgkJfQoKCQkjIERlc2NyaXB0aW9uCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGVzY3JpcHRpb259OwoJCX0KCgkJcHJpbnQgJHJlc3VsdCAuICJcbiI7CQoJfQp9CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIE1haW4KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKCm15IEByZXN1bHQgPSBydW5fcXVlcnkoIlNFTEVDVCBOYW1lLCBEZXNjcmlwdGlvbiwgRHJpdmUgRlJPTSBXaW4zMl9DRFJPTURyaXZlIik7CnByaW50X21vZHVsZWRhdGEgKCJOYW1lIiwgIkRlc2NyaXB0aW9uIiwgIkRyaXZlIiwgXEByZXN1bHQpOwpleGl0IDA7Cg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (13,1,'Software','Installed software packages','','Name;Version;Description','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (14,9,'Software','Installed software packages','/usr/bin/perl','Name;Version','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9zb2Z0d2FyZS5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAwOCBSYW1vbiBOb3ZvYSwgcm5vdm9hQGFydGljYS5lcwojICAgICAgICAgICAoYykgMjAwOC0yMDIxIEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgp1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwoKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCgkjIERyb3AgdGhlIGhlYWRlcgoJc2hpZnQgKEBsaW5lcyk7CgkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoKCQkjIENoZWNrIGZvciBlcnJvcnMKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL15FUlJPUi8pIHsKCQkJZXhpdCAxOwoJCX0KCgkJIyBCbGFjayBsaXN0CgkJaWYgKCRsaW5lc1skaV0gPX4gbS9GaWxlIDEvKSB7CgkJCW5leHQ7CgkJfQoKCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15ICRtb2R1bGVfaXRlbSA9ICRfWzBdOwoJbXkgJG1vZHVsZV9kYXRhID0gJF9bMV07CglteSAkbW9kdWxlX2Rlc2NyaXB0aW9uID0gJF9bMl07CglteSBAZGF0YSA9IEB7JF9bM119OwoJbXkgJHJlc3VsdDsKCglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCQoJCSRyZXN1bHQgPSAnJzsKCgkJIyBJdGVtCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2l0ZW19KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSAuICc7JzsKCQl9CgoJCSMgRGF0YQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX07CgkJfQoKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCA9IHJ1bl9xdWVyeSgiU0VMRUNUIE5hbWUsIFZlcnNpb24gRlJPTSBXaW4zMl9Qcm9kdWN0Iik7CnByaW50X21vZHVsZWRhdGEgKCJOYW1lIiwgIlZlcnNpb24iLCAiIiwgXEByZXN1bHQpOwpleGl0IDA7Cg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (15,9,'Patches','Installed patches','/usr/bin/perl','HotFixID;Description;FixComments;ServicePackInEffect','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9wYXRjaC5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAwOCBSYW1vbiBOb3ZvYSwgcm5vdm9hQGFydGljYS5lcwojICAgICAgICAgICAoYykgMjAwOC0yMDIxIEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgp1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwoKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCgkjIERyb3AgdGhlIGhlYWRlcgoJc2hpZnQgKEBsaW5lcyk7CgkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoKCQkjIENoZWNrIGZvciBlcnJvcnMKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL15FUlJPUi8pIHsKCQkJZXhpdCAxOwoJCX0KCgkJIyBCbGFjayBsaXN0CgkJaWYgKCRsaW5lc1skaV0gPX4gbS9GaWxlIDEvKSB7CgkJCW5leHQ7CgkJfQoKCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15ICRtb2R1bGVfaXRlbSA9ICRfWzBdOwoJbXkgJG1vZHVsZV9kYXRhID0gJF9bMV07CglteSAkbW9kdWxlX2Rlc2NyaXB0aW9uID0gJF9bMl07CglteSBAZGF0YSA9IEB7JF9bM119OwoJbXkgJHJlc3VsdDsKCglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCQoJCSRyZXN1bHQgPSAnJzsKCgkJIyBJdGVtCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2l0ZW19KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSAuICc7JzsKCQl9CgoJCSMgRGF0YQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0gLiAnOyc7CgkJfQoKCQkjIERlc2NyaXB0aW9uCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGVzY3JpcHRpb259OwoJCX0KCgkJcHJpbnQgJHJlc3VsdCAuICJcbiI7CQoJfQp9CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIE1haW4KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKCm15IEByZXN1bHQgPSBydW5fcXVlcnkoIlNFTEVDVCBIb3RGaXhJRCwgRGVzY3JpcHRpb24sIEZpeENvbW1lbnRzIEZST00gV2luMzJfUXVpY2tGaXhFbmdpbmVlcmluZyIpOwpwcmludF9tb2R1bGVkYXRhICgiSG90Rml4SUQiLCAiRGVzY3JpcHRpb24iLCAiRml4Q29tbWVudHMiLCBcQHJlc3VsdCk7CmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (16,1,'Init&#x20;services','Services programmed to lauch in Unix','','Service','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (17,9,'Init&#x20;services','Windows services','/usr/bin/perl','Name;PathName;State','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9zZXJ2aWNlcy5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAwOCBSYW1vbiBOb3ZvYSwgcm5vdm9hQGFydGljYS5lcwojICAgICAgICAgICAoYykgMjAwOC0yMDIxIEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgp1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwoKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCgkjIERyb3AgdGhlIGhlYWRlcgoJc2hpZnQgKEBsaW5lcyk7CgkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoKCQkjIENoZWNrIGZvciBlcnJvcnMKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL15FUlJPUi8pIHsKCQkJZXhpdCAxOwoJCX0KCgkJIyBCbGFjayBsaXN0CgkJaWYgKCRsaW5lc1skaV0gPX4gbS9GaWxlIDEvKSB7CgkJCW5leHQ7CgkJfQoKCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15ICRtb2R1bGVfaXRlbSA9ICRfWzBdOwoJbXkgJG1vZHVsZV9kYXRhID0gJF9bMV07CglteSAkbW9kdWxlX2Rlc2NyaXB0aW9uID0gJF9bMl07CglteSBAZGF0YSA9IEB7JF9bM119OwoJbXkgJHJlc3VsdDsKCglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCQoJCSRyZXN1bHQgPSAnJzsKCgkJIyBJdGVtCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2l0ZW19KSkgewoJCQkkcmVzdWx0IC49ICRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSAuICc7JzsKCQl9CgoJCSMgRGF0YQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kYXRhfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0gLiAnOyc7CgkJfQoKCQkjIERlc2NyaXB0aW9uCgkJaWYgKGRlZmluZWQoJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfZGVzY3JpcHRpb259OwoJCX0KCgkJcHJpbnQgJHJlc3VsdCAuICJcbiI7CQoJfQp9CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIE1haW4KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKCm15IEByZXN1bHQgPSBydW5fcXVlcnkoIlNFTEVDVCBOYW1lLCBQYXRoTmFtZSwgU3RhdGUgRlJPTSBXaW4zMl9TZXJ2aWNlIik7CnByaW50X21vZHVsZWRhdGEgKCJOYW1lIiwgIlBhdGhOYW1lIiwgIlN0YXRlIiwgXEByZXN1bHQpOwpleGl0IDA7Cg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (18,1,'File&#x20;system','UNIX filesystem mounted on system','','Device;Free size;Total size;Mount point','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (19,9,'File&#x20;system','Disk drives','','Device;Total size;Free size;Mount point','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (20,1,'Process','Process running on system','','Process output from ps','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (21,9,'Process','Process running on system','/usr/bin/perl','Name;PathName;State','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9wcm9jZXNzZXMucGwKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBDb3B5cmlnaHQgKGMpIDIwMDggUmFtb24gTm92b2EsIHJub3ZvYUBhcnRpY2EuZXMKIyAgICAgICAgICAgKGMpIDIwMDgtMjAyMSBBcnRpY2EgU29sdWNpb25lcyBUZWNub2xvZ2ljYXMgUy5MCiMKIyBUaGlzIHByb2dyYW0gaXMgZnJlZSBzb2Z0d2FyZTsgeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQgYW5kL29yCiMgbW9kaWZ5IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UKIyBhcyBwdWJsaXNoZWQgYnkgdGhlIEZyZWUgU29mdHdhcmUgRm91bmRhdGlvbjsgdmVyc2lvbiAyLgojCiMgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsCiMgYnV0IFdJVEhPVVQgQU5ZIFdBUlJBTlRZOyB3aXRob3V0IGV2ZW4gdGhlIGltcGxpZWQgd2FycmFudHkgb2YKIyBNRVJDSEFOVEFCSUxJVFkgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuICBTZWUgdGhlCiMgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4KIyBZb3Ugc2hvdWxkIGhhdmUgcmVjZWl2ZWQgYSBjb3B5IG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFsb25nIHdpdGggdGhpcyBwcm9ncmFtOyBpZiBub3QsIHdyaXRlIHRvIHRoZSBGcmVlIFNvZnR3YXJlCiMgRm91bmRhdGlvbiwgSW5jLiwgNTEgRnJhbmtsaW4gU3RyZWV0LCBGaWZ0aCBGbG9vciwgQm9zdG9uLCBNQSAgMDIxMTAtMTMwMSwgVVNBLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKCnVubGVzcygtZSAkd21pX2NsaWVudCkgewoJcHJpbnQgIltlcnJvcl0gJHdtaV9jbGllbnQgbm90IGZvdW5kLlxuIjsKCWV4aXQgMTsKfQoKaWYgKCQjQVJHViAhPSAyKSB7CglwcmludCAiVXNhZ2U6ICQwIDx0YXJnZXQgaXA+IDx1c2VybmFtZT4gPHBhc3N3b3JkPlxuIjsKCWV4aXQgMTsKfQoKbXkgJHRhcmdldF9pcCA9ICRBUkdWWzBdOwpteSAkdXNlcm5hbWUgPSAkQVJHVlsxXTsKbXkgJHBhc3N3b3JkID0gJEFSR1ZbMl07CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFNVQiBydW5fcXVlcnkgKCR3cWxfcXVlcnkpCiMgUnVucyB0aGUgZ2l2ZW4gV1FMIHF1ZXJ5IGFuZCByZXR1cm5zIHRoZSByZXN1bHQgYXMgYW4gYXJyYXkgb2YgaGFzaGVzLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcnVuX3F1ZXJ5IHsKCW15ICR3cWxfcXVlcnkgPSAkX1swXTsKCW15IEByZXN1bHQgPSB7fTsKCgkkd3FsX3F1ZXJ5ID1+ICdzLyIvXCcvZyc7CgoJIyBSdW4gdGhlIERDT00vV01JIGNsaWVudAoJbXkgJG91dHB1dCA9IGAkd21pX2NsaWVudCAtVSAnJHVzZXJuYW1lJyUnJHBhc3N3b3JkJyAvLyR0YXJnZXRfaXAgXCIkd3FsX3F1ZXJ5XCIgMj4vZGV2L251bGxgOwoKCW15IEBsaW5lcyA9IHNwbGl0KC9cbi8sICRvdXRwdXQpOwoJIyBIZWFkZXIsIGRlc2NyaXB0aW9uLCByZXN1bHRzCglpZiAoJCNsaW5lcyA8IDIpIHsKCQlleGl0IDE7Cgl9CgoJIyBEcm9wIHRoZSBoZWFkZXIKCXNoaWZ0IChAbGluZXMpOwoJCgkjIEdldCBjb2x1bW4gbmFtZXMKCW15IEBjb2x1bW5fbmFtZXMgPSBzcGxpdCgvXHwvLCBzaGlmdCAoQGxpbmVzKSk7CgoJIyBHZXQgcm93IGRhdGEKCW15ICRpZHggPSAwOwoJZm9yIChteSAkaSA9IDA7ICRpIDw9ICQjbGluZXM7ICRpKyspIHsKCgkJIyBDaGVjayBmb3IgZXJyb3JzCgkJaWYgKCRsaW5lc1skaV0gPX4gbS9eRVJST1IvKSB7CgkJCWV4aXQgMTsKCQl9CgoJCSMgQmxhY2sgbGlzdAoJCWlmICgkbGluZXNbJGldID1+IG0vRmlsZSAxLykgewoJCQluZXh0OwoJCX0KCgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSAkbW9kdWxlX2l0ZW0gPSAkX1swXTsKCW15ICRtb2R1bGVfZGF0YSA9ICRfWzFdOwoJbXkgJG1vZHVsZV9kZXNjcmlwdGlvbiA9ICRfWzJdOwoJbXkgQGRhdGEgPSBAeyRfWzNdfTsKCW15ICRyZXN1bHQ7CgoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkKCQkkcmVzdWx0ID0gJyc7CgoJCSMgSXRlbQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfaXRlbX0gLiAnOyc7CgkJfQoKCQkjIERhdGEKCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2RhdGF9IC4gJzsnOwoJCX0KCgkJIyBEZXNjcmlwdGlvbgoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufTsKCQl9CgoJCXByaW50ICRyZXN1bHQgLiAiXG4iOwkKCX0KfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBNYWluCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgpteSBAcmVzdWx0ID0gcnVuX3F1ZXJ5KCJTRUxFQ1QgTmFtZSwgUGF0aE5hbWUsIFN0YXRlIEZST00gV2luMzJfU2VydmljZSIpOwpwcmludF9tb2R1bGVkYXRhICgiTmFtZSIsICJQYXRoTmFtZSIsICJTdGF0ZSIsIFxAcmVzdWx0KTsJCmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (22,1,'Users','User list','','Username','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (23,9,'Users','User list','/usr/bin/perl','Domain;User','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9wcm9jZXNzZXMucGwKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBDb3B5cmlnaHQgKGMpIDIwMDggUmFtb24gTm92b2EsIHJub3ZvYUBhcnRpY2EuZXMKIyAgICAgICAgICAgKGMpIDIwMDgtMjAyMSBBcnRpY2EgU29sdWNpb25lcyBUZWNub2xvZ2ljYXMgUy5MCiMKIyBUaGlzIHByb2dyYW0gaXMgZnJlZSBzb2Z0d2FyZTsgeW91IGNhbiByZWRpc3RyaWJ1dGUgaXQgYW5kL29yCiMgbW9kaWZ5IGl0IHVuZGVyIHRoZSB0ZXJtcyBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UKIyBhcyBwdWJsaXNoZWQgYnkgdGhlIEZyZWUgU29mdHdhcmUgRm91bmRhdGlvbjsgdmVyc2lvbiAyLgojCiMgVGhpcyBwcm9ncmFtIGlzIGRpc3RyaWJ1dGVkIGluIHRoZSBob3BlIHRoYXQgaXQgd2lsbCBiZSB1c2VmdWwsCiMgYnV0IFdJVEhPVVQgQU5ZIFdBUlJBTlRZOyB3aXRob3V0IGV2ZW4gdGhlIGltcGxpZWQgd2FycmFudHkgb2YKIyBNRVJDSEFOVEFCSUxJVFkgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuICBTZWUgdGhlCiMgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgZm9yIG1vcmUgZGV0YWlscy4KIyBZb3Ugc2hvdWxkIGhhdmUgcmVjZWl2ZWQgYSBjb3B5IG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFsb25nIHdpdGggdGhpcyBwcm9ncmFtOyBpZiBub3QsIHdyaXRlIHRvIHRoZSBGcmVlIFNvZnR3YXJlCiMgRm91bmRhdGlvbiwgSW5jLiwgNTEgRnJhbmtsaW4gU3RyZWV0LCBGaWZ0aCBGbG9vciwgQm9zdG9uLCBNQSAgMDIxMTAtMTMwMSwgVVNBLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKCnVubGVzcygtZSAkd21pX2NsaWVudCkgewoJcHJpbnQgIltlcnJvcl0gJHdtaV9jbGllbnQgbm90IGZvdW5kLlxuIjsKCWV4aXQgMTsKfQoKaWYgKCQjQVJHViAhPSAyKSB7CglwcmludCAiVXNhZ2U6ICQwIDx0YXJnZXQgaXA+IDx1c2VybmFtZT4gPHBhc3N3b3JkPlxuIjsKCWV4aXQgMTsKfQoKbXkgJHRhcmdldF9pcCA9ICRBUkdWWzBdOwpteSAkdXNlcm5hbWUgPSAkQVJHVlsxXTsKbXkgJHBhc3N3b3JkID0gJEFSR1ZbMl07CgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFNVQiBydW5fcXVlcnkgKCR3cWxfcXVlcnkpCiMgUnVucyB0aGUgZ2l2ZW4gV1FMIHF1ZXJ5IGFuZCByZXR1cm5zIHRoZSByZXN1bHQgYXMgYW4gYXJyYXkgb2YgaGFzaGVzLgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcnVuX3F1ZXJ5IHsKCW15ICR3cWxfcXVlcnkgPSAkX1swXTsKCW15IEByZXN1bHQgPSB7fTsKCgkkd3FsX3F1ZXJ5ID1+ICdzLyIvXCcvZyc7CgoJIyBSdW4gdGhlIERDT00vV01JIGNsaWVudAoJbXkgJG91dHB1dCA9IGAkd21pX2NsaWVudCAtVSAnJHVzZXJuYW1lJyUnJHBhc3N3b3JkJyAvLyR0YXJnZXRfaXAgXCIkd3FsX3F1ZXJ5XCIgMj4vZGV2L251bGxgOwoKCW15IEBsaW5lcyA9IHNwbGl0KC9cbi8sICRvdXRwdXQpOwoJIyBIZWFkZXIsIGRlc2NyaXB0aW9uLCByZXN1bHRzCglpZiAoJCNsaW5lcyA8IDIpIHsKCQlleGl0IDE7Cgl9CgoJIyBEcm9wIHRoZSBoZWFkZXIKCXNoaWZ0IChAbGluZXMpOwoJCgkjIEdldCBjb2x1bW4gbmFtZXMKCW15IEBjb2x1bW5fbmFtZXMgPSBzcGxpdCgvXHwvLCBzaGlmdCAoQGxpbmVzKSk7CgoJIyBHZXQgcm93IGRhdGEKCW15ICRpZHggPSAwOwoJZm9yIChteSAkaSA9IDA7ICRpIDw9ICQjbGluZXM7ICRpKyspIHsKCgkJIyBDaGVjayBmb3IgZXJyb3JzCgkJaWYgKCRsaW5lc1skaV0gPX4gbS9eRVJST1IvKSB7CgkJCWV4aXQgMTsKCQl9CgoJCSMgQmxhY2sgbGlzdAoJCWlmICgkbGluZXNbJGldID1+IG0vRmlsZSAxLykgewoJCQluZXh0OwoJCX0KCgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSAkbW9kdWxlX2l0ZW0gPSAkX1swXTsKCW15ICRtb2R1bGVfZGF0YSA9ICRfWzFdOwoJbXkgJG1vZHVsZV9kZXNjcmlwdGlvbiA9ICRfWzJdOwoJbXkgQGRhdGEgPSBAeyRfWzNdfTsKCW15ICRyZXN1bHQ7CgoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkKCQkkcmVzdWx0ID0gJyc7CgoJCSMgSXRlbQoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9pdGVtfSkpIHsKCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfaXRlbX0gLiAnOyc7CgkJfQoKCQkjIERhdGEKCQlpZiAoZGVmaW5lZCgkZWxlbWVudC0+eyRtb2R1bGVfZGF0YX0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2RhdGF9IC4gJzsnOwoJCX0KCgkJIyBEZXNjcmlwdGlvbgoJCWlmIChkZWZpbmVkKCRlbGVtZW50LT57JG1vZHVsZV9kZXNjcmlwdGlvbn0pKSB7CgkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2Rlc2NyaXB0aW9ufTsKCQl9CgoJCXByaW50ICRyZXN1bHQgLiAiXG4iOwkKCX0KfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBNYWluCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgpteSBAcmVzdWx0ID0gcnVuX3F1ZXJ5KCJTRUxFQ1QgTmFtZSwgUGF0aE5hbWUsIFN0YXRlIEZST00gV2luMzJfU2VydmljZSIpOwpwcmludF9tb2R1bGVkYXRhICgiTmFtZSIsICJQYXRoTmFtZSIsICJTdGF0ZSIsIFxAcmVzdWx0KTsJCmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (24,9,'Services','Services&#x20;installed','','Name;Command;Status','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (25,15,'Software','Installed&#x20;software&#x20;applications','','Name;Version;Description','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (26,7,'Cisco&#x20;Interface&#x20;Remote&#x20;Inventory','Remote&#x20;inventory&#x20;module&#x20;to&#x20;get&#x20;all&#x20;cards&#x20;in&#x20;a&#x20;Cisco','/usr/bin/perl','Name;Card&#x20;Name;ID/Serial','IyEvdXNyL2Jpbi9wZXJsDQojSW52ZW50YXJpbyBkZSBUYXJqZXRhcw0KI1Nsb3Q7UGFydE51bWJlcjtTZXJpYWxOdW1iZXINCg0KIyEvdXNyL2Jpbi9wZXJsIC13DQoNCm15ICR0YXJnZXRfaXAgPSAkQVJHVlswXTsNCm15ICRjb21tdW5pdHkgPSAkQVJHVlsxXTsNCg0KI34gRXhlY3V0ZSBjb21tYW5kDQokY29tbWFuZCA9IGBzbm1wd2FsayAtdjJjIC1jICRjb21tdW5pdHkgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjJgOw0KDQojfiBTcGxpdCB0aGUgb3V0cHV0IGluIGxpbmVzDQpAdGVtcCA9IHNwbGl0ICgiXG4iLCAkY29tbWFuZCk7DQpteSBAdmFsdWVzOw0KDQojfiBFYWNoIGxpbmUNCmZvcmVhY2ggKEB0ZW1wKSB7DQoJI34gc3dhcCBkb3RzIGJ5IHNwYWNlcw0KCSRfID1+IHMvXC4vIC9nOw0KCSN+IHNwbGl0IHRoZSBsaW5lIGJ5IHNwYWNlcw0KCUBsaW5lID0gc3BsaXQgKC8gLywgJF8pOw0KCSN+IHNhdmUgdGhlIDd0aCB2YWx1ZQ0KCXB1c2ggKEB2YWx1ZXMsICRsaW5lWzddKTsNCn0NCg0KZm9yZWFjaCAoQHZhbHVlcykgew0KCSN+IHByaW50ICIkXyI7DQoJJFBJRCA9ICcnOw0KCSRQSUQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjEzLiRfYDsNCgkkUElEIC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS4xMS4kX2A7DQoJJFBJRCA9fiBzL1wifFxufFw8fFw+fFwmfFxbfFxdLy9nOw0KDQoJaWYgKCRQSUQgbmUgIiIgKSB7DQoJCSRyZXN1bHQgPSAnJzsNCgkJIyRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBzeXNOYW1lLjBgIC4gJzsnOw0KCQkkcmVzdWx0IC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS43LiRfYCAuICc7JzsNCgkJIyRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjIuJF9gIC4gJzsnOw0KCQkkcmVzdWx0IC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS4xMy4kX2AgLiAnOyc7DQoJCSRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjExLiRfYDsNCgkJDQoJCSRyZXN1bHQgPX4gcy9cInxcbnxcPHxcPnxcJnxcW3xcXS8vZzsNCgkJcHJpbnQgJHJlc3VsdCAuICJcbiI7DQoJfQ0KfQ0KZXhpdCAwOw0K',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (27,7,'Cisco&#x20;Interface&#x20;Remote&#x20;Inventory&#x20;SSH','Remote&#x20;inventory&#x20;module&#x20;to&#x20;get&#x20;all&#x20;cards&#x20;in&#x20;a&#x20;Cisco','/usr/bin/perl','Name;Card&#x20;Name;ID/Serial','IyEvdXNyL2Jpbi9wZXJsIAojCiMgKGMpIEFydGljYSAyMDE4CiMgVGhpcyBpcyBhbiBFbnRlcnByaXNlIGludmVudG9yeSBzY3JpcHQgZm9yIFBhbmRvcmEgRk1TIDdORwojIFRoaXMgc2NyaXB0IHdpbGwgY29sbGVjdCBhIHJlbW90ZSBDSVNDTyBjb25maWd1cmF0aW9uCiMgUkVNRU1CRVIgVE8gQUNUSVZBVEUgSVQgQVMgQkxPQ0sgTU9ERSAhISEKCnVzZSB3YXJuaW5nczsKdXNlIHN0cmljdDsKdXNlIE5ldDo6U1NIOjpFeHBlY3Q7CgojIExvYWQgY29uZmlnIGZyb20gY29tbWFuZCBsaW5lCmlmICgkI0FSR1YgIT0gMikgewogICAgcHJpbnQgIlVzYWdlOiAkMCA8VGFyZ2V0IElQPiA8VXNlcm5hbWU+IDxQYXNzd29yZD4gPEVuYWJsZSBwYXNzd29yZD5cbiI7CiAgICBleGl0IDE7Cn0KCm15ICR0aW1lb3V0ID0gNTsKbXkgJHRhcmdldCA9ICRBUkdWWzBdOwpteSAkdXNlcm5hbWUgPSAkQVJHVlsxXTsKbXkgJHBhc3N3b3JkID0gJEFSR1ZbMl07Cm15ICRlbmFibGVfcGFzcyA9ICRBUkdWWzNdOwoKbXkgJHNzaCA9IE5ldDo6U1NIOjpFeHBlY3QtPm5ldygKICAgIGhvc3QgPT4gJHRhcmdldCwKICAgIHVzZXIgPT4gJHVzZXJuYW1lLAogICAgcGFzc3dvcmQgPT4gJHBhc3N3b3JkLAogICAgcmF3X3B0eSA9PiAxLAogICAgdGltZW91dCA9PiAkdGltZW91dAopOwokc3NoLT5sb2dpbigxKSBvciBkaWUgIlVuYWJsZSB0byBzdGFydDogJCEiOwokc3NoLT5zZW5kKCJlbiIpOwokc3NoLT53YWl0Zm9yKCcvUGFzc3dvcmQ6L2knKTsKJHNzaC0+c2VuZCgkZW5hYmxlX3Bhc3MpOwokc3NoLT53YWl0Zm9yKCcvXCMvJyk7CiRzc2gtPnNlbmQoInRlcm1pbmFsIGxlbmd0aCAwIik7CiRzc2gtPndhaXRmb3IoJy9cIy8nKTsKJHNzaC0+ZWF0KCRzc2gtPnBlZWsoKSk7ICMgdG8gcmVtb3ZlIGN1cnJlbnQgb3V0cHV0CiRzc2gtPnNlbmQoInNob3cgcnVubmluZy1jb25maWciKTsKCiMgcmV0dXJucyB0aGUgbmV4dCBsaW5lLCByZW1vdmluZyBpdCBmcm9tIHRoZSBpbnB1dCBzdHJlYW06Cm15ICRsaW5lOwokc3NoLT5yZWFkX2xpbmUoKTsgIyB0byByZW1vdmUgc2hvdyBydW5uaW5nLWNvbmZpZwp3aGlsZSAoZGVmaW5lZCgkbGluZSA9ICRzc2gtPnJlYWRfbGluZSgpKSkgewogICAgcHJpbnQgJGxpbmUgLiAiXG4iOwp9Cg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (28,7,'Cisco&#x20;Inventory','Get&#x20;remote&#x20;device&#x20;information&#x20;about&#x20;the&#x20;cisco&#x20;device','/usr/bin/perl','IP;Hardware;SerialNumber;IOS','IyEvdXNyL2Jpbi9wZXJsDQoNCiNJbmZvcm1hY2lvbiBkZWwgRXF1aXBvDQojSVA7SGFyZHdhcmU7U2VyaWFsTnVtYmVyO0lPUw0KDQpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07DQpteSAkY29tbXVuaXR5ID0gJEFSR1ZbMV07DQoNCiRyZXN1bHQgPSAnJzsNCiMkcmVzdWx0IC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgc3lzTmFtZS4wYCAuICc7JzsNCiRyZXN1bHQgLj0gJHRhcmdldF9pcCAuICc7JzsNCiRlcnJvciA9ICcnOw0KJGVycm9yIC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS4yLjEgfCBncmVwIGV4aXN0c2A7DQokc2VyaWFsID0gJyc7DQokc2VyaWFsIC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS4xMS4xYDsNCiRzZXJpYWwgPX4gcy9cInxcbnxcPHxcPnxcJnxcW3xcXS8vZzsNCg0KaWYgKCRlcnJvciBlcSAiIiAmJiAkc2VyaWFsIG5lICIiKXsNCiAgICAkcmVzdWx0IC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS4yLjFgIC4gJzsnOw0KICAgICRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjExLjFgIC4gJzsnOw0KDQp9IGVsc2Ugew0KICAgICRWU1MgPSAnJzsNCiAgICAkVlNTIC49IGBzbm1wZ2V0IC12MmMgLWMgJGNvbW11bml0eSAtT3ZxICR0YXJnZXRfaXAgbWliLTIuNDcuMS4xLjEuMS4yLjEgfCBncmVwIFZpcnR1YWxgOw0KICAgIGlmICgkVlNTIGVxICIiKSB7DQogICAgICAgICRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjIuMTAwMWAgLiAnOyc7DQogICAgICAgICRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjExLjEwMDFgIC4gJzsnOw0KICAgIH0gZWxzZSB7DQogICAgICAgICRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjIuMWAgLiAnOyc7DQogICAgICAgICRyZXN1bHQgLj0gYHNubXBnZXQgLXYyYyAtYyAkY29tbXVuaXR5IC1PdnEgJHRhcmdldF9pcCBtaWItMi40Ny4xLjEuMS4xLjExLjJgIC4gJzsnOw0KICAgIH0NCn0NCg0KJHJlc3VsdCAuPSBgc25tcGdldCAtdjJjIC1jICRjb21tdW5pdHkgLU92cSAkdGFyZ2V0X2lwIHN5c0Rlc2NyLjAgfCBncmVwIElPU2A7DQokcmVzdWx0ID1+IHMvXCJ8XG58XDx8XD58XCZ8XFt8XF0vL2c7DQpwcmludCAkcmVzdWx0IC4gIlxuIjsNCmV4aXQgMDsNCg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (29,1,'IP','IP&#x20;address','','Interface;Address','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (30,1,'Routes','Routes&#x20;table','','Destination;Gateway;Mask;Flags;Metric;Use;Interface','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (31,7,'Cisco&#x20;Configuration','This&#x20;script&#x20;will&#x20;collect&#x20;a&#x20;remote&#x20;CISCO&#x20;configuration','/usr/bin/perl','Configuration&#x20;dump','IyEvdXNyL2Jpbi9wZXJsIAojCiMgKGMpIEFydGljYSAyMDE0CiMgVGhpcyBpcyBhbiBFbnRlcnByaXNlIGludmVudG9yeSBzY3JpcHQgZm9yIFBhbmRvcmEgRk1TIDUKIyBUaGlzIHNjcmlwdCB3aWxsIGNvbGxlY3QgYSByZW1vdGUgQ0lTQ08gY29uZmlndXJhdGlvbgojIFJFTUVNQkVSIFRPIEFDVElWQVRFIElUIEFTIEJMT0NLIE1PREUgISEhCgp1c2Ugd2FybmluZ3M7CnVzZSBzdHJpY3Q7CnVzZSBOZXQ6OlRlbG5ldDsKCm15ICR0YXJnZXQgPSAiIjsKbXkgJGxvZ2luX3Bhc3MgPSAiIjsKbXkgJGVuYWJsZV9wYXNzID0gIiI7Cm15ICRvdXRwdXRfZmlsZSA9ICIvdG1wL2Npc2NvIi4kJDsKbXkgJFRJTUVPVVQ9NTsKCiMgTG9hZCBjb25maWcgZmlsZSBmcm9tIGNvbW1hbmQgbGluZQppZiAoJCNBUkdWIDwgMiAgKXsKICAgICAgICBwcmludCAiSSBuZWVkIHNldmVyYWwgcGFyYW1ldGVycyBpbiB0aGlzIGZvcm1hdDogXG5cbiI7CglwcmludCAiICAgICAgZ2V0X2NvbmZpZy5wbCA8aXBfYWRkcmVzcz4gPGxvZ2luX3Bhc3M+IDxlbmFibGVfcGFzcz4gXG5cbiI7CiAgICAgICAgZXhpdDsKfQoKJHRhcmdldCA9ICRBUkdWWzBdOwokbG9naW5fcGFzcyA9ICRBUkdWWzFdOwokZW5hYmxlX3Bhc3MgPSAkQVJHVlsyXTsKCm15ICR0ZWxuZXQgPSBuZXcgTmV0OjpUZWxuZXQgKCBUaW1lb3V0PT4kVElNRU9VVCwgRXJybW9kZT0+J3JldHVybicpOyAKJHRlbG5ldC0+b3BlbigkdGFyZ2V0KTsgCiR0ZWxuZXQtPndhaXRmb3IoJy9QYXNzd29yZDovaScpOyAKJHRlbG5ldC0+cHJpbnQoJGxvZ2luX3Bhc3MpOyAKCiR0ZWxuZXQtPndhaXRmb3IoJy9cPiQvaScpOyAKJHRlbG5ldC0+cHJpbnQoJ2VuJyk7CiR0ZWxuZXQtPndhaXRmb3IoJy9QYXNzd29yZDovaScpOwokdGVsbmV0LT5wcmludCgkZW5hYmxlX3Bhc3MpOwokdGVsbmV0LT53YWl0Zm9yKCcvXCMvJyk7CiR0ZWxuZXQtPmNtZF9yZW1vdmVfbW9kZSgxKTsKCiR0ZWxuZXQtPnByaW50KCdzaG93IHJ1bm5pbmctY29uZmlnJyk7CgpteSAkZmggPSAkdGVsbmV0LT5pbnB1dF9sb2coJG91dHB1dF9maWxlKTsKbXkgJG91dHB1dCA9IDE7Cgp3aGlsZSAoZGVmaW5lZCgkb3V0cHV0KSl7Cgkkb3V0cHV0ID0gJHRlbG5ldC0+d2FpdGZvcignL01vcmUvaScpOyAKCSR0ZWxuZXQtPnByaW50KCIiKTsgCn0KCm15ICRidWZmZXIgPSAiIjsKCm9wZW4gT1VURiwgJG91dHB1dF9maWxlOwp3aGlsZSAoPE9VVEY+KSB7CgkkXyA9fiBzL1x4MDgvL2c7CgkkXyA9fiBzL1wtXC1Nb3JlXC1cLVtcdFxzXSovL2c7CgkkXyA9fiBzL1w7Ly9nOwoJJGJ1ZmZlciA9ICRidWZmZXIgLiAkXzsKfQpjbG9zZSAoT1VURik7Cgp1bmxpbmsgKCRvdXRwdXRfZmlsZSk7CnByaW50ICRidWZmZXI7Cg==',1,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (32,9,'Motherboard','This&#x20;script&#x20;retrieves&#x20;the&#x20;manufacturer,model&#x20;and&#x20;ID&#x20;from&#x20;the&#x20;motherboard&#x20;of&#x20;a&#x20;Windows&#x20;system','/usr/bin/perl','Manufacturer;Model;ID','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9tb3RoZXJib2FyZC5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAxNSBCb3JqYSBTYW5jaGV6IDxmYm9yamEuc2FuY2hlekBhcnRpY2EuZXM+CiMgICAgICAgICAgIChjKSAyMDE1IEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgojdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCSMgRHJvcCB0aGUgaGVhZGVyCglzaGlmdCAoQGxpbmVzKTsKCQkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoJCSMgQ2hlY2sgZm9yIGVycm9ycwoJCWlmICgkbGluZXNbJGldID1+IG0vXkVSUk9SLykgewoJCQlleGl0IDE7CgkJfQoKCQkjIEJsYWNrIGxpc3QKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL0ZpbGUgMS8pIHsKCQkJbmV4dDsKCQl9CgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSBAbW9kdWxlX2hlYWRlcnMgPSBAeyRfWzBdfTsKCW15IEBtb2R1bGVfdW5pdHMgICA9IEB7JF9bMV19OwoJbXkgQGRhdGEgICAgICAgICAgID0gQHskX1syXX07CglteSAkcmVzdWx0OwoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkkcmVzdWx0ID0gJyc7CgkJZm9yICgkaT0wOyAkaTxAbW9kdWxlX2hlYWRlcnM7JGkrKykgewoJCQlpZiAoZGVmaW5lZCAoJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSkpIHsKCQkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSAuICRtb2R1bGVfdW5pdHNbJGldIC4gJzsnOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdCAuPSAnOyc7CgkJCX0KCQl9CgkJY2hvcCgkcmVzdWx0KTsKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCAgPSBydW5fcXVlcnkoIlNFTEVDVCAqIEZST00gV2luMzJfY29tcHV0ZXJzeXN0ZW0iKTsKIyBSZW1lbWJlciB0byBtYXRjaCBsZW5naHQgb2YgYm90aCBhcnJheXMgaGVhZGVycyAmIHVuaXRzCm15IEBoZWFkZXJzID0gKCJNYW51ZmFjdHVyZXIiLCJNb2RlbCIsIk9FTVN0cmluZ0FycmF5Iik7Cm15IEB1bml0cyAgID0gKCIiLCIiLCIiKTsKcHJpbnRfbW9kdWxlZGF0YSAoXEBoZWFkZXJzLFxAdW5pdHMsIFxAcmVzdWx0KTsKZXhpdCAwOwo=',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (33,9,'Monitors','Retrieve&#x20;all&#x20;monitor&#x20;info&#x20;from&#x20;a&#x20;Windows&#x20;system.','/usr/bin/perl','Model;ID','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9tb25pdG9ycy5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAxNSBCb3JqYSBTYW5jaGV6IDxmYm9yamEuc2FuY2hlekBhcnRpY2EuZXM+CiMgICAgICAgICAgIChjKSAyMDE1IEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgojdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCSMgRHJvcCB0aGUgaGVhZGVyCglzaGlmdCAoQGxpbmVzKTsKCQkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoJCSMgQ2hlY2sgZm9yIGVycm9ycwoJCWlmICgkbGluZXNbJGldID1+IG0vXkVSUk9SLykgewoJCQlleGl0IDE7CgkJfQoKCQkjIEJsYWNrIGxpc3QKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL0ZpbGUgMS8pIHsKCQkJbmV4dDsKCQl9CgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSBAbW9kdWxlX2hlYWRlcnMgPSBAeyRfWzBdfTsKCW15IEBtb2R1bGVfdW5pdHMgICA9IEB7JF9bMV19OwoJbXkgQGRhdGEgICAgICAgICAgID0gQHskX1syXX07CglteSAkcmVzdWx0OwoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkkcmVzdWx0ID0gJyc7CgkJZm9yICgkaT0wOyAkaTxAbW9kdWxlX2hlYWRlcnM7JGkrKykgewoJCQlpZiAoZGVmaW5lZCAoJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSkpIHsKCQkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSAuICRtb2R1bGVfdW5pdHNbJGldIC4gJzsnOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdCAuPSAnOyc7CgkJCX0KCQl9CgkJY2hvcCgkcmVzdWx0KTsKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCAgPSBydW5fcXVlcnkoIlNFTEVDVCBOYW1lLFBOUERldmljZUlEIEZST00gV2luMzJfRGVza3RvcE1vbml0b3IiKTsKIyBSZW1lbWJlciB0byBtYXRjaCBsZW5naHQgb2YgYm90aCBhcnJheXMgaGVhZGVycyAmIHVuaXRzCm15IEBoZWFkZXJzID0gKCJOYW1lIiwiUE5QRGV2aWNlSUQiKTsKbXkgQHVuaXRzICAgPSAoIiIsIiIpOwpwcmludF9tb2R1bGVkYXRhIChcQGhlYWRlcnMsXEB1bml0cywgXEByZXN1bHQpOwpleGl0IDA7',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (34,9,'Printers','Retrieve&#x20;all&#x20;printers&#x20;of&#x20;a&#x20;Windows&#x20;system','/usr/bin/perl','Name;Driver;Port','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9wcmludGVycy5wbAojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIENvcHlyaWdodCAoYykgMjAxNSBCb3JqYSBTYW5jaGV6IDxmYm9yamEuc2FuY2hlekBhcnRpY2EuZXM+CiMgICAgICAgICAgIChjKSAyMDA4IEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgojdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCSMgRHJvcCB0aGUgaGVhZGVyCglzaGlmdCAoQGxpbmVzKTsKCQkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoJCSMgQ2hlY2sgZm9yIGVycm9ycwoJCWlmICgkbGluZXNbJGldID1+IG0vXkVSUk9SLykgewoJCQlleGl0IDE7CgkJfQoKCQkjIEJsYWNrIGxpc3QKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL0ZpbGUgMS8pIHsKCQkJbmV4dDsKCQl9CgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSBAbW9kdWxlX2hlYWRlcnMgPSBAeyRfWzBdfTsKCW15IEBtb2R1bGVfdW5pdHMgICA9IEB7JF9bMV19OwoJbXkgQGRhdGEgICAgICAgICAgID0gQHskX1syXX07CglteSAkcmVzdWx0OwoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkkcmVzdWx0ID0gJyc7CgkJZm9yICgkaT0wOyAkaTxAbW9kdWxlX2hlYWRlcnM7JGkrKykgewoJCQlpZiAoZGVmaW5lZCAoJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSkpIHsKCQkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSAuICRtb2R1bGVfdW5pdHNbJGldIC4gJzsnOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdCAuPSAnOyc7CgkJCX0KCQl9CgkJY2hvcCgkcmVzdWx0KTsKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCAgPSBydW5fcXVlcnkoIlNFTEVDVCBDYXB0aW9uLERyaXZlck5hbWUsUG9ydE5hbWUgRlJPTSBXaW4zMl9wcmludGVyIik7CiMgUmVtZW1iZXIgdG8gbWF0Y2ggbGVuZ2h0IG9mIGJvdGggYXJyYXlzIGhlYWRlcnMgJiB1bml0cwpteSBAaGVhZGVycyA9ICgiQ2FwdGlvbiIsIkRyaXZlck5hbWUiLCJQb3J0TmFtZSIpOwpteSBAdW5pdHMgICA9ICgiIiwiIiwiIik7CnByaW50X21vZHVsZWRhdGEgKFxAaGVhZGVycyxcQHVuaXRzLCBcQHJlc3VsdCk7CmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (35,9,'product_key','Retrieve&#x20;the&#x20;Windows&#x20;product&#x20;key','/usr/bin/perl','Key','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9wcm9kdWN0a2V5LnBsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgQ29weXJpZ2h0IChjKSAyMDE1IEJvcmphIFNhbmNoZXosIDxmYm9yamEuc2FuY2hlekBhcnRpY2EuZXM+CiMgICAgICAgICAgIChjKSAyMDE1IEFydGljYSBTb2x1Y2lvbmVzIFRlY25vbG9naWNhcyBTLkwKIwojIFRoaXMgcHJvZ3JhbSBpcyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKIyBtb2RpZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZQojIGFzIHB1Ymxpc2hlZCBieSB0aGUgRnJlZSBTb2Z0d2FyZSBGb3VuZGF0aW9uOyB2ZXJzaW9uIDIuCiMKIyBUaGlzIHByb2dyYW0gaXMgZGlzdHJpYnV0ZWQgaW4gdGhlIGhvcGUgdGhhdCBpdCB3aWxsIGJlIHVzZWZ1bCwKIyBidXQgV0lUSE9VVCBBTlkgV0FSUkFOVFk7IHdpdGhvdXQgZXZlbiB0aGUgaW1wbGllZCB3YXJyYW50eSBvZgojIE1FUkNIQU5UQUJJTElUWSBvciBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4gIFNlZSB0aGUKIyBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSBmb3IgbW9yZSBkZXRhaWxzLgojIFlvdSBzaG91bGQgaGF2ZSByZWNlaXZlZCBhIGNvcHkgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYWxvbmcgd2l0aCB0aGlzIHByb2dyYW07IGlmIG5vdCwgd3JpdGUgdG8gdGhlIEZyZWUgU29mdHdhcmUKIyBGb3VuZGF0aW9uLCBJbmMuLCA1MSBGcmFua2xpbiBTdHJlZXQsIEZpZnRoIEZsb29yLCBCb3N0b24sIE1BICAwMjExMC0xMzAxLCBVU0EuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgojdXNlIHN0cmljdDsKdXNlIHdhcm5pbmdzOwoKdXNlIEZpbGU6OkJhc2VuYW1lOwp1c2UgSFRNTDo6RW50aXRpZXMgKCk7CgojIENoZWNrIGZvciB3bWljCm15ICR3bWlfY2xpZW50ID0gIi91c3IvYmluL3BhbmRvcmF3bWljIjsKdW5sZXNzKC1lICR3bWlfY2xpZW50KSB7CglwcmludCAiW2Vycm9yXSAkd21pX2NsaWVudCBub3QgZm91bmQuXG4iOwoJZXhpdCAxOwp9CgppZiAoJCNBUkdWICE9IDIpIHsKCXByaW50ICJVc2FnZTogJDAgPHRhcmdldCBpcD4gPHVzZXJuYW1lPiA8cGFzc3dvcmQ+XG4iOwoJZXhpdCAxOwp9CgpteSAkdGFyZ2V0X2lwID0gJEFSR1ZbMF07Cm15ICR1c2VybmFtZSA9ICRBUkdWWzFdOwpteSAkcGFzc3dvcmQgPSAkQVJHVlsyXTsKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHJ1bl9xdWVyeSAoJHdxbF9xdWVyeSkKIyBSdW5zIHRoZSBnaXZlbiBXUUwgcXVlcnkgYW5kIHJldHVybnMgdGhlIHJlc3VsdCBhcyBhbiBhcnJheSBvZiBoYXNoZXMuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBydW5fcXVlcnkgewoJbXkgJHdxbF9xdWVyeSA9ICRfWzBdOwoJbXkgQHJlc3VsdCA9IHt9OwoKCSR3cWxfcXVlcnkgPX4gJ3MvIi9cJy9nJzsKCgkjIFJ1biB0aGUgRENPTS9XTUkgY2xpZW50CglteSAkb3V0cHV0ID0gYCR3bWlfY2xpZW50IC1VICckdXNlcm5hbWUnJSckcGFzc3dvcmQnIC8vJHRhcmdldF9pcCBcIiR3cWxfcXVlcnlcIiAyPi9kZXYvbnVsbGA7CgoJbXkgQGxpbmVzID0gc3BsaXQoL1xuLywgJG91dHB1dCk7CgkjIEhlYWRlciwgZGVzY3JpcHRpb24sIHJlc3VsdHMKCWlmICgkI2xpbmVzIDwgMikgewoJCWV4aXQgMTsKCX0KCSMgRHJvcCB0aGUgaGVhZGVyCglzaGlmdCAoQGxpbmVzKTsKCQkKCSMgR2V0IGNvbHVtbiBuYW1lcwoJbXkgQGNvbHVtbl9uYW1lcyA9IHNwbGl0KC9cfC8sIHNoaWZ0IChAbGluZXMpKTsKCgkjIEdldCByb3cgZGF0YQoJbXkgJGlkeCA9IDA7Cglmb3IgKG15ICRpID0gMDsgJGkgPD0gJCNsaW5lczsgJGkrKykgewoJCSMgQ2hlY2sgZm9yIGVycm9ycwoJCWlmICgkbGluZXNbJGldID1+IG0vXkVSUk9SLykgewoJCQlleGl0IDE7CgkJfQoKCQkjIEJsYWNrIGxpc3QKCQlpZiAoJGxpbmVzWyRpXSA9fiBtL0ZpbGUgMS8pIHsKCQkJbmV4dDsKCQl9CgkJbXkgQGNvbHVtbiA9IHNwbGl0KC9cfC8sICRsaW5lc1skaV0pOwoJCWZvciAobXkgJGogPSAwOyAkaiA8PSAkI2NvbHVtbl9uYW1lczsgJGorKykgewoJCQlpZiAoISBkZWZpbmVkKCRjb2x1bW5bJGpdKSkgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICIiOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdFskaWR4XS0+eyRjb2x1bW5fbmFtZXNbJGpdfSA9ICRjb2x1bW5bJGpdOwoJCQl9CgkJfQoJCQoJCSRpZHgrKzsKCX0KCQoJcmV0dXJuIEByZXN1bHQ7Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgU1VCIHByaW50X21vZHVsZWRhdGEgKCRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhLCAKIyAkbW9kdWxlX2Rlc2NyaXB0aW9uLCBAZGF0YSkKIyBQcmludHMgYSBtb2R1bGVkYXRhIFhNTCB0YWcuICRtb2R1bGVfaXRlbSwgJG1vZHVsZV9kYXRhIGFuZAojICRtb2R1bGVfZGVzY3JpcHRpb24gYXJlIHVzZWQgdG8gaW5kZXggdGhlIGl0ZW0sIGRhdGEgYW5kIGRlc2NyaXB0aW9uCiMgWE1MIHRhZ3MgcmVzcGVjdGl2ZWx5LgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwpzdWIgcHJpbnRfbW9kdWxlZGF0YSB7CglteSBAbW9kdWxlX2hlYWRlcnMgPSBAeyRfWzBdfTsKCW15IEBtb2R1bGVfdW5pdHMgICA9IEB7JF9bMV19OwoJbXkgQGRhdGEgICAgICAgICAgID0gQHskX1syXX07CglteSAkcmVzdWx0OwoJZm9yZWFjaCBteSAkZWxlbWVudCAoQGRhdGEpIHsKCQkkcmVzdWx0ID0gJyc7CgkJZm9yICgkaT0wOyAkaTxAbW9kdWxlX2hlYWRlcnM7JGkrKykgewoJCQlpZiAoZGVmaW5lZCAoJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSkpIHsKCQkJCSRyZXN1bHQgLj0gJGVsZW1lbnQtPnskbW9kdWxlX2hlYWRlcnNbJGldfSAuICRtb2R1bGVfdW5pdHNbJGldIC4gJzsnOwoJCQl9CgkJCWVsc2UgewoJCQkJJHJlc3VsdCAuPSAnOyc7CgkJCX0KCQl9CgkJY2hvcCgkcmVzdWx0KTsKCQlwcmludCAkcmVzdWx0IC4gIlxuIjsJCgl9Cn0KCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgTWFpbgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwoKbXkgQHJlc3VsdCAgPSBydW5fcXVlcnkoIlNlbGVjdCBPQTN4T3JpZ2luYWxQcm9kdWN0S2V5IGZyb20gU29mdHdhcmVMaWNlbnNpbmdTZXJ2aWNlIik7CiMgUmVtZW1iZXIgdG8gbWF0Y2ggbGVuZ2h0IG9mIGJvdGggYXJyYXlzIGhlYWRlcnMgJiB1bml0cwpteSBAaGVhZGVycyA9ICgiT0EzeE9yaWdpbmFsUHJvZHVjdEtleSIpOwpteSBAdW5pdHMgICA9ICgiIik7CnByaW50X21vZHVsZWRhdGEgKFxAaGVhZGVycyxcQHVuaXRzLCBcQHJlc3VsdCk7CmV4aXQgMDsK',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (36,9,'product_ID','Retrieve&#x20;the&#x20;Windows&#x20;product&#x20;ID','/usr/bin/perl','Key','IyEvdXNyL2Jpbi9wZXJsCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgcGFuZG9yYV9wcm9kdWN0SUQucGwKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBDb3B5cmlnaHQgKGMpIDIwMTUgQm9yamEgU2FuY2hleiwgPGZib3JqYS5zYW5jaGV6QGFydGljYS5lcz4KIyAgICAgICAgICAgKGMpIDIwMTUgQXJ0aWNhIFNvbHVjaW9uZXMgVGVjbm9sb2dpY2FzIFMuTAojCiMgVGhpcyBwcm9ncmFtIGlzIGZyZWUgc29mdHdhcmU7IHlvdSBjYW4gcmVkaXN0cmlidXRlIGl0IGFuZC9vcgojIG1vZGlmeSBpdCB1bmRlciB0aGUgdGVybXMgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlCiMgYXMgcHVibGlzaGVkIGJ5IHRoZSBGcmVlIFNvZnR3YXJlIEZvdW5kYXRpb247IHZlcnNpb24gMi4KIwojIFRoaXMgcHJvZ3JhbSBpcyBkaXN0cmlidXRlZCBpbiB0aGUgaG9wZSB0aGF0IGl0IHdpbGwgYmUgdXNlZnVsLAojIGJ1dCBXSVRIT1VUIEFOWSBXQVJSQU5UWTsgd2l0aG91dCBldmVuIHRoZSBpbXBsaWVkIHdhcnJhbnR5IG9mCiMgTUVSQ0hBTlRBQklMSVRZIG9yIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFLiAgU2VlIHRoZQojIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlIGZvciBtb3JlIGRldGFpbHMuCiMgWW91IHNob3VsZCBoYXZlIHJlY2VpdmVkIGEgY29weSBvZiB0aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UKIyBhbG9uZyB3aXRoIHRoaXMgcHJvZ3JhbTsgaWYgbm90LCB3cml0ZSB0byB0aGUgRnJlZSBTb2Z0d2FyZQojIEZvdW5kYXRpb24sIEluYy4sIDUxIEZyYW5rbGluIFN0cmVldCwgRmlmdGggRmxvb3IsIEJvc3RvbiwgTUEgIDAyMTEwLTEzMDEsIFVTQS4KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKCiN1c2Ugc3RyaWN0Owp1c2Ugd2FybmluZ3M7Cgp1c2UgRmlsZTo6QmFzZW5hbWU7CnVzZSBIVE1MOjpFbnRpdGllcyAoKTsKCiMgQ2hlY2sgZm9yIHdtaWMKbXkgJHdtaV9jbGllbnQgPSAiL3Vzci9iaW4vcGFuZG9yYXdtaWMiOwp1bmxlc3MoLWUgJHdtaV9jbGllbnQpIHsKCXByaW50ICJbZXJyb3JdICR3bWlfY2xpZW50IG5vdCBmb3VuZC5cbiI7CglleGl0IDE7Cn0KCmlmICgkI0FSR1YgIT0gMikgewoJcHJpbnQgIlVzYWdlOiAkMCA8dGFyZ2V0IGlwPiA8dXNlcm5hbWU+IDxwYXNzd29yZD5cbiI7CglleGl0IDE7Cn0KCm15ICR0YXJnZXRfaXAgPSAkQVJHVlswXTsKbXkgJHVzZXJuYW1lID0gJEFSR1ZbMV07Cm15ICRwYXNzd29yZCA9ICRBUkdWWzJdOwoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcnVuX3F1ZXJ5ICgkd3FsX3F1ZXJ5KQojIFJ1bnMgdGhlIGdpdmVuIFdRTCBxdWVyeSBhbmQgcmV0dXJucyB0aGUgcmVzdWx0IGFzIGFuIGFycmF5IG9mIGhhc2hlcy4KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKc3ViIHJ1bl9xdWVyeSB7CglteSAkd3FsX3F1ZXJ5ID0gJF9bMF07CglteSBAcmVzdWx0ID0ge307CgoJJHdxbF9xdWVyeSA9fiAncy8iL1wnL2cnOwoKCSMgUnVuIHRoZSBEQ09NL1dNSSBjbGllbnQKCW15ICRvdXRwdXQgPSBgJHdtaV9jbGllbnQgLVUgJyR1c2VybmFtZSclJyRwYXNzd29yZCcgLy8kdGFyZ2V0X2lwIFwiJHdxbF9xdWVyeVwiIDI+L2Rldi9udWxsYDsKCglteSBAbGluZXMgPSBzcGxpdCgvXG4vLCAkb3V0cHV0KTsKCSMgSGVhZGVyLCBkZXNjcmlwdGlvbiwgcmVzdWx0cwoJaWYgKCQjbGluZXMgPCAyKSB7CgkJZXhpdCAxOwoJfQoJIyBEcm9wIHRoZSBoZWFkZXIKCXNoaWZ0IChAbGluZXMpOwoJCQoJIyBHZXQgY29sdW1uIG5hbWVzCglteSBAY29sdW1uX25hbWVzID0gc3BsaXQoL1x8Lywgc2hpZnQgKEBsaW5lcykpOwoKCSMgR2V0IHJvdyBkYXRhCglteSAkaWR4ID0gMDsKCWZvciAobXkgJGkgPSAwOyAkaSA8PSAkI2xpbmVzOyAkaSsrKSB7CgkJIyBDaGVjayBmb3IgZXJyb3JzCgkJaWYgKCRsaW5lc1skaV0gPX4gbS9eRVJST1IvKSB7CgkJCWV4aXQgMTsKCQl9CgoJCSMgQmxhY2sgbGlzdAoJCWlmICgkbGluZXNbJGldID1+IG0vRmlsZSAxLykgewoJCQluZXh0OwoJCX0KCQlteSBAY29sdW1uID0gc3BsaXQoL1x8LywgJGxpbmVzWyRpXSk7CgkJZm9yIChteSAkaiA9IDA7ICRqIDw9ICQjY29sdW1uX25hbWVzOyAkaisrKSB7CgkJCWlmICghIGRlZmluZWQoJGNvbHVtblskal0pKSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gIiI7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0WyRpZHhdLT57JGNvbHVtbl9uYW1lc1skal19ID0gJGNvbHVtblskal07CgkJCX0KCQl9CgkJCgkJJGlkeCsrOwoJfQoJCglyZXR1cm4gQHJlc3VsdDsKfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBTVUIgcHJpbnRfbW9kdWxlZGF0YSAoJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEsIAojICRtb2R1bGVfZGVzY3JpcHRpb24sIEBkYXRhKQojIFByaW50cyBhIG1vZHVsZWRhdGEgWE1MIHRhZy4gJG1vZHVsZV9pdGVtLCAkbW9kdWxlX2RhdGEgYW5kCiMgJG1vZHVsZV9kZXNjcmlwdGlvbiBhcmUgdXNlZCB0byBpbmRleCB0aGUgaXRlbSwgZGF0YSBhbmQgZGVzY3JpcHRpb24KIyBYTUwgdGFncyByZXNwZWN0aXZlbHkuCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCnN1YiBwcmludF9tb2R1bGVkYXRhIHsKCW15IEBtb2R1bGVfaGVhZGVycyA9IEB7JF9bMF19OwoJbXkgQG1vZHVsZV91bml0cyAgID0gQHskX1sxXX07CglteSBAZGF0YSAgICAgICAgICAgPSBAeyRfWzJdfTsKCW15ICRyZXN1bHQ7Cglmb3JlYWNoIG15ICRlbGVtZW50IChAZGF0YSkgewoJCSRyZXN1bHQgPSAnJzsKCQlmb3IgKCRpPTA7ICRpPEBtb2R1bGVfaGVhZGVyczskaSsrKSB7CgkJCWlmIChkZWZpbmVkICgkZWxlbWVudC0+eyRtb2R1bGVfaGVhZGVyc1skaV19KSkgewoJCQkJJHJlc3VsdCAuPSAkZWxlbWVudC0+eyRtb2R1bGVfaGVhZGVyc1skaV19IC4gJG1vZHVsZV91bml0c1skaV0gLiAnOyc7CgkJCX0KCQkJZWxzZSB7CgkJCQkkcmVzdWx0IC49ICc7JzsKCQkJfQoJCX0KCQljaG9wKCRyZXN1bHQpOwoJCXByaW50ICRyZXN1bHQgLiAiXG4iOwkKCX0KfQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBNYWluCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCgpteSBAcmVzdWx0ICA9IHJ1bl9xdWVyeSgiU2VsZWN0IFNlcmlhbE51bWJlciBmcm9tIFdpbjMyX09wZXJhdGluZ1N5c3RlbSIpOwojIFJlbWVtYmVyIHRvIG1hdGNoIGxlbmdodCBvZiBib3RoIGFycmF5cyBoZWFkZXJzICYgdW5pdHMKbXkgQGhlYWRlcnMgPSAoIlNlcmlhbE51bWJlciIpOwpteSBAdW5pdHMgICA9ICgiIik7CnByaW50X21vZHVsZWRhdGEgKFxAaGVhZGVycyxcQHVuaXRzLCBcQHJlc3VsdCk7CmV4aXQgMDsKCg==',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (37,2,'CPU','CPU','','Brand;Clock;Model','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (38,2,'RAM','RAM','','Size','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (39,2,'NIC','NIC','','NIC;Mac;Speed','',0,2);
INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (40,2,'Software','Software','','PKGINST;VERSION;NAME','',0,2);


-- Categoria field is used to segregate several types
-- (plugin, agents, network) on their data
-- types, could be used or could be avoided and use directly primary key (id_tipo) 

--
-- Dumping data for table `tusuario`
--
INSERT INTO `tusuario` (`id_user`, `fullname`, `firstname`, `lastname`, `middlename`, `password`, `comments`, `last_connect`, `registered`, `email`, `phone`, `is_admin`, `language`, `block_size`, `section`, `data_section`, `metaconsole_access`, `local_user`, `api_token`) VALUES
('admin', 'Pandora', 'Pandora', 'Admin', '', '$2y$10$Wv/xoxjI2VAkthJhk/PzeeGIhBKYU/K.TMgUdmW7fEP2NQkdWlB9K', 'Admin Pandora', 1232642121, 0, 'admin@example.com', '555-555-5555', 1, 'default', 0, 'Default', '', 'advanced', 1, 'pandora1234');

--
-- Dumping data for table `tusuario_perfil`
--

INSERT INTO `tusuario_perfil` (`id_up`, `id_usuario`, `id_perfil`, `id_grupo`, `assigned_by`, `id_policy`, `tags`) VALUES (1,'admin',5,0,'admin',0,'');

--
-- Dumping data for table `tperfil`
--

INSERT INTO `tperfil` VALUES 
	(1,'Operator&#x20;&#40;Read&#41;',1,0,0,0,0,0,0,1,0,0,1,0,0,0,1,0,0,1,0,0,0,0,0),
	(2,'Operator&#x20;&#40;Write&#41;',1,0,0,0,0,0,0,1,1,0,1,1,0,0,1,1,0,1,1,0,0,0,0),
	(3,'Chief&#x20;Operator',1,0,0,0,0,0,0,1,1,1,1,1,0,1,1,1,1,1,1,1,0,0,0),
	(4,'Group&#x20;coordinator',1,1,1,1,0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0),
	(5,'Pandora&#x20;Administrator',1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1);

--
-- Dumping data for table `tnews`
--

INSERT INTO `tnews` (`id_news`, `author`, `subject`, `text`, `timestamp`) VALUES (1,'admin','Welcome&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console', '&amp;lt;p&#x20;style=&quot;text-align:&#x20;center;&#x20;font-size:&#x20;13px;&quot;&amp;gt;Hello,&#x20;congratulations,&#x20;if&#x20;you&apos;ve&#x20;arrived&#x20;here&#x20;you&#x20;already&#x20;have&#x20;an&#x20;operational&#x20;monitoring&#x20;console.&#x20;Remember&#x20;that&#x20;our&#x20;forums&#x20;and&#x20;online&#x20;documentation&#x20;are&#x20;available&#x20;24x7&#x20;to&#x20;get&#x20;you&#x20;out&#x20;of&#x20;any&#x20;trouble.&#x20;You&#x20;can&#x20;replace&#x20;this&#x20;message&#x20;with&#x20;a&#x20;personalized&#x20;one&#x20;at&#x20;Admin&#x20;tools&#x20;-&amp;amp;gt;&#x20;Site&#x20;news.&amp;lt;/p&amp;gt;&#x20;',NOW());

INSERT INTO tmodule VALUES (1,'Agent&#x20;module');
INSERT INTO tmodule VALUES (2,'Network&#x20;module');
INSERT INTO tmodule VALUES (4,'Plugin&#x20;module');
INSERT INTO tmodule VALUES (5,'Prediction&#x20;module');
INSERT INTO tmodule VALUES (6,'WMI&#x20;module');
INSERT INTO tmodule VALUES (7, 'Web&#x20;module');
INSERT INTO tmodule VALUES (8, 'Wux&#x20;module');
INSERT INTO tmodule	VALUES (9, 'Wizard&#x20;module');


INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (1,'OS&#x20;Total&#x20;process','Total&#x20;process&#x20;in&#x20;Operating&#x20;System&#x20;&#40;UNIX&#x20;MIB&#41;',13,15,0,0,300,0,'','','public','HOST-RESOURCES-MIB::hrSystemProcesses.0 ',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (2,'OS&#x20;CPU&#x20;Load&#x20;&#40;1&#x20;min&#41;','CPU&#x20;Load&#x20;in&#x20;Operating&#x20;System&#x20;&#40;UNIX&#x20;MIB&#41;',13,15,0,0,300,0,'','','public','UCD-SNMP-MIB::laLoad.1',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (3,'Sysname','Get&#x20;name&#x20;of&#x20;system&#x20;using&#x20;SNMP&#x20;standard&#x20;MIB',1,17,0,0,900,0,'','','public','.1.3.6.1.2.1.1.1.0',1,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (4,'OS&#x20;Users','Active&#x20;users&#x20;in&#x20;Operating&#x20;System&#x20;&#40;UNIX&#x20;MIB&#41;',13,15,0,0,300,0,'','','public','HOST-RESOURCES-MIB::hrSystemNumUsers.0',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (11,'Catalyst&#x20;CPU&#x20;Usage&#x20;&#40;5min&#41;','Cisco&#x20;Catayst&#x20;Switches&#x20;CPU&#x20;Usage.&#x20;Taken&#x20;from&#x20;ftp://ftp.cisco.com/pub/mibs/oid/OLD-CISCO-CPU-MIB.oid',2,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.2.1.58',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (22,'HSRP&#x20;Status','Get&#x20;status&#x20;of&#x20;HSRP',2,18,0,0,300,0,'','','public','1.3.6.1.4.1.9.9.106.1.2.1.1.15.12.106',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (24,'ifOperStatus_if1','Status&#x20;of&#x20;NIC#1',10,18,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.8.1',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (25,'ifOperStatus_if2','Status&#x20;of&#x20;NIC&#x20;#2',10,18,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.8.2',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (26,'ifOperStatus_if3','Status&#x20;of&#x20;NIC&#x20;#3',10,18,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.8.3',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (27,'ifOutOctets_if1','Output&#x20;throughtput&#x20;on&#x20;Interface&#x20;#1',10,16,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.16.1',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'bytes/sec','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (28,'ifOutOctets_if2','Output&#x20;troughtput&#x20;on&#x20;interface&#x20;#2',10,16,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.16.2',1,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'bytes/sec','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (29,'ifOutOctets_if3','Output&#x20;troughtput&#x20;on&#x20;Interface&#x20;#3',10,16,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.16.3',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'bytes/sec','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (30,'ifInOctets_if1','Input&#x20;troughtput&#x20;on&#x20;Interface&#x20;#1',10,16,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.10.1',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'bytes/sec','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (31,'ifInOctets_if2','Input&#x20;throughtput&#x20;for&#x20;interface&#x20;#2',10,16,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.10.2',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'bytes/sec','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (32,'ifInOctets_if3','Input&#x20;throught&#x20;on&#x20;interface&#x20;#3',10,16,0,0,300,0,'1','','public','.1.3.6.1.2.1.2.2.1.10.3',2,2,0,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.00000,'bytes/sec','basic','','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (34,'Host&#x20;Alive','Check&#x20;if&#x20;host&#x20;is&#x20;alive&#x20;using&#x20;ICMP&#x20;ping&#x20;check.',10,6,0,0,300,0,'','','','',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (36,'Host&#x20;Latency','Get&#x20;host&#x20;network&#x20;latency&#x20;in&#x20;miliseconds,&#x20;using&#x20;ICMP.',10,7,0,0,300,0,'','','','',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (37,'Check&#x20;HTTP&#x20;Server','Test&#x20;APACHE2&#x20;HTTP&#x20;service&#x20;remotely&#x20;&#40;Protocol&#x20;response,&#x20;not&#x20;only&#x20;openport&#41;',10,9,0,0,300,80,'GET / HTTP/1.0^M^M','HTTP/1.1 200 OK','','',3,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (38,'Check&#x20;FTP&#x20;Server','Check&#x20;FTP&#x20;protocol,&#x20;not&#x20;only&#x20;check&#x20;port.',10,9,0,0,300,21,'QUIT','220','','',3,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (39,'Check&#x20;SSH&#x20;Server','Checks&#x20;port&#x20;22&#x20;is&#x20;opened',10,9,0,0,300,22,'','','','',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (40,'Check&#x20;Telnet&#x20;server','Check&#x20;telnet&#x20;port',10,9,0,0,300,23,'','','','',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (41,'Check&#x20;SMTP&#x20;server','Check&#x20;if&#x20;SMTP&#x20;port&#x20;it&#039;s&#x20;open',10,9,0,0,300,25,'','','','',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (42,'Check&#x20;POP3&#x20;server','Check&#x20;POP3&#x20;port.',10,9,0,0,300,110,'','','','',2,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (49,'OS&#x20;CPU&#x20;Load&#x20;&#40;5&#x20;min&#41;','CPU&#x20;load&#x20;on&#x20;a&#x20;5&#x20;min&#x20;average&#x20;interval.&#x20;UCD-SNMP&#x20;Mib&#x20;&#40;Usually&#x20;for&#x20;all&#x20;Linux&#x20;and&#x20;some&#x20;UNIX&#41;',13,15,0,0,300,0,'','','public','UCD-SNMP-MIB::laLoad.2',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (50,'System&#x20;Description','Get&#x20;system&#x20;description&#x20;&#40;all&#x20;mibs&#41;.',1,17,0,0,9000,0,'','','public','SNMPv2-MIB::sysDescr.0',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (51,'OS&#x20;Raw&#x20;Interrupts','Get&#x20;system&#x20;raw&#x20;interrupts&#x20;from&#x20;SO',13,16,0,0,300,0,'','','public','UCD-SNMP-MIB::ssRawInterrupts.0',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (52,'OS&#x20;IO&#x20;Signals&#x20;sent','IO&#x20;Signals&#x20;sent&#x20;by&#x20;Kernel',13,16,0,0,300,0,'','','public','UCD-SNMP-MIB::ssIOSent.0',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (53,'System&#x20;Uptime','Sistem&#x20;uptime&#x20;in&#x20;timeticks',1,15,0,0,3600,0,'','','public','.1.3.6.1.2.1.1.3.0',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.000000115740741,'days','basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (176,'Catalyst&#x20;Free&#x20;Mem','Taken&#x20;from&#x20;ftp://ftp.cisco.com/pub/mibs/oid/OLD-CISCO-MEMORY-MIB.oid',2,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.2.1.8',4,2,0,NULL,NULL,NULL,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (200,'CPU&#x20;load','CPU0&#x20;load&#x20;average',16,1,100,0,300,0,'','','','SELECT&#x20;LoadPercentage&#x20;from&#x20;Win32_Processor&#x20;WHERE&#x20;DeviceID&#x20;=&#x20;&quot;CPU0&quot;',1,6,0,'Administrator','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (201,'Free&#x20;RAM','Available&#x20;RAM&#x20;memory&#x20;in&#x20;bytes',16,1,0,0,300,0,'','','','SELECT&#x20;AvailableBytes&#x20;from&#x20;Win32_PerfRawData_PerfOS_Memory',1,6,0,'Administrator',NULL,NULL,10,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (202,'Windows&#x20;version','Operating&#x20;system&#x20;version',16,3,0,0,300,0,'','','','SELECT&#x20;Caption&#x20;FROM&#x20;Win32_OperatingSystem',1,6,0,'Administrator',NULL,NULL,10,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (203,'Free&#x20;RAM','Available&#x20;RAM&#x20;memory&#x20;in&#x20;bytes',16,1,0,0,300,0,'','','','SELECT&#x20;AvailableBytes&#x20;from&#x20;Win32_PerfRawData_PerfOS_Memory',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (204,'Hostname','The&#x20;hostname&#x20;of&#x20;the&#x20;machine.',16,3,0,0,300,0,'','','','SELECT&#x20;DNSHostName&#x20;FROM&#x20;Win32_ComputerSystem',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (205,'Computer&#x20;number&#x20;of&#x20;CPUs','Displays&#x20;the&#x20;number&#x20;of&#x20;CPUs&#x20;present&#x20;in&#x20;the&#x20;system',17,1,0,0,300,0,'','','','SELECT&#x20;NumberOfProcessors&#x20;FROM&#x20;Win32_ComputerSystem',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (206,'Server&#x20;Domain','Display&#x20;the&#x20;Domain&#x20;the&#x20;machine&#x20;belongs&#x20;to.',16,3,0,0,300,0,'','','','SELECT&#x20;Domain&#x20;FROM&#x20;Win32_ComputerSystem',2,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (207,'Number&#x20;of&#x20;Processes','Displays&#x20;the&#x20;number&#x20;of&#x20;processes&#x20;running&#x20;in&#x20;the&#x20;system',16,1,0,0,300,0,'','','','SELECT&#x20;NumberOfProcesses&#x20;FROM&#x20;Win32_OperatingSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (208,'Serial&#x20;Number','Serial&#x20;Number&#x20;of&#x20;the&#x20;machine',16,3,0,0,300,0,'','','','SELECT&#x20;SerialNumber&#x20;FROM&#x20;Win32_OperatingSystem',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (209,'CPU&#x20;Model','Displays&#x20;the&#x20;CPU&#x20;model',17,3,0,0,300,0,'','','','SELECT&#x20;Name&#x20;FROM&#x20;Win32_Processor',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (210,'Service&#x20;Pack','Service&#x20;Pack&#x20;Version&#x20;Installed',16,1,0,0,300,0,'','','','SELECT&#x20;ServicePackMajorVersion&#x20;FROM&#x20;Win32_OperatingSystem',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (211,'Free&#x20;Physical&#x20;Memory','Displays&#x20;the&#x20;amount&#x20;of&#x20;free&#x20;physical&#x20;memory&#x20;in&#x20;the&#x20;system',16,1,0,0,300,0,'','','','SELECT&#x20;FreePhysicalMemory&#x20;FROM&#x20;Win32_OperatingSystem',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (212,'Free&#x20;Virtual&#x20;Memory','Displays&#x20;the&#x20;amount&#x20;of&#x20;free&#x20;virtual&#x20;memory&#x20;in&#x20;the&#x20;system',16,1,0,0,300,0,'','','','SELECT&#x20;FreeVirtualMemory&#x20;FROM&#x20;Win32_OperatingSystem',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (213,'License&#x20;Activation','This&#x20;module&#x20;lets&#x20;you&#x20;know&#x20;whether&#x20;you&#x20;have&#x20;to&#x20;activate&#x20;your&#x20;Windows&#x20;license&#x20;or&#x20;not.\r\n\r\n0&#x20;=&#x20;No\r\n1=&#x20;Yes',16,2,0,0,300,0,'','','','SELECT&#x20;ActivationRequired&#x20;FROM&#x20;Win32_WindowsProductActivation',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (214,'Total&#x20;Swap&#x20;Space&#x20;Size','Total&#x20;Swap&#x20;Space&#x20;Size',16,1,0,0,300,0,'','','','SELECT&#x20;TotalSwapSpaceSize&#x20;from&#x20;win32_operatingsystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (215,'Total&#x20;Virtual&#x20;Memory&#x20;Size','Total&#x20;Virtual&#x20;Memory&#x20;Size',16,1,0,0,300,0,'','','','select&#x20;TotalVirtualMemorySize&#x20;from&#x20;win32_operatingsystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (216,'Total&#x20;Visible&#x20;Memory&#x20;Size','Total&#x20;Visible&#x20;Memory&#x20;Size',16,1,0,0,300,0,'','','','SELECT&#x20;TotalVisibleMemorySize&#x20;from&#x20;win32_operatingsystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (217,'Free&#x20;Space&#x20;In&#x20;Paging&#x20;Files','Gets&#x20;the&#x20;free&#x20;space&#x20;in&#x20;paging&#x20;files',16,1,0,0,300,0,'','','','Select&#x20;FreeSpaceInPagingFiles&#x20;from&#x20;Win32_operatingsystem',4,6,0,'none','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (218,'Free&#x20;Space&#x20;In&#x20;Paging&#x20;Files','Gets&#x20;the&#x20;free&#x20;space&#x20;in&#x20;paging&#x20;files',16,1,0,0,300,0,'','','','Select&#x20;FreeSpaceInPagingFiles&#x20;from&#x20;Win32_operatingsystem',4,6,0,'none','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (219,'Number&#x20;of&#x20;Users','Displays&#x20;the&#x20;number&#x20;of&#x20;users',16,1,0,0,300,0,'','','','SELECT&#x20;NumberOfUsers&#x20;FROM&#x20;Win32_operatingsystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (220,'Last&#x20;BootUp&#x20;Time','Displays&#x20;the&#x20;Last&#x20;BootUp&#x20;Time',16,3,0,0,300,0,'','','','SELECT&#x20;LastBootUpTime&#x20;FROM&#x20;Win32_operatingsystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (221,'BIOS&#x20;Name','Displays&#x20;the&#x20;BIOS&#x20;Name',17,3,0,0,300,0,'','','','SELECT&#x20;BiosCharacteristics&#x20;FROM&#x20;Win32_BIOS',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (222,'BIOS&#x20;Version','Displays&#x20;the&#x20;BIOS&#x20;version',17,3,0,0,300,0,'','','','SELECT&#x20;BIOSVersion&#x20;FROM&#x20;Win32_BIOS',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (223,'BIOS&#x20;Manufacturer','Displays&#x20;the&#x20;BIOS&#x20;Manufacturer',17,3,0,0,300,0,'','','','SELECT&#x20;Manufacturer&#x20;FROM&#x20;Win32_BIOS',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (224,'BIOS&#x20;Status','Displays&#x20;the&#x20;BIOS&#x20;Status',17,3,0,0,300,0,'','','','SELECT&#x20;Status&#x20;FROM&#x20;Win32_BIOS',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (225,'BIOS&#x20;Serial&#x20;Number','Displays&#x20;the&#x20;BIOS&#x20;Serial&#x20;Number',17,3,0,0,300,0,'','','','SELECT&#x20;SerialNumber&#x20;FROM&#x20;Win32_BIOS',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (226,'Windows&#x20;Temp&#x20;Directory','Path&#x20;of&#x20;the&#x20;Windows&#x20;Temp&#x20;Directory',16,3,0,0,300,0,'','','','SELECT&#x20;TempDirectory&#x20;FROM&#x20;Win32_BootConfiguration',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (227,'Windows&#x20;Admin&#x20;Password&#x20;Status','Status&#x20;of&#x20;the&#x20;Windows&#x20;Admin&#x20;password:&#x20;1&#x20;is&#x20;set.',16,2,0,0,300,0,'','','','SELECT&#x20;AdminPasswordStatus&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (228,'Computer&#x20;System&#x20;Description','Displays&#x20;the&#x20;computer&#x20;System&#x20;description',17,3,0,0,300,0,'','','','SELECT&#x20;Description&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (230,'Computer&#x20;Automatic&#x20;Reset&#x20;Boot&#x20;Option','Displays&#x20;the&#x20;computer&#x20;Automatic&#x20;reset&#x20;boot&#x20;option',17,3,0,0,300,0,'','','','SELECT&#x20;AutomaticResetBootOption&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (231,'Computer&#x20;Automatic&#x20;Reset&#x20;Capability','Displays&#x20;the&#x20;computer&#x20;automatic&#x20;reset&#x20;capability',17,3,0,0,300,0,'','','','SELECT&#x20;AutomaticResetCapability&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (232,'Computer&#x20;Boot&#x20;Option&#x20;On&#x20;Limit','Displays&#x20;the&#x20;computer&#x20;Boot&#x20;Option&#x20;on&#x20;Limit',17,1,0,0,300,0,'','','','SELECT&#x20;BootOptionOnLimit&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (233,'Computer&#x20;Boot&#x20;Option&#x20;On&#x20;Watch&#x20;Dog','Displays&#x20;the&#x20;Computer&#x20;Boot&#x20;Option&#x20;On&#x20;Watch&#x20;Dog',17,1,0,0,300,0,'','','','SELECT&#x20;BootOptionOnWatchDog&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (234,'Computer&#x20;Boot&#x20;ROM&#x20;Supported','Displays&#x20;if&#x20;the&#x20;computer&#x20;Boot&#x20;ROM&#x20;is&#x20;supported',17,3,0,0,300,0,'','','','SELECT&#x20;BootROMSupported&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (235,'Computer&#x20;Bootup&#x20;State','Displays&#x20;the&#x20;computer&#x20;Bootup&#x20;State',17,3,0,0,300,0,'','','','SELECT&#x20;BootupState&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (236,'Computer&#x20;Chassis&#x20;Bootup&#x20;State','Displays&#x20;the&#x20;computer&#x20;Chassis&#x20;Bootup&#x20;State',16,1,0,0,300,0,'','','','SELECT&#x20;ChassisBootupState&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (237,'Computer&#x20;Daylight&#x20;In&#x20;Effect','Displays&#x20;whether&#x20;the&#x20;computer&#x20;Daylight&#x20;In&#x20;Effect&#x20;is&#x20;enabler&#x20;or&#x20;not',16,3,0,0,300,0,'','','','SELECT&#x20;DaylightInEffect&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (238,'Computer&#x20;DNS&#x20;Host&#x20;Name','Displays&#x20;the&#x20;DNS&#x20;Host&#x20;Name',16,3,0,0,300,0,'','','','SELECT&#x20;DNSHostName&#x20;FROM&#x20;Win32_ComputerSystem',2,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (239,'Computer&#x20;Domain','Displays&#x20;the&#x20;computer&#x20;Domain',16,3,0,0,300,0,'','','','SELECT&#x20;Domain&#x20;FROM&#x20;Win32_ComputerSystem',2,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (240,'Computer&#x20;Domain&#x20;Role','Displays&#x20;the&#x20;computer&#x20;Domain&#x20;Role',16,1,0,0,300,0,'','','','SELECT&#x20;DomainRole&#x20;FROM&#x20;Win32_ComputerSystem',2,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (241,'Computer&#x20;Enable&#x20;Daylight&#x20;Savings&#x20;Time','Displays&#x20;whether&#x20;the&#x20;computer&#x20;Daylight&#x20;Savings&#x20;Time&#x20;is&#x20;enabled',16,3,0,0,300,0,'','','','SELECT&#x20;EnableDaylightSavingsTime&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (242,'Computer&#x20;Front&#x20;Panel&#x20;Reset&#x20;Status','Displays&#x20;the&#x20;computer&#x20;Front&#x20;Panel&#x20;Reset&#x20;Status',16,1,0,0,300,0,'','','','SELECT&#x20;FrontPanelResetStatus&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (243,'Computer&#x20;Infrared&#x20;Support','Displays&#x20;the&#x20;computer&#x20;Infrared&#x20;Support',16,3,0,0,300,0,'','','','SELECT&#x20;InfraredSupported&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (244,'Computer&#x20;Initial&#x20;Load&#x20;Info','Displays&#x20;the&#x20;computer&#x20;Initial&#x20;Load&#x20;Info',16,3,0,0,300,0,'','','','SELECT&#x20;InitialLoadInfo&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (245,'Computer&#x20;Install&#x20;Date','Displays&#x20;the&#x20;computer&#x20;install&#x20;date',16,3,0,0,300,0,'','','','SELECT&#x20;InstallDate&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (246,'Computer&#x20;Keyboard&#x20;Password&#x20;Status','Displays&#x20;the&#x20;computer&#x20;keyboard&#x20;password&#x20;status',16,1,0,0,300,0,'','','','SELECT&#x20;KeyboardPasswordStatus&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (247,'Computer&#x20;Last&#x20;Load&#x20;Info','Displays&#x20;the&#x20;computer&#x20;last&#x20;load&#x20;info',16,3,0,0,300,0,'','','','SELECT&#x20;LastLoadInfo&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (248,'Computer&#x20;Manufacturer','Displays&#x20;the&#x20;computer&#x20;manufacturer',16,3,0,0,300,0,'','','','SELECT&#x20;Manufacturer&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (249,'Computer&#x20;Model','Displays&#x20;the&#x20;computer&#x20;model',17,3,0,0,300,0,'','','','SELECT&#x20;Model&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (250,'Computer&#x20;Name','Displays&#x20;the&#x20;computer&#x20;name',16,3,0,0,300,0,'','','','SELECT&#x20;Name&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (251,'Computer&#x20;Network&#x20;Server&#x20;Mode&#x20;Enabled','Displays&#x20;the&#x20;computer&#x20;Network&#x20;Server&#x20;Mode&#x20;Enabled',16,3,0,0,300,0,'','','','SELECT&#x20;NetworkServerModeEnabled&#x20;FROM&#x20;Win32_ComputerSystem',2,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (252,'Computer&#x20;Part&#x20;of&#x20;Domain','Displays&#x20;the&#x20;computer&#x20;Part&#x20;of&#x20;Domain',16,3,0,0,300,0,'','','','SELECT&#x20;PartOfDomain&#x20;FROM&#x20;Win32_ComputerSystem',2,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (253,'Computer&#x20;Pause&#x20;After&#x20;Reset','Displays&#x20;the&#x20;computer&#x20;Pause&#x20;After&#x20;Reset',17,1,0,0,300,0,'','','','SELECT&#x20;PauseAfterReset&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (254,'Computer&#x20;Power&#x20;Management&#x20;Capabilities','Displays&#x20;the&#x20;computer&#x20;Power&#x20;Management&#x20;Capabilities',17,3,0,0,300,0,'','','','SELECT&#x20;PowerManagementCapabilities&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (255,'Computer&#x20;Power&#x20;Management&#x20;Support','Displays&#x20;the&#x20;computer&#x20;Power&#x20;Management&#x20;Support',17,3,0,0,300,0,'','','','SELECT&#x20;PowerManagementSupported&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (256,'Computer&#x20;Power&#x20;on&#x20;Password&#x20;Status','Displays&#x20;the&#x20;computer&#x20;Power&#x20;on&#x20;Password&#x20;Status',17,2,0,0,300,0,'','','','SELECT&#x20;PowerOnPasswordStatus&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (257,'Computer&#x20;Power&#x20;State','Displays&#x20;the&#x20;computer&#x20;Power&#x20;State',17,2,0,0,300,0,'','','','SELECT&#x20;PowerState&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (258,'Computer&#x20;Power&#x20;Supply&#x20;State','Displays&#x20;the&#x20;computer&#x20;Power&#x20;Supply&#x20;State',17,1,0,0,300,0,'','','','SELECT&#x20;PowerSupplyState&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (259,'Computer&#x20;Reset&#x20;Capability','Displays&#x20;the&#x20;computer&#x20;Reset&#x20;Capability',16,1,0,0,300,0,'','','','SELECT&#x20;ResetCapability&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (260,'Computer&#x20;Reset&#x20;Count','Displays&#x20;the&#x20;computer&#x20;Reset&#x20;Count',16,1,0,0,300,0,'','','','SELECT&#x20;ResetCount&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (261,'Computer&#x20;Reset&#x20;Limit','Displays&#x20;the&#x20;computer&#x20;Reset&#x20;Limit',16,1,0,0,300,0,'','','','SELECT&#x20;ResetLimit&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (262,'Computer&#x20;Roles','Displays&#x20;the&#x20;computer&#x20;Roles',16,3,0,0,300,0,'','','','SELECT&#x20;Roles&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (263,'Computer&#x20;Status','Displays&#x20;the&#x20;computer&#x20;Status',16,3,0,0,300,0,'','','','SELECT&#x20;Status&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (264,'Computer&#x20;System&#x20;Startup&#x20;Delay','Displays&#x20;the&#x20;computer&#x20;System&#x20;Startup&#x20;Delay',16,1,0,0,300,0,'','','','SELECT&#x20;SystemStartupDelay&#x20;FROM&#x20;Win32_ComputerSystem',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (265,'Computer&#x20;System&#x20;Startup&#x20;Options','Displays&#x20;the&#x20;computer&#x20;System&#x20;Startup&#x20;Options',16,3,0,0,300,0,'','','','SELECT&#x20;SystemStartupOptions&#x20;FROM&#x20;Win32_ComputerSystem',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (266,'Exchange&#x20;VMLargestBlockSize&#x20;key','The&#x20;VMLargestBlockSize&#x20;key&#x20;represents&#x20;the&#x20;size&#x20;&#40;in&#x20;bytes&#41;&#x20;of&#x20;the&#x20;largest&#x20;available&#x20;block&#x20;of&#x20;virtual&#x20;memory',20,1,0,0,300,0,'','','','SELECT&#x20;VMLargestBlockSize&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (267,'Exchange&#x20;VMTotalLargeFreeBlockBytes','The&#x20;VMTotalFreeBlocks&#x20;key&#x20;represents&#x20;the&#x20;size&#x20;&#40;in&#x20;bytes&#41;&#x20;of&#x20;the&#x20;total&#x20;largest&#x20;free&#x20;available&#x20;block&#x20;of&#x20;virtual&#x20;memory',20,1,0,0,300,0,'','','','SELECT&#x20;VMTotalLargeFreeBlockBytes&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (268,'Exchange&#x20;VMTotalFreeBlocks','The&#x20;VMTotalFreeBlocks&#x20;key&#x20;represents&#x20;the&#x20;size&#x20;&#40;in&#x20;bytes&#41;&#x20;of&#x20;the&#x20;Total&#x20;Free&#x20;Available&#x20;blocks&#x20;of&#x20;virtual&#x20;memory',20,1,0,0,300,0,'','','','SELECT&#x20;VMTotalFreeBlocks&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (269,'Exchange&#x20;TotalMessagesScannedforUCE','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter.&#x20;If&#x20;this&#x20;number&#x20;is&#x20;0&#x20;or&#x20;very&#x20;low,&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;might&#x20;not&#x',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesScannedforUCE&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (270,'Exchange&#x20;TotalUCEMessagesActedUpon','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;that&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;has&#x20;identified&#x20;as&#x20;UCE&#x20;and&#x20;acted&#x20;on&#x20;based&#x20;on&#x20;the&#x20;action&#x20;specified&#x20;by&#x20;an&#x20;adm',20,1,0,0,300,0,'','','','SELECT&#x20;TotalUCEMessagesActedUpon&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (271,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof1','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof1&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (272,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof3','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof3&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (273,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof5','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof5&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (274,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof6','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof6&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (275,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof7','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof7&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (276,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof8','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof8&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (277,'Exchange&#x20;TotalMessagesAssignedanSCLRatingof9','The&#x20;total&#x20;number&#x20;of&#x20;messages&#x20;scanned&#x20;by&#x20;Intelligent&#x20;Message&#x20;Filter&#x20;that&#x20;were&#x20;assigned&#x20;a&#x20;spam&#x20;confidence&#x20;level&#x20;&#40;SCL&#41;&#x20;rating&#x20;of&#x20;x,&#x20;where&#x20;x&#x2',20,1,0,0,300,0,'','','','SELECT&#x20;TotalMessagesAssignedanSCLRatingof9&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeUCF_MSExchangeIntelligentMessageFilter&#x20;Where&#x20;Name=&#039;_Total&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (278,'Exchange&#x20;ClientBackgroundRPCsFailed','Shows&#x20;the&#x20;client-reported&#x20;rate&#x20;of&#x20;failed&#x20;RPCs&#x20;&#40;since&#x20;the&#x20;store&#x20;was&#x20;started&#41;&#x20;due&#x20;to&#x20;the&#x20;Server&#x20;Too&#x20;Busy&#x20;ROC&#x20;error.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientBackgroundRPCsFailed&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (279,'Exchange&#x20;ClientBackgroundRPCssucceeded','The&#x20;count&#x20;of&#x20;succeeded&#x20;RPC&#x20;calls.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientBackgroundRPCssucceeded&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (280,'Exchange&#x20;ClientForegroundRPCssucceeded','The&#x20;number&#x20;of&#x20;RPCs&#x20;that&#x20;Outlook&#x20;successfully&#x20;sent&#x20;to&#x20;the&#x20;server.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientForegroundRPCssucceeded&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (281,'Exchange&#x20;ClientRPCsattempted','The&#x20;number&#x20;of&#x20;remote&#x20;procedure&#x20;calls&#x20;&#40;RPCs&#41;&#x20;that&#x20;Outlook&#x20;tried&#x20;to&#x20;send&#x20;to&#x20;the&#x20;server.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsattempted&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (282,'Exchange&#x20;ClientRPCsFailed','The&#x20;number&#x20;of&#x20;RPCs&#x20;that&#x20;were&#x20;tried&#x20;and&#x20;that&#x20;failed',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailed&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (283,'Exchange&#x20;ClientRPCsFailedAccessDenied','Failed&#x20;RPC&#x20;connections&#x20;with&#x20;a&#x20;Access&#x20;Denied&#x20;error.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailedAccessDenied&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (284,'Exchange&#x20;ClientRPCsFailedAllothererrors','The&#x20;rate&#x20;of&#x20;failed&#x20;RPC&#x20;requests&#x20;&#40;since&#x20;the&#x20;Exchange&#x20;store&#x20;was&#x20;started&#41;&#x20;due&#x20;to&#x20;all&#x20;other&#x20;RPC&#x20;errors.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailedAllothererrors&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (285,'Exchange&#x20;ClientRPCsFailedCallCancelled','RPC&#x20;connections&#x20;that&#x20;got&#x20;cancelled.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailedCallCancelled&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (286,'Exchange&#x20;ClientRPCsFailedCallFailed','RPC&#x20;Failed&#x20;connections&#x20;with&#x20;exit&#x20;code:&#x20;Failed&#x20;Call',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailedCallFailed&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (287,'Exchange&#x20;ClientRPCsFailedServerTooBusy','The&#x20;number&#x20;of&#x20;failed&#x20;RPC&#x20;requests&#x20;&#40;since&#x20;the&#x20;Exchange&#x20;store&#x20;was&#x20;started&#41;&#x20;due&#x20;to&#x20;the&#x20;&quot;Server&#x20;Too&#x20;Busy&quot;&#x20;RPC&#x20;error.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailedServerTooBusy&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (288,'Exchange&#x20;ClientRPCsFailedServerUnavailable','The&#x20;rate&#x20;of&#x20;failed&#x20;RPC&#x20;requests&#x20;&#40;since&#x20;the&#x20;Exchange&#x20;store&#x20;was&#x20;started&#41;&#x20;due&#x20;to&#x20;the&#x20;&quot;Server&#x20;Unavailable&quot;&#x20;RPC&#x20;error.&#x20;',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCsFailedServerUnavailable&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (289,'Exchange&#x20;ClientRPCssucceeded','The&#x20;rate&#x20;of&#x20;successful&#x20;RPC&#x20;requests.',20,1,0,0,300,0,'','','','SELECT&#x20;ClientRPCssucceeded&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (290,'Exchange&#x20;RPCRequests','Rate&#x20;of&#x20;RPC&#x20;requests.',20,1,0,0,300,0,'','','','SELECT&#x20;RPCRequests&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (291,'Exchange&#x20;RPCAveragedLatency','Average&#x20;reported&#x20;latency',20,1,0,0,300,0,'','','','SELECT&#x20;RPCAveragedLatency&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (292,'Exchange&#x20;RPCOperationsPersec','RPC&#x20;operations&#x20;per&#x20;Second',20,1,0,0,300,0,'','','','SELECT&#x20;RPCOperationsPersec&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (293,'Exchange&#x20;RPCRequestsPeak','Peak&#x20;of&#x20;RPC&#x20;requests',20,1,0,0,300,0,'','','','SELECT&#x20;RPCRequestsPeak&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (294,'Exchange&#x20;UserCount','The&#x20;number&#x20;of&#x20;users&#x20;connected&#x20;to&#x20;the&#x20;information&#x20;store',20,1,0,0,300,0,'','','','SELECT&#x20;UserCount&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (295,'Exchange&#x20;ActiveConnectionCount','Number&#x20;of&#x20;connections&#x20;that&#x20;have&#x20;shown&#x20;some&#x20;activity&#x20;in&#x20;the&#x20;last&#x20;10&#x20;minutes.',20,1,0,0,300,0,'','','','SELECT&#x20;ActiveConnectionCount&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (296,'Exchange&#x20;ActiveUserCount','This&#x20;counter&#x20;gives&#x20;the&#x20;number&#x20;of&#x20;unique&#x20;users&#x20;that&#x20;have&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server&#x20;and&#x20;been&#x20;active&#x20;in&#x20;the&#x20;last&#x20;10&#x20;minutes',20,1,0,0,300,0,'','','','SELECT&#x20;ActiveUserCount&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (297,'Exchange&#x20;MaximumConnections','Maximum&#x20;Connections',20,1,0,0,300,0,'','','','SELECT&#x20;MaximumConnections&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (298,'Exchange&#x20;MaximumUsers','Maximum&#x20;number&#x20;of&#x20;Users.',20,1,0,0,300,0,'','','','SELECT&#x20;MaximumUsers&#x20;FROM&#x20;Win32_PerfRawData_MSExchangeIS_MSExchangeIS',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (299,'AD&#x20;AppMgmt','Status&#x20;of&#x20;the&#x20;AppMgmt&#x20;service.',18,3,0,0,300,0,'','','','SELECT&#x20;name,status,state&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name=&#039;AppMgmt&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (300,'AD&#x20;Dnscache','Status&#x20;of&#x20;the&#x20;Dnscache&#x20;service&#x20;used&#x20;by&#x20;the&#x20;AD.',18,3,0,0,300,0,'','','','SELECT&#x20;name,status,state&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name=&#039;Dnscache&#039;',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (301,'IIS&#x20;CurrentFileCacheMemoryUsage','The&#x20;number&#x20;of&#x20;bytes&#x20;currently&#x20;used&#x20;for&#x20;the&#x20;user-mode&#x20;file&#x20;cache.&#x20;',19,1,0,0,300,0,'','','','select&#x20;CurrentFileCacheMemoryUsage&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (302,'IIS&#x20;ActiveFlushedEntries','The&#x20;number&#x20;of&#x20;user-mode&#x20;cache&#x20;entries&#x20;that&#x20;have&#x20;been&#x20;flushed,&#x20;though&#x20;memory&#x20;is&#x20;still&#x20;allocated&#x20;for&#x20;these&#x20;entries.&#x20;The&#x20;allocated&#x20;memory&#x20;will&#x20;',19,1,0,0,300,0,'','','','select&#x20;ActiveFlushedEntries&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (303,'IIS&#x20;CurrentFilesCached','The&#x20;number&#x20;of&#x20;files&#x20;whose&#x20;content&#x20;is&#x20;currently&#x20;in&#x20;the&#x20;user-mode&#x20;cache.&#x20;',19,1,0,0,300,0,'','','','select&#x20;CurrentFilesCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (304,'IIS&#x20;CurrentMetadataCached','The&#x20;current&#x20;number&#x20;of&#x20;metadata&#x20;information&#x20;blocks&#x20;in&#x20;the&#x20;user-mode&#x20;cache.&#x20;',19,1,0,0,300,0,'','','','select&#x20;CurrentMetadataCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (305,'IIS&#x20;CurrentURIsCached','The&#x20;number&#x20;of&#x20;URI&#x20;information&#x20;blocks&#x20;that&#x20;are&#x20;currently&#x20;stored&#x20;in&#x20;the&#x20;user-mode&#x20;cache.&#x20;',19,1,0,0,300,0,'','','','select&#x20;CurrentURIsCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (306,'IIS&#x20;DescriptionFileCacheFlushes','Description&#x20;of&#x20;the&#x20;number&#x20;of&#x20;files&#x20;that&#x20;have&#x20;been&#x20;removed&#x20;from&#x20;the&#x20;user-mode&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;DescriptionFileCacheFlushes&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (307,'IIS&#x20;FileCacheHits','The&#x20;number&#x20;of&#x20;successful&#x20;lookups&#x20;in&#x20;the&#x20;user-mode&#x20;file&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;FileCacheHits&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (308,'IIS&#x20;FileCacheHitsPercent','The&#x20;ratio&#x20;of&#x20;user-mode&#x20;file&#x20;cache&#x20;hits&#x20;to&#x20;total&#x20;cache&#x20;requests&#x20;that&#x20;have&#x20;been&#x20;made&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started&#x20;up',19,1,0,0,300,0,'','','','select&#x20;FileCacheHitsPercent&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (309,'IIS&#x20;FileCacheHitsPercent_Base','Base&#x20;value&#x20;for&#x20;FileCacheHitsPercent&#x20;used&#x20;to&#x20;calculate&#x20;percentage.',19,1,0,0,300,0,'','','','select&#x20;FileCacheHitsPercent_Base&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (310,'IIS&#x20;FileCacheMisses','The&#x20;number&#x20;of&#x20;unsuccessful&#x20;lookups&#x20;in&#x20;the&#x20;user-mode&#x20;file&#x20;cache&#x20;that&#x20;have&#x20;been&#x20;made&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;FileCacheMisses&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (311,'IIS&#x20;Frequency_Object','Frequency,&#x20;in&#x20;ticks&#x20;per&#x20;second,&#x20;of&#x20;Timestamp_Object.&#x20;This&#x20;property&#x20;is&#x20;defined&#x20;by&#x20;the&#x20;provider',19,1,0,0,300,0,'','','','select&#x20;Frequency_Object&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (312,'IIS&#x20;Frequency_PerfTime','Frequency,&#x20;in&#x20;ticks&#x20;per&#x20;second,&#x20;of&#x20;Timestamp_Perftime',19,1,0,0,300,0,'','','','select&#x20;Frequency_PerfTime&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (313,'IIS&#x20;KernelCurrentURIsCached','The&#x20;number&#x20;of&#x20;URI&#x20;information&#x20;blocks&#x20;currently&#x20;cached&#x20;by&#x20;the&#x20;kernel.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelCurrentURIsCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (314,'IIS&#x20;KernelTotalFlushedURIs','The&#x20;number&#x20;of&#x20;URI&#x20;information&#x20;blocks&#x20;that&#x20;have&#x20;been&#x20;removed&#x20;from&#x20;the&#x20;kernel&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelTotalFlushedURIs&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (315,'IIS&#x20;KernelTotalURIsCached','The&#x20;number&#x20;of&#x20;URI&#x20;information&#x20;blocks&#x20;that&#x20;have&#x20;been&#x20;added&#x20;to&#x20;the&#x20;kernel&#x20;URI&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelTotalURIsCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (316,'IIS&#x20;KernelURICacheFlushes','The&#x20;number&#x20;of&#x20;kernel&#x20;URI&#x20;cache&#x20;flushes&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelURICacheFlushes&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (317,'IIS&#x20;KernelURICacheHits','The&#x20;number&#x20;of&#x20;successful&#x20;lookups&#x20;in&#x20;the&#x20;kernel&#x20;URI&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelURICacheHits&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (318,'IIS&#x20;KernelURICacheHitsPercent','The&#x20;ratio&#x20;of&#x20;Kernel:&#x20;URI&#x20;Cache&#x20;Hits&#x20;to&#x20;total&#x20;cache&#x20;requests&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started',19,1,0,0,300,0,'','','','select&#x20;KernelURICacheHitsPercent&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (319,'IIS&#x20;KernelUriCacheHitsPersec','The&#x20;average&#x20;number&#x20;of&#x20;kernel&#x20;URI&#x20;cache&#x20;hits&#x20;that&#x20;are&#x20;being&#x20;made&#x20;per&#x20;second.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelUriCacheHitsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (320,'Free&#x20;disk','_VOLUME_ID&#x20;is&#x20;your&#x20;volume&#x20;ID,&#x20;for&#x20;example&#x20;&quot;c:&quot;',16,1,0,0,600,0,'','','','SELECT&#x20;FreeSpace&#x20;FROM&#x20;Win32_LogicalDisk&#x20;WHERE&#x20;DeviceID&#x20;=&#x20;_VOLUME_ID_',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (321,'Process&#x20;Status','Return&#x20;status&#x20;of&#x20;Process&#x20;Status&#x20;given&#x20;it&#039;s&#x20;name&#x20;&#40;case&#x20;sensitive!&#41;&#x20;including&#x20;extension.&#x20;Use&#x20;process&#x20;manager&#x20;to&#x20;get&#x20;process&#x20;name.&#x20;Returns&#x20;1&#x20;if',16,2,0,0,300,0,'','','Running','SELECT&#x20;State&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;_Name&#x20;of&#x20;process_&quot;',4,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (322,'IIS&#x20;KernelURICacheMisses','The&#x20;number&#x20;of&#x20;unsuccessful&#x20;lookups&#x20;in&#x20;the&#x20;kernel&#x20;URI&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;KernelURICacheMisses&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (323,'IIS&#x20;MaximumFileCacheMemoryUsage','The&#x20;maximum&#x20;number&#x20;of&#x20;bytes&#x20;that&#x20;have&#x20;been&#x20;used&#x20;for&#x20;the&#x20;user-mode&#x20;file&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;MaximumFileCacheMemoryUsage&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (324,'IIS&#x20;MetadataCacheFlushes','The&#x20;number&#x20;of&#x20;user-mode&#x20;metadata&#x20;cache&#x20;flushes&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.',19,1,0,0,300,0,'','','','select&#x20;MetadataCacheFlushes&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (325,'IIS&#x20;MetadataCacheHits','The&#x20;number&#x20;of&#x20;successful&#x20;lookups&#x20;in&#x20;the&#x20;user-mode&#x20;metadata&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;MetadataCacheHits&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (326,'IIS&#x20;MetadataCacheHitsPercent','The&#x20;ratio&#x20;of&#x20;successful&#x20;lookups&#x20;to&#x20;total&#x20;metadata&#x20;cache&#x20;requests.&#x20;',19,1,0,0,300,0,'','','','select&#x20;MetadataCacheHitsPercent&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (327,'IIS&#x20;MetadataCacheMisses','The&#x20;number&#x20;of&#x20;unsuccessful&#x20;lookups&#x20;in&#x20;the&#x20;user-mode&#x20;metadata&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;MetadataCacheMisses&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (328,'IIS&#x20;TotalFilesCached','The&#x20;number&#x20;of&#x20;files&#x20;whose&#x20;content&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;user-mode&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;TotalFilesCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (329,'IIS&#x20;TotalFlushedFiles','The&#x20;number&#x20;of&#x20;file&#x20;handles&#x20;that&#x20;have&#x20;been&#x20;removed&#x20;from&#x20;the&#x20;user-mode&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;TotalFlushedFiles&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (330,'IIS&#x20;TotalFlushedMetadata','The&#x20;number&#x20;of&#x20;metadata&#x20;information&#x20;blocks&#x20;that&#x20;have&#x20;been&#x20;removed&#x20;from&#x20;the&#x20;user-mode&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;TotalFlushedMetadata&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (331,'IIS&#x20;TotalFlushedURIs','The&#x20;number&#x20;of&#x20;URI&#x20;information&#x20;blocks&#x20;that&#x20;have&#x20;been&#x20;removed&#x20;from&#x20;the&#x20;user-mode&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;TotalFlushedURIs&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (332,'IIS&#x20;TotalMetadataCached','The&#x20;number&#x20;of&#x20;metadata&#x20;information&#x20;blocks&#x20;that&#x20;have&#x20;been&#x20;added&#x20;to&#x20;the&#x20;user-mode&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;TotalMetadataCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (333,'IIS&#x20;TotalURIsCached','The&#x20;number&#x20;of&#x20;URI&#x20;information&#x20;blocks&#x20;that&#x20;have&#x20;been&#x20;added&#x20;to&#x20;the&#x20;kernel&#x20;URI&#x20;cache&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;TotalURIsCached&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (334,'IIS&#x20;URICacheFlushes','The&#x20;number&#x20;of&#x20;kernel&#x20;URI&#x20;cache&#x20;flushes&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;URICacheFlushes&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (335,'IIS&#x20;URICacheHits','The&#x20;number&#x20;of&#x20;successful&#x20;lookups&#x20;in&#x20;the&#x20;kernel&#x20;URI&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;URICacheHits&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (336,'IIS&#x20;URICacheHitsPercent','The&#x20;ratio&#x20;of&#x20;Kernel:&#x20;URI&#x20;Cache&#x20;Hits&#x20;to&#x20;total&#x20;cache&#x20;requests&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;URICacheHitsPercent&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (337,'IIS&#x20;URICacheMisses','The&#x20;number&#x20;of&#x20;unsuccessful&#x20;lookups&#x20;in&#x20;the&#x20;kernel&#x20;URI&#x20;cache&#x20;that&#x20;have&#x20;occurred&#x20;since&#x20;the&#x20;WWW&#x20;service&#x20;started.&#x20;',19,1,0,0,300,0,'','','','select&#x20;URICacheMisses&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebServiceCache',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (338,'IIS&#x20;AnonymousUsersPersec','Rate&#x20;at&#x20;which&#x20;users&#x20;are&#x20;making&#x20;anonymous&#x20;connections&#x20;using&#x20;the&#x20;Web&#x20;service.&#x20;&#40;the&#x20;value&#x20;given&#x20;is&#x20;the&#x20;total&#x20;users&#41;',19,1,0,0,300,0,'','','','select&#x20;AnonymousUsersPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (339,'IIS&#x20;BytesReceivedPersec','Total&#x20;bytes&#x20;received&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;BytesReceivedPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (340,'IIS&#x20;BytesSentPersec','Total&#x20;bytes&#x20;sent&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;BytesSentPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (341,'IIS&#x20;BytesTotalPersec','This&#x20;is&#x20;the&#x20;total&#x20;rate&#x20;of&#x20;bytes&#x20;transferred&#x20;by&#x20;the&#x20;Web&#x20;service',19,1,0,0,300,0,'','','','select&#x20;BytesTotalPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (342,'IIS&#x20;CGIRequestsPersec','Rate&#x20;of&#x20;CGI&#x20;requests&#x20;that&#x20;are&#x20;simultaneously&#x20;being&#x20;processed&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;CGIRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (343,'IIS&#x20;ConnectionAttemptsPersec','Rate&#x20;at&#x20;which&#x20;connections&#x20;using&#x20;the&#x20;Web&#x20;service&#x20;are&#x20;being&#x20;attempted.',19,1,0,0,300,0,'','','','select&#x20;ConnectionAttemptsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (344,'IIS&#x20;CopyRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;COPY&#x20;method&#x20;are&#x20;made.&#x20;COPY&#x20;requests&#x20;are&#x20;used&#x20;for&#x20;copying&#x20;files&#x20;and&#x20;directories.',19,1,0,0,300,0,'','','','select&#x20;CopyRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (345,'IIS&#x20;CurrentAnonymousUsers','Number&#x20;of&#x20;users&#x20;who&#x20;currently&#x20;have&#x20;an&#x20;anonymous&#x20;connection&#x20;using&#x20;the&#x20;Web&#x20;service.\r\n',19,1,0,0,300,0,'','','','select&#x20;CurrentAnonymousUsers&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (346,'IIS&#x20;CurrentBlockedAsyncIORequests','Current&#x20;requests&#x20;temporarily&#x20;blocked&#x20;due&#x20;to&#x20;bandwidth&#x20;throttling&#x20;settings.',19,1,0,0,300,0,'','','','select&#x20;CurrentBlockedAsyncIORequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (347,'IIS&#x20;CurrentCGIRequests','Current&#x20;number&#x20;of&#x20;CGI&#x20;requests&#x20;that&#x20;are&#x20;simultaneously&#x20;being&#x20;processed&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','Currentblockedbandwidthbytes','select&#x20;CurrentCGIRequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (348,'IIS&#x20;CurrentConnections','Current&#x20;number&#x20;of&#x20;connections&#x20;established&#x20;with&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;CurrentConnections&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (349,'IIS&#x20;CurrentISAPIExtensionRequests','select&#x20;CurrentISAPIExtensionRequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',19,1,0,0,300,0,'','','','select&#x20;CurrentISAPIExtensionRequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (350,'IIS&#x20;CurrentNonAnonymousUsers','Number&#x20;of&#x20;users&#x20;who&#x20;currently&#x20;have&#x20;a&#x20;non-anonymous&#x20;connection&#x20;using&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;CurrentNonAnonymousUsers&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (351,'IIS&#x20;DeleteRequestsPersec','Total&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;DELETE&#x20;method&#x20;are&#x20;made.&#x20;DELETE&#x20;requests&#x20;are&#x20;generally&#x20;used&#x20;for&#x20;file&#x20;removal.',19,1,0,0,300,0,'','','','select&#x20;DeleteRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (352,'IIS&#x20;FilesPersec','Total&#x20;files&#x20;transferred;&#x20;that&#x20;is,&#x20;sent&#x20;and&#x20;received&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;FilesPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (353,'IIS&#x20;FilesReceivedPersec','Total&#x20;received&#x20;files&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;FilesReceivedPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (354,'IIS&#x20;FilesSentPersec','Rate&#x20;at&#x20;which&#x20;files&#x20;are&#x20;sent&#x20;by&#x20;the&#x20;Web&#x20;service.\r\n',19,1,0,0,300,0,'','','','select&#x20;FilesSentPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (355,'IIS&#x20;GetRequestsPersec&#x20;','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;GET&#x20;method&#x20;are&#x20;made.&#x20;GET&#x20;requests&#x20;are&#x20;generally&#x20;used&#x20;for&#x20;basic&#x20;file&#x20;retrievals&#x20;or&#x20;image&#x20;maps,&#x20;tho',19,1,0,0,300,0,'','','','select&#x20;GetRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (356,'IIS&#x20;HeadRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;HEAD&#x20;method&#x20;are&#x20;made.&#x20;HEAD&#x20;requests&#x20;generally&#x20;indicate&#x20;that&#x20;clients&#x20;are&#x20;querying&#x20;the&#x20;state&#x20;of&#x20;document',19,1,0,0,300,0,'','','','select&#x20;HeadRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (357,'IIS&#x20;ISAPIExtensionRequestsPersec','Rate&#x20;of&#x20;ISAPI&#x20;extension&#x20;requests&#x20;that&#x20;are&#x20;simultaneously&#x20;being&#x20;processed&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;ISAPIExtensionRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (358,'IIS&#x20;LockedErrorsPersec','Rate&#x20;of&#x20;errors&#x20;due&#x20;to&#x20;requests&#x20;that&#x20;cannot&#x20;be&#x20;satisfied&#x20;by&#x20;the&#x20;server&#x20;because&#x20;the&#x20;requested&#x20;document&#x20;was&#x20;locked.&#x20;These&#x20;are&#x20;generally&#x20;reporte',19,1,0,0,300,0,'','','','select&#x20;LockedErrorsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (359,'IIS&#x20;LockRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;LOCK&#x20;method&#x20;are&#x20;made.&#x20;LOCK&#x20;requests&#x20;are&#x20;used&#x20;to&#x20;lock&#x20;a&#x20;file&#x20;for&#x20;one&#x20;user&#x20;so&#x20;that&#x20;only&#x20;t',19,1,0,0,300,0,'','','','select&#x20;LockRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (360,'IIS&#x20;LogonAttemptsPersec','Rate&#x20;at&#x20;which&#x20;logons&#x20;using&#x20;the&#x20;Web&#x20;service&#x20;are&#x20;being&#x20;attempted.',19,1,0,0,300,0,'','','','select&#x20;LogonAttemptsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (361,'IIS&#x20;MaximumAnonymousUsers','Maximum&#x20;number&#x20;of&#x20;users&#x20;who&#x20;established&#x20;concurrent&#x20;anonymous&#x20;connections&#x20;using&#x20;the&#x20;Web&#x20;service&#x20;&#40;counted&#x20;after&#x20;service&#x20;start&#x20;up&#41;.',19,1,0,0,300,0,'','','','select&#x20;MaximumAnonymousUsers&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (362,'IIS&#x20;MaximumCGIRequests','Maximum&#x20;number&#x20;of&#x20;CGI&#x20;requests&#x20;simultaneously&#x20;processed&#x20;by&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;MaximumCGIRequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (363,'IIS&#x20;MaximumConnections','Maximum&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;established&#x20;with&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;MaximumConnections&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (364,'IIS&#x20;MaximumISAPIExtensionRequests','Maximum&#x20;number&#x20;of&#x20;ISAPI&#x20;extension&#x20;requests&#x20;simultaneously&#x20;processed&#x20;by&#x20;the&#x20;Web&#x20;service.\r\n',19,1,0,0,300,0,'','','','select&#x20;MaximumISAPIExtensionRequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (365,'IIS&#x20;MaximumNonAnonymousUsers','Maximum&#x20;number&#x20;of&#x20;users&#x20;who&#x20;established&#x20;concurrent&#x20;non-anonymous&#x20;connections&#x20;using&#x20;the&#x20;Web&#x20;service&#x20;&#40;counted&#x20;after&#x20;service&#x20;start&#x20;up&#41;.',19,1,0,0,300,0,'','','','select&#x20;MaximumNonAnonymousUsers&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (366,'IIS&#x20;MeasuredAsyncIOBandwidthUsage','Measured&#x20;bandwidth&#x20;of&#x20;asynchronous&#x20;I/O&#x20;averaged&#x20;over&#x20;a&#x20;minute.',19,1,0,0,300,0,'','','','select&#x20;MeasuredAsyncIOBandwidthUsage&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (367,'IIS&#x20;MkcolRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;MKCOL&#x20;method&#x20;are&#x20;made.&#x20;MKCOL&#x20;requests&#x20;are&#x20;used&#x20;to&#x20;create&#x20;directories&#x20;on&#x20;the&#x20;server.',19,1,0,0,300,0,'','','','select&#x20;MkcolRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (368,'IIS&#x20;MoveRequestsPersec','Rate&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;MOVE&#x20;method&#x20;are&#x20;made.&#x20;MOVE&#x20;requests&#x20;are&#x20;used&#x20;for&#x20;moving&#x20;files&#x20;and&#x20;directories.',19,1,0,0,300,0,'','','','select&#x20;MoveRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (369,'IIS&#x20;NonAnonymousUsersPersec','Rate&#x20;at&#x20;which&#x20;users&#x20;are&#x20;making&#x20;non-anonymous&#x20;connections&#x20;using&#x20;the&#x20;Web&#x20;service.',19,1,0,0,300,0,'','','','select&#x20;NonAnonymousUsersPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (370,'IIS&#x20;NotFoundErrorsPersec','Rate&#x20;of&#x20;errors&#x20;due&#x20;to&#x20;requests&#x20;that&#x20;could&#x20;not&#x20;be&#x20;satisfied&#x20;by&#x20;the&#x20;server&#x20;because&#x20;the&#x20;requested&#x20;document&#x20;could&#x20;not&#x20;be&#x20;found.&#x20;These&#x20;error',19,1,0,0,300,0,'','','','select&#x20;NotFoundErrorsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (371,'IIS&#x20;OptionsRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;OPTIONS&#x20;method&#x20;are&#x20;made.',19,1,0,0,300,0,'','','','select&#x20;OptionsRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (372,'IIS&#x20;OtherRequestMethosPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;are&#x20;made&#x20;that&#x20;do&#x20;not&#x20;use&#x20;the&#x20;OPTIONS,&#x20;GET,&#x20;HEAD,&#x20;POST,&#x20;PUT,&#x20;DELETE,&#x20;TRACE,&#x20;MOVE,&#x20;COPY,&#x20;MKCOL,&#x20;PROPFIND,&#x20;PRO',19,1,0,0,300,0,'','','','select&#x20;OtherRequestMethosPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (373,'IIS&#x20;PostRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;POST&#x20;method&#x20;are&#x20;made.&#x20;POST&#x20;requests&#x20;are&#x20;generally&#x20;used&#x20;for&#x20;forms&#x20;or&#x20;gateway&#x20;requests.',19,1,0,0,300,0,'','','','select&#x20;PostRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (374,'IIS&#x20;PropfindRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;PROPFIND&#x20;method&#x20;are&#x20;made.&#x20;PROPFIND&#x20;requests&#x20;retrieve&#x20;property&#x20;values&#x20;on&#x20;files&#x20;and&#x20;directories.',19,1,0,0,300,0,'','','','select&#x20;PropfindRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (375,'IIS&#x20;ProppatchRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;PROPPATCH&#x20;method&#x20;are&#x20;made.&#x20;PROPPATCH&#x20;requests&#x20;set&#x20;property&#x20;values&#x20;on&#x20;files&#x20;and&#x20;directories.',19,1,0,0,300,0,'','','','select&#x20;ProppatchRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (376,'IIS&#x20;PutRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;PUT&#x20;method&#x20;are&#x20;made.',19,1,0,0,300,0,'','','','select&#x20;PutRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (377,'IIS&#x20;SearchRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;MS-SEARCH&#x20;method&#x20;are&#x20;made.&#x20;MS-SEARCH&#x20;requests&#x20;query&#x20;the&#x20;server&#x20;to&#x20;find&#x20;resources&#x20;that&#x20;match&#x20;a&#x20;set&#x20',19,1,0,0,300,0,'','','','select&#x20;SearchRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (378,'IIS&#x20;ServiceUptime','Time&#x20;that&#x20;the&#x20;Web&#x20;service&#x20;is&#x20;available&#x20;to&#x20;users.&#x20;',19,1,0,0,300,0,'','','','select&#x20;ServiceUptime&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (379,'IIS&#x20;TotalAllowedAsyncIORequests','Total&#x20;requests&#x20;that&#x20;are&#x20;allowed&#x20;by&#x20;bandwidth&#x20;throttling&#x20;settings&#x20;&#40;counted&#x20;after&#x20;service&#x20;start&#x20;up&#41;.',19,1,0,0,300,0,'','','','select&#x20;TotalAllowedAsyncIORequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (380,'IIS&#x20;TotalAnonymousUsers','Total&#x20;number&#x20;of&#x20;users&#x20;who&#x20;established&#x20;an&#x20;anonymous&#x20;connection&#x20;with&#x20;the&#x20;Web&#x20;service&#x20;&#40;counted&#x20;after&#x20;service&#x20;start&#x20;up&#41;.',19,1,0,0,300,0,'','','','select&#x20;TotalAnonymousUsers&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (382,'IIS&#x20;TotalBlockedAsyncIORequests','Total&#x20;requests&#x20;that&#x20;are&#x20;temporarily&#x20;blocked&#x20;due&#x20;to&#x20;bandwidth&#x20;throttling&#x20;settings&#x20;&#40;counted&#x20;after&#x20;service&#x20;startup&#41;.',19,1,0,0,300,0,'','','','select&#x20;TotalBlockedAsyncIORequests&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (384,'IIS&#x20;UnlockRequestsPersec','Rate&#x20;at&#x20;which&#x20;HTTP&#x20;requests&#x20;using&#x20;the&#x20;UNLOCK&#x20;method&#x20;are&#x20;made.&#x20;UNLOCK&#x20;requests&#x20;are&#x20;used&#x20;to&#x20;remove&#x20;locks&#x20;from&#x20;files.',19,1,0,0,300,0,'','','','select&#x20;UnlockRequestsPersec&#x20;from&#x20;Win32_PerfRawData_W3SVC_WebService',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (385,'Exchange&#x20;AvgRecipientsPermsgReceived','Average&#x20;number&#x20;of&#x20;recipients&#x20;per&#x20;inbound&#x20;message&#x20;received.',20,1,0,0,300,0,'','','','select&#x20;AvgRecipientsPermsgReceived&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (386,'Exchange&#x20;AvgRecipientsPermsgSent','Average&#x20;number&#x20;of&#x20;recipients&#x20;per&#x20;outbound&#x20;messages&#x20;sent.',20,1,0,0,300,0,'','','','select&#x20;AvgRecipientsPermsgSent&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (387,'Exchange&#x20;AvgRetriesPermsgDelivered','Average&#x20;number&#x20;of&#x20;retries&#x20;per&#x20;local&#x20;delivery.',20,1,0,0,300,0,'','','','select&#x20;AvgRetriesPermsgDelivered&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (388,'Exchange&#x20;AvgRetriesPermsgSent','Average&#x20;number&#x20;of&#x20;retries&#x20;per&#x20;outbound&#x20;message&#x20;sent.',20,1,0,0,300,0,'','','','select&#x20;AvgRetriesPermsgSent&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (389,'Exchange&#x20;BadmailedMessagesBadPickupFile','Number&#x20;of&#x20;malformed&#x20;pickup&#x20;messages&#x20;sent&#x20;to&#x20;the&#x20;SMTP&#x20;bad&#x20;mail&#x20;directory.',20,1,0,0,300,0,'','','','select&#x20;BadmailedMessagesBadPickupFile&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (390,'Exchange&#x20;BadmailedMessagesGeneralFailure','Number&#x20;of&#x20;messages&#x20;sent&#x20;to&#x20;badmail&#x20;for&#x20;reasons&#x20;not&#x20;associated&#x20;with&#x20;a&#x20;specific&#x20;counter.',20,1,0,0,300,0,'','','','select&#x20;BadmailedMessagesGeneralFailure&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (391,'Exchange&#x20;BadmailedMessagesHopCountExceeded','Number&#x20;of&#x20;messages&#x20;sent&#x20;to&#x20;badmail&#x20;because&#x20;they&#x20;had&#x20;exceeded&#x20;the&#x20;maximum&#x20;hop&#x20;count.',20,1,0,0,300,0,'','','','select&#x20;BadmailedMessagesHopCountExceeded&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (392,'Exchange&#x20;BadmailedMessagesNDRofDSN','Number&#x20;of&#x20;delivery&#x20;status&#x20;notifications&#x20;sent&#x20;to&#x20;badmail&#x20;because&#x20;they&#x20;could&#x20;not&#x20;be&#x20;delivered.',20,1,0,0,300,0,'','','','select&#x20;BadmailedMessagesNDRofDSN&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (393,'Exchange&#x20;BadmailedMessagesNoRecipients','Number&#x20;of&#x20;messages&#x20;sent&#x20;to&#x20;badmail&#x20;because&#x20;they&#x20;had&#x20;no&#x20;recipients.',20,1,0,0,300,0,'','','','select&#x20;BadmailedMessagesNoRecipients&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (394,'Exchange&#x20;BadmailedMessagesTriggeredviaEvent','Number&#x20;of&#x20;messages&#x20;sent&#x20;to&#x20;badmail&#x20;at&#x20;the&#x20;request&#x20;of&#x20;a&#x20;server&#x20;event&#x20;sink.',20,1,0,0,300,0,'','','','select&#x20;BadmailedMessagesTriggeredviaEvent&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (395,'Exchange&#x20;BytesReceivedPersec','Rate&#x20;at&#x20;which&#x20;bytes&#x20;are&#x20;received&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;BytesReceivedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (396,'Exchange&#x20;BytesReceivedTotal','Total&#x20;number&#x20;of&#x20;bytes&#x20;received&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;BytesReceivedTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (397,'Exchange&#x20;BytesSentPersec','Rate&#x20;at&#x20;which&#x20;bytes&#x20;are&#x20;sent&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;BytesSentPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (398,'Exchange&#x20;BytesSentTotal','Total&#x20;number&#x20;of&#x20;bytes&#x20;sent&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;BytesSentTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (399,'Exchange&#x20;BytesTotal','Rate&#x20;at&#x20;which&#x20;bytes&#x20;are&#x20;sent&#x20;and&#x20;received.',20,1,0,0,300,0,'','','','select&#x20;BytesTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (400,'Exchange&#x20;BytesTotalPersec','Rate&#x20;at&#x20;which&#x20;bytes&#x20;are&#x20;sent&#x20;and&#x20;received.',20,1,0,0,300,0,'','','','select&#x20;BytesTotalPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (401,'Exchange&#x20;CatAddresslookupcompletions','Number&#x20;of&#x20;address&#x20;lookup&#x20;completions&#x20;processed.',20,1,0,0,300,0,'','','','select&#x20;CatAddresslookupcompletions&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (402,'Exchange&#x20;CatAddresslookupcompletionsPersec','Number&#x20;of&#x20;address&#x20;lookup&#x20;completions&#x20;processed&#x20;per&#x20;second.',20,1,0,0,300,0,'','','','select&#x20;CatAddresslookupcompletionsPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (403,'Exchange&#x20;CatAddresslookups','Number&#x20;of&#x20;Directory&#x20;Services&#x20;&#40;DS&#41;&#x20;lookups&#x20;for&#x20;individual&#x20;addresses.',20,1,0,0,300,0,'','','','select&#x20;CatAddresslookups&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (404,'Exchange&#x20;CatAddressLookupsNotFound','Number&#x20;of&#x20;address&#x20;lookups&#x20;that&#x20;did&#x20;not&#x20;find&#x20;any&#x20;DS&#x20;object.',20,1,0,0,300,0,'','','','select&#x20;CatAddresslookupsnotfound&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (405,'Exchange&#x20;CatAddresslookupsPersec','Number&#x20;of&#x20;address&#x20;lookups&#x20;dispatched&#x20;to&#x20;the&#x20;DS&#x20;per&#x20;second.',20,1,0,0,300,0,'','','','select&#x20;CatAddresslookupsPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (406,'Exchange&#x20;CatCategorizationscompleted','Total&#x20;number&#x20;of&#x20;messages&#x20;submitted&#x20;to&#x20;the&#x20;categorizer&#x20;that&#x20;have&#x20;finished&#x20;categorization.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationscompleted&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (407,'Exchange&#x20;CatCategorizationscompletedPersec','Rate&#x20;of&#x20;categorizations&#x20;completed.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationscompletedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (408,'Exchange&#x20;CatCategorizationscompletedsuccessfully','Number&#x20;of&#x20;categorizations&#x20;that&#x20;completed&#x20;without&#x20;any&#x20;errors.\r\n',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationscompletedsuccessfully&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (409,'Exchange&#x20;CatCategorizationsfailedDSconnectionfailure','Number&#x20;of&#x20;categorizations&#x20;that&#x20;failed.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationsfailedDSconnectionfailure&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (410,'Exchange&#x20;CatCategorizationsfailedDSlogonfailure','Number&#x20;of&#x20;categorizations&#x20;that&#x20;failed&#x20;due&#x20;to&#x20;a&#x20;DS&#x20;logon&#x20;failure',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationsfailedDSlogonfailure&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (411,'Exchange&#x20;CatCategorizationsfailednonretryableerror','Number&#x20;of&#x20;categorizations&#x20;that&#x20;failed&#x20;with&#x20;a&#x20;hard&#x20;error&#x20;&#40;cannot&#x20;be&#x20;retried&#41;.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationsfailednonretryableerror&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (412,'Exchange&#x20;CatCategorizationsfailedOutOfMemory','Number&#x20;of&#x20;categorizations&#x20;that&#x20;failed&#x20;due&#x20;to&#x20;lack&#x20;of&#x20;available&#x20;memory.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationsfailedOutOfMemory&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (413,'Exchange&#x20;CatCategorizationsfailedretryableerror&#x20;','Number&#x20;of&#x20;categorizations&#x20;that&#x20;failed&#x20;with&#x20;an&#x20;error&#x20;that&#x20;could&#x20;be&#x20;retried.',20,1,0,0,300,0,'','','','SELECT&#x20;CatCategorizationsfailedretryableerror&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (414,'Exchange&#x20;CatCategorizationsfailedsinkretryableerror','Number&#x20;of&#x20;categorizations&#x20;that&#x20;failed&#x20;with&#x20;a&#x20;generic&#x20;error&#x20;that&#x20;could&#x20;be&#x20;retried.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationsfailedsinkretryableerror&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (415,'Exchange&#x20;CatCategorizationsinprogress','Number&#x20;of&#x20;categorizations&#x20;in&#x20;progress.',20,1,0,0,300,0,'','','','select&#x20;CatCategorizationsinprogress&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (416,'Exchange&#x20;CategorizerQueueLength','Number&#x20;of&#x20;messages&#x20;in&#x20;the&#x20;categorizer&#x20;queue.',20,1,0,0,300,0,'','','','select&#x20;CategorizerQueueLength&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (417,'LDAP&#x20;CatLDAPbindfailures','Total&#x20;number&#x20;of&#x20;LDAP&#x20;bind&#x20;failures.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPbindfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (418,'LDAP&#x20;CatLDAPbinds','Total&#x20;number&#x20;of&#x20;successful&#x20;LDAP&#x20;bind&#x20;operations&#x20;performed',21,1,0,0,300,0,'','','','select&#x20;CatLDAPbinds&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (419,'LDAP&#x20;CatLDAPconnectionfailures','Total&#x20;number&#x20;of&#x20;failed&#x20;LDAP&#x20;connections.\r\n',21,1,0,0,300,0,'','','','select&#x20;CatLDAPconnectionfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (420,'LDAP&#x20;CatLDAPconnections','Total&#x20;number&#x20;of&#x20;LDAP&#x20;connections&#x20;opened.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPconnections&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (421,'LDAP&#x20;CatLDAPconnectionscurrentlyopen','Number&#x20;of&#x20;LDAP&#x20;connections&#x20;currently&#x20;open.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPconnectionscurrentlyopen&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (422,'LDAP&#x20;CatLDAPGeneralCompletionFailures','Number&#x20;of&#x20;LDAP&#x20;completions&#x20;with&#x20;a&#x20;generic&#x20;failure.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPgeneralcompletionfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (423,'LDAP&#x20;CatLDAPpagedsearchcompletionfailures','Number&#x20;of&#x20;LDAP&#x20;completions&#x20;with&#x20;a&#x20;generic&#x20;failure.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPpagedsearchcompletionfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (424,'LDAP&#x20;CatLDAPpagedsearches','LDAP&#x20;paged&#x20;searches&#x20;successfully&#x20;dispatched.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPpagedsearches&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (425,'LDAP&#x20;CatLDAPpagedsearchescompleted&#x20;','LDAP&#x20;paged&#x20;searches&#x20;successfully&#x20;dispatched.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPpagedsearchescompleted&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (426,'LDAP&#x20;CatLDAPpagedsearchfailures','Number&#x20;of&#x20;failures&#x20;to&#x20;dispatch&#x20;an&#x20;asynchronous&#x20;LDAP&#x20;page&#x20;search.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPpagedsearchfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (427,'LDAP&#x20;CatLDAPsearchcompletionfailures','Number&#x20;of&#x20;LDAP&#x20;searches&#x20;that&#x20;completed&#x20;with&#x20;a&#x20;failure.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchcompletionfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (428,'LDAP&#x20;CatLDAPsearches','LDAP&#x20;searches&#x20;successfully&#x20;dispatched.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearches&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (429,'LDAP&#x20;CatLDAPsearchesabandoned','Number&#x20;of&#x20;LDAP&#x20;searches&#x20;abandoned.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchesabandoned&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (430,'LDAP&#x20;CatLDAPsearchescompleted','Number&#x20;of&#x20;LDAP&#x20;search&#x20;completions&#x20;processed.\r\n',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchescompleted&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (431,'LDAP&#x20;CatLDAPsearchescompletedPersec','LDAP&#x20;search&#x20;completions&#x20;processed&#x20;per&#x20;second.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchescompletedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (432,'LDAP&#x20;CatLDAP&#x20;archespendingcompletion','Number&#x20;of&#x20;LDAP&#x20;searches&#x20;pending&#x20;async&#x20;completion.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchespendingcompletion&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (433,'LDAP&#x20;CatLDAPsearchesPersec','LDAP&#x20;searches&#x20;successfully&#x20;dispatched&#x20;per&#x20;second.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchesPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (434,'LDAP&#x20;CatLDAPsearchfailures','Number&#x20;of&#x20;failures&#x20;to&#x20;dispatch&#x20;an&#x20;async&#x20;LDAP&#x20;search.',21,1,0,0,300,0,'','','','select&#x20;CatLDAPsearchfailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (435,'Exchange&#x20;Catmailmsgduplicatecollisions','Number&#x20;of&#x20;times&#x20;a&#x20;duplicate&#x20;recipient&#x20;address&#x20;was&#x20;detected&#x20;by&#x20;mailmsg&#x20;or&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;Catmailmsgduplicatecollisions&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (436,'Exchange&#x20;CatMessagesaborted','Number&#x20;of&#x20;messages&#x20;marked&#x20;to&#x20;be&#x20;canceled&#x20;by&#x20;the&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;CatMessagesaborted&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (437,'Exchange&#x20;CatMessagesbifurcated','Number&#x20;of&#x20;new&#x20;messages&#x20;created&#x20;by&#x20;the&#x20;categorizer&#x20;&#40;bifurcation&#41;.',20,1,0,0,300,0,'','','','select&#x20;CatMessagesbifurcated&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (438,'Exchange&#x20;CatMessagesCategorized','Number&#x20;of&#x20;messages&#x20;categorizer&#x20;has&#x20;submitted&#x20;to&#x20;queuing.',20,1,0,0,300,0,'','','','select&#x20;CatMessagesCategorized&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (439,'Exchange&#x20;CatMessagessubmitted','Rate&#x20;at&#x20;which&#x20;messages&#x20;are&#x20;being&#x20;submitted&#x20;to&#x20;the&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;CatMessagessubmitted&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (440,'Exchange&#x20;CatMessagessubmittedPersec','Rate&#x20;at&#x20;which&#x20;messages&#x20;are&#x20;being&#x20;submitted&#x20;to&#x20;the&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;CatMessagessubmittedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (441,'Exchange&#x20;CatRecipientsaftercategorization','Number&#x20;of&#x20;mailmsg&#x20;recipients&#x20;submitted&#x20;from&#x20;categorizer&#x20;to&#x20;queuing.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsaftercategorization&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (442,'Exchange&#x20;CatRecipientsbeforecategorization','Number&#x20;of&#x20;mailmsg&#x20;recipients&#x20;submitted&#x20;to&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsbeforecategorization&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (443,'Exchange&#x20;CatRecipientsincategorization','Number&#x20;of&#x20;recipients&#x20;that&#x20;the&#x20;categorizer&#x20;is&#x20;currently&#x20;processing.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsincategorization&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (444,'Exchange&#x20;CatRecipientsNDRdambiguousaddress','Number&#x20;of&#x20;recipients&#x20;with&#x20;addresses&#x20;that&#x20;match&#x20;multiple&#x20;DS&#x20;objects.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsNDRdambiguousaddress&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (445,'Exchange&#x20;CatRecipientsNDRdbycategorizer','Number&#x20;of&#x20;recipients&#x20;set&#x20;to&#x20;receive&#x20;a&#x20;non-delivery&#x20;report&#x20;from&#x20;the&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsNDRdbycategorizer&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (446,'Exchange&#x20;CatRecipientsNDRdforwardingloop','Number&#x20;of&#x20;recipients&#x20;that&#x20;received&#x20;a&#x20;non-delivery&#x20;report&#x20;from&#x20;the&#x20;categorizer&#x20;due&#x20;to&#x20;a&#x20;forwarding&#x20;loop&#x20;detection.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsNDRdforwardingloop&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',1,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (447,'Exchange&#x20;CatRecipientsNDRdillegaladdress','Number&#x20;of&#x20;recipients&#x20;with&#x20;illegal&#x20;addresses&#x20;detected&#x20;by&#x20;the&#x20;categorizer.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsNDRdillegaladdress&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (448,'Exchange&#x20;CatRecipientsNDRdsinkreciperrors','Number&#x20;of&#x20;recipients&#x20;that&#x20;received&#x20;a&#x20;non-delivery&#x20;report&#x20;from&#x20;the&#x20;categorizer&#x20;due&#x20;to&#x20;a&#x20;generic&#x20;recipient&#x20;failure.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsNDRdsinkreciperrors&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (449,'Exchange&#x20;CatRecipientsNDRdunresolved','Number&#x20;of&#x20;senders&#x20;not&#x20;found&#x20;in&#x20;the&#x20;DS.',20,1,0,0,300,0,'','','','select&#x20;CatRecipientsNDRdunresolved&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (450,'Exchange&#x20;CatSendersunresolved','Number&#x20;of&#x20;senders&#x20;not&#x20;found&#x20;in&#x20;the&#x20;DS.',20,1,0,0,300,0,'','','','select&#x20;CatSendersunresolved&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (451,'Exchange&#x20;CatSenderswithambiguousaddresses','Number&#x20;of&#x20;senders&#x20;with&#x20;addresses&#x20;that&#x20;match&#x20;multiple&#x20;DS&#x20;objects.',20,1,0,0,300,0,'','','','select&#x20;CatSenderswithambiguousaddresses&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (452,'Exchange&#x20;ConnectionErrorsPersec','Number&#x20;of&#x20;connection&#x20;errors&#x20;per&#x20;second.',20,1,0,0,300,0,'','','','select&#x20;ConnectionErrorsPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (453,'Exchange&#x20;CurrentMessagesinLocalDelivery','Number&#x20;of&#x20;messages&#x20;that&#x20;are&#x20;currently&#x20;being&#x20;processed&#x20;by&#x20;a&#x20;server&#x20;event&#x20;sink&#x20;for&#x20;local&#x20;delivery.',20,1,0,0,300,0,'','','','select&#x20;CurrentMessagesinLocalDelivery&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (454,'Exchange&#x20;DirectoryDropsPersec','Number&#x20;of&#x20;messages&#x20;placed&#x20;in&#x20;a&#x20;drop&#x20;directory&#x20;per&#x20;second.',20,1,0,0,300,0,'','','','select&#x20;DirectoryDropsPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (455,'Exchange&#x20;DirectoryDropsTotal','Total&#x20;number&#x20;of&#x20;messages&#x20;placed&#x20;in&#x20;a&#x20;drop&#x20;directory.',20,1,0,0,300,0,'','','','select&#x20;DirectoryDropsTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (456,'Exchange&#x20;DNSQueriesPersec','Rate&#x20;of&#x20;DNS&#x20;lookups.',20,1,0,0,300,0,'','','','select&#x20;DNSQueriesPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (457,'Exchange&#x20;DNSQueriesTotal','Total&#x20;number&#x20;of&#x20;DNS&#x20;lookups.',20,1,0,0,300,0,'','','','select&#x20;DNSQueriesTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (458,'Exchange&#x20;ETRNMessagesPersec','Number&#x20;of&#x20;Extended&#x20;Simple&#x20;Mail&#x20;Transport&#x20;Protocol&#x20;&#40;ETRN&#41;&#x20;messages&#x20;per&#x20;second.',20,1,0,0,300,0,'','','','select&#x20;ETRNMessagesPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (459,'Exchange&#x20;ETRNMessagesTotal','Total&#x20;number&#x20;of&#x20;ETRN&#x20;messages&#x20;received&#x20;by&#x20;the&#x20;server.',20,1,0,0,300,0,'','','','select&#x20;ETRNMessagesTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (460,'Exchange&#x20;InboundConnectionsCurrent','Total&#x20;current&#x20;inbound&#x20;connections',20,1,0,0,300,0,'','','','select&#x20;InboundConnectionsCurrent&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (461,'Exchange&#x20;InboundConnectionsTotal','Total&#x20;number&#x20;of&#x20;inbound&#x20;connections&#x20;received.',20,1,0,0,300,0,'','','','select&#x20;InboundConnectionsTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (462,'Exchange&#x20;LocalQueueLength','Number&#x20;of&#x20;messages&#x20;in&#x20;the&#x20;local&#x20;queue.',20,1,0,0,300,0,'','','','select&#x20;LocalQueueLength&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (463,'Exchange&#x20;LocalRetryQueueLength','Number&#x20;of&#x20;messages&#x20;in&#x20;the&#x20;local&#x20;retry&#x20;queue.',20,1,0,0,300,0,'','','','select&#x20;LocalRetryQueueLength&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (464,'Exchange&#x20;MessageBytesReceivedPersec','Rate&#x20;that&#x20;bytes&#x20;are&#x20;received&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;MessageBytesReceivedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (465,'Exchange&#x20;MessageBytesReceivedTotal','Total&#x20;number&#x20;of&#x20;bytes&#x20;received&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;MessageBytesReceivedTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (466,'Exchange&#x20;MessageBytesSentPersec','Rate&#x20;that&#x20;bytes&#x20;are&#x20;sent&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;MessageBytesSentPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (467,'Exchange&#x20;MessageBytesSentTotal','Total&#x20;number&#x20;of&#x20;bytes&#x20;sent&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;MessageBytesSentTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (468,'Exchange&#x20;MessageBytesTotal','Total&#x20;number&#x20;of&#x20;bytes&#x20;sent&#x20;and&#x20;received&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;MessageBytesTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (469,'Exchange&#x20;MessageBytesTotalPersec','Rate&#x20;at&#x20;which&#x20;bytes&#x20;are&#x20;sent&#x20;and&#x20;received&#x20;in&#x20;messages.',20,1,0,0,300,0,'','','','select&#x20;MessageBytesTotalPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (470,'Exchange&#x20;&#x20;MessageDeliveryRetries','Total&#x20;number&#x20;of&#x20;local&#x20;deliveries&#x20;that&#x20;were&#x20;retried.',20,1,0,0,300,0,'','','','select&#x20;MessageDeliveryRetries&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (471,'Exchange&#x20;MessagesCurrentlyUndeliverable','Number&#x20;of&#x20;messages&#x20;that&#x20;have&#x20;been&#x20;reported&#x20;as&#x20;currently&#x20;undeliverable&#x20;by&#x20;routing.',20,1,0,0,300,0,'','','','select&#x20;MessagesCurrentlyUndeliverable&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (472,'Exchange&#x20;MessagesDeliveredPersec','Rate&#x20;at&#x20;which&#x20;messages&#x20;are&#x20;delivered&#x20;to&#x20;local&#x20;mailboxes.\r\n',20,1,0,0,300,0,'','','','select&#x20;MessagesDeliveredPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (473,'Exchange&#x20;MessagesDeliveredTotal','Total&#x20;number&#x20;of&#x20;messages&#x20;delivered&#x20;to&#x20;local&#x20;mailboxes.',20,1,0,0,300,0,'','','','select&#x20;MessagesDeliveredTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (474,'Exchange&#x20;MessageSendRetries','Total&#x20;number&#x20;of&#x20;outbound&#x20;message&#x20;send&#x20;operations&#x20;that&#x20;were&#x20;retried.',20,1,0,0,300,0,'','','','select&#x20;MessageSendRetries&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (475,'Exchange&#x20;MessagesPendingRouting','Number&#x20;of&#x20;messages&#x20;that&#x20;have&#x20;been&#x20;categorized&#x20;but&#x20;not&#x20;routed.',20,1,0,0,300,0,'','','','select&#x20;MessagesPendingRouting&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (476,'Exchange&#x20;MessagesReceivedPersec','Rate&#x20;that&#x20;inbound&#x20;messages&#x20;are&#x20;being&#x20;received.\r\n',20,1,0,0,300,0,'','','','select&#x20;MessagesReceivedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (477,'Exchange&#x20;MessagesReceivedTotal','Total&#x20;number&#x20;of&#x20;inbound&#x20;messages&#x20;accepted.',20,1,0,0,300,0,'','','','select&#x20;MessagesReceivedTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (478,'Exchange&#x20;MessagesRefusedforAddressObjects','Total&#x20;number&#x20;of&#x20;messages&#x20;refused&#x20;due&#x20;to&#x20;lack&#x20;of&#x20;address&#x20;objects.',20,1,0,0,300,0,'','','','select&#x20;MessagesRefusedforAddressObjects&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (479,'Exchange&#x20;MessagesRefusedforMailObjects','Total&#x20;number&#x20;of&#x20;messages&#x20;refused&#x20;due&#x20;to&#x20;lack&#x20;of&#x20;mail&#x20;objects.',20,1,0,0,300,0,'','','','select&#x20;MessagesRefusedforMailObjects&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (480,'Exchange&#x20;MessagesRefusedforSize','Total&#x20;number&#x20;of&#x20;messages&#x20;rejected&#x20;because&#x20;they&#x20;were&#x20;too&#x20;big.',20,1,0,0,300,0,'','','','select&#x20;MessagesRefusedforSize&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (481,'Exchange&#x20;MessagesSentPersec','Rate&#x20;at&#x20;which&#x20;outbound&#x20;messages&#x20;are&#x20;being&#x20;sent.',20,1,0,0,300,0,'','','','select&#x20;MessagesSentPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (482,'Exchange&#x20;MessagesSentTotal','Total&#x20;number&#x20;of&#x20;outbound&#x20;messages&#x20;sent.',20,1,0,0,300,0,'','','','select&#x20;MessagesSentTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (483,'Exchange&#x20;NDRsGenerated','Number&#x20;of&#x20;non-delivery&#x20;reports&#x20;that&#x20;have&#x20;been&#x20;generated.',20,1,0,0,300,0,'','','','select&#x20;NDRsGenerated&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (484,'Exchange&#x20;NumberofMailFilesOpen','Number&#x20;of&#x20;handles&#x20;to&#x20;open&#x20;mail&#x20;files.',20,1,0,0,300,0,'','','','select&#x20;NumberofMailFilesOpen&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (485,'Exchange&#x20;NumberofQueueFilesOpen','Number&#x20;of&#x20;handles&#x20;to&#x20;open&#x20;queue&#x20;files.',20,1,0,0,300,0,'','','','select&#x20;NumberofQueueFilesOpen&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (486,'Exchange&#x20;OutboundConnectionsCurrent','Number&#x20;of&#x20;connections&#x20;currently&#x20;outbound.',20,1,0,0,300,0,'','','','select&#x20;OutboundConnectionsCurrent&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (487,'Exchange&#x20;OutboundConnectionsRefused','Number&#x20;of&#x20;outbound&#x20;connection&#x20;attempts&#x20;refused&#x20;by&#x20;remote&#x20;sites.',20,1,0,0,300,0,'','','','select&#x20;OutboundConnectionsRefused&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (488,'Exchange&#x20;OutboundConnectionsTotal','Total&#x20;number&#x20;of&#x20;outbound&#x20;connections&#x20;attempted.',20,1,0,0,300,0,'','','','select&#x20;OutboundConnectionsTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (489,'Exchange&#x20;PercentRecipientsLocal','Percentage&#x20;of&#x20;recipients&#x20;that&#x20;will&#x20;be&#x20;delivered&#x20;locally.',20,1,0,0,300,0,'','','','select&#x20;PercentRecipientsLocal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (490,'Exchange&#x20;PercentRecipientsRemote','Percentage&#x20;of&#x20;recipients&#x20;that&#x20;will&#x20;be&#x20;delivered&#x20;remotely.',20,1,0,0,300,0,'','','','select&#x20;PercentRecipientsRemote&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (491,'Exchange&#x20;PickupDirectoryMessagesRetrievedPersec','Rate&#x20;at&#x20;which&#x20;messages&#x20;are&#x20;being&#x20;retrieved&#x20;from&#x20;the&#x20;mail&#x20;pick-up&#x20;directory.',20,1,0,0,300,0,'','','','select&#x20;PickupDirectoryMessagesRetrievedPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (492,'Exchange&#x20;PickupDirectoryMessagesRetrievedTotal&#x20;','Total&#x20;number&#x20;of&#x20;messages&#x20;retrieved&#x20;from&#x20;the&#x20;mail&#x20;pick-up&#x20;directory.',20,1,0,0,300,0,'','','','select&#x20;PickupDirectoryMessagesRetrievedTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (493,'Exchange&#x20;RemoteQueueLength','Number&#x20;of&#x20;messages&#x20;in&#x20;the&#x20;remote&#x20;queue.',20,1,0,0,300,0,'','','','select&#x20;RemoteQueueLength&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (494,'Exchange&#x20;RemoteRetryQueueLength','Number&#x20;of&#x20;messages&#x20;in&#x20;the&#x20;retry&#x20;queue&#x20;for&#x20;remote&#x20;delivery.',20,1,0,0,300,0,'','','','select&#x20;RemoteRetryQueueLength&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (495,'Exchange&#x20;RoutingTableLookupsPersec','Number&#x20;of&#x20;routing&#x20;table&#x20;lookups&#x20;per&#x20;second.',20,1,0,0,300,0,'','','','select&#x20;RoutingTableLookupsPersec&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (496,'Exchange&#x20;RoutingTableLookups','Total&#x20;number&#x20;of&#x20;routing&#x20;table&#x20;lookups.',20,1,0,0,300,0,'','','','select&#x20;RoutingTableLookupsTotal&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (497,'Exchange&#x20;TotalConnectionErrors','Total&#x20;number&#x20;of&#x20;connection&#x20;errors.',20,1,0,0,300,0,'','','','select&#x20;TotalConnectionErrors&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (498,'Exchange&#x20;TotalDSNFailures','Total&#x20;number&#x20;of&#x20;failed&#x20;DSN&#x20;generation&#x20;attempts.',20,1,0,0,300,0,'','','','select&#x20;TotalDSNFailures&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (499,'Exchange&#x20;Totalmessagessubmitted','Total&#x20;messages&#x20;submitted&#x20;to&#x20;queuing&#x20;for&#x20;delivery.',20,1,0,0,300,0,'','','','select&#x20;Totalmessagessubmitted&#x20;from&#x20;Win32_PerfFormattedData_SMTPSVC_SMTPServer',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (501,'MSDTC&#x20;AbortedTransactions','Number&#x20;of&#x20;canceled&#x20;transactions.',22,1,0,0,300,0,'','','','select&#x20;AbortedTransactions&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (502,'MSDTC&#x20;AbortedTransactionsPersec','Transactions&#x20;canceled&#x20;per&#x20;second.',22,1,0,0,300,0,'','','','select&#x20;AbortedTransactionsPersec&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (503,'MSDTC&#x20;ActiveTransactions','Number&#x20;of&#x20;currently&#x20;active&#x20;transactions.',22,1,0,0,300,0,'','','','select&#x20;ActiveTransactions&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (504,'MSDTC&#x20;ActiveTransactionsMaximum','Maximum&#x20;number&#x20;of&#x20;transactions&#x20;ever&#x20;concurrently&#x20;active.',22,1,0,0,300,0,'','','','select&#x20;ActiveTransactionsMaximum&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (505,'MSDTC&#x20;CommittedTransactions','Number&#x20;of&#x20;committed&#x20;transactions.\r\n',22,1,0,0,300,0,'','','','select&#x20;CommittedTransactions&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (506,'MSDTC&#x20;CommittedTransactionsPersec','Transactions&#x20;committed&#x20;per&#x20;second.',22,1,0,0,300,0,'','','','select&#x20;CommittedTransactionsPersec&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (507,'MSDTC&#x20;ForceAbortedTransactions','Number&#x20;of&#x20;transactions&#x20;canceled&#x20;by&#x20;the&#x20;system&#x20;administrator.',22,1,0,0,300,0,'','','','select&#x20;ForceAbortedTransactions&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (508,'MSDTC&#x20;ForceCommittedTransactions','Number&#x20;of&#x20;transactions&#x20;committed&#x20;by&#x20;the&#x20;system&#x20;administrator.',22,1,0,0,300,0,'','','','select&#x20;ForceCommittedTransactions&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (509,'MSDTC&#x20;InDoubtTransactions','Number&#x20;of&#x20;transactions&#x20;whose&#x20;outcomes&#x20;are&#x20;in&#x20;doubt.',22,1,0,0,300,0,'','','','select&#x20;InDoubtTransactions&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (510,'MSDTC&#x20;ResponseTimeAverage','Average&#x20;time&#x20;delta&#x20;between&#x20;transaction&#x20;beginning&#x20;and&#x20;commitment.',22,1,0,0,300,0,'','','','select&#x20;ResponseTimeAverage&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (511,'MSDTC&#x20;ResponseTimeMaximum','Maximum&#x20;time&#x20;delta&#x20;between&#x20;transaction&#x20;beginning&#x20;and&#x20;commitment.',22,1,0,0,300,0,'','','','select&#x20;ResponseTimeMaximum&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (512,'MSDTC&#x20;ResponseTimeMinimum','Minimum&#x20;time&#x20;delta&#x20;between&#x20;transaction&#x20;beginning&#x20;and&#x20;commitment.',22,1,0,0,300,0,'','','','select&#x20;ResponseTimeMinimum&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (513,'MSDTC&#x20;TransactionsPersec','Transactions&#x20;performed&#x20;per&#x20;second.',22,1,0,0,300,0,'','','','select&#x20;TransactionsPersec&#x20;from&#x20;Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator',3,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (514,'c2900InfoPeakBuffersUsed','ftp://ftp.cisco.com/pub/mibs/oid/CISCO-C2900-MIB.oid',23,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.9.87.1.1.2.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (515,'c2900InfoTotalBufferDepth','ftp://ftp.cisco.com/pub/mibs/oid/CISCO-C2900-MIB.oid',23,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.9.87.1.1.3.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (516,'c2900BandwidthUsageCurrent	','ftp://ftp.cisco.com/pub/mibs/oid/CISCO-C2900-MIB.oid',23,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.9.87.1.5.1.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (517,'Latest&#x20;Message&#x20;&#x20;','Get&#x20;the&#x20;last&#x20;message&#x20;sent&#x20;in&#x20;Syslog',2,17,0,0,300,0,'','','public','1.3.6.1.4.1.9.9.41.1.2.3.1.5.12',1,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (518,'Latest&#x20;Message&#x20;date','',2,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.9.41.1.2.3.1.6.12',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (519,'CPU&#x20;avgBusy1min	','',2,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.2.1.57.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (520,'CPU&#x20;avgBusy5min	','',2,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.2.1.58.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (521,'Software&#x20;Image&#x20;running&#x20;','',2,17,0,0,1800,0,'','','public','1.3.6.1.4.1.9.2.1.73.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (522,'nvRAMUsed','',2,15,0,0,300,0,'','','public','1.3.6.1.4.1.9.3.6.8.0',2,2,0,'','','0',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (523,'Printers&#x20;BytesPrintedPersec','Number&#x20;of&#x20;bytes&#x20;per&#x20;second&#x20;printed&#x20;on&#x20;a&#x20;print&#x20;queue.',24,1,0,0,300,0,'','','','select&#x20;BytesPrintedPersec&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (524,'Printers&#x20;JobErrors','Total&#x20;number&#x20;of&#x20;job&#x20;errors&#x20;in&#x20;a&#x20;print&#x20;queue&#x20;after&#x20;the&#x20;last&#x20;restart.',24,1,0,0,300,0,'','','','select&#x20;JobErrors&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;&#x20;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (525,'Printers&#x20;Jobs','Current&#x20;number&#x20;of&#x20;jobs&#x20;in&#x20;a&#x20;print&#x20;queue.',24,1,0,0,300,0,'','','','select&#x20;Jobs&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;&#x20;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (526,'Printers&#x20;JobsSpooling','Current&#x20;number&#x20;of&#x20;spooling&#x20;jobs&#x20;in&#x20;a&#x20;print&#x20;queue.',24,1,0,0,300,0,'','','','select&#x20;JobsSpooling&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (527,'Printers&#x20;MaxJobsSpooling','Maximum&#x20;number&#x20;of&#x20;spooling&#x20;jobs&#x20;in&#x20;a&#x20;print&#x20;queue&#x20;after&#x20;the&#x20;last&#x20;restart.\r\n',24,1,0,0,300,0,'','','','select&#x20;MaxJobsSpooling&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (528,'Printers&#x20;NotReadyErrors','Total&#x20;number&#x20;of&#x20;printer-not-ready&#x20;errors&#x20;in&#x20;a&#x20;print&#x20;queue&#x20;after&#x20;the&#x20;last&#x20;restart.',24,1,0,0,300,0,'','','','select&#x20;NotReadyErrors&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (529,'Printers&#x20;OutofPaperErrors','Total&#x20;number&#x20;of&#x20;out-of-paper&#x20;errors&#x20;in&#x20;a&#x20;print&#x20;queue&#x20;after&#x20;the&#x20;last&#x20;restart.',24,1,0,0,300,0,'','','','select&#x20;OutofPaperErrors&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (530,'Printers&#x20;TotalJobsPrinted','Total&#x20;number&#x20;of&#x20;jobs&#x20;printed&#x20;on&#x20;a&#x20;print&#x20;queue&#x20;after&#x20;the&#x20;last&#x20;restart.',24,1,0,0,300,0,'','','','select&#x20;TotalJobsPrinted&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (531,'Printers&#x20;TotalPagesPrinted','Total&#x20;number&#x20;of&#x20;pages&#x20;printed&#x20;through&#x20;GDI&#x20;on&#x20;a&#x20;print&#x20;queue&#x20;after&#x20;the&#x20;last&#x20;restart.',24,1,0,0,300,0,'','','','select&#x20;TotalPagesPrinted&#x20;from&#x20;Win32_PerfRawData_Spooler_PrintQueue&#x20;where&#x20;NAME&#x20;=&#x20;&#039;_total&#039;',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (532,'Printers&#x20;Availability','Availability&#x20;and&#x20;status&#x20;of&#x20;the&#x20;device\r\n\r\nValue	Meaning\r\n\r\n10x1&#x20;Other\r\n\r\n20x2&#x20;Unknown\r\n\r\n30x3&#x20;Running&#x20;or&#x20;Full&#x20;Power\r\n\r\n40x4&#x20;Warning\r\n\r\n50x5&#x20;In&#x20;Test\r\n\r\n60x6&#x20;Not&#x20;Applicable\r',24,3,0,0,300,0,'','','','select&#x20;Availability&#x20;from&#x20;Win32_Printer',5,6,0,'','','10',0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,NULL,NULL,NULL,0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (533,'Serv_IISAdmin','IIS&#x20;Administration&#x20;Server&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;IISAdmin&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (534,'Serv_MSSQL_server','Displays&#x20;if&#x20;&#x20;MS&#x20;SQL&#x20;SERVER&#x20;is&#x20;running',27,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;MSSQLSERVER&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (535,'SQLServer_DataFilesSizeKB','Sql&#x20;database&#x20;size&#x20;in&#x20;kb&#x0d;&#x0a;',27,1,0,0,0,0,'','','','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;MSSQLSERVER&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (536,'SQLServer_SQLErrors&#x20;&#x20;','Errors&#x20;/&#x20;sec&#x20;in&#x20;the&#x20;database&#x0d;&#x0a;',27,1,0,0,0,0,'','','','select&#x20;Errors/sec&#x20;&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerSQLErrors&#x20;&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (537,'SQLServer_TotalServerMemoryKB','Specifies&#x20;the&#x20;amount&#x20;of&#x20;memory&#x20;not&#x20;used&#x20;currently&#x20;by&#x20;the&#x20;server.&#x0d;&#x0a;',27,1,0,0,0,0,'','','','select&#x20;TotalServerMemoryKB&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerMemoryManager&#x20;&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (538,'SQLServer_ConnectionMemoryKB','Specifies&#x20;the&#x20;total&#x20;amount&#x20;of&#x20;dynamic&#x20;memory&#x20;the&#x20;server&#x20;is&#x20;using&#x20;for&#x20;maintaining&#x20;connections.',27,1,0,0,0,0,'','','','select&#x20;ConnectionMemoryKB&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerMemoryManager&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (539,'SQLServer_MaxWorkspaceMemoryKB','Indicates&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;memory&#x20;available&#x20;for&#x20;executing&#x20;processes&#x20;such&#x20;as&#x20;hash&#x20;operations,&#x20;sort,&#x20;bulk&#x20;copy,&#x20;and&#x20;index&#x20;creation.',27,1,0,0,0,0,'','','','select&#x20;MaximumWorkspaceMemoryKB&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerMemoryManager&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (540,'SQLServer_UserConnections','Count&#x20;the&#x20;number&#x20;of&#x20;users&#x20;currently&#x20;connected&#x20;to&#x20;SQL&#x20;Server.',27,1,0,0,0,0,'','','','select&#x20;UserConnections&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerGeneralStatistics',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (541,'SQLServer_&#x20;Processesblocked','Number&#x20;of&#x20;processes&#x20;currently&#x20;blocked.',27,1,0,0,0,0,'','','','select&#x20;Processesblocked&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerGeneralStatistics',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (542,'SQLServer_ActiveTempTables','Number&#x20;of&#x20;tables&#x20;or&#x20;table&#x20;variables&#x20;temporary&#x20;used.',27,1,0,0,0,0,'','','','select&#x20;ActiveTempTables&#x20;&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerGeneralStatistics&#x20;&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (543,'SQLServer_TempTablesForDestruction','Number&#x20;of&#x20;tables&#x20;and&#x20;variables&#x20;temporary&#x20;waiting&#x20;tables&#x20;to&#x20;destroy&#x20;the&#x20;thread&#x20;cleaning&#x20;system.',27,1,0,0,0,0,'','','','select&#x20;TempTablesForDestruction&#x20;&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerGeneralStatistics&#x20;&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (544,'SQLServer_BytesReceivedPersec','Number&#x20;of&#x20;bytes&#x20;received&#x20;per&#x20;second.&#x0d;&#x0a;',27,1,0,0,0,0,'','','','select&#x20;BytesReceivedPersec&#x20;&#x20;from&#x20;Win32_PerfFormattedData_MSSQLSERVER_SQLServerDatabaseMirroring',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (545,'SQLServer_BytesSentPersec','Number&#x20;of&#x20;bytes&#x20;sent&#x20;per&#x20;second.&#x0d;&#x0a;',27,1,0,0,0,0,'','','','select&#x20;BytesSentPersec&#x20;&#x20;from&#x20;Win32_PerfFormattedData_MSSQLSERVER_SQLServerDatabaseMirroring&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (546,'SQLServer_LogSendQueueKB','Total&#x20;number&#x20;of&#x20;kilobytes&#x20;of&#x20;log&#x20;that&#x20;have&#x20;not&#x20;yet&#x20;been&#x20;sent&#x20;to&#x20;the&#x20;mirror&#x20;server.&#x0d;&#x0a;',27,1,0,0,0,0,'','','','select&#x20;LogSendQueueKB&#x20;&#x20;from&#x20;Win32_PerfFormattedData_MSSQLSERVER_SQLServerDatabaseMirroring',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (547,'SQLServer_FreeSpaceintempdbKB','The&#x20;amount&#x20;of&#x20;space&#x20;&#40;in&#x20;kilobytes&#41;&#x20;available&#x20;in&#x20;tempdb.',27,1,0,0,0,0,'','','','select&#x20;FreeSpaceintempdbKB&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerTransactions&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (548,'SQLServer_Transactions','Number&#x20;of&#x20;currently&#x20;active&#x20;transactions&#x20;of&#x20;all&#x20;types.',27,1,0,0,0,0,'','','','select&#x20;Transactions&#x20;from&#x20;Win32_PerfRawData_MSSQLSERVER_SQLServerTransactions&#x20;&#x20;&#x20;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (549,'Perf_OracleHandleCount','Returns&#x20;handle&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;HandleCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (550,'Serv_Oracle_1TNSListener','Show&#x20;if&#x20;oracle&#x20;listener&#x20;is&#x20;running&#x0d;&#x0a;',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;Oracle_1TNSListener&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (551,'Serv_Oracle&#x20;&lt;SID&gt;&#x20;VSS&#x20;Writer&#x20;Service','Show&#x20;if&#x20;Serv_Oracle&#x20;VSS&#x20;Writer&#x20;Service&#x20;is&#x20;running&#x0d;&#x0a;&#x0d;&#x0a;',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;Oracle&#x20;ORACLETA&#x20;VSS&#x20;Writer&#x20;Service&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (552,'Serv_OracleDBConsoleORACLE_SID','Show&#x20;if&#x20;OracleDBConsoleORACLE_SID&#x20;is&#x20;running&#x0d;&#x0a;&#x0d;&#x0a;',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;OracleDBConsoleORACLE_SID&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (553,'Serv_Oracle&#x20;OraDb11g_home1&#x20;Clr&#x20;Agent','Show&#x20;if&#x20;Oracle&#x20;OraDb11g_home1&#x20;Clr&#x20;Agent&#x20;is&#x20;up&#x0d;&#x0a;&#x0d;&#x0a;',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;Oracle&#x20;OraDb11g_home1&#x20;Clr&#x20;Agent&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (554,'Serv_OracleJobScheduler&lt;SID&gt;','Show&#x20;if&#x20;OracleJobScheduler&#x20;service&#x20;is&#x20;up&#x0d;&#x0a;&#x0d;&#x0a;',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;OracleJobScheduler&lt;SID&gt;&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (555,'Serv_OracleMTSRecoveryService','Show&#x20;if&#x20;OracleMTSRecoveryService&#x20;is&#x20;running&#x0d;&#x0a;&#x0d;&#x0a;',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;OracleMTSRecoveryService&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (556,'ORACLE_HOME_Paths','Displays&#x20;the&#x20;path&#x20;of&#x20;the&#x20;ORACLE_HOME&#x20;environment&#x20;variable&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;',28,3,0,0,0,0,'','','','SELECT&#x20;VariableValue&#x20;FROM&#x20;Win32_Environment&#x20;WHERE&#x20;Name=&#x20;&quot;ORACLE_HOME&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (557,'Check&#x20;port&#x20;1433/TCP','',27,10,0,0,0,1433,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (558,'Check&#x20;port&#x20;1158/TCP','Comprueba&#x20;el&#x20;estado&#x20;del&#x20;puerto&#x20;HTTP&#x20;de&#x20;la&#x20;Consola&#x20;de&#x20;Enterprise&#x20;Manager&#x20;&#40;Oracle&#41;1158',28,9,0,0,0,1158,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (559,'Check&#x20;port&#x20;3938/TCP','Comprueba&#x20;el&#x20;estado&#x20;del&#x20;puerto&#x20;Puerto&#x20;del&#x20;Agente&#x20;de&#x20;Enterprise&#x20;Manager&#x20;&#40;oracle&#41;&#x0d;&#x0a;',28,9,0,0,0,3938,'','','public','',7,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (560,'Check&#x20;port&#x20;5620/TCP','Comprueba&#x20;el&#x20;estado&#x20;del&#x20;puerto&#x20;HTTP&#x20;para&#x20;Ultra&#x20;Search&#x20;&#40;oracle&#41;&#x0d;&#x0a;',28,9,0,0,0,5620,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (561,'Check&#x20;port&#x20;5560/TCP','Comprueba&#x20;el&#x20;estado&#x20;del&#x20;puerto&#x20;&#x20;HTTP&#x20;para&#x20;iSQL*Plus&#x20;&#40;Oracle&#41;&#x0d;&#x0a;',28,9,0,0,0,5560,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (562,'N360_status&#x20;','Muestra&#x20;si&#x20;el&#x20;antivirus&#x20;Norton&#x20;360&#x20;esta&#x20;corriendo&#x20;o&#x20;no&#x0d;&#x0a;',30,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;N360&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (563,'NortonInternetSecurity_status&#x20;','Muestra&#x20;si&#x20;el&#x20;antivirus&#x20;Norton&#x20;Internet&#x20;Security&#x20;esta&#x20;corriendo&#x20;o&#x20;no&#x0d;&#x0a;&#x0d;&#x0a;',30,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;NIS&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (564,'NortonAntivirus_status&#x20;','Muestra&#x20;si&#x20;el&#x20;antivirus&#x20;Norton&#x20;esta&#x20;corriendo&#x20;o&#x20;no&#x0d;&#x0a;&#x0d;&#x0a;',30,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;NAV&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (565,'NortonIdentifySafe_status&#x20;','Muestra&#x20;si&#x20;el&#x20;Norton&#x20;Identity&#x20;Safe&#x20;esta&#x20;corriendo&#x0d;&#x0a;',30,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;NCO&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (566,'WindowsFirewall_status&#x20;','Show&#x20;if&#x20;&#x20;Firewall&#x20;Windows&#x20;is&#x20;running&#x0d;&#x0a;',29,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;MpsSvc&quot;&#x20;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (567,'WindowsDefender_status','Show&#x20;if&#x20;&#x20;WindowsDefender&#x20;is&#x20;running',29,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;WinDefend&quot;&#x20;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (568,'PandaGlobalProtection_status&#x20;','Show&#x20;if&#x20;PandaGlobalProtection&#x20;is&#x20;running',31,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;Panda&#x20;Software&#x20;Controller&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (569,'PandaFunctionService_status&#x20;','Show&#x20;if&#x20;PandaFunctionService&#x20;is&#x20;running',31,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;PAVFNSVR&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (570,'Panda_Process_Protection_Service_&#x20;status&#x20;','Show&#x20;if&#x20;Panda&#x20;ProcessProtection&#x20;Service&#x20;is&#x20;running',31,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;PavPrSrv&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (571,'Panda_Anti-Malware_Service_status','Show&#x20;if&#x20;&#x20;Panda&#x20;Anti-Malware&#x20;Service&#x20;is&#x20;running',31,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;PAVSRV&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (572,'McAfee_Network_Agent_status&#x20;','Show&#x20;if&#x20;McAfee_Network_Agent&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;McNASvc&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (573,'McAfee_Protection_Manager_status&#x20;','Show&#x20;if&#x20;McAfee_Protection_Manager&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;mcmscsvc&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (574,'McAfee_Scanner_status&#x20;','Show&#x20;if&#x20;McAfee_Scanner&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;McODS&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (575,'McAfee_Proxy_Service_status&#x20;','Show&#x20;if&#x20;McAfee_Proxy_Service&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;McProxy&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (576,'McAfee_Real-time_Scanner_status&#x20;','Show&#x20;if&#x20;McAfee_Real-time_Scanner&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;McShield&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (577,'McAfee_SystemGuards_status&#x20;','Show&#x20;if&#x20;McAfee_SystemGuards&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;McSysmon&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (578,'McAfee_Personal_Firewall_Service_status&#x20;','Show&#x20;if&#x20;McAfee_Personal_Firewall_Service&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;MpfService&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (579,'McAfee_Anti-Spam_Service_status&#x20;','Show&#x20;if&#x20;McAfee_Anti-Spam_Service&#x20;is&#x20;running',32,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;MSK80Service&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (580,'Bitdefender_Virus_Shield_status','Show&#x20;if&#x20;Bitdefender&#x20;Virus&#x20;Shield&#x20;is&#x20;running',33,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;VSSERV&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (581,'BitDefender_Parental_service_status','Show&#x20;if&#x20;BitDefender&#x20;Parental&#x20;Control&#x20;service&#x20;is&#x20;running',33,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BdDesktopParental&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (582,'Bitdefender-Desktop_Update_Service_status','Show&#x20;if&#x20;Bitdefender&#x20;Desktop&#x20;Update&#x20;Service&#x20;is&#x20;running',33,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;UPDATESRV&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (583,'Perf_DNSCachingMemory','Total&#x20;caching&#x20;memory&#x20;used&#x20;by&#x20;DNS&#x20;server.',35,1,0,0,0,0,'','','','select&#x20;CachingMemory&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (584,'Perf_DNSDatabaseNodeMemory','Total&#x20;database&#x20;node&#x20;memory&#x20;used&#x20;by&#x20;DNS&#x20;server.',35,1,0,0,0,0,'','','','select&#x20;DatabaseNodeMemory&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (585,'Perf_DNSDynamicUpdateNoOperation','No-operation/Empty&#x20;dynamic&#x20;update&#x20;requests&#x20;per&#x20;second&#x20;received&#x20;by&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;DynamicUpdateNoOperation&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (586,'Perf_DNSDynamicUpdateQueued','Dynamic&#x20;updates&#x20;queued&#x20;per&#x20;second&#x20;by&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;DynamicUpdateQueued&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (587,'Perf_DNSDynamicUpdateReceived','Dynamic&#x20;update&#x20;requests&#x20;received&#x20;per&#x20;second&#x20;by&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;DynamicUpdateReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (588,'Perf_DNSDynamicUpdateRejected','Dynamic&#x20;updates&#x20;rejected&#x20;per&#x20;second&#x20;by&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;DynamicUpdateRejected&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (589,'Perf_DNSDynamicUpdateTimeOuts','Dynamic&#x20;update&#x20;timeouts&#x20;per&#x20;second&#x20;of&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;DynamicUpdateTimeOuts&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (590,'Perf_DNSDynamicUpdateWrittentoDatabase','Dynamic&#x20;updates&#x20;written&#x20;to&#x20;the&#x20;database&#x20;per&#x20;second&#x20;by&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;DynamicUpdateWrittentoDatabase&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (591,'Perf_DNSNbstatMemory','Total&#x20;Nbstat&#x20;memory&#x20;used&#x20;by&#x20;DNS&#x20;server.',35,1,0,0,0,0,'','','','select&#x20;NbstatMemory&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (592,'Perf_DNSNotifyReceived','Notifies&#x20;received&#x20;per&#x20;second&#x20;by&#x20;the&#x20;secondary&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;NotifyReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (593,'Perf_DNSNotifySent','Notifies&#x20;sent&#x20;per&#x20;second&#x20;by&#x20;the&#x20;master&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;NotifySent&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (594,'Perf_DNSRecordFlowMemory','Total&#x20;record&#x20;flow&#x20;memory&#x20;used&#x20;by&#x20;DNS&#x20;server.',35,1,0,0,0,0,'','','','select&#x20;NbstatMemory&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (595,'Perf_DNSRecursiveQueries','Recursive&#x20;queries&#x20;per&#x20;second&#x20;received&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;RecursiveQueries&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (596,'Perf_DNSRecursiveQueryFailure','Recursive&#x20;query&#x20;failures&#x20;per&#x20;second&#x20;on&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;RecursiveQueryFailure&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (597,'Perf_DNSRecursiveSendTimeOuts','Recursive&#x20;queries&#x20;sending&#x20;timeouts&#x20;per&#x20;second&#x20;on&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;RecursiveSendTimeOuts&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (598,'Perf_DNSSecureUpdateFailure','Secure&#x20;updates&#x20;failed&#x20;per&#x20;second&#x20;of&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;SecureUpdateFailure&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (599,'Perf_DNSSecureUpdateReceived','Secure&#x20;update&#x20;requests&#x20;per&#x20;second&#x20;received&#x20;by&#x20;the&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;SecureUpdateReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (600,'Perf_DNSTCPMessageMemory','Total&#x20;TCP&#x20;message&#x20;memory&#x20;used&#x20;by&#x20;DNS&#x20;server.',35,1,0,0,0,0,'','','','select&#x20;TCPMessageMemory&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (601,'Perf_DNSTCPResponseSent','TCP&#x20;reponses&#x20;per&#x20;second&#x20;sent&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;TCPResponseSent&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (602,'Perf_DNSTotalQueryReceived','Queries&#x20;per&#x20;second&#x20;received&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;TotalQueryReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (603,'Perf_DNSTotalResponseSent','Reponses&#x20;per&#x20;second&#x20;sent&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;TotalResponseSent&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (604,'Perf_DNSUDPMessageMemory','Total&#x20;UDP&#x20;message&#x20;memory&#x20;used&#x20;by&#x20;DNS&#x20;server.',35,1,0,0,0,0,'','','','select&#x20;UDPMessageMemory&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (605,'Perf_DNSTCPQueryReceived','TCP&#x20;queries&#x20;per&#x20;second&#x20;received&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;TCPQueryReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (606,'Perf_DNSUDPQueryReceived','UDP&#x20;queries&#x20;per&#x20;second&#x20;received&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;UDPQueryReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (607,'Perf_DNSUDPResponseSent','UDP&#x20;reponses&#x20;per&#x20;second&#x20;sent&#x20;by&#x20;DNS&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;UDPResponseSent&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (608,'Perf_DNSUnmatchedResponsesReceived','Response&#x20;packets&#x20;per&#x20;second&#x20;received&#x20;by&#x20;the&#x20;DNS&#x20;server&#x20;that&#x20;do&#x20;not&#x20;match&#x20;any&#x20;outstanding&#x20;remote&#x20;query.',35,4,0,0,0,0,'','','','select&#x20;UnmatchedResponsesReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (609,'Perf_DNSWINSLookupReceived','WINS&#x20;lookup&#x20;requests&#x20;per&#x20;second&#x20;received&#x20;by&#x20;the&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;WINSLookupReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (610,'Perf_DNSWINSResponseSent','WINS&#x20;lookup&#x20;responses&#x20;per&#x20;second&#x20;sent&#x20;by&#x20;the&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;WINSResponseSent&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (611,'Perf_DNSWINSReverseLookupReceived','WINS&#x20;reverse&#x20;lookup&#x20;requests&#x20;per&#x20;second&#x20;received&#x20;by&#x20;the&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;WINSReverseLookupReceived&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (612,'Perf_DNSWINSReverseResponseSent','WINS&#x20;Reverse&#x20;lookup&#x20;responses&#x20;per&#x20;second&#x20;sent&#x20;by&#x20;the&#x20;server.',35,4,0,0,0,0,'','','','select&#x20;WINSReverseResponseSent&#x20;from&#x20;Win32_PerfFormattedData_DNS_DNS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (613,'Perf_NTDSABANRPersec','The&#x20;rate&#x20;at&#x20;which&#x20;Address&#x20;Book&#x20;clients&#x20;perform&#x20;Ambiguous&#x20;Name&#x20;Resolutions&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;ABANRPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (614,'Perf_NTDSABBrowsesPersec','AB&#x20;Browses/sec&#x20;is&#x20;the&#x20;rate&#x20;at&#x20;which&#x20;Address&#x20;Book&#x20;clients&#x20;perform&#x20;browse&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;ABBrowsesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (615,'Perf_NTDSABClientSessions','Number&#x20;of&#x20;connected&#x20;Address&#x20;Book&#x20;client&#x20;sessions.',36,1,0,0,0,0,'','','','select&#x20;ABClientSessions&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (616,'Perf_NTDSABMatchesPersec','The&#x20;rate&#x20;at&#x20;which&#x20;Address&#x20;Book&#x20;clients&#x20;perform&#x20;find&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;ABMatchesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (617,'Perf_NTDSABPropertyReadsPersec','The&#x20;rate&#x20;at&#x20;which&#x20;Address&#x20;Book&#x20;clients&#x20;perform&#x20;property&#x20;read&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;ABPropertyReadsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (618,'Perf_NTDSABProxyLookupsPersec','The&#x20;rate&#x20;at&#x20;which&#x20;proxy&#x20;clients&#x20;perform&#x20;search&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;ABProxyLookupsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (619,'Perf_NTDSATQRequestLatency','Average&#x20;length&#x20;of&#x20;time&#x20;&#40;in&#x20;milliseconds&#41;&#x20;to&#x20;process&#x20;a&#x20;request,&#x20;not&#x20;including&#x20;time&#x20;spent&#x20;on&#x20;the&#x20;queue.',36,1,0,0,0,0,'','','','select&#x20;ATQRequestLatency&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (620,'Perf_NTDSATQThreadsLDAP','The&#x20;number&#x20;of&#x20;threads&#x20;that&#x20;ATQ&#x20;has&#x20;currently&#x20;allocated&#x20;to&#x20;servicing&#x20;LDAP&#x20;requests.',36,1,0,0,0,0,'','','','select&#x20;ATQThreadsLDAP&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (621,'Perf_NTDSATQThreadsOther','The&#x20;number&#x20;of&#x20;threads&#x20;that&#x20;the&#x20;ATQ&#x20;has&#x20;currently&#x20;allocated&#x20;to&#x20;DS&#x20;services&#x20;other&#x20;than&#x20;LDAP.',36,1,0,0,0,0,'','','','select&#x20;ATQThreadsOther&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (622,'Perf_NTDSATQThreadsTotal','The&#x20;total&#x20;number&#x20;of&#x20;ATQ&#x20;threads&#x20;that&#x20;are&#x20;either&#x20;waiting&#x20;to&#x20;service&#x20;an&#x20;incoming&#x20;request,&#x20;or&#x20;are&#x20;already&#x20;servicing&#x20;a&#x20;request.',36,1,0,0,0,0,'','','','select&#x20;ATQThreadsTotal&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (623,'Perf_NTDSBasesearchesPersec','The&#x20;number&#x20;of&#x20;base&#x20;searches/sec',36,1,0,0,0,0,'','','','select&#x20;BasesearchesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (624,'Perf_NTDSDatabaseaddsPersec','The&#x20;number&#x20;of&#x20;database&#x20;adds/sec',36,1,0,0,0,0,'','','','select&#x20;DatabaseaddsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (625,'Perf_NTDSDatabasedeletesPersec','The&#x20;number&#x20;of&#x20;database&#x20;deletes/sec',36,1,0,0,0,0,'','','','select&#x20;DatabasedeletesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (626,'Perf_NTDSDatabaserecyclesPersec','The&#x20;number&#x20;of&#x20;database&#x20;recycles/sec',36,1,0,0,0,0,'','','','select&#x20;DatabaserecyclesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (627,'Perf_NTDSDigestBindsPersec','The&#x20;number&#x20;of&#x20;digest&#x20;binds/sec',36,1,0,0,0,0,'','','','select&#x20;DigestBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (628,'Perf_NTDSDRAInboundBytesCompressedBetweenSitesAfterCompressionPersec','Compressed&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;inbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;after&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesCompressedBetweenSitesAfterCompressionPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (629,'Perf_NTDSDRAInboundBytesCompressedBetweenSitesAfterCompressionSinceBoot','Compressed&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;inbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;after&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesCompressedBetweenSitesAfterCompressionSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (630,'Perf_NTDSDRAInboundBytesCompressedBetweenSitesBeforeCompressionSinceBoot','Original&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;inbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;before&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesCompressedBetweenSitesBeforeCompressionSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (631,'Perf_NTDSDRAInboundBytesCompressedBetweenSitesBeforeCompressionPersec','Original&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;inbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;before&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesCompressedBetweenSitesBeforeCompressionPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (632,'Perf_NTDSDRAInboundBytesNotCompressedWithinSitePersec','Number&#x20;of&#x20;bytes&#x20;replicated&#x20;in&#x20;that&#x20;were&#x20;not&#x20;compressed&#x20;at&#x20;the&#x20;source&#x20;&#40;i.e.,&#x20;from&#x20;DSAs&#x20;in&#x20;the&#x20;same&#x20;site&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesNotCompressedWithinSitePersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (633,'Perf_NTDSDRAInboundBytesNotCompressedWithinSiteSinceBoot','Number&#x20;of&#x20;bytes&#x20;replicated&#x20;in&#x20;that&#x20;were&#x20;not&#x20;compressed&#x20;at&#x20;the&#x20;source&#x20;&#40;i.e.,&#x20;from&#x20;DSAs&#x20;in&#x20;the&#x20;same&#x20;site&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesNotCompressedWithinSiteSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (634,'Perf_NTDSDRAInboundBytesTotalPersec','Total&#x20;number&#x20;of&#x20;bytes&#x20;replicated&#x20;in.&#x20;Sum&#x20;of&#x20;the&#x20;number&#x20;of&#x20;uncompressed&#x20;bytes&#x20;&#40;never&#x20;compressed&#41;&#x20;and&#x20;the&#x20;number&#x20;of&#x20;compressed&#x20;bytes&#x20;&#40;a',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesTotalPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (635,'Perf_NTDSDRAInboundBytesTotalSinceBoot','Total&#x20;number&#x20;of&#x20;bytes&#x20;replicated&#x20;in.&#x20;Sum&#x20;of&#x20;the&#x20;number&#x20;of&#x20;uncompressed&#x20;bytes&#x20;&#40;never&#x20;compressed&#41;&#x20;and&#x20;the&#x20;number&#x20;of&#x20;compressed&#x20;bytes&#x20;&#40;a',36,1,0,0,0,0,'','','','select&#x20;DRAInboundBytesTotalSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (636,'Perf_NTDSDRAInboundFullSyncObjectsRemaining','Number&#x20;of&#x20;objects&#x20;remaining&#x20;until&#x20;the&#x20;full&#x20;sync&#x20;completes&#x20;&#40;when&#x20;set&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundFullSyncObjectsRemaining&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (637,'Perf_NTDSDRAInboundLinkValueUpdatesRemaininginPacket','The&#x20;number&#x20;of&#x20;link&#x20;value&#x20;updates&#x20;received&#x20;in&#x20;the&#x20;current&#x20;directory&#x20;replication&#x20;update&#x20;packet&#x20;that&#x20;have&#x20;not&#x20;yet&#x20;been&#x20;applied&#x20;to&#x20;the&#x20;local&#x2',36,1,0,0,0,0,'','','','select&#x20;DRAInboundLinkValueUpdatesRemaininginPacket&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (638,'Perf_NTDSDRAInboundObjectsAppliedPersec','The&#x20;rate&#x20;at&#x20;which&#x20;replication&#x20;updates&#x20;received&#x20;from&#x20;replication&#x20;partners&#x20;are&#x20;applied&#x20;by&#x20;the&#x20;local&#x20;directory&#x20;service.&#x20;This&#x20;count&#x20;excludes&#x20;changes&#x20;',36,1,0,0,0,0,'','','','select&#x20;DRAInboundObjectsAppliedPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (639,'Perf_NTDSDRAInboundObjectsFilteredPersec','Number&#x20;of&#x20;objects&#x20;received&#x20;from&#x20;inbound&#x20;replication&#x20;partners&#x20;that&#x20;contained&#x20;no&#x20;updates&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;applied.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundObjectsFilteredPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (640,'Perf_NTDSDRAInboundObjectsPersec','No&#x20;of&#x20;objects&#x20;received&#x20;from&#x20;neighbors&#x20;through&#x20;inbound&#x20;replication.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundObjectsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (641,'Perf_NTDSDRAInboundObjectUpdatesRemaininginPacket','The&#x20;number&#x20;of&#x20;object&#x20;updates&#x20;received&#x20;in&#x20;the&#x20;current&#x20;directory&#x20;replication&#x20;update&#x20;packet&#x20;that&#x20;have&#x20;not&#x20;yet&#x20;been&#x20;applied&#x20;to&#x20;the&#x20;local&#x20;server.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundObjectUpdatesRemaininginPacket&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (642,'Perf_NTDSDRAInboundPropertiesTotalPersec','Total&#x20;number&#x20;of&#x20;object&#x20;properties&#x20;received&#x20;from&#x20;inbound&#x20;replication&#x20;partners.',36,1,0,0,0,0,'','','','select&#x20;DRAInboundPropertiesTotalPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (643,'Perf_NTDSDRAInboundTotalUpdatesRemaininginPacket','The&#x20;number&#x20;of&#x20;total&#x20;&#40;link&#x20;values&#x20;+&#x20;object&#41;&#x20;updates&#x20;received&#x20;in&#x20;the&#x20;current&#x20;directory&#x20;replication&#x20;update&#x20;packet&#x20;that&#x20;have&#x20;not&#x20;yet&#x20;been&#x2',36,1,0,0,0,0,'','','','select&#x20;DRAInboundTotalUpdatesRemaininginPacket&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (644,'Perf_NTDSDRAInboundValuesDNsonlyPersec','Number&#x20;of&#x20;object&#x20;property&#x20;values&#x20;received&#x20;from&#x20;inbound&#x20;replication&#x20;partners&#x20;that&#x20;are&#x20;Distinguished&#x20;Names;&#x20;i.e.,&#x20;that&#x20;reference&#x20;other&#x20;objects.&#x20;DN-values,&#x',36,1,0,0,0,0,'','','','select&#x20;DRAInboundValuesDNsonlyPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (645,'Perf_NTDSDRAInboundValuesTotalPersec','Total&#x20;number&#x20;of&#x20;object&#x20;property&#x20;values&#x20;received&#x20;from&#x20;inbound&#x20;replication&#x20;partners.&#x20;Each&#x20;inbound&#x20;object&#x20;has&#x20;one&#x20;or&#x20;more&#x20;properties,&#x20;and&#x20;each&#x20;prope',36,1,0,0,0,0,'','','','select&#x20;DRAInboundValuesTotalPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (646,'Perf_NTDSDRAOutboundBytesCompressedBetweenSitesAfterCompressionPersec','Compressed&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;outbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;after&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesCompressedBetweenSitesAfterCompressionPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (647,'Perf_NTDSDRAOutboundBytesCompressedBetweenSitesAfterCompressionSinceBoot','Compressed&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;outbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;after&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesCompressedBetweenSitesAfterCompressionSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (648,'Perf_NTDSDRAOutboundBytesCompressedBetweenSitesBeforeCompressionPersec','Original&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;outbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;before&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesCompressedBetweenSitesBeforeCompressionPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (649,'Perf_NTDSDRAOutboundBytesCompressedBetweenSitesBeforeCompressionSinceBoot','Original&#x20;size&#x20;in&#x20;bytes&#x20;of&#x20;outbound&#x20;compressed&#x20;replication&#x20;data&#x20;&#40;size&#x20;before&#x20;compression,&#x20;from&#x20;DSAs&#x20;in&#x20;other&#x20;sites&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesCompressedBetweenSitesBeforeCompressionSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (650,'Perf_NTDSDRAOutboundBytesNotCompressedWithinSitePersec','Number&#x20;of&#x20;bytes&#x20;replicated&#x20;out&#x20;that&#x20;were&#x20;not&#x20;compressed&#x20;&#40;i.e.,&#x20;from&#x20;DSAs&#x20;in&#x20;the&#x20;same&#x20;site&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesNotCompressedWithinSitePersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (651,'Perf_NTDSDRAOutboundBytesNotCompressedWithinSiteSinceBoot','Number&#x20;of&#x20;bytes&#x20;replicated&#x20;out&#x20;that&#x20;were&#x20;not&#x20;compressed&#x20;&#40;i.e.,&#x20;from&#x20;DSAs&#x20;in&#x20;the&#x20;same&#x20;site&#41;.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesNotCompressedWithinSiteSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (652,'Perf_NTDSDRAOutboundBytesTotalPersec','Total&#x20;number&#x20;of&#x20;bytes&#x20;replicated&#x20;out.&#x20;Sum&#x20;of&#x20;the&#x20;number&#x20;of&#x20;uncompressed&#x20;bytes&#x20;&#40;never&#x20;compressed&#41;&#x20;and&#x20;the&#x20;number&#x20;of&#x20;compressed&#x20;bytes&#x20;&#40;',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesTotalPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (653,'Perf_NTDSDRAOutboundBytesTotalSinceBoot','Total&#x20;number&#x20;of&#x20;bytes&#x20;replicated&#x20;out.&#x20;Sum&#x20;of&#x20;the&#x20;number&#x20;of&#x20;uncompressed&#x20;bytes&#x20;&#40;never&#x20;compressed&#41;&#x20;and&#x20;the&#x20;number&#x20;of&#x20;compressed&#x20;bytes&#x20;&#40;',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundBytesTotalSinceBoot&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (654,'Perf_NTDSDRAOutboundObjectsFilteredPersec','Number&#x20;of&#x20;objects&#x20;looked&#x20;at&#x20;by&#x20;outbound&#x20;replication&#x20;that&#x20;were&#x20;determined&#x20;to&#x20;have&#x20;no&#x20;updates&#x20;that&#x20;the&#x20;outbound&#x20;partner&#x20;did&#x20;not&#x20;already&#x20;have.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundObjectsFilteredPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (655,'Perf_NTDSDRAOutboundObjectsPersec','No&#x20;of&#x20;objects&#x20;replicated&#x20;out.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundObjectsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (656,'Perf_NTDSDRAOutboundPropertiesPersec','No&#x20;of&#x20;properties&#x20;replicated&#x20;out.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundPropertiesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (657,'Perf_NTDSDRAOutboundValuesDNsonlyPersec','Number&#x20;of&#x20;object&#x20;property&#x20;values&#x20;containing&#x20;Distinguished&#x20;Names&#x20;sent&#x20;to&#x20;outbound&#x20;replication&#x20;partners.&#x20;DN-values,&#x20;such&#x20;as&#x20;group&#x20;or&#x20;distribution&#x20;list&#x20;m',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundValuesDNsonlyPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (658,'Perf_NTDSDRAOutboundValuesTotalPersec','Number&#x20;of&#x20;object&#x20;property&#x20;values&#x20;sent&#x20;to&#x20;outbound&#x20;replication&#x20;partners.',36,1,0,0,0,0,'','','','select&#x20;DRAOutboundValuesTotalPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (659,'Perf_NTDSDRAPendingReplicationOperations','The&#x20;total&#x20;number&#x20;of&#x20;replication&#x20;operations&#x20;on&#x20;the&#x20;directory&#x20;that&#x20;are&#x20;queued&#x20;for&#x20;this&#x20;server&#x20;but&#x20;not&#x20;yet&#x20;performed.',36,1,0,0,0,0,'','','','select&#x20;DRAPendingReplicationOperations&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (660,'Perf_NTDSDRAPendingReplicationSynchronizations','DRA&#x20;Pending&#x20;Replication&#x20;Synchronizations&#x20;is&#x20;the&#x20;number&#x20;of&#x20;directory&#x20;synchronizations&#x20;that&#x20;are&#x20;queued&#x20;for&#x20;this&#x20;server&#x20;but&#x20;not&#x20;yet&#x20;processed.',36,1,0,0,0,0,'','','','select&#x20;DRAPendingReplicationSynchronizations&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (661,'Perf_NTDSDRASyncFailuresonSchemaMismatch','No&#x20;of&#x20;sync&#x20;requests&#x20;made&#x20;to&#x20;the&#x20;neighbors&#x20;that&#x20;failed&#x20;because&#x20;their&#x20;schema&#x20;are&#x20;out&#x20;of&#x20;sync.',36,1,0,0,0,0,'','','','select&#x20;DRASyncFailuresonSchemaMismatch&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (662,'Perf_NTDSDRASyncRequestsMade','No&#x20;of&#x20;sync&#x20;requests&#x20;made&#x20;to&#x20;the&#x20;neighbors.',36,1,0,0,0,0,'','','','select&#x20;DRASyncRequestsMade&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (663,'Perf_NTDSDRASyncRequestsSuccessful','No&#x20;of&#x20;sync&#x20;requests&#x20;made&#x20;to&#x20;the&#x20;neighbors&#x20;that&#x20;successfully&#x20;returned.',36,1,0,0,0,0,'','','','select&#x20;DRASyncRequestsSuccessful&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (664,'Perf_NTDSDRAThreadsGettingNCChanges','The&#x20;number&#x20;of&#x20;threads&#x20;on&#x20;the&#x20;server&#x20;which&#x20;are&#x20;currently&#x20;attempting&#x20;to&#x20;acquire&#x20;changes&#x20;from&#x20;another&#x20;server.',36,1,0,0,0,0,'','','','select&#x20;DRAThreadsGettingNCChanges&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (665,'Perf_NTDSDRAThreadsGettingNCChangesHoldingSemaphore','The&#x20;number&#x20;of&#x20;threads&#x20;on&#x20;the&#x20;server&#x20;which&#x20;are&#x20;currently&#x20;attempting&#x20;to&#x20;acquire&#x20;changes&#x20;from&#x20;another&#x20;server&#x20;and&#x20;hold&#x20;a&#x20;semaphore&#x20;required&#x20;to&#',36,1,0,0,0,0,'','','','select&#x20;DRAThreadsGettingNCChangesHoldingSemaphore&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (666,'Perf_NTDSDSClientBindsPersec','Number&#x20;of&#x20;ntdsapi.dll&#x20;binds&#x20;per&#x20;second&#x20;serviced&#x20;by&#x20;this&#x20;DC.',36,1,0,0,0,0,'','','','select&#x20;DSClientBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (667,'Perf_NTDSDSClientNameTranslationsPersec','Number&#x20;of&#x20;ntdsapi.dll&#x20;name&#x20;translations&#x20;per&#x20;second&#x20;serviced&#x20;by&#x20;this&#x20;DC.',36,1,0,0,0,0,'','','','select&#x20;DSClientNameTranslationsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (668,'Perf_NTDSDSDirectoryReadsPersec','Number&#x20;of&#x20;directory&#x20;reads&#x20;per&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;DSDirectoryReadsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (669,'Perf_NTDSDSDirectorySearchesPersec','Number&#x20;of&#x20;directory&#x20;searches&#x20;per&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;DSDirectorySearchesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (670,'Perf_NTDSDSDirectoryWritesPersec','Number&#x20;of&#x20;directory&#x20;writes&#x20;per&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;DSDirectoryWritesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (671,'Perf_NTDSDSMonitorListSize','The&#x20;number&#x20;of&#x20;requests&#x20;to&#x20;be&#x20;notified&#x20;when&#x20;objects&#x20;are&#x20;updated&#x20;that&#x20;are&#x20;currently&#x20;registered&#x20;with&#x20;this&#x20;DSA.',36,1,0,0,0,0,'','','','select&#x20;DSMonitorListSize&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (672,'Perf_NTDSDSNameCachehitrate','The&#x20;percentage&#x20;of&#x20;directory&#x20;object&#x20;name&#x20;component&#x20;look&#x20;ups&#x20;that&#x20;are&#x20;satisfied&#x20;out&#x20;of&#x20;the&#x20;DSA&#039;s&#x20;name&#x20;cache.',36,1,0,0,0,0,'','','','select&#x20;DSNameCachehitrate&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (673,'Perf_NTDSDSNotifyQueueSize','The&#x20;number&#x20;of&#x20;pending&#x20;update&#x20;notifications&#x20;that&#x20;have&#x20;been&#x20;queued,&#x20;but&#x20;not&#x20;yet&#x20;transmitted&#x20;to&#x20;clients.',36,1,0,0,0,0,'','','','select&#x20;DSNotifyQueueSize&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (674,'Perf_NTDSDSSearchsuboperationsPersec','Number&#x20;of&#x20;search&#x20;suboperations&#x20;per&#x20;second.&#x20;One&#x20;search&#x20;operation&#x20;is&#x20;made&#x20;up&#x20;of&#x20;many&#x20;sub&#x20;operations.&#x20;A&#x20;sub&#x20;operation&#x20;roughly&#x20;corresponds&#x20;to&#x20;an',36,1,0,0,0,0,'','','','select&#x20;DSSearchsuboperationsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (675,'Perf_NTDSDSSecurityDescriptorsuboperationsPersec','Number&#x20;of&#x20;Security&#x20;Descriptor&#x20;Propagation&#x20;suboperations&#x20;per&#x20;second.&#x20;One&#x20;Security&#x20;Descriptor&#x20;Propagation&#x20;operation&#x20;is&#x20;made&#x20;up&#x20;of&#x20;many&#x20;sub&#x20;operations.&#x20;A',36,1,0,0,0,0,'','','','select&#x20;DSSecurityDescriptorsuboperationsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (676,'Perf_NTDSDSServerBindsPersec','Number&#x20;of&#x20;DC-to-DC&#x20;binds&#x20;per&#x20;second&#x20;serviced&#x20;by&#x20;this&#x20;DC.',36,1,0,0,0,0,'','','','select&#x20;DSServerBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (677,'Perf_NTDSDSServerNameTranslationsPersec','Number&#x20;of&#x20;DC-to-DC&#x20;name&#x20;translations&#x20;per&#x20;second&#x20;serviced&#x20;by&#x20;this&#x20;DC.',36,1,0,0,0,0,'','','','select&#x20;DSServerNameTranslationsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (678,'Perf_NTDSDSThreadsinUse','DS&#x20;Threads&#x20;in&#x20;Use&#x20;is&#x20;the&#x20;current&#x20;number&#x20;of&#x20;threads&#x20;in&#x20;use&#x20;by&#x20;the&#x20;directory&#x20;service&#x20;&#40;different&#x20;than&#x20;the&#x20;number&#x20;of&#x20;threads&#x20;in&#x20;the&#x2',36,1,0,0,0,0,'','','','select&#x20;DSThreadsinUse&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (679,'Perf_NTDSExternalBindsPersec','The&#x20;number&#x20;of&#x20;external&#x20;binds/sec',36,1,0,0,0,0,'','','','select&#x20;ExternalBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (680,'Perf_NTDSFastBindsPersec','The&#x20;number&#x20;of&#x20;fast&#x20;binds/sec',36,1,0,0,0,0,'','','','select&#x20;FastBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (681,'Perf_NTDSLDAPActiveThreads','LDAP&#x20;Active&#x20;Threads&#x20;is&#x20;the&#x20;current&#x20;number&#x20;of&#x20;threads&#x20;in&#x20;use&#x20;by&#x20;the&#x20;LDAP&#x20;subsystem&#x20;of&#x20;the&#x20;local&#x20;directory&#x20;service.',36,1,0,0,0,0,'','','','select&#x20;LDAPActiveThreads&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (682,'Perf_NTDSLDAPBindTime','Time&#x20;&#40;in&#x20;milliseconds&#41;&#x20;taken&#x20;for&#x20;last&#x20;successful&#x20;LDAP&#x20;bind.',36,1,0,0,0,0,'','','','select&#x20;LDAPBindTime&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (683,'Perf_NTDSLDAPClientSessions','Number&#x20;of&#x20;connected&#x20;LDAP&#x20;client&#x20;sessions.',36,1,0,0,0,0,'','','','select&#x20;LDAPClientSessions&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (684,'Perf_NTDSLDAPClosedConnectionsPersec','The&#x20;number&#x20;of&#x20;LDAP&#x20;connections&#x20;that&#x20;have&#x20;been&#x20;closed&#x20;in&#x20;the&#x20;last&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;LDAPClosedConnectionsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (685,'Perf_NTDSLDAPNewConnectionsPersec','The&#x20;number&#x20;of&#x20;new&#x20;LDAP&#x20;connections&#x20;that&#x20;have&#x20;arrived&#x20;in&#x20;the&#x20;last&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;LDAPNewConnectionsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (686,'Perf_NTDSLDAPNewSSLConnectionsPersec','The&#x20;number&#x20;of&#x20;new&#x20;SSL&#x20;or&#x20;TLS&#x20;connections&#x20;that&#x20;arrived&#x20;in&#x20;the&#x20;last&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;LDAPNewSSLConnectionsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (687,'Perf_NTDSLDAPSearchesPersec','LDAP&#x20;Searches/sec&#x20;is&#x20;the&#x20;rate&#x20;at&#x20;which&#x20;LDAP&#x20;clients&#x20;perform&#x20;search&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;LDAPSearchesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (688,'Perf_NTDSLDAPSuccessfulBindsPersec','Number&#x20;of&#x20;LDAP&#x20;Binds&#x20;per&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;LDAPSuccessfulBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (689,'Perf_NTDSLDAPUDPoperationsPersec','The&#x20;number&#x20;of&#x20;UDP&#x20;operations&#x20;the&#x20;LDAP&#x20;server&#x20;is&#x20;processing&#x20;per&#x20;second.',36,1,0,0,0,0,'','','','select&#x20;LDAPUDPoperationsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (690,'Perf_NTDSLDAPWritesPersec','LDAP&#x20;Writes/sec&#x20;is&#x20;the&#x20;rate&#x20;at&#x20;which&#x20;LDAP&#x20;clients&#x20;perform&#x20;write&#x20;operations.',36,1,0,0,0,0,'','','','select&#x20;LDAPWritesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (691,'Perf_NTDSLinkValuesCleanedPersec','The&#x20;rate&#x20;at&#x20;which&#x20;link&#x20;values&#x20;that&#x20;need&#x20;to&#x20;be&#x20;cleaned&#x20;are&#x20;cleaned.',36,1,0,0,0,0,'','','','select&#x20;LinkValuesCleanedPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (692,'Perf_NTDSNegotiatedBindsPersec','The&#x20;number&#x20;of&#x20;negotiated&#x20;binds/sec',36,1,0,0,0,0,'','','','select&#x20;NegotiatedBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (693,'Perf_NTDSNTLMBindsPersec','The&#x20;number&#x20;of&#x20;NTLM&#x20;binds/sec',36,1,0,0,0,0,'','','','select&#x20;NTLMBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (694,'Perf_NTDSOnelevelsearchesPersec','The&#x20;number&#x20;of&#x20;onelevel&#x20;searches/sec',36,1,0,0,0,0,'','','','select&#x20;OnelevelsearchesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (695,'Perf_NTDSPhantomsCleanedPersec','The&#x20;rate&#x20;at&#x20;which&#x20;stale&#x20;phantoms&#x20;are&#x20;cleaned.',36,1,0,0,0,0,'','','','select&#x20;PhantomsCleanedPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (696,'Perf_NTDSPhantomsVisitedPersec','The&#x20;rate&#x20;at&#x20;which&#x20;phantoms&#x20;are&#x20;visited&#x20;to&#x20;determine&#x20;if&#x20;they&#x20;are&#x20;stale&#x20;and&#x20;need&#x20;to&#x20;be&#x20;cleaned.',36,1,0,0,0,0,'','','','select&#x20;PhantomsVisitedPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (697,'Perf_NTDSSimpleBindsPersec','The&#x20;number&#x20;of&#x20;simple&#x20;binds/sec',36,1,0,0,0,0,'','','','select&#x20;SimpleBindsPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (698,'Perf_NTDSSubtreesearchesPersec','The&#x20;number&#x20;of&#x20;subtree&#x20;searches/sec',36,1,0,0,0,0,'','','','select&#x20;SubtreesearchesPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (699,'Perf_NTDSTombstonesGarbageCollectedPersec','The&#x20;rate&#x20;at&#x20;which&#x20;expired&#x20;tombstoned&#x20;objects&#x20;are&#x20;garbage&#x20;collected.',36,1,0,0,0,0,'','','','select&#x20;TombstonesGarbageCollectedPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (700,'Perf_NTDSTombstonesVisitedPersec','The&#x20;rate&#x20;at&#x20;which&#x20;tombstoned&#x20;objects&#x20;are&#x20;visited&#x20;to&#x20;be&#x20;considered&#x20;for&#x20;garbage&#x20;collected.',36,1,0,0,0,0,'','','','select&#x20;TombstonesVisitedPersec&#x20;from&#x20;Win32_PerfRawData_NTDS_NTDS',3,6,0,'Administrator','none','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (701,'BullGuard_BsBackup_service','The&#x20;BullGuard&#x20;Backup&#x20;service&#x20;enables&#x20;you&#x20;to&#x20;backup&#x20;files&#x20;that&#x20;are&#x20;in&#x20;use&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsBackup&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (703,'BullGuard_BsBhvScan_service','BullGuard&#x20;behavioural&#x20;detection&#x20;service&#x0d;&#x0a;&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsBhvScan&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (704,'BullGuard_BsFileScan_service','The&#x20;BullGuard&#x20;File&#x20;Scan&#x20;service&#x20;performs&#x20;on-access&#x20;scan&#x20;for&#x20;detecting&#x20;malware&#x20;in&#x20;real&#x20;time&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsFileScan&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (705,'BullGuard_firewall_service','BullGuard&#x20;firewall&#x20;service&#x0d;&#x0a;&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsFire&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (706,'BullGuard_BsMailProxy_service','The&#x20;BullGuard&#x20;Behavioural&#x20;Detection&#x20;Service&#x20;is&#x20;an&#x20;anti-virus&#x20;component&#x20;of&#x20;BullGuard&#x20;Internet&#x20;Security&#x0d;&#x0a;&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsMailProxy&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (707,'BullGuard_main_service','BullGuard&#x20;main&#x20;service&#x0d;&#x0a;&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsMain&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (708,'BullGuard_BsScanner_service','The&#x20;BullGuard&#x20;Scan&#x20;Service&#x20;is&#x20;the&#x20;central&#x20;anti-virus&#x20;component&#x20;of&#x20;BullGuard&#x20;Internet&#x20;Security&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsScanner&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (709,'BullGuard_update_service','BullGuard&#x20;update&#x20;service&#x0d;&#x0a;&#x0d;&#x0a;',37,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;BsUpdate&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (710,'Serv_OracleService&lt;SID&gt;','Returns&#x20;OracleService&lt;SID&gt;&#x20;status',28,2,0,0,0,0,'','','','SELECT&#x20;state&#x20;FROM&#x20;Win32_Service&#x20;WHERE&#x20;Name&#x20;=&#x20;&quot;OracleService&lt;SID&gt;&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (711,'Perf_OracleOtherOperationCount','Returns&#x20;other&#x20;operation&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;OtherOperationCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (712,'Perf_OracleOtherTransferCount','Returns&#x20;other&#x20;transfer&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;OtherTransferCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (713,'Perf_OraclePageFaults','Returns&#x20;page&#x20;faults&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;PageFaults&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (714,'Perf_OraclePageFileUsage','Returns&#x20;page&#x20;file&#x20;usage&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;PageFileUsage&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (715,'Perf_OraclePrivatePageCount','Returns&#x20;private&#x20;page&#x20;access&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;PrivatePageCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (716,'Perf_OracleQuotaNonPagedPoolUsage','Returns&#x20;the&#x20;current&#x20;quota&#x20;for&#x20;non&#x20;paged&#x20;pool&#x20;usage&#x20;in&#x20;Oracle&#x20;process.',28,1,0,0,0,0,'','','','select&#x20;QuotaNonPagedPoolUsage&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (717,'Perf_OracleQuotaPagedPoolUsage','Returns&#x20;the&#x20;current&#x20;quota&#x20;for&#x20;paged&#x20;pool&#x20;usage&#x20;in&#x20;Oracle&#x20;process.',28,1,0,0,0,0,'','','','select&#x20;QuotaPagedPoolUsage&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (718,'Perf_OracleReadOperationCount','Returns&#x20;read&#x20;operation&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;ReadOperationCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (719,'Perf_OracleReadTransferCount','Returns&#x20;read&#x20;transfer&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;ReadTransferCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (720,'Perf_OracleThreadCount','Returns&#x20;current&#x20;thread&#x20;count&#x20;for&#x20;Oracle&#x20;process.',28,1,0,0,0,0,'','','','select&#x20;ThreadCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (721,'Perf_OracleWriteOperationCount','Returns&#x20;write&#x20;operation&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;WriteOperationCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (722,'Perf_OracleWriteTransferCount','Returns&#x20;write&#x20;transfer&#x20;count&#x20;per&#x20;second&#x20;for&#x20;Oracle&#x20;process.',28,4,0,0,0,0,'','','','select&#x20;WriteTransferCount&#x20;from&#x20;Win32_Process&#x20;WHERE&#x20;Caption&#x20;=&#x20;&quot;oracle.exe&quot;',7,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (723,'Serv_MSExchangeAB','Microsoft&#x20;Exchange&#x20;MSExchangeAB&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeAB&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (724,'Serv_MSExchangeADTopology','Microsoft&#x20;Exchange&#x20;MSExchangeADTopology&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeADTopology&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (725,'Serv_MSExchangeAntispamUpdate','Microsoft&#x20;Exchange&#x20;MSExchangeAntispamUpdate&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeAntispamUpdate&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (726,'Serv_MSExchangeEdgeSync','Microsoft&#x20;Exchange&#x20;MSExchangeEdgeSync&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeEdgeSync&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (727,'Serv_MSExchangeFBA','Microsoft&#x20;Exchange&#x20;MSExchangeFBA&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeFBA&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (728,'Serv_MSExchangeFDS','Microsoft&#x20;Exchange&#x20;MSExchangeFDS&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeFDS&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (729,'Serv_MSExchangeImap4','Microsoft&#x20;Exchange&#x20;MSExchangeImap4&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeImap4&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (730,'Serv_MSExchangeIS','Microsoft&#x20;Exchange&#x20;MSExchangeIS&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeIS&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (731,'Serv_MSExchangeMailboxAssistants','Microsoft&#x20;Exchange&#x20;MSExchangeMailboxAssistants&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeMailboxAssistants&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (732,'Serv_MSExchangeMailboxReplication','Microsoft&#x20;Exchange&#x20;MSExchangeMailboxReplication&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeMailboxReplication&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (733,'Serv_MSExchangeMailSubmission','Microsoft&#x20;Exchange&#x20;MSExchangeMailSubmission&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeMailSubmission&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (734,'Serv_MSExchangePop3','Microsoft&#x20;Exchange&#x20;MSExchangePop3&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangePop3&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (735,'Serv_MSExchangeProtectedServiceHost','Microsoft&#x20;Exchange&#x20;MSExchangeProtectedServiceHost&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeProtectedServiceHost&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (736,'Serv_MSExchangeRepl','Microsoft&#x20;Exchange&#x20;MSExchangeRepl&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeRepl&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (737,'Serv_MSExchangeRPC','Microsoft&#x20;Exchange&#x20;MSExchangeRPC&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeRPC&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (738,'Serv_MSExchangeSA','Microsoft&#x20;Exchange&#x20;MSExchangeSA&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeSA&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (739,'Serv_MSExchangeSearch','Microsoft&#x20;Exchange&#x20;MSExchangeSearch&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeSearch&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (740,'Serv_MSExchangeSearchB','Microsoft&#x20;Exchange&#x20;msftesql-Exchange&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;msftesql-Exchange&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (741,'Serv_MSExchangeServiceHost','Microsoft&#x20;Exchange&#x20;MSExchangeServiceHost&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeServiceHost&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (742,'Serv_MSExchangeThrottling','Microsoft&#x20;Exchange&#x20;MSExchangeThrottling&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeThrottling&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (743,'Serv_MSExchangeTransport','Microsoft&#x20;Exchange&#x20;MSExchangeTransport&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeTransport&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (744,'Serv_MSExchangeTransportLogSearch','Microsoft&#x20;Exchange&#x20;MSExchangeTransportLogSearch&#x20;service&#x20;status.',26,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSExchangeTransportLogSearch&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (745,'Serv_W3SVC','Microsoft&#x20;IIS&#x20;W3SVC&#x20;service&#x20;status.',38,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;W3SVC&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (746,'Serv_SMTPSVC','Microsoft&#x20;IIS&#x20;SMTPSVC&#x20;service&#x20;status.',38,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;SMTPSVC&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (747,'Serv_NNTPSVC','Microsoft&#x20;IIS&#x20;NNTPSVC&#x20;service&#x20;status.',38,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;NNTPSVC&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (749,'Serv_MSFTPSVC','Microsoft&#x20;IIS&#x20;MSFTPSVC&#x20;service&#x20;status.',38,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;MSFTPSVC&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (750,'Serv_WinRM','Microsoft&#x20;Windows&#x20;WinRM&#x20;service&#x20;status.',16,2,0,0,300,0,'','','Running','Select&#x20;State&#x20;from&#x20;Win32_Service&#x20;WHERE&#x20;name&#x20;=&#x20;&#039;WinRM&#039;',3,6,0,'Administrador','6683','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (751,'Check&#x20;port&#x20;59535/TCP','Checks&#x20;59535/TCP&#x20;Port&#x20;status.',39,9,0,0,0,59535,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (752,'Check&#x20;port&#x20;59536/TCP','Checks&#x20;59536/TCP&#x20;Port&#x20;status.',39,9,0,0,0,59536,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (753,'Check&#x20;RPC&#x20;Server','Checks&#x20;RPC&#x20;Port&#x20;status.',39,9,0,0,0,135,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (754,'Check&#x20;POP3&#x20;Server','Checks&#x20;POP3&#x20;Port&#x20;status.',39,9,0,0,0,110,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (755,'Check&#x20;IMAP4&#x20;Server','Checks&#x20;IMAP4&#x20;Port&#x20;status.',39,9,0,0,0,143,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (756,'Check&#x20;SMTP&#x20;Server','Checks&#x20;SMTP&#x20;Port&#x20;status.',39,9,0,0,0,25,'','','public','',3,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (757,'AVGIDSAgent_status','Show&#x20;if&#x20;AVGIDSAgent&#x20;is&#x20;running&#x0d;&#x0a;',40,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;AVGIDSAgent&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (758,'AVG_watchdog_status','Show&#x20;if&#x20;AVG&#x20;watchdog&#x20;is&#x20;running&#x0d;&#x0a;',40,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;avgwd&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (759,'AVG_firewall_status','Show&#x20;if&#x20;AVG&#x20;firewall&#x20;is&#x20;running&#x0d;&#x0a;',40,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;avgfws&quot;&#x20;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (760,'KIS_service_status','Show&#x20;if&#x20;KIS&#x20;antivirus&#x20;is&#x20;running&#x0d;&#x0a;',41,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;ksvsvc&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (761,'Serv_NTDS','Checks&#x20;if&#x20;NTDS&#x20;service&#x20;is&#x20;running',18,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name=&quot;NTDS&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (762,'Serv_DNS','Checks&#x20;if&#x20;DNS&#x20;service&#x20;is&#x20;running',34,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name=&quot;DNS&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (763,'KIS_KLBLMain_status','Show&#x20;if&#x20;KIS&#x20;antivirus&#x20;is&#x20;running&#x0d;&#x0a;',41,2,0,0,0,0,'','','Running','select&#x20;state&#x20;from&#x20;Win32_Service&#x20;where&#x20;name&#x20;=&#x20;&quot;KLBLMain&quot;',3,6,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (764,'MongoDB&#x20;Port&#x20;Check','Remote&#x20;check&#x20;of&#x20;standard&#x20;TCP&#x20;port&#x20;of&#x20;MongoDB&#x20;Server.',15,9,0,0,0,27017,'','','public','',7,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (765,'PostgreSQL&#x20;Remote&#x20;Port&#x20;check','Check&#x20;remote&#x20;port&#x20;on&#x20;PostgreSQL&#x20;Server.',15,9,0,0,0,5432,'','','public','',7,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (766,'DBSelects','Number&#x20;of&#x20;selects&#x20;on&#x20;database',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Com_select\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (767,'DBUpdates','Number&#x20;of&#x20;updates&#x20;on&#x20;database',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Com_update\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (768,'InnoDB_Rows_Read','Rows&#x20;read&#x20;on&#x20;InnoDB&#x20;engine',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Innodb_rows_read\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (769,'DB_Connections','Current&#x20;connections&#x20;on&#x20;database',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Connections\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (770,'Qcache_not_cached','Cache&#x20;hit&#x20;missing&#x20;&#40;queries&#x20;not&#x20;cached&#41;',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Qcache_not_cached\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (771,'Table_locks_waited','Table&#x20;locks&#x20;waited',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Table_locks_waited\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (772,'Slow_launch_threads','Slow&#x20;launch&#x20;threads',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Slow_launch_threads\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (773,'Qcache_hits','Queries&#x20;cached&#x20;successfully',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Qcache_hits\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (774,'Innodb_data_pending_reads','InnoDB&#x20;engine&#x20;pending&#x20;reads',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Innodb_data_pending_reads\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (775,'Aborted_connects','Aborted&#x20;connection&#x20;attempts',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Aborted_connects\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (776,'Bytes_received','Bytes&#x20;received&#x20;by&#x20;database&#x20;&#40;global&#41;',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Bytes_received\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (777,'Bytes_sent','Bytes_sent&#x20;by&#x20;database&#x20;&#40;global&#41;',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Bytes_sent\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (778,'MySQL_Updates','Updates&#x20;per&#x20;second',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Com_update\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (779,'MySQL_Deletes','Deletes&#x20;per&#x20;second',42,4,0,0,300,0,'','','','',6,4,6,'','','',0,0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','basic','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"IP&#x20;address\",\"help\":\"IP&#x20;address\",\"value\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"Username&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"Password&#x20;to&#x20;access&#x20;to&#x20;database\",\"value\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Query&#x20;string\",\"help\":\"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;\",\"value\":\"Com_delete\"}}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (780,'MySQL&#x20;Port','Check&#x20;MySql&#x20;Port',42,9,0,0,300,3306,'','','public','',2,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (781,'Check&#x20;Oracle&#x20;Listener&#x20;Port','Check&#x20;Oracle&#x20;Listener&#x20;Port',28,9,0,0,300,1521,'','','public','',2,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (782,'Check_MSSQLServer_Port','Check&#x20;port&#x20;MSSQL&#x20;Server',27,9,0,0,300,1433,'','','public','',2,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (783,'Check&#x20;Informix&#x20;Port','',19,9,0,0,300,1526,'','','public','',2,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `wizard_level`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `tags`, `disabled_types_event`, `module_macros`) VALUES (784,'Check&#x20;port&#x20;DB2','',49,9,0,0,300,50000,'','','public','',2,2,0,'','','',0,1,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.0000000000000,'basic','','','','','','');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`) VALUES (785,'Packet&#x20;Loss','Measure&#x20;packet&#x20;loss&#x20;in&#x20;the&#x20;network,&#x20;using&#x20;a&#x20;flood&#x20;ping&#x20;&#40;50&#x20;ping&#x20;in&#x20;8&#x20;secons&#41;&#x20;and&#x20;counting&#x20;back&#x20;missing&#x20;packets.&#x20;It&#x20;should&#x20;be&#x20;zero&#x20;on&#x20;most&#x20;cases.&#x20;',10,1,0,0,300,0,'','','','',2,4,9,'','','',0,0,1,10.00,0.00,'',30.00,0.00,'',0,'','','',0,0,0.00000,'%','nowizard','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Test&#x20;time\",\"help\":\"\",\"value\":\"8\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Target&#x20;IP\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"}}','You&#x20;should&#x20;check&#x20;manually&#x20;the&#x20;packet&#x20;loss&#x20;of&#x20;the&#x20;network&#x20;with&#x20;a&#x20;flood&#x20;ping&#x20;on&#x20;targeted&#x20;host&#x20;&#40;ping&#x20;-c&#x20;100&#x20;-f&#x20;xxxx&#41;.&#x20;Aditionally,&#x20;and&#x20;due&#x20;the&#x20;major&#x20;packet&#x20;loss,&#x20;probably&#x20;you&#x20;can&#x20;see&#x20;a&#x20;simple&#x20;ping&#x20;failing&#x20;here.&#x20;Check&#x20;your&#x20;network&#x20;equipment.','You&#x20;should&#x20;check&#x20;manually&#x20;the&#x20;packet&#x20;loss&#x20;of&#x20;the&#x20;network&#x20;with&#x20;a&#x20;flood&#x20;ping&#x20;on&#x20;targeted&#x20;host&#x20;&#40;ping&#x20;-c&#x20;100&#x20;-f&#x20;xxxx&#41;','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0);
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `max_critical`, `str_warning`, `min_ff_event`, `min_critical`, `custom_string_2`, `str_critical`, `custom_integer_1`) VALUES (786,'N.&#x20;total&#x20;processes','Number&#x20;of&#x20;running&#x20;processes&#x20;in&#x20;a&#x20;Windows&#x20;system.',11,34,0,0,300,0,'tasklist&#x20;/NH&#x20;|&#x20;find&#x20;/c&#x20;/v&#x20;&quot;&quot;','','','',6,2,0,'','','',0,0,1,0,0,'0.00','',0,'',0,'','windows');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `max_critical`, `str_warning`, `min_ff_event`, `min_critical`, `custom_string_2`, `str_critical`, `custom_integer_1`) VALUES (787,'Free&#x20;space&#x20;in&#x20;C:','Free&#x20;space&#x20;available&#x20;in&#x20;C:',11,34,0,0,300,0,'powershell&#x20;$obj=&#40;Get-WmiObject&#x20;-class&#x20;&quot;Win32_LogicalDisk&quot;&#x20;-namespace&#x20;&quot;root&#92;CIMV2&quot;&#41;&#x20;;&#x20;$obj.FreeSpace[0]&#x20;*&#x20;100&#x20;/$obj.Size[0]','','','',4,2,0,'','','',0,0,1,0,0,'0.00','',0,'',0,'','windows');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `max_critical`, `str_warning`, `min_ff_event`, `min_critical`, `custom_string_2`, `str_critical`, `custom_integer_1`) VALUES (789,'Linux&#x20;processes','Running&#x20;processes',43,34,0,0,300,0,'ps&#x20;elf&#x20;|&#x20;wc&#x20;-l','','','',6,2,0,'','','',0,0,1,0,0,'0.00','',0,'',0,'','linux');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `max_critical`, `str_warning`, `min_ff_event`, `min_critical`, `custom_string_2`, `str_critical`, `custom_integer_1`) VALUES (791,'Linux&#x20;available&#x20;memory&#x20;percent','Available&#x20;memory&#x20;%',43,34,0,0,300,0,'free&#x20;|&#x20;grep&#x20;Mem&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$NF/$2&#x20;*&#x20;100}&#039;','','','',4,2,0,'','','',0,0,1,0,0,'0.00','',0,'',0,'','linux');
INSERT INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `max_critical`, `str_warning`, `min_ff_event`, `min_critical`, `custom_string_2`, `str_critical`, `custom_integer_1`) VALUES (792,'Linux&#x20;available&#x20;disk&#x20;/','Available&#x20;free&#x20;space&#x20;in&#x20;mountpoint&#x20;/',43,34,0,0,300,0,'df&#x20;/&#x20;|&#x20;tail&#x20;-n&#x20;+2&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$&#40;NF-1&#41;}&#039;&#x20;|&#x20;tr&#x20;-d&#x20;&#039;%&#039;','','','',4,2,0,'','','',0,0,1,0,0,'0.00','',0,'',0,'','inherited');

--
-- Dumping data for table `tnetwork_component_group`
--

INSERT INTO `tnetwork_component_group` VALUES (1,'General group',0);
INSERT INTO `tnetwork_component_group` VALUES (2,'Cisco MIBs',10);
INSERT INTO `tnetwork_component_group` VALUES (5,'UNIX&#x20;Systems',12);
INSERT INTO `tnetwork_component_group` VALUES (10,'Network Management',0);
INSERT INTO `tnetwork_component_group` VALUES (11,'Microsoft&#x20;Windows',12);
INSERT INTO `tnetwork_component_group` VALUES (12,'Operating Systems',0);
INSERT INTO `tnetwork_component_group` VALUES (13,'UCD Mibs (Linux, UCD-SNMP)',12);
INSERT INTO `tnetwork_component_group` VALUES (14,'WMI',12);
INSERT INTO `tnetwork_component_group` VALUES (15,'Databases',0);
INSERT INTO `tnetwork_component_group` VALUES (16,'Windows System',14);
INSERT INTO `tnetwork_component_group` VALUES (17,'Windows Hardware Layer',14);
INSERT INTO `tnetwork_component_group` VALUES (18,'Windows AD ',14);
INSERT INTO `tnetwork_component_group` VALUES (19,'Windows IIS ',14);
INSERT INTO `tnetwork_component_group` VALUES (20,'Windows Exchange',14);
INSERT INTO `tnetwork_component_group` VALUES (21,'Windows LDAP ',14);
INSERT INTO `tnetwork_component_group` VALUES (22,'Windows MSDTC  ',14);
INSERT INTO `tnetwork_component_group` VALUES (23,'Catalyst 2900  ',2);
INSERT INTO `tnetwork_component_group` VALUES (24,'Windows Printers',14);
INSERT INTO `tnetwork_component_group` VALUES (25,'Citrix',0);
INSERT INTO `tnetwork_component_group` VALUES (26,'Exchange&#x20;Services',20);
INSERT INTO `tnetwork_component_group` VALUES (27,'MS&#x20;SQL&#x20;Server',15);
INSERT INTO `tnetwork_component_group` VALUES (28,'Oracle',15);
INSERT INTO `tnetwork_component_group` VALUES (29,'Antivirus',0);
INSERT INTO `tnetwork_component_group` VALUES (30,'Norton',29);
INSERT INTO `tnetwork_component_group` VALUES (31,'Panda',29);
INSERT INTO `tnetwork_component_group` VALUES (32,'McAfee',29);
INSERT INTO `tnetwork_component_group` VALUES (33,'Bitdefender',29);
INSERT INTO `tnetwork_component_group` VALUES (34,'Windows&#x20;DNS',14);
INSERT INTO `tnetwork_component_group` VALUES (35,'DNS&#x20;Counters',34);
INSERT INTO `tnetwork_component_group` VALUES (36,'AD&#x20;Counters',18);
INSERT INTO `tnetwork_component_group` VALUES (37,'BullGuard',29);
INSERT INTO `tnetwork_component_group` VALUES (38,'IIS&#x20;services',19);
INSERT INTO `tnetwork_component_group` VALUES (39,'Exchange&#x20;TCP&#x20;Ports',20);
INSERT INTO `tnetwork_component_group` VALUES (40,'AVG',29);
INSERT INTO `tnetwork_component_group` VALUES (41,'Kaspersky',29);
INSERT INTO `tnetwork_component_group` VALUES (42,'MySQL',15);
INSERT INTO `tnetwork_component_group` VALUES (43,'Linux',5);
INSERT INTO `tnetwork_component_group` VALUES (44,'HP-UX',5);
INSERT INTO `tnetwork_component_group` VALUES (45,'Solaris',5);
INSERT INTO `tnetwork_component_group` VALUES (46,'AIX',5);
INSERT INTO `tnetwork_component_group` VALUES (47,'BSD',5);
INSERT INTO `tnetwork_component_group` VALUES (48,'MacOS',0);
INSERT INTO `tnetwork_component_group` VALUES (49,'DB2',15);


-- Network profile

INSERT INTO `tnetwork_profile` (`id_np`, `name`, `description`) VALUES (2,'Basic&#x20;Monitoring','Only&#x20;checks&#x20;for&#x20;availability&#x20;and&#x20;latency&#x20;of&#x20;targeted&#x20;hosts.');
INSERT INTO `tnetwork_profile` (`id_np`, `name`, `description`) VALUES (3,'Basic DMZ Server monitoring','This group of network checks, checks for default services located on DMZ servers...');
INSERT INTO `tnetwork_profile` (`id_np`, `name`, `description`) VALUES (7,'Linux&#x20;Server&#x20;with&#x20;SNMP','Group&#x20;of&#x20;&quot;basic&quot;&#x20;modules&#x20;for&#x20;SNMP&#x20;monitoring&#x20;of&#x20;Linux&#x20;remote&#x20;devices.&#x20;This&#x20;includes&#x20;basic&#x20;conectivity&#x20;checks&#x20;and&#x20;a&#x20;full&#x20;range&#x20;of&#x20;System');

-- Network profile components

INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (34,2);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (34,3);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (37,3);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (39,3);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (38,3);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (4,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (34,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (30,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (27,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (24,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (49,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (51,7);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (36,2);
INSERT INTO `tnetwork_profile_component` (`id_nc`, `id_np`) VALUES (36,3);

--
-- Dumping data for table `tlocal_component`
--

INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (1,'Event&#x20;1000','module_begin\r\nmodule_name Event_1000-Citrix\r\nmodule_description\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source application\r\nmodule_eventtype\r\nmodule_eventcode 1000\r\nmodule_application\r\nmodule_end ','',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (2,'Event&#x20;1004','module_begin\r\nmodule_name Event_1004-Citrix\r\nmodule_description\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source application\r\nmodule_eventtype\r\nmodule_eventcode 1004\r\nmodule_application\r\nmodule_end ','',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (3,'Event&#x20;1202','module_begin\r\nmodule_name Event_1202-Citrix\r\nmodule_description\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source application\r\nmodule_eventtype\r\nmodule_eventcode 1202\r\nmodule_application\r\nmodule_end\r\nn ','',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (4,'Event&#x20;3621','module_begin\r\nmodule_name Event_3621\nr\nmodule_description Citrix cannot connect SQL server\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source application\r\nmodule_eventtype Error\r\nmodule_eventcode 3621\r\nmodule_application\r\nmodule_end ','Citrix cannot connect SQL server',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (5,'Event&#x20;9014','module_begin\r\nmodule_name Event_9014\nr\nmodule_description Invalid licence\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source system\r\nmodule_eventtype Error\r\nmodule_eventcode 9014\r\nmodule_application MetaFrame\r\nmodule_end ','Invalid licence',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (6,'Event&#x20;5774','module_begin\r\nmodule_name Event_5774\nr\nmodule_description Server goes to grace period (Not enough licences)\r\ndurante 96hr).\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source system\r\nmodule_eventtype Error\r\n\nmodule_eventcode 5774\r\nmodule_application MetaFrame\r\nmodule_end ','Server goes to grace period (Not enough licences)',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (7,'Event&#x20;1388','module_begin\r\nmodule_name Event_1388\nr\nmodule_description Citrix internal monitoring\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source application\r\nmodule_eventtype\r\nmodule_eventcode 1388\r\nmodule_application HCAService\r\nmodule_end ','Citrix internal monitoring',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (8,'Event&#x20;3961','module_begin\r\nmodule_name Event_3961\nr\nmodule_description The Data Collector is out of memory, and the Dynamic Store data might be out of sync. Please elect a new Data Collector and make sure you have enough memory on the new Data Collector\r\nmodule_type async_string\r\nmodule_logevent\r\nmodule_source System\r\nmodule_eventtype\r\nmodule_eventcode 3961\r\nmodule_application\r\nmodule_end ','The Data Collector is out of memory, and the Dynamic Store data might be out of sync. Please elect a new Data Collector and make sure you have enough memory on the new Data Collector',9,'',25,23,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (9,'Serv_HCA','module_begin\r\nmodule_name Serv_HCA\r\nmodule_description\r\nmodule_type generic_proc\r\nmodule_service HCAService\r\nmodule_end ','',9,'',25,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (10,'Serv_CTXcpusvnc','module_begin\r\nmodule_name Serv_CTXcpusvnc\r\nmodule_description\r\nmodule_type generic_proc\r\nmodule_service CTXCpuusync\r\n\nmodule_end ','',9,'',25,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (11,'Serv_IMA','module_begin\r\nmodule_name Serv_IMA\r\n\nmodule_description\r\nmodule_type generic_proc\r\nmodule_service IMAService\r\nmodule_end ','',9,'',25,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (13,'Serv_CTXSMA','module_begin\r\nmodule_name Serv_CTXSMA\r\nmodule_description\r\nmodule_type generic_proc\r\nmodule_service Citrix SMA Service\r\nmodule_end','',9,'',25,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (14,'Citrix_Sessions','module_begin\r\nmodule_name Citrix_Sessions\r\nmodule_description Opened active sessions on server\r\nmodule_type generic_data\r\nmodule_exec query session | grep Active | wc -l\r\nmodule_end ','Opened active sessions on server',9,'',25,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (15,'Users_Connected','module_begin\r\nmodule_name Users_Connected\r\nmodule_description Users connected to this server\r\nmodule_type generic_data\r\nmodule_exec quser | grep Active | wc -l\r\nmodule_interval 2\r\nmodule_end\r\n ','Users connected to this server',9,'',25,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (16,'Busy&#x20;XML&#x20;Threads','module_begin\r\nmodule_name Busy XML Threads\r\nmodule_description Total threads in the manager who manage the sessions. If there are more than XX, service fails. NOTE: Run this module only in managers\r\nmodule_type generic_data\r\nmodule_exec Typeperf &#039;&#92;&#92;MAQUINA&#92;Citrix Metaframe Presentation Server&#92;Number of busy XML threads&#039; -sc 1\r\nmodule_end\r\n','Total threads in the manager who manage the sessions. If there are more than XX, service fails. NOTE: Run this module only in managers',9,'',25,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (17,'CPU&#x20;Load','module_begin&#x0d;&#x0a;module_name&#x20;CPU&#x20;Load&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_wmiquery&#x20;SELECT&#x20;LoadPercentage&#x20;FROM&#x20;Win32_Processor&#x0d;&#x0a;module_wmicolumn&#x20;LoadPercentage&#x0d;&#x0a;module_description&#x20;CPU&#x20;Load&#x20;&#40;%&#41;&#x0d;&#x0a;module_min_warning&#x20;80&#x0d;&#x0a;module_max_warning&#x20;90&#x0d;&#x0a;module_min_critical&#x20;91&#x0d;&#x0a;module_max_critical&#x20;0&#x0d;&#x0a;module_end','CPU&#x20;Load&#x20;&#40;using&#x20;WMI&#41;',9,'',11,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (18,'FreeMemory','#&#x20;Free&#x20;Memory&#x0d;&#x0a;module_begin&#x0d;&#x0a;module_name&#x20;FreeMemory&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_freepercentmemory&#x0d;&#x0a;module_description&#x20;Free&#x20;memory&#x20;&#40;%&#41;.&#x0d;&#x0a;module_min_warning&#x20;21&#x0d;&#x0a;module_max_warning&#x20;30&#x0d;&#x0a;module_min_critical&#x20;0&#x0d;&#x0a;module_max_critical&#x20;20&#x0d;&#x0a;module_end','Free&#x20;memory&#x20;&#40;%&#41;.',9,'',11,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (19,'Microsoft&#x20;Antivirus','module_begin&#x0d;&#x0a;module_name&#x20;Microsoft&#x20;Antivirus&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_service&#x20;MsMpSvc&#x0d;&#x0a;module_description&#x20;Check&#x20;if&#x20;microsoft&#x20;antivirus/malware&#x20;service&#x20;is&#x20;running&#x0d;&#x0a;module_end','Check&#x20;if&#x20;microsoft&#x20;antivirus/malware&#x20;service&#x20;is&#x20;running',9,'',11,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (21,'Microsoft&#x20;Firewall','module_begin&#x0d;&#x0a;module_name&#x20;Microsoft&#x20;Firewall&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_service&#x20;MpsSvc&#x0d;&#x0a;module_description&#x20;Microsoft&#x20;windows&#x20;firewall&#x20;status.&#x0d;&#x0a;module_end','Microsoft&#x20;windows&#x20;firewall&#x20;status.',9,'',11,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (22,'Kaspersky&#x20;Antivirus','module_begin&#x0d;&#x0a;module_name&#x20;Kaspersky&#x20;Antivirus&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_service&#x20;AVP&#x0d;&#x0a;module_description&#x20;Kaspersky&#x20;Antivirus&#x0d;&#x0a;module_end','Checks&#x20;Karspersky&#x20;Antivirus&#x20;service&#x20;status',9,'',11,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (23,'CPU&#x20;Free','module_begin&#x20;&#x0d;&#x0a;module_name&#x20;&#x20;CPU&#x20;Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;echo&#x20;$&#40;&#40;&#x20;100-`vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$15&#x20;}&#039;`&#41;&#41;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;Percentage&#x20;CPU&#x20;Free&#x0d;&#x0a;module_end','Percentage&#x20;of&#x20;free&#x20;CPU',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (24,'Load&#x20;Average','module_begin&#x0d;&#x0a;module_name&#x20;Load&#x20;Average&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;uptime&#x20;|&#x20;awk&#x20;-F&#x20;&quot;,&quot;&#x20;&#039;{print&#x20;$3}&#039;&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$3}&#039;&#x20;|&#x20;tr&#x20;&shy;d&#x20;&quot;&#92;n&quot;&#x0d;&#x0a;module_description&#x20;Average&#x20;load&#x20;last&#x20;minute&#x0d;&#x0a;module_end&#x0d;&#x0a;','Load&#x20;average&#x20;for&#x20;last&#x20;minute',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (25,'Memory&#x20;Free','module_begin&#x0d;&#x0a;module_name&#x20;Memory&#x20;Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_freepercentmemory&#x0d;&#x0a;module_description&#x20;Percentage&#x20;Mem&#x20;Free&#x0d;&#x0a;module_end&#x0d;&#x0a;','Percentage&#x20;of&#x20;free&#x20;memory',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (26,'Disk&#x20;Free','module_begin&#x0d;&#x0a;module_name&#x20;Disk&#x20;Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_freepercentdisk&#x20;/&#x0d;&#x0a;module_description&#x20;&#x20;Percentage&#x20;Free&#x20;Disk&#x0d;&#x0a;module_end&#x0d;&#x0a;','Percentage&#x20;of&#x20;free&#x20;disk',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (27,'SSH&#x20;Status','module_begin&#x0d;&#x0a;module_name&#x20;SSH&#x20;Status&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_exec&#x20;ps&#x20;-Af&#x20;|&#x20;grep&#x20;sshd&#x20;|&#x20;grep&#x20;-v&#x20;&quot;grep&quot;&#x20;|&#x20;wc&#x20;-l&#x0d;&#x0a;module_description&#x20;Check&#x20;ssh&#x20;service&#x0d;&#x0a;module_end','Monitors&#x20;SSH&#x20;server&#x20;status',1,'',43,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (28,'Free&#x20;i-nodes','module_begin&#x0d;&#x0a;module_name&#x20;Free&#x20;i-nodes&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-i&#x20;|&#x20;grep&#x20;-E&#x20;&quot;/$&quot;&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;100-&#40;&#40;$3/$2&#41;*100&#41;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;Percentage&#x20;Free&#x20;i-nodes&#x0d;&#x0a;module_end&#x0d;&#x0a;','Percentage&#x20;of&#x20;free&#x20;i-nodes',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (29,'FreeDiskC','module_begin&#x0d;&#x0a;module_name&#x20;FreeDiskC&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_freepercentdisk&#x20;C:&#x0d;&#x0a;module_description&#x20;Free&#x20;space&#x20;on&#x20;drive&#x20;C:&#x20;&#40;%&#41;&#x0d;&#x0a;module_min_warning&#x20;31&#x0d;&#x0a;module_max_warning&#x20;40&#x0d;&#x0a;module_min_critical&#x20;0&#x0d;&#x0a;module_max_critical&#x20;30&#x0d;&#x0a;module_end&#x0d;&#x0a;','Free&#x20;space&#x20;on&#x20;disk&#x20;C:&#x20;&#40;%&#41;',9,'',11,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (30,'Windows_Update_LastRun','module_begin&#x0d;&#x0a;module_name&#x20;Windows_Update_LastRun&#x0d;&#x0a;module_type&#x20;generic_data_string&#x0d;&#x0a;module_exec&#x20;getreg&#x20;LM&#x20;&quot;SOFTWARE&#92;Microsoft&#92;Windows&#92;CurrentVersion&#92;WindowsUpdate&#92;Auto&#x20;Update&quot;&#x20;SetupWizardLaunchTime&#x0d;&#x0a;module_description&#x20;Last&#x20;date&#x20;and&#x20;time&#x20;user&#x20;launch&#x20;microsoft&#x20;Windows&#x20;update&#x0d;&#x0a;module_end','Last&#x20;date&#x20;and&#x20;time&#x20;user&#x20;launch&#x20;microsoft&#x20;Windows&#x20;update',9,'',11,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (31,'cpu_user','module_begin&#x0d;&#x0a;module_name&#x20;cpu_user&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_interval&#x20;1&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;-n0&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$15&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;User&#x20;CPU&#x20;Usage&#x20;&#40;%&#41;&#x0d;&#x0a;module_end','User&#x20;CPU&#x20;Usage&#x20;&#40;%&#41;',4,'',47,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (32,'cpu_system','module_begin&#x0d;&#x0a;module_name&#x20;cpu_system&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_interval&#x20;1&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;-n0&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$16&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;System&#x20;CPU&#x20;Usage&#x20;&#40;%&#41;&#x0d;&#x0a;module_end','System&#x20;CPU&#x20;Usage&#x20;&#40;%&#41;',4,'',47,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (33,'Load&#x20;Average','module_begin&#x0d;&#x0a;module_name&#x20;Load&#x20;Average&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;uptime&#x20;|&#x20;cut&#x20;-d&#x20;&quot;,&quot;&#x20;-f&#x20;4&#x20;|&#x20;cut&#x20;-d&#x20;&quot;:&quot;&#x20;-f&#x20;2&#x20;|&#x20;sed&#x20;&quot;s/&#x20;//g&quot;&#x0d;&#x0a;module_description&#x20;Average&#x20;process&#x20;in&#x20;CPU&#x20;&#40;Last&#x20;minute&#41;&#x0d;&#x0a;module_end&#x0d;&#x0a;','Average&#x20;process&#x20;in&#x20;CPU&#x20;&#40;Last&#x20;minute&#41;',4,'',47,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (34,'disk_root_free','module_begin&#x0d;&#x0a;module_name&#x20;disk_root_free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-kh&#x20;/&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;100-$5&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition&#x0d;&#x0a;module_end','Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition',4,'',47,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (35,'memfree','module_begin&#x0d;&#x0a;module_name&#x20;memfree&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;-H&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$5}&#039;&#x0d;&#x0a;module_description&#x20;Unused&#x20;RAM&#x20;memory&#x0d;&#x0a;module_end&#x0d;&#x0a;','Free&#x20;memory&#x20;on&#x20;system',4,'',47,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (36,'sshDaemon','module_begin&#x0d;&#x0a;module_name&#x20;sshDaemon&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_exec&#x20;ps&#x20;-Af&#x20;|&#x20;grep&#x20;sshd&#x20;|&#x20;grep&#x20;-v&#x20;&quot;grep&quot;&#x20;|&#x20;wc&#x20;-l&#x20;|&#x20;sed&#x20;&quot;s/&#x20;//g&quot;&#x0d;&#x0a;module_end&#x0d;&#x0a;','Check&#x20;if&#x20;SSH&#x20;daemon&#x20;is&#x20;running',4,'',47,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (37,'cpu_user','module_begin&#x0d;&#x0a;module_name&#x20;cpu_user&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_interval&#x20;1&#x0d;&#x0a;module_exec&#x20;sar&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$2&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;User&#x20;CPU&#x20;Usage&#x20;&#40;%&#41;&#x0d;&#x0a;module_min_warning&#x20;70&#x0d;&#x0a;module_max_warning&#x20;90&#x0d;&#x0a;module_min_critical&#x20;91&#x0d;&#x0a;module_max_critical&#x20;0&#x0d;&#x0a;module_end','User&#x20;CPU&#x20;Usage&#x20;&#40;%&#41;',8,'',48,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (38,'Load&#x20;Average','module_begin&#x0d;&#x0a;module_name&#x20;Load&#x20;Average&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;uptime&#x20;|&#x20;sed&#x20;&#039;s/.*load&#x20;averages:&#x20;//&#039;|awk&#x20;&#039;{print&#x20;$1}&#039;&#x0d;&#x0a;module_description&#x20;Average&#x20;process&#x20;in&#x20;CPU&#x20;&#40;Last&#x20;minute&#41;&#x0d;&#x0a;module_end&#x0d;&#x0a;','Average&#x20;process&#x20;in&#x20;CPU&#x20;&#40;Last&#x20;minute&#41;',8,'',48,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (39,'Cache&#x20;mem&#x20;free','module_begin&#x0d;&#x0a;module_name&#x20;Cache&#x20;mem&#x20;free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vm_stat&#x20;|&#x20;grep&#x20;&#039;Pages&#x20;free&#039;|&#x20;awk&#x20;&#039;{print&#x20;$3/256}&#039;&#x0d;&#x0a;module_description&#x20;Free&#x20;cache&#x20;memory&#x20;in&#x20;MB&#x0d;&#x0a;module_min_warning&#x20;500&#x0d;&#x0a;module_max_warning&#x20;600&#x0d;&#x0a;module_min_critical&#x20;100&#x0d;&#x0a;module_max_critical&#x20;499&#x0d;&#x0a;module_end&#x0d;&#x0a;','Free&#x20;cache&#x20;memory&#x20;in&#x20;MB',8,'',48,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (40,'Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition','module_begin&#x0d;&#x0a;module_name&#x20;disk_root_free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-kh&#x20;/&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;100-$5&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition&#x0d;&#x0a;module_min_warning&#x20;70&#x0d;&#x0a;module_max_warning&#x20;90&#x0d;&#x0a;module_min_critical&#x20;91&#x0d;&#x0a;module_max_critical&#x20;100&#x0d;&#x0a;module_end','Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition',8,'',48,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (41,'disk_usage_/','module_begin&#x0d;&#x0a;module_name&#x20;disk_usage_/&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-P&#x20;|&#x20;grep&#x20;-e&#x20;&quot;/$&quot;&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$5}&#039;&#x20;|&#x20;tr&#x20;-d&#x20;%&#x0d;&#x0a;module_description&#x20;&#x20;Disk&#x20;usage&#x20;on&#x20;/&#x20;&#40;%&#41;&#x0d;&#x0a;module_end','Disk&#x20;usage&#x20;on&#x20;/&#x20;&#40;%&#41;',5,'',44,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (42,'Swap_Free','module_begin&#x0d;&#x0a;module_name&#x20;Swap_Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;/usr/sbin/swapinfo&#x20;-t&#x20;|&#x20;grep&#x20;memory&#x20;|&#x20;tr&#x20;-d&#x20;&quot;%&quot;&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;100-$5&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;Unused&#x20;swap&#x20;memory&#x0d;&#x0a;module_end&#x0d;&#x0a;','Unused&#x20;swap&#x20;memory',5,'',44,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (43,'RAM_Free','module_begin&#x0d;&#x0a;module_name&#x20;RAM_Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;/usr/sbin/swapinfo&#x20;-t&#x20;|&#x20;grep&#x20;memory&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$4}&#039;&#x0d;&#x0a;module_description&#x20;Unused&#x20;RAM&#x20;memory&#x0d;&#x0a;module_end&#x0d;&#x0a;','Unused&#x20;RAM&#x20;memory',5,'',44,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (44,'CPU_User','module_begin&#x0d;&#x0a;module_name&#x20;CPU_User&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$16&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;%&#x20;of&#x20;USER&#x20;CPU&#x0d;&#x0a;module_end','%&#x20;of&#x20;USER&#x20;CPU',5,'',44,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (45,'CPU_System','module_begin&#x0d;&#x0a;module_name&#x20;CPU_System&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$17&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;%&#x20;of&#x20;system&#x20;CPU&#x0d;&#x0a;module_end&#x0d;&#x0a;','%&#x20;of&#x20;system&#x20;CPU',5,'',44,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (46,'disk_root_free','module_begin&#x0d;&#x0a;module_name&#x20;disk_root_free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-k&#x20;/&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;tr&#x20;-d&#x20;&quot;%&quot;&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;100-$5&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition&#x0d;&#x0a;module_end','Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition',2,'',45,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (47,'Swap_Free','module_begin&#x0d;&#x0a;module_name&#x20;Swap_Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$4&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;Unused&#x20;swap&#x20;memory&#x0d;&#x0a;module_end','Unused&#x20;swap&#x20;memory',2,'',45,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (48,'RAM_Free','module_begin&#x0d;&#x0a;module_name&#x20;RAM_Free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$5&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;Unused&#x20;RAM&#x20;memory&#x0d;&#x0a;module_end','Unused&#x20;RAM&#x20;memory',2,'',45,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (49,'CPU_System','module_begin&#x0d;&#x0a;module_name&#x20;CPU_System&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$21&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;%&#x20;of&#x20;system&#x20;CPU&#x0d;&#x0a;module_end','%&#x20;of&#x20;system&#x20;CPU',2,'',45,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (50,'Disk_Seek_Operations','module_begin&#x0d;&#x0a;module_name&#x20;Disk_Seek_Operations&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$14&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;Disk&#x20;Seek&#x20;operations&#x0d;&#x0a;module_end','Disk&#x20;Seek&#x20;operations',2,'',45,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (51,'Pandora_Agent_RAM','module_begin&#x0d;&#x0a;module_name&#x20;Pandora_Agent_RAM&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;ps&#x20;-Afly&#x20;|&#x20;grep&#x20;perl&#x20;|&#x20;grep&#x20;-v&#x20;grep&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$9&#x20;}&#039;&#x0d;&#x0a;module_description&#x20;Return&#x20;size&#x20;in&#x20;KB&#x20;of&#x20;memory&#x20;used&#x20;by&#x20;process&#x20;Pandora&#x0d;&#x0a;module_end&#x0d;&#x0a;','Return&#x20;size&#x20;in&#x20;KB&#x20;of&#x20;memory&#x20;used&#x20;by&#x20;process&#x20;Pandora',2,'',45,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (52,'InetdDaemon','module_begin&#x0d;&#x0a;module_name&#x20;InetdDaemon&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_exec&#x20;ps&#x20;-Af&#x20;|&#x20;grep&#x20;inetd&#x20;|&#x20;grep&#x20;-v&#x20;&quot;grep&quot;&#x20;|&#x20;wc&#x20;-l&#x20;|&#x20;&#x20;awk&#x20;&#039;{&#x20;print&#x20;$1&#x20;}&#039;&#x0d;&#x0a;module_end','Check&#x20;inetd&#x20;daemon&#x20;running',2,'',45,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (53,'Pandora_Agent_RAM','module_begin&#x0d;&#x0a;module_name&#x20;Pandora_Agent_RAM&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;ps&#x20;axu&#x20;|&#x20;grep&#x20;perl&#x20;|&#x20;grep&#x20;-v&#x20;grep&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$4&#x20;}&#039;&#x20;|&#x20;tr&#x20;&quot;,&quot;&#x20;&quot;.&quot;&#x0d;&#x0a;module_end&#x0d;&#x0a;','Return&#x20;RAM&#x20;used&#x20;by&#x20;pandora&#x20;fms&#x20;agent.',3,'',46,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (54,'InetdDaemon','module_begin&#x0d;&#x0a;module_name&#x20;InetdDaemon&#x0d;&#x0a;module_type&#x20;generic_proc&#x0d;&#x0a;module_exec&#x20;ps&#x20;-Af&#x20;|&#x20;grep&#x20;inetd&#x20;|&#x20;grep&#x20;-v&#x20;&quot;grep&quot;&#x20;|&#x20;wc&#x20;-l&#x20;|&#x20;&#x20;awk&#x20;&#039;{&#x20;print&#x20;$1&#x20;}&#039;&#x0d;&#x0a;module_end&#x0d;&#x0a;','Check&#x20;inetddaemon&#x20;running&#x20;in&#x20;system',3,'',46,2,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (55,'disk_root_free','module_begin&#x0d;&#x0a;module_name&#x20;disk_root_free&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-k&#x20;/&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;100-$4&#x20;}&#039;&#x0d;&#x0a;module_max&#x20;100&#x0d;&#x0a;module_min&#x20;0&#x0d;&#x0a;module_description&#x20;Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition&#x0d;&#x0a;module_end','Free&#x20;disk&#x20;Percentage&#x20;of&#x20;root&#x20;partition',3,'',46,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (56,'OpenedFiles&#x20;','module_begin&#x20;&#x0d;&#x0a;module_name&#x20;OpenedFiles&#x20;&#x0d;&#x0a;module_type&#x20;generic_data&#x20;&#x0d;&#x0a;module_exec&#x20;lsof&#x20;|&#x20;wc&#x20;-l&#x20;&#x0d;&#x0a;module_description&#x20;Total&#x20;files&#x20;opened&#x20;in&#x20;system&#x20;&#x0d;&#x0a;module_end&#x20;','Total&#x20;files&#x20;opened&#x20;in&#x20;system&#x20;',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (57,'Zombie&#x20;processes','module_begin&#x20;&#x0d;&#x0a;module_name&#x20;Zombie&#x20;processes&#x0d;&#x0a;module_type&#x20;generic_data&#x20;&#x0d;&#x0a;module_exec&#x20;ps&#x20;&#x2D;eos&#x20;|&#x20;grep&#x20;&#x27;Z&#x27;&#x20;|&#x20;wc&#x20;&#x2D;l&#x20;|&#x20;tr&#x20;&#x2D;d&#x20;&#x22;&#92;n&#x22;&#x20;&#x0d;&#x0a;module_description&#x20;Number&#x20;of&#x20;zombie&#x20;processes&#x20;&#x0d;&#x0a;module_end&#x20;','Number&#x20;of&#x20;zombie&#x20;processes&#x20;',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tlocal_component` (`id`, `name`, `data`, `description`, `id_os`, `os_version`, `id_network_component_group`, `type`, `max`, `min`, `module_interval`, `id_module_group`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `each_ff`, `ff_timeout`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `prediction_sample_window`, `prediction_samples`, `prediction_threshold`) VALUES (58,'Disk_IO_Wait','module_begin&#x20;&#x0d;&#x0a;module_name&#x20;Disk_IO_Wait&#x20;&#x0d;&#x0a;module_type&#x20;generic_data&#x20;&#x0d;&#x0a;module_exec&#x20;top&#x20;-n&#x20;3&#x20;-c&#x20;|&#x20;grep&#x20;&quot;Cpu&quot;&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$6&#x20;}&#039;&#x20;|&#x20;grep&#x20;-o&#x20;&quot;[0-9]*&quot;&#x20;|&#x20;tail&#x20;-1&#x20;&#x0d;&#x0a;module_description&#x20;Simple&#x20;approach&#x20;to&#x20;IO/Wait&#x20;monitoring.&#x20;&#x0d;&#x0a;module_end&#x20;','Simple&#x20;approach&#x20;to&#x20;IO/Wait&#x20;monitoring.&#x20;',1,'',43,1,0,0,0,0,1,0.00,0.00,NULL,0.00,0.00,NULL,0,0.000000000000000,NULL,'basic',NULL,'','','',0,0,0,'','',0,0,0,0,0,0,0,0,0,0,0);

-- GIS Data
INSERT INTO `tgis_map` VALUES (1,'Sample',-3.708187,40.42056,0,16,'',-3.708187,40.42056,0,0,1);
INSERT INTO `tgis_map_connection` VALUES (1,'OpenStreetMap (MapQuest Open)','OSM','{\"type\":\"OSM\",\"url\":\"http://tile.openstreetmap.org/${z}/${x}/${y}.png\"}',19,16,-3.708187,40.42056,0,-3.708187,40.42056,0,0);
INSERT INTO `tgis_map_connection` VALUES (2,'OpenStreetMap (Standard)','OSM','{\"type\":\"OSM\",\"url\":\"http://tile.openstreetmap.org/${z}/${x}/${y}.png\"}',19,16,-3.708187,40.42056,0,-3.708187,40.42056,0,0);
INSERT INTO `tgis_map_has_tgis_map_con` VALUES (1,1,'2010-03-01 09:46:48',1);
INSERT INTO `tgis_map_layer` VALUES (1,'Group All',1,0,1,0);

-- example alert template

-- alert actions (default)
INSERT INTO `talert_actions` (`id`, `name`, `id_alert_command`, `field1`, `field2`, `field3`, `field4`, `field5`, `field6`, `field7`, `field8`, `field9`, `field10`, `id_group`, `action_threshold`, `field1_recovery`, `field2_recovery`, `field3_recovery`, `field4_recovery`, `field5_recovery`, `field6_recovery`, `field7_recovery`, `field8_recovery`, `field9_recovery`, `field10_recovery`) VALUES
(1,'Mail&#x20;to&#x20;Admin',1,'yourmail@domain.es','[PANDORA] Alert from agent _agent_ on module _module_','&lt;div&#x20;style=&quot;background-color:#EAF0F6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:30px;&#x20;margin:0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:560px;&#x20;background-color:white;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:right;&#x20;color:#223549;&#x20;font-weight:700;&#x20;line-height:36px;&#x20;padding:0px;&#x20;font-size:12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:100%;&#x20;margin:0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;onerror=&apos;this.style.display=\"none\";&apos;&#x20;src=&quot;_statusimage_&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:105px;&#x20;margin-top:20px;&#x20;padding:0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:24px;&#x20;text-align:center;&#x20;color:#223549;&#x20;padding:0px&#x20;10%;&#x20;line-height:34px;&#x20;margin:20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;bad&#x20;news&#x20;for&#x20;you,&#x20;something&#x20;is&#x20;on&#x20;&lt;span&#x20;style=&quot;text-transform:uppercase;&#x20;font-weight:800;&quot;&gt;_modulestatus_&lt;/span&gt;&#x20;status!&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:100px;&#x20;max-width:50%;&#x20;margin-top:0px;&#x20;font-weight:700;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:#F6F6F6;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px;&#x20;margin-top:40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-weight:400!important;&quot;&gt;_modulegraph_24h_&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:center;&#x20;margin-top:10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','','','',0,0,'','','&lt;div&#x20;style=&quot;background-color:#EAF0F6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:30px;&#x20;margin:0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:560px;&#x20;background-color:white;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:right;&#x20;color:#223549;&#x20;font-weight:700;&#x20;line-height:36px;&#x20;padding:0px;&#x20;font-size:12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:100%;&#x20;margin:0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Good-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:105px;&#x20;margin-top:20px;&#x20;padding:0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:24px;&#x20;text-align:center;&#x20;color:#223549;&#x20;padding:0px&#x20;10%;&#x20;line-height:34px;&#x20;margin:20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;good&#x20;news&#x20;for&#x20;you,&#x20;alert&#x20;has&#x20;been&#x20;&lt;span&#x20;style=&quot;text-transform:uppercase;&#x20;font-weight:800;&quot;&gt;recovered&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:100px;&#x20;max-width:50%;&#x20;margin-top:0px;&#x20;font-weight:700;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:#F6F6F6;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px;&#x20;margin-top:40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-weight:400!important;&quot;&gt;_modulegraph_24h_&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:center;&#x20;margin-top:10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','text/html','','','','','','');
INSERT INTO `talert_actions` (`id`, `name`, `id_alert_command`, `field1`, `field2`, `field3`, `field4`, `field5`, `field6`, `field7`, `field8`, `field9`, `field10`, `id_group`, `action_threshold`, `field1_recovery`, `field2_recovery`, `field3_recovery`, `field4_recovery`, `field5_recovery`, `field6_recovery`, `field7_recovery`, `field8_recovery`, `field9_recovery`, `field10_recovery`) VALUES
(2,'Restart&#x20;agent',12,'REFRESH AGENT *','','','','','','','','','',0,0,'','','','','','','','','','');
INSERT INTO `talert_actions` (`id`, `name`, `id_alert_command`, `field1`, `field2`, `field3`, `field4`, `field5`, `field6`, `field7`, `field8`, `field9`, `field10`, `id_group`, `action_threshold`, `field1_recovery`, `field2_recovery`, `field3_recovery`, `field4_recovery`, `field5_recovery`, `field6_recovery`, `field7_recovery`, `field8_recovery`, `field9_recovery`, `field10_recovery`) VALUES
(3,'Monitoring&#x20;Event',3,'_agent_&#x20;_module_&#x20;generated&#x20;an&#x20;event&#x20;alert&#x20;&#40;_data_&#41;','alert_fired','pandora','','4','','','','','',0,0,'RECOVERED:&#x20;_agent_&#x20;_module_&#x20;generated&#x20;event&#x20;alert&#x20;&#40;_data_&#41;','alert_ceased','pandora','','4','','','','','');
INSERT INTO `talert_actions` (`id`, `name`, `id_alert_command`, `field1`, `field2`, `field3`, `field4`, `field5`, `field6`, `field7`, `field8`, `field9`, `field10`, `id_group`, `action_threshold`, `field1_recovery`, `field2_recovery`, `field3_recovery`, `field4_recovery`, `field5_recovery`, `field6_recovery`, `field7_recovery`, `field8_recovery`, `field9_recovery`, `field10_recovery`) VALUES
(4,'Send&#x20;Report&#x20;by&#x20;e-mail',14,'','yourmail@domain.es','','&lt;div&#x20;style=&quot;background-color:&#x20;#eaf0f6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:&#x20;30px;&#x20;margin:&#x20;0;&quot;&gt;&lt;table&#x20;style=&quot;max-width:&#x20;560px;&#x20;background-color:&#x20;white;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&lt;thead&gt;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:&#x20;right;&#x20;color:&#x20;#223549;&#x20;font-weight:&#x20;bold;&#x20;line-height:&#x20;36px;&#x20;padding:&#x20;0px;&#x20;font-size:&#x20;12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:&#x20;100%;&#x20;margin:&#x20;0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;onerror=&quot;this.style.display=&amp;quot;none&amp;quot;;&quot;&#x20;src=&quot;_statusimage_&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:&#x20;105px;&#x20;margin-top:&#x20;20px;&#x20;padding:&#x20;0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;24px;&#x20;text-align:&#x20;center;&#x20;color:&#x20;#223549;&#x20;padding:&#x20;0px&#x20;10%;&#x20;line-height:&#x20;34px;&#x20;margin:&#x20;20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;bad&#x20;news&#x20;for&#x20;you,&#x20;something&#x20;is&#x20;on&#x20;&lt;span&#x20;style=&quot;text-transform:&#x20;uppercase;&#x20;font-weight:&#x20;800;&quot;&gt;_modulestatus_&lt;/span&gt;&#x20;status!&lt;/p&gt;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:&#x20;100px;&#x20;max-width:&#x20;50%;&#x20;margin-top:&#x20;0px;&#x20;font-weight:&#x20;bold;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:&#x20;#f6f6f6;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px;&#x20;margin-top:&#x20;40px;&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:&#x20;20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Report&#x20;details&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Generated:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_generated_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Report&#x20;date:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Description:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_description_&lt;/span&gt;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;div&#x20;style=&quot;text-align:&#x20;center;&#x20;margin-top:&#x20;10px;&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&gt;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;','','','','','','',0,0,'','','','&lt;div&#x20;style=&quot;background-color:&#x20;#eaf0f6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:&#x20;30px;&#x20;margin:&#x20;0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:&#x20;560px;&#x20;background-color:&#x20;white;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;text-align:&#x20;right;&#x20;color:&#x20;#223549;&#x20;font-weight:&#x20;bold;&#x20;line-height:&#x20;36px;&#x20;padding:&#x20;0px;&#x20;font-size:&#x20;12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:&#x20;100%;&#x20;margin:&#x20;0px;&quot;&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Good-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:&#x20;105px;&#x20;margin-top:&#x20;20px;&#x20;padding:&#x20;0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;colspan=&quot;2&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;24px;&#x20;text-align:&#x20;center;&#x20;color:&#x20;#223549;&#x20;padding:&#x20;0px&#x20;10%;&#x20;line-height:&#x20;34px;&#x20;margin:&#x20;20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;good&#x20;news&#x20;for&#x20;you,&#x20;alert&#x20;has&#x20;been&#x20;&lt;span&#x20;style=&quot;text-transform:&#x20;uppercase;&#x20;font-weight:&#x20;800;&quot;&gt;recovered&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:&#x20;100px;&#x20;max-width:&#x20;50%;&#x20;margin-top:&#x20;0px;&#x20;font-weight:&#x20;bold;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&lt;/div&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;colspan=&quot;2&quot;&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;background-color:&#x20;#f6f6f6;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px;&#x20;margin-top:&#x20;40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Report&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Generated:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_generated_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Report&#x20;date:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Description:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_description_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:&#x20;center;&#x20;margin-top:&#x20;10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&gt;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','','');
INSERT INTO `talert_actions` (`id`, `name`, `id_alert_command`, `field1`, `field2`, `field3`, `field4`, `field5`, `field6`, `field7`, `field8`, `field9`, `field10`, `id_group`, `action_threshold`, `field1_recovery`, `field2_recovery`, `field3_recovery`, `field4_recovery`, `field5_recovery`, `field6_recovery`, `field7_recovery`, `field8_recovery`, `field9_recovery`, `field10_recovery`) VALUES
(5,'Send&#x20;Report&#x20;by&#x20;e-mail&#x20;(from&#x20;template)',15,'','','yourmail@domain.es','','&lt;div&#x20;style=&quot;background-color:&#x20;#eaf0f6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:&#x20;30px;&#x20;margin:&#x20;0;&quot;&gt;&lt;table&#x20;style=&quot;max-width:&#x20;560px;&#x20;background-color:&#x20;white;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&lt;thead&gt;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:&#x20;right;&#x20;color:&#x20;#223549;&#x20;font-weight:&#x20;bold;&#x20;line-height:&#x20;36px;&#x20;padding:&#x20;0px;&#x20;font-size:&#x20;12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:&#x20;100%;&#x20;margin:&#x20;0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;onerror=&quot;this.style.display=&amp;quot;none&amp;quot;;&quot;&#x20;src=&quot;_statusimage_&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:&#x20;105px;&#x20;margin-top:&#x20;20px;&#x20;padding:&#x20;0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;24px;&#x20;text-align:&#x20;center;&#x20;color:&#x20;#223549;&#x20;padding:&#x20;0px&#x20;10%;&#x20;line-height:&#x20;34px;&#x20;margin:&#x20;20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;bad&#x20;news&#x20;for&#x20;you,&#x20;something&#x20;is&#x20;on&#x20;&lt;span&#x20;style=&quot;text-transform:&#x20;uppercase;&#x20;font-weight:&#x20;800;&quot;&gt;_modulestatus_&lt;/span&gt;&#x20;status!&lt;/p&gt;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:&#x20;100px;&#x20;max-width:&#x20;50%;&#x20;margin-top:&#x20;0px;&#x20;font-weight:&#x20;bold;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:&#x20;#f6f6f6;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px;&#x20;margin-top:&#x20;40px;&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:&#x20;20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Report&#x20;details&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Generated:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_generated_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Report&#x20;date:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Description:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_description_&lt;/span&gt;&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;div&#x20;style=&quot;text-align:&#x20;center;&#x20;margin-top:&#x20;10px;&quot;&gt;&lt;p&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&gt;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;','','','','','',0,0,'','','','','&lt;div&#x20;style=&quot;background-color:&#x20;#eaf0f6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:&#x20;30px;&#x20;margin:&#x20;0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:&#x20;560px;&#x20;background-color:&#x20;white;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;text-align:&#x20;right;&#x20;color:&#x20;#223549;&#x20;font-weight:&#x20;bold;&#x20;line-height:&#x20;36px;&#x20;padding:&#x20;0px;&#x20;font-size:&#x20;12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;0px&#x20;0px&#x20;5px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:&#x20;100%;&#x20;margin:&#x20;0px;&quot;&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Good-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:&#x20;105px;&#x20;margin-top:&#x20;20px;&#x20;padding:&#x20;0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;colspan=&quot;2&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;24px;&#x20;text-align:&#x20;center;&#x20;color:&#x20;#223549;&#x20;padding:&#x20;0px&#x20;10%;&#x20;line-height:&#x20;34px;&#x20;margin:&#x20;20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;good&#x20;news&#x20;for&#x20;you,&#x20;alert&#x20;has&#x20;been&#x20;&lt;span&#x20;style=&quot;text-transform:&#x20;uppercase;&#x20;font-weight:&#x20;800;&quot;&gt;recovered&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:&#x20;100px;&#x20;max-width:&#x20;50%;&#x20;margin-top:&#x20;0px;&#x20;font-weight:&#x20;bold;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&lt;/div&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;colspan=&quot;2&quot;&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;background-color:&#x20;#f6f6f6;&#x20;border-radius:&#x20;10px;&#x20;padding:&#x20;10px&#x20;20px;&#x20;margin-top:&#x20;40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:&#x20;20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;18px;&#x20;line-height:&#x20;30px;&#x20;color:&#x20;#223549;&quot;&gt;Report&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Generated:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_generated_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Report&#x20;date:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_date_&lt;em&gt;&lt;br&gt;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;15px;&#x20;color:&#x20;#333333;&#x20;font-weight:&#x20;800;&#x20;line-height:&#x20;15px;&quot;&gt;Description:&amp;nbsp;&lt;span&#x20;style=&quot;font-weight:&#x20;400!important;&quot;&gt;_report_description_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:&#x20;center;&#x20;margin-top:&#x20;10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&gt;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;style=&quot;font-size:&#x20;12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:&#x20;400;&#x20;color:&#x20;#777;&quot;&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','');
INSERT INTO `talert_actions` (`id`, `name`, `id_alert_command`) VALUES (6,'Create&#x20;Pandora&#x20;ITSM&#x20;ticket',16);

-- alert templates (default)
INSERT INTO `talert_templates` (`id`,`name`,`description`,`id_alert_action`,`field1`,`field2`,`field3`,`field4`,`field5`,`field6`,`field7`,`field8`,`field9`,`field10`,`field11`,`field12`,`field13`,`field14`,`field15`,`field16`,`field17`,`field18`,`field19`,`field20`,`type`,`value`,`matches_value`,`max_value`,`min_value`,`time_threshold`,`max_alerts`,`min_alerts`,`time_from`,`time_to`,`monday`,`tuesday`,`wednesday`,`thursday`,`friday`,`saturday`,`sunday`,`recovery_notify`,`field1_recovery`,`field2_recovery`,`field3_recovery`,`field4_recovery`,`field5_recovery`,`field6_recovery`,`field7_recovery`,`field8_recovery`,`field9_recovery`,`field10_recovery`,`field11_recovery`,`field12_recovery`,`field13_recovery`,`field14_recovery`,`field15_recovery`,`field16_recovery`,`field17_recovery`,`field18_recovery`,`field19_recovery`,`field20_recovery`,`priority`,`id_group`,`special_day`,`wizard_level`,`min_alerts_reset_counter`,`disable_event`,`previous_name`, `schedule`)
VALUES (1,'Critical&#x20;condition','This is a generic alert template to fire on condition CRITICAL',1,'','','&lt;div&#x20;style=&quot;background-color:#EAF0F6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:30px;&#x20;margin:0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:560px;&#x20;background-color:white;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:right;&#x20;color:#223549;&#x20;font-weight:700;&#x20;line-height:36px;&#x20;padding:0px;&#x20;font-size:12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:100%;&#x20;margin:0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Bad-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:105px;&#x20;margin-top:20px;&#x20;padding:0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:24px;&#x20;text-align:center;&#x20;color:#223549;&#x20;padding:0px&#x20;10%;&#x20;line-height:34px;&#x20;margin:20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;bad&#x20;news&#x20;for&#x20;you,&#x20;something&#x20;is&#x20;on&#x20;&lt;span&#x20;style=&quot;text-transform:uppercase;&#x20;font-weight:800;&quot;&gt;critical&lt;/span&gt;&#x20;status!&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:100px;&#x20;max-width:50%;&#x20;margin-top:0px;&#x20;font-weight:700;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:#F6F6F6;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px;&#x20;margin-top:40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;critical&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-weight:400!important;&quot;&gt;_modulegraph_24h_&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:center;&#x20;margin-top:10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','','','','','','','','','','','','','','critical','',1,0.00,0.00,86400,1,0,'00:00:00','00:00:00',1,1,1,1,1,1,1,1,'','[PANDORA]&#x20;Alert&#x20;RECOVERED&#x20;for&#x20;CRITICAL&#x20;status&#x20;on&#x20;_agent_&#x20;/&#x20;_module_','&lt;div&#x20;style=&quot;background-color:#EAF0F6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:30px;&#x20;margin:0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:560px;&#x20;background-color:white;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:right;&#x20;color:#223549;&#x20;font-weight:700;&#x20;line-height:36px;&#x20;padding:0px;&#x20;font-size:12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:100%;&#x20;margin:0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Good-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:105px;&#x20;margin-top:20px;&#x20;padding:0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:24px;&#x20;text-align:center;&#x20;color:#223549;&#x20;padding:0px&#x20;10%;&#x20;line-height:34px;&#x20;margin:20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;good&#x20;news&#x20;for&#x20;you,&#x20;alert&#x20;has&#x20;been&#x20;&lt;span&#x20;style=&quot;text-transform:uppercase;&#x20;font-weight:800;&quot;&gt;recovered&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:100px;&#x20;max-width:50%;&#x20;margin-top:0px;&#x20;font-weight:700;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:#F6F6F6;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px;&#x20;margin-top:40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;normal&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-weight:400!important;&quot;&gt;_modulegraph_24h_&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:center;&#x20;margin-top:10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','','','','','','','','','','','','','',4,0,0,'basic',0,0,NULL,'{\"monday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"tuesday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"wednesday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"thursday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"friday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"saturday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"sunday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}]}');

INSERT INTO `talert_templates` (`id`,`name`,`description`,`id_alert_action`,`field1`,`field2`,`field3`,`field4`,`field5`,`field6`,`field7`,`field8`,`field9`,`field10`,`field11`,`field12`,`field13`,`field14`,`field15`,`field16`,`field17`,`field18`,`field19`,`field20`,`type`,`value`,`matches_value`,`max_value`,`min_value`,`time_threshold`,`max_alerts`,`min_alerts`,`time_from`,`time_to`,`monday`,`tuesday`,`wednesday`,`thursday`,`friday`,`saturday`,`sunday`,`recovery_notify`,`field1_recovery`,`field2_recovery`,`field3_recovery`,`field4_recovery`,`field5_recovery`,`field6_recovery`,`field7_recovery`,`field8_recovery`,`field9_recovery`,`field10_recovery`,`field11_recovery`,`field12_recovery`,`field13_recovery`,`field14_recovery`,`field15_recovery`,`field16_recovery`,`field17_recovery`,`field18_recovery`,`field19_recovery`,`field20_recovery`,`priority`,`id_group`,`special_day`,`wizard_level`,`min_alerts_reset_counter`,`disable_event`,`previous_name`, `schedule`)
VALUES (2,'Manual&#x20;alert','This is a template used to fire manual alerts, condition defined here never will be executed. Use this template to assign to your actions/commands used to do remote management (Agent restart, execute commands on server, etc).',NULL,'','','&lt;style&#x20;type=&quot;text/css&quot;&gt;&lt;!--&#x0d;&#x0a;&#47;&#42;&#x20;Take&#x20;care&#x20;of&#x20;image&#x20;borders&#x20;and&#x20;formatting&#x20;&#42;&#47;&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;img&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;max-width:&#x20;600px;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;outline:&#x20;none;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;text-decoration:&#x20;none;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;-ms-interpolation-mode:&#x20;bicubic;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;a&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;border:&#x20;0;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;outline:&#x20;none;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;a&#x20;img&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;border:&#x20;none;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#47;&#42;&#x20;General&#x20;styling&#x20;&#42;&#47;&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;td,&#x20;h1,&#x20;h2,&#x20;h3&#x20;&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-family:&#x20;Helvetica,&#x20;Arial,&#x20;sans-serif;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-weight:&#x20;400;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;td&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-size:&#x20;14px;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;line-height:&#x20;150%;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;text-align:&#x20;left;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;body&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;-webkit-font-smoothing:antialiased;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;-webkit-text-size-adjust:none;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;width:&#x20;100%;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;height:&#x20;100%;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;color:&#x20;#37302d;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;background:&#x20;#ffffff;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;table&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;border-collapse:&#x20;collapse&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;h1,&#x20;h2,&#x20;h3&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;padding:&#x20;0;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;margin:&#x20;0;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;color:&#x20;#444444;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-weight:&#x20;400;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;line-height:&#x20;110%;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;h1&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-size:&#x20;35px;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;h2&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-size:&#x20;30px;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;h3&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-size:&#x20;24px;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;h4&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-size:&#x20;18px;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-weight:&#x20;normal;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;.important-font&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;color:&#x20;#21BEB4;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;font-weight:&#x20;bold;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;.hide&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;display:&#x20;none&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;.force-full-width&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;width:&#x20;100%&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;}&#x0d;&#x0a;--&gt;&lt;/style&gt;&#x0d;&#x0a;&lt;style&#x20;type=&quot;text/css&quot;&#x20;media=&quot;screen&quot;&gt;&lt;!--&#x0d;&#x0a;@media&#x20;screen&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;@import&#x20;url&#40;http://fonts.googleapis.com/css?family=Open+Sans:400&#41;;&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#47;&#42;&#x20;Thanks&#x20;Outlook&#x20;2013!&#x20;&#42;&#47;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td,&#x20;h1,&#x20;h2,&#x20;h3&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;font-family:&#x20;&#039;Open&#x20;Sans&#039;,&#x20;&#039;Helvetica&#x20;Neue&#039;,&#x20;Arial,&#x20;sans-serif&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;--&gt;&lt;/style&gt;&#x0d;&#x0a;&lt;style&#x20;type=&quot;text/css&quot;&#x20;media=&quot;only&#x20;screen&#x20;and&#x20;&#40;max-width:&#x20;600px&#41;&quot;&gt;&lt;!--&#x0d;&#x0a;&#47;&#42;&#x20;Mobile&#x20;styles&#x20;&#42;&#47;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;@media&#x20;only&#x20;screen&#x20;and&#x20;&#40;max-width:&#x20;600px&#41;&#x20;{&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;table[class=&quot;w320&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;width:&#x20;320px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;table[class=&quot;w300&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;width:&#x20;300px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;table[class=&quot;w290&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;width:&#x20;290px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class=&quot;w320&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;width:&#x20;320px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class~=&quot;mobile-padding&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-left:&#x20;14px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-right:&#x20;14px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class*=&quot;mobile-padding-left&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-left:&#x20;14px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class*=&quot;mobile-padding-right&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-right:&#x20;14px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class*=&quot;mobile-block&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;display:&#x20;block&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;width:&#x20;100%&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;text-align:&#x20;left&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-left:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-right:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-bottom:&#x20;15px&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class*=&quot;mobile-no-padding-bottom&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;padding-bottom:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class~=&quot;mobile-center&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;text-align:&#x20;center&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;table[class*=&quot;mobile-center-block&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;float:&#x20;none&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;margin:&#x20;0&#x20;auto&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;*[class*=&quot;mobile-hide&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;display:&#x20;none&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;width:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;height:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;line-height:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;font-size:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;td[class*=&quot;mobile-border&quot;]&#x20;{&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;border:&#x20;0&#x20;!important;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;}&#x0d;&#x0a;--&gt;&lt;/style&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;align=&quot;center&quot;&#x20;valign=&quot;top&quot;&#x20;bgcolor=&quot;#ffffff&quot;&#x20;width=&quot;100%&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;background:&#x20;#1f1f1f;&#x20;height:&#x20;70px;&quot;&#x20;width=&quot;100%&quot;&gt;&lt;center&gt;&#x0d;&#x0a;&lt;table&#x20;class=&quot;w320&quot;&#x20;style=&quot;width:&#x20;600px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;class=&quot;mobile-block&#x20;mobile-no-padding-bottom&#x20;mobile-center&quot;&#x20;style=&quot;background:&#x20;#1f1f1f;&#x20;padding:&#x20;10px&#x20;10px&#x20;10px&#x20;20px;&quot;&#x20;valign=&quot;top&quot;&#x20;width=&quot;270&quot;&gt;&lt;a&#x20;style=&quot;text-decoration:&#x20;none;&quot;&#x20;href=&quot;#&quot;&gt;&#x20;&lt;img&#x20;src=&quot;https://pandorafms.com/images/logo_pandora_email.png&quot;&#x20;alt=&quot;Your&#x20;Logo&quot;&#x20;width=&quot;200&quot;&gt;&#x20;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;class=&quot;mobile-block&#x20;mobile-center&quot;&#x20;style=&quot;background:&#x20;#1f1f1f;&#x20;padding:&#x20;17px&#x20;15px&#x20;10px&#x20;10px;&quot;&#x20;valign=&quot;top&quot;&#x20;width=&quot;270&quot;&gt;&amp;nbsp;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/center&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;border-bottom:&#x20;1px&#x20;solid&#x20;#e7e7e7;&quot;&gt;&lt;center&#x20;style=&quot;padding-bottom:&#x20;20px;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;class=&quot;w320&quot;&#x20;style=&quot;width:&#x20;600px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;class=&quot;mobile-padding&quot;&#x20;style=&quot;padding:&#x20;20px;&quot;&#x20;align=&quot;left&quot;&gt;&lt;br&#x20;class=&quot;mobile-hide&quot;&gt;&#x0d;&#x0a;&lt;h2&gt;Pandora&#x20;FMS&#x20;alert&#x20;system&lt;/h2&gt;&#x0d;&#x0a;&lt;br&gt;&#x20;Dear&#x20;customer,&lt;br&gt;&lt;br&gt;&#x20;We&#x20;have&#x20;&lt;strong&gt;good&#x20;news&lt;/strong&gt;&#x20;for&#x20;you.&#x20;Alert&#x20;has&#x20;been&#x20;&lt;strong&gt;RECOVERED&lt;/strong&gt;&amp;nbsp;status!&lt;br&gt;&#x20;&lt;br&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;bgcolor=&quot;#ffffff&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;width:&#x20;100px;&#x20;background:&#x20;#D84A38;&quot;&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;w:anchorlock/&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;center&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;![endif]--&gt;&#x20;&lt;a&#x20;style=&quot;background-color:&#x20;#1f1f1f;&#x20;color:&#x20;whitesmoke;&#x20;display:&#x20;inline-block;&#x20;font-family:&#x20;sans-serif;&#x20;font-size:&#x20;13px;&#x20;font-weight:&#x20;bold;&#x20;line-height:&#x20;33px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;width:&#x20;250px;&#x20;-webkit-text-size-adjust:&#x20;none;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&#x20;&lt;!--[if&#x20;mso]&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;/center&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;/v:rect&gt;&#x0d;&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&lt;![endif]--&gt;&lt;/div&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;background-color:&#x20;#ffffff;&#x20;font-size:&#x20;0;&#x20;line-height:&#x20;0;&quot;&#x20;width=&quot;281&quot;&gt;&amp;nbsp;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;class=&quot;mobile-hide&quot;&#x20;style=&quot;padding-top:&#x20;20px;&#x20;padding-bottom:&#x20;0;&#x20;vertical-align:&#x20;bottom;&quot;&#x20;valign=&quot;bottom&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding-bottom:&#x20;0px;&#x20;vertical-align:&#x20;bottom;&quot;&#x20;align=&quot;right&quot;&#x20;valign=&quot;bottom&quot;&gt;&lt;img&#x20;style=&quot;vertical-align:&#x20;bottom;&#x20;padding-bottom:&#x20;10px;&quot;&#x20;src=&quot;https://pandorafms.com/images/alerta_verde.png&quot;&#x20;alt=&quot;&quot;&#x20;width=&quot;130&quot;&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/center&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;background-color:&#x20;#f8f8f8;&#x20;border-bottom:&#x20;1px&#x20;solid&#x20;#e7e7e7;&#x20;padding-top:&#x20;10px;&quot;&#x20;valign=&quot;top&quot;&gt;&lt;center&gt;&#x0d;&#x0a;&lt;table&#x20;class=&quot;w320&quot;&#x20;style=&quot;height:&#x20;100%;&#x20;width:&#x20;600px;&quot;&#x20;border=&quot;0&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;class=&quot;mobile-padding&quot;&#x20;style=&quot;padding:&#x20;20px;&quot;&#x20;valign=&quot;top&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;border=&quot;0&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding-right:&#x20;20px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;strong&gt;Monitoring&#x20;details&lt;/strong&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding-top:&#x20;25px;&#x20;width:&#x20;150px;&#x20;border-top:&#x20;1px&#x20;solid&#x20;#E7E7E7;&#x20;vertical-align:&#x20;top;&quot;&gt;&lt;strong&gt;Data&lt;/strong&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding-top:&#x20;25px;&#x20;padding-right:&#x20;20px;&#x20;border-top:&#x20;1px&#x20;solid&#x20;#E7E7E7;&#x20;vertical-align:&#x20;top;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;_modulestatus_&#41;&lt;/em&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&gt;&lt;strong&gt;Agent&lt;/strong&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&gt;&lt;strong&gt;Module&lt;/strong&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&gt;_module_&#x20;&lt;em&gt;_moduledescription_&#x20;&lt;/em&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&gt;&lt;strong&gt;Timestamp&lt;/strong&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&gt;_timestamp_&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding-top:&#x20;20px;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;width:&#x20;100%;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;vertical-align:&#x20;top;&quot;&#x20;width=&quot;350&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module:&#x20;&lt;br&gt;&lt;br&gt;&#x20;_modulegraph_24h_&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/center&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;background-color:&#x20;#1f1f1f;&quot;&gt;&lt;center&gt;&#x0d;&#x0a;&lt;table&#x20;class=&quot;w320&quot;&#x20;style=&quot;height:&#x20;100%;&#x20;color:&#x20;#ffffff;&#x20;width:&#x20;600px;&quot;&#x20;border=&quot;0&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;bgcolor=&quot;#1f1f1f&quot;&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;class=&quot;mobile-padding&quot;&#x20;style=&quot;font-size:&#x20;12px;&#x20;padding:&#x20;20px;&#x20;background-color:&#x20;#1f1f1f;&#x20;color:&#x20;#ffffff;&#x20;text-align:&#x20;center;&quot;&#x20;align=&quot;right&quot;&#x20;valign=&quot;middle&quot;&gt;&lt;a&#x20;style=&quot;color:&#x20;#ffffff;&quot;&#x20;href=&quot;https://pandorafms.com/company/contact/&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&#x20;&lt;a&#x20;style=&quot;color:&#x20;#ffffff;&quot;&#x20;href=&quot;https://forums.pandorafms.com/&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&#x20;&lt;a&#x20;style=&quot;color:&#x20;#ffffff;&quot;&#x20;href=&quot;https://pandorafms.com/manual/&quot;&gt;Docs&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/center&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;/td&gt;&#x0d;&#x0a;&lt;/tr&gt;&#x0d;&#x0a;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;','','','','','','','','','','','','','','','','','','max_min','',1,0.00,1.00,86400,1,0,'00:00:00','00:00:00',1,1,1,1,1,1,1,0,'','','','','','','','','','','','','','','','','','','','',1,0,0,'basic',0,0,NULL,'{\"monday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"tuesday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"wednesday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"thursday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"friday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"saturday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"sunday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}]}');

INSERT INTO `talert_templates` (`id`,`name`,`description`,`id_alert_action`,`field1`,`field2`,`field3`,`field4`,`field5`,`field6`,`field7`,`field8`,`field9`,`field10`,`field11`,`field12`,`field13`,`field14`,`field15`,`field16`,`field17`,`field18`,`field19`,`field20`,`type`,`value`,`matches_value`,`max_value`,`min_value`,`time_threshold`,`max_alerts`,`min_alerts`,`time_from`,`time_to`,`monday`,`tuesday`,`wednesday`,`thursday`,`friday`,`saturday`,`sunday`,`recovery_notify`,`field1_recovery`,`field2_recovery`,`field3_recovery`,`field4_recovery`,`field5_recovery`,`field6_recovery`,`field7_recovery`,`field8_recovery`,`field9_recovery`,`field10_recovery`,`field11_recovery`,`field12_recovery`,`field13_recovery`,`field14_recovery`,`field15_recovery`,`field16_recovery`,`field17_recovery`,`field18_recovery`,`field19_recovery`,`field20_recovery`,`priority`,`id_group`,`special_day`,`wizard_level`,`min_alerts_reset_counter`,`disable_event`,`previous_name`, `schedule`)
VALUES (3,'Warning&#x20;condition','This&#x20;is&#x20;a&#x20;generic&#x20;alert&#x20;template&#x20;to&#x20;fire&#x20;on&#x20;WARNING&#x20;condition.',1,'','','&lt;div&#x20;style=&quot;background-color:#EAF0F6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:30px;&#x20;margin:0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:560px;&#x20;background-color:white;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:right;&#x20;color:#223549;&#x20;font-weight:700;&#x20;line-height:36px;&#x20;padding:0px;&#x20;font-size:12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:100%;&#x20;margin:0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/Warning-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:105px;&#x20;margin-top:20px;&#x20;padding:0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:24px;&#x20;text-align:center;&#x20;color:#223549;&#x20;padding:0px&#x20;10%;&#x20;line-height:34px;&#x20;margin:20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;bad&#x20;news&#x20;for&#x20;you,&#x20;something&#x20;is&#x20;on&#x20;&lt;span&#x20;style=&quot;text-transform:uppercase;&#x20;font-weight:800;&quot;&gt;WARNING&lt;/span&gt;&#x20;status!&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:100px;&#x20;max-width:50%;&#x20;margin-top:0px;&#x20;font-weight:700;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:#F6F6F6;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px;&#x20;margin-top:40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;warning&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-weight:400!important;&quot;&gt;_modulegraph_24h_&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:center;&#x20;margin-top:10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','','','','','','','','','','','','','','warning','',1,0.00,0.00,86400,1,0,'00:00:00','00:00:00',1,1,1,1,1,1,1,1,'','[PANDORA]&#x20;Alert&#x20;RECOVERED&#x20;for&#x20;WARNING&#x20;status&#x20;on&#x20;_agent_&#x20;/&#x20;_module_','&lt;div&#x20;style=&quot;background-color:#EAF0F6;&#x20;font-family:&#x20;Arial,&#x20;Helvetica,&#x20;sans-serif;&#x20;padding:30px;&#x20;margin:0;&quot;&gt;&#x0d;&#x0a;&lt;table&#x20;style=&quot;max-width:560px;&#x20;background-color:white;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px&#x20;40px;&quot;&#x20;cellspacing=&quot;0&quot;&#x20;cellpadding=&quot;0&quot;&#x20;align=&quot;center&quot;&gt;&#x0d;&#x0a;&lt;thead&gt;&lt;tr&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/&quot;&#x20;target=&quot;_blank&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Pandora-FMS.png&quot;&#x20;width=&quot;206px&quot;&gt;&lt;/a&gt;&lt;/td&gt;&#x0d;&#x0a;&lt;td&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;p&#x20;style=&quot;text-align:right;&#x20;color:#223549;&#x20;font-weight:700;&#x20;line-height:36px;&#x20;padding:0px;&#x20;font-size:12px;&quot;&gt;Automatic&#x20;alert&#x20;system&lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&#x20;style=&quot;padding:0px&#x20;0px&#x20;5px;&quot;&gt;&lt;hr&#x20;style=&quot;border:&#x20;1px&#x20;solid&#x20;#f5f5f5;&#x20;width:100%;&#x20;margin:0px;&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/thead&gt;&#x0d;&#x0a;&lt;tbody&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;img&#x20;src=&quot;https://pandorafms.com/wp-content/uploads/2022/03/System-email-Good-news.png&quot;&#x20;style=&quot;display:&#x20;block;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;width:105px;&#x20;margin-top:20px;&#x20;padding:0px;&quot;&#x20;width=&quot;105px&quot;&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:24px;&#x20;text-align:center;&#x20;color:#223549;&#x20;padding:0px&#x20;10%;&#x20;line-height:34px;&#x20;margin:20px&#x20;0px;&quot;&gt;We&#x20;have&#x20;good&#x20;news&#x20;for&#x20;you,&#x20;alert&#x20;has&#x20;been&#x20;&lt;span&#x20;style=&quot;text-transform:uppercase;&#x20;font-weight:800;&quot;&gt;recovered&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;div&gt;&lt;!--[if&#x20;mso]&gt;&lt;v:rect&#x20;xmlns:v=&quot;urn:schemas-microsoft-com:vml&quot;&#x20;xmlns:w=&quot;urn:schemas-microsoft-com:office:word&quot;&#x20;href=&quot;#&quot;&#x20;style=&quot;height:33px;v-text-anchor:middle;width:100px;&quot;&#x20;stroke=&quot;f&quot;&#x20;fillcolor=&quot;#D84A38&quot;&gt;&lt;w:anchorlock/&gt;&lt;center&gt;&lt;![endif]--&gt;&lt;a&#x20;style=&quot;background-color:&#x20;#223549;&#x20;border:&#x20;none;&#x20;color:&#x20;white;&#x20;padding:&#x20;15px&#x20;30px;&#x20;text-align:&#x20;center;&#x20;text-decoration:&#x20;none;&#x20;display:&#x20;block;&#x20;font-size:&#x20;16px;&#x20;margin-left:&#x20;auto;&#x20;margin-right:&#x20;auto;&#x20;border-radius:100px;&#x20;max-width:50%;&#x20;margin-top:0px;&#x20;font-weight:700;&quot;&#x20;href=&quot;_homeurl_&quot;&gt;Go&#x20;to&#x20;Pandora&#x20;FMS&#x20;Console&lt;/a&gt;&lt;!--[if&#x20;mso]&gt;&lt;/center&gt;&lt;/v:rect&gt;&lt;![endif]--&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;colspan=&quot;2&quot;&gt;&lt;div&#x20;style=&quot;background-color:#F6F6F6;&#x20;border-radius:10px;&#x20;padding:10px&#x20;20px;&#x20;margin-top:40px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;Monitoring&#x20;details&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Data:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_data_&#x20;&lt;em&gt;&#40;normal&#41;&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Agent:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_agent_&#x20;&lt;em&gt;_address_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Module:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_module_&#x20;&lt;em&gt;_moduledescription_&lt;/em&gt;&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:15px;&#x20;color:#333333;&#x20;font-weight:800;&#x20;line-height:15px;&quot;&gt;Timestamp:&#x20;&lt;span&#x20;style=&quot;font-weight:400!important;&quot;&gt;_timestamp_&lt;/span&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&lt;/td&gt;&lt;/tr&gt;&#x0d;&#x0a;&lt;tr&gt;&lt;td&#x20;style=&quot;padding:20px&#x20;0px;&quot;&#x20;colspan=&quot;2&quot;&gt;&lt;p&#x20;style=&quot;font-size:18px;&#x20;line-height:30px;&#x20;color:#223549;&quot;&gt;This&#x20;is&#x20;a&#x20;graph&#x20;of&#x20;latest&#x20;24hr&#x20;data&#x20;for&#x20;this&#x20;module&lt;/p&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-weight:400!important;&quot;&gt;_modulegraph_24h_&lt;/p&gt;&#x0d;&#x0a;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&#x0d;&#x0a;&lt;/table&gt;&#x0d;&#x0a;&lt;div&#x20;style=&quot;text-align:center;&#x20;margin-top:10px;&quot;&gt;&#x0d;&#x0a;&lt;p&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;&lt;a&#x20;href=&quot;https://pandorafms.com/en/contact/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Contact&#x20;Us&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/community/forums/forum/english/&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Support&lt;/a&gt;&amp;nbsp;&amp;nbsp;|&amp;nbsp;&amp;nbsp;&lt;a&#x20;href=&quot;https://pandorafms.com/manual/en/start&quot;&#x20;style=&quot;font-size:12px;&#x20;text-decoration:&#x20;none;&#x20;font-weight:400;&#x20;color:#777;&quot;&gt;Docs&lt;/a&gt;&lt;/p&gt;&#x0d;&#x0a;&lt;/div&gt;&#x0d;&#x0a;&lt;/div&gt;','','','','','','','','','','','','','','','','','',3,0,0,'basic',0,0,NULL,'{\"monday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"tuesday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"wednesday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"thursday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"friday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"saturday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}],\"sunday\":[{\"start\":\"00:00:00\",\"end\":\"00:00:00\"}]}');

-- treport_custom_sql Data
INSERT INTO `treport_custom_sql` (`id`, `name`, `sql`) VALUES (1, 'Monitoring&#x20;Report&#x20;Agent', 'select&#x20;direccion,&#x20;alias,&#x20;comentarios,&#x20;&#40;select&#x20;nombre&#x20;from&#x20;tgrupo&#x20;where&#x20;tgrupo.id_grupo&#x20;=&#x20;tagente.id_grupo&#41;&#x20;as&#x20;`group`&#x20;from&#x20;tagente;');
INSERT INTO `treport_custom_sql` (`id`, `name`, `sql`) VALUES (2, 'Monitoring&#x20;Report&#x20;Modules', 'select&#x20;&#40;select&#x20;tagente.alias&#x20;from&#x20;tagente&#x20;where&#x20;tagente.id_agente&#x20;=&#x20;tagente_modulo.id_agente&#41;&#x20;as&#x20;agent_nombre,&#x20;nombre&#x20;,&#x20;&#40;select&#x20;tmodule_group.name&#x20;from&#x20;tmodule_group&#x20;where&#x20;tmodule_group.id_mg&#x20;=&#x20;tagente_modulo.id_module_group&#41;&#x20;as&#x20;module_group,&#x20;module_interval&#x20;from&#x20;tagente_modulo&#x20;where&#x20;delete_pending&#x20;=&#x20;0&#x20;order&#x20;by&#x20;nombre;');
INSERT INTO `treport_custom_sql` (`id`, `name`, `sql`) VALUES (3, 'Monitoring&#x20;Report&#x20;Alerts', 'select&#x20;t1.alias&#x20;as&#x20;agent_name,&#x20;t2.nombre&#x20;as&#x20;module_name,&#x20;&#40;select&#x20;talert_templates.name&#x20;from&#x20;talert_templates&#x20;where&#x20;talert_templates.id&#x20;=&#x20;t3.id_alert_template&#41;&#x20;as&#x20;template,&#x20;&#40;select&#x20;group_concat&#40;t02.name&#41;&#x20;from&#x20;talert_template_module_actions&#x20;as&#x20;t01&#x20;inner&#x20;join&#x20;talert_actions&#x20;as&#x20;t02&#x20;on&#x20;t01.id_alert_action&#x20;=&#x20;t02.id&#x20;where&#x20;t01.id_alert_template_module&#x20;=&#x20;t3.id&#x20;group&#x20;by&#x20;t01.id_alert_template_module&#41;&#x20;as&#x20;actions&#x20;from&#x20;tagente&#x20;as&#x20;t1&#x20;inner&#x20;join&#x20;tagente_modulo&#x20;as&#x20;t2&#x20;on&#x20;t1.id_agente&#x20;=&#x20;t2.id_agente&#x20;inner&#x20;join&#x20;talert_template_modules&#x20;as&#x20;t3&#x20;on&#x20;t2.id_agente_modulo&#x20;=&#x20;t3.id_agent_module&#x20;order&#x20;by&#x20;agent_name,&#x20;module_name;');
INSERT INTO `treport_custom_sql` (`id`, `name`, `sql`) VALUES (4, 'Group&#x20;view', 'select&#x20;t1.nombre,&#x20;&#40;select&#x20;count&#40;t3.id_agente&#41;&#x20;from&#x20;tagente&#x20;as&#x20;t3&#x20;where&#x20;t1.id_grupo&#x20;=&#x20;t3.id_grupo&#41;&#x20;as&#x20;agents,&#x20;&#40;SELECT&#x20;COUNT&#40;t4.id_agente&#41;&#x20;FROM&#x20;tagente&#x20;as&#x20;t4&#x20;WHERE&#x20;t4.id_grupo&#x20;=&#x20;t1.id_grupo&#x20;AND&#x20;t4.disabled&#x20;=&#x20;0&#x20;AND&#x20;t4.ultimo_contacto&#x20;&lt;&#x20;NOW&#40;&#41;&#x20;-&#x20;&#40;intervalo&#x20;/&#x20;&#40;1/2&#41;&#41;&#41;&#x20;as&#x20;agent_unknown,&#x20;&#40;SELECT&#x20;COUNT&#40;tagente_estado.id_agente_estado&#41;&#x20;FROM&#x20;tagente_estado,&#x20;tagente,&#x20;tagente_modulo&#x20;WHERE&#x20;tagente.id_grupo&#x20;=&#x20;t1.id_grupo&#x20;AND&#x20;tagente.disabled&#x20;=&#x20;0&#x20;AND&#x20;tagente.id_agente&#x20;=&#x20;tagente_estado.id_agente&#x20;AND&#x20;tagente_estado.id_agente_modulo&#x20;=&#x20;tagente_modulo.id_agente_modulo&#x20;AND&#x20;tagente_modulo.disabled&#x20;=&#x20;0&#x20;AND&#x20;utimestamp&#x20;&gt;&#x20;0&#x20;AND&#x20;tagente_modulo.id_tipo_modulo&#x20;NOT&#x20;IN&#40;21,22,23,24,100&#41;&#x20;AND&#x20;&#40;UNIX_TIMESTAMP&#40;NOW&#40;&#41;&#41;&#x20;-&#x20;tagente_estado.utimestamp&#41;&#x20;&gt;=&#x20;&#40;tagente_estado.current_interval&#x20;/&#x20;&#40;1/2&#41;&#41;&#41;&#x20;as&#x20;monitor_unknow,&#x20;&#40;SELECT&#x20;COUNT&#40;tagente_estado.id_agente_estado&#41;&#x20;FROM&#x20;tagente_estado,&#x20;tagente,&#x20;tagente_modulo&#x20;WHERE&#x20;tagente.id_grupo&#x20;=&#x20;t1.id_grupo&#x20;AND&#x20;tagente.disabled&#x20;=&#x20;0&#x20;AND&#x20;tagente.id_agente&#x20;=&#x20;tagente_estado.id_agente&#x20;AND&#x20;tagente_estado.id_agente_modulo&#x20;=&#x20;tagente_modulo.id_agente_modulo&#x20;AND&#x20;tagente_modulo.disabled&#x20;=&#x20;0&#x20;AND&#x20;tagente_modulo.id_tipo_modulo&#x20;NOT&#x20;IN&#x20;&#40;21,22,23,24&#41;&#x20;AND&#x20;utimestamp&#x20;=&#x20;0&#41;&#x20;as&#x20;monitor_no_init,&#x20;&#40;SELECT&#x20;COUNT&#40;tagente_estado.id_agente_estado&#41;&#x20;FROM&#x20;tagente_estado,&#x20;tagente,&#x20;tagente_modulo&#x20;WHERE&#x20;tagente.id_grupo&#x20;=&#x20;t1.id_grupo&#x20;AND&#x20;tagente.disabled&#x20;=&#x20;0&#x20;AND&#x20;tagente_estado.id_agente&#x20;=&#x20;tagente.id_agente&#x20;AND&#x20;tagente_estado.id_agente_modulo&#x20;=&#x20;tagente_modulo.id_agente_modulo&#x20;AND&#x20;tagente_modulo.disabled&#x20;=&#x20;0&#x20;AND&#x20;estado&#x20;=&#x20;0&#x20;AND&#x20;&#40;&#40;UNIX_TIMESTAMP&#40;NOW&#40;&#41;&#41;&#x20;-&#x20;tagente_estado.utimestamp&#41;&#x20;&lt;&#x20;&#40;tagente_estado.current_interval&#x20;/&#x20;&#40;1/2&#41;&#41;&#x20;OR&#x20;&#40;tagente_modulo.id_tipo_modulo&#x20;IN&#40;21,22,23,24,100&#41;&#41;&#41;&#x20;AND&#x20;&#40;utimestamp&#x20;&gt;&#x20;0&#x20;OR&#x20;&#40;tagente_modulo.id_tipo_modulo&#x20;IN&#40;21,22,23,24&#41;&#41;&#41;&#41;&#x20;as&#x20;monitor_ok,&#x20;&#40;SELECT&#x20;COUNT&#40;tagente_estado.id_agente_estado&#41;&#x20;FROM&#x20;tagente_estado,&#x20;tagente,&#x20;tagente_modulo&#x20;WHERE&#x20;tagente.id_grupo&#x20;=&#x20;t1.id_grupo&#x20;AND&#x20;tagente.disabled&#x20;=&#x20;0&#x20;AND&#x20;tagente_estado.id_agente&#x20;=&#x20;tagente.id_agente&#x20;AND&#x20;tagente_estado.id_agente_modulo&#x20;=&#x20;tagente_modulo.id_agente_modulo&#x20;AND&#x20;tagente_modulo.disabled&#x20;=&#x20;0&#x20;AND&#x20;estado&#x20;=&#x20;1&#x20;AND&#x20;&#40;&#40;UNIX_TIMESTAMP&#40;NOW&#40;&#41;&#41;&#x20;-&#x20;tagente_estado.utimestamp&#41;&#x20;&lt;&#x20;&#40;tagente_estado.current_interval&#x20;/&#x20;&#40;1/2&#41;&#41;&#x20;OR&#x20;&#40;tagente_modulo.id_tipo_modulo&#x20;IN&#40;21,22,23,24,100&#41;&#41;&#41;&#x20;AND&#x20;utimestamp&#x20;&gt;&#x20;0&#41;&#x20;as&#x20;monitor_critical,&#x20;&#40;SELECT&#x20;COUNT&#40;talert_template_modules.id&#41;&#x20;FROM&#x20;talert_template_modules,&#x20;tagente_modulo,&#x20;tagente_estado,&#x20;tagente&#x20;WHERE&#x20;tagente.id_grupo&#x20;=&#x20;t1.id_grupo&#x20;AND&#x20;tagente_modulo.id_agente&#x20;=&#x20;tagente.id_agente&#x20;AND&#x20;tagente_estado.id_agente_modulo&#x20;=&#x20;tagente_modulo.id_agente_modulo&#x20;AND&#x20;tagente_modulo.disabled&#x20;=&#x20;0&#x20;AND&#x20;tagente.disabled&#x20;=&#x20;0&#x20;AND&#x20;talert_template_modules.id_agent_module&#x20;=&#x20;tagente_modulo.id_agente_modulo&#x20;AND&#x20;times_fired&#x20;&gt;&#x20;0&#41;&#x20;as&#x20;monitor_alert_fired&#x20;from&#x20;tgrupo&#x20;as&#x20;t1&#x20;where&#x20;0&#x20;&lt;&#x20;&#40;select&#x20;count&#40;t2.id_agente&#41;&#x20;from&#x20;tagente&#x20;as&#x20;t2&#x20;where&#x20;t1.id_grupo&#x20;=&#x20;t2.id_grupo&#41;');
INSERT INTO `treport_custom_sql` (`id`, `name`, `sql`) VALUES (5, 'Agent&#x20;safe&#x20;mode&#x20;not&#x20;enable', 'select&#x20;alias&#x20;from&#x20;tagente&#x20;where&#x20;safe_mode_module&#x20;=&#x20;0');

-- trecon scripts
INSERT INTO `trecon_script` (`type`,`name`,`description`,`script`,`macros`) VALUES (1, 'Discovery.Application.VMware', 'Discovery&#x20;Application&#x20;script&#x20;to&#x20;monitor&#x20;VMware&#x20;technologies&#x20;&#40;ESXi,&#x20;VCenter,&#x20;VSphere&#41;', '/usr/share/pandora_server/util/recon_scripts/vmware-plugin.pl', '{"1":{"macro":"_field1_","desc":"Configuration&#x20;file","help":"","value":"","hide":""}}');
INSERT INTO `trecon_script` (`type`,`name`,`description`,`script`,`macros`) VALUES (2, 'Discovery.Cloud', 'Discovery&#x20;Cloud&#x20;script&#x20;to&#x20;monitor&#x20;Cloud&#x20;technologies&#x20;&#40;AWS.EC2,&#x20;AWS.S3,&#x20;AWS.RDS,&#x20RDS,&#x20AWS.EKS&#41;', '/usr/share/pandora_server/util/recon_scripts/pcm_client.pl', '{"1":{"macro":"_field1_","desc":"Configuration&#x20;file","help":"","value":"","hide":""}}');

-- IPAM is 3.
INSERT INTO `trecon_script` (`type`,`name`,`description`,`script`,`macros`) VALUES (4, 'IPMI&#x20;Recon','Specific&#x20;Pandora&#x20;FMS&#x20;Intel&#x20;DCM&#x20;Discovery&#x20;&#40;c&#41;&#x20;Artica&#x20;ST&#x20;2011&#x20;&lt;info@artica.es&gt;&#x0d;&#x0a;&#x0d;&#x0a;Usage:&#x20;./ipmi-recon.pl&#x20;&lt;task_id&gt;&#x20;&lt;group_id&gt;&#x20;&lt;custom_field1&gt;&#x20;&lt;custom_field2&gt;&#x20;&lt;custom_field3&gt;&#x20;&lt;custom_field4&gt;&#x0d;&#x0a;&#x0d;&#x0a;*&#x20;custom_field1&#x20;=&#x20;Network&#x20;i.e.:&#x20;192.168.100.0/24&#x0d;&#x0a;*&#x20;custom_field2&#x20;=&#x20;Username&#x0d;&#x0a;*&#x20;custom_field3&#x20;=&#x20;Password&#x0d;&#x0a;*&#x20;custom_field4&#x20;=&#x20;Additional&#x20;parameters&#x20;i.e.:&#x20;-D&#x20;LAN_2_0','/usr/share/pandora_server/util/recon_scripts/ipmi-recon.pl','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Network\",\"help\":\"i.e.:&#x20;192.168.100.0/24\",\"value\":\"\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"\",\"value\":\"\",\"hide\":\"1\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Additional&#x20;parameters\",\"help\":\"Optional&#x20;additional&#x20;parameters&#x20;such&#x20;as&#x20;-D&#x20;LAN_2_0&#x20;to&#x20;use&#x20;IPMI&#x20;ver&#x20;2.0&#x20;instead&#x20;of&#x20;1.5.&#x20;&#x20;These&#x20;options&#x20;will&#x20;also&#x20;be&#x20;passed&#x20;to&#x20;the&#x20;IPMI&#x20;plugin&#x20;when&#x20;the&#x20;current&#x20;values&#x20;are&#x20;read.\",\"value\":\"\",\"hide\":\"\"}}');

INSERT INTO `trecon_script` (`type`,`name`,`description`,`script`,`macros`) VALUES (3, 'IPAM Recon', 'This script is used to automatically detect network hosts availability and name, used as Recon Custom Script in the recon task. Parameters used are:\n\n* custom_field1 = network. i.e.: 192.168.100.0/24\n* custom_field2 = associated IPAM network id. i.e.: 4. Please do not change this value, it is assigned automatically in IPAM management.\n\nSee documentation for more information.', '/usr/share/pandora_server/util/recon_scripts/IPAMrecon.pl', '{"1":{"macro":"_field1_","desc":"Network","help":"i.e.:&#x20;192.168.100.0/24","value":"","hide":""}}');

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `execute`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (1,'IPMI&#x20;Plugin','Plugin&#x20;to&#x20;get&#x20;IPMI&#x20;monitors&#x20;from&#x20;a&#x20;IPMI&#x20;Device.',0,'/usr/share/pandora_server/util/plugin/ipmi-plugin.pl',0,'{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Target&#x20;IP\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Username\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Password\",\"help\":\"\",\"value\":\"\",\"hide\":\"true\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Sensor\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"5\":{\"macro\":\"_field5_\",\"desc\":\"Additional&#x20;Options\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"}}','-h&#x20;_field1_&#x20;-u&#x20;_field2_&#x20;-p&#x20;_field3_&#x20;-s&#x20;_field4_&#x20;--&#x20;_field5_', 1);

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `execute`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (2,'DNS&#x20;Plugin','This&#x20;plugin&#x20;is&#x20;used&#x20;to&#x20;check&#x20;if&#x20;a&#x20;specific&#x20;domain&#x20;return&#x20;a&#x20;specific&#x20;IP&#x20;address,&#x20;and&#x20;to&#x20;check&#x20;how&#x20;time&#x20;&#40;milisecs&#41;&#x20;takes&#x20;the&#x20;DNS&#x20;to&#x20;answer.&#x20;Use&#x20;IP&#x20;address&#x20;parameter&#x20;to&#x20;specify&#x20;the&#x20;IP&#x20;of&#x20;your&#x20;domain.&#x20;Use&#x20;these&#x20;custom&#x20;parameters&#x20;for&#x20;the&#x20;other&#x20;parameters:&#x0d;&#x0a;&#x0d;&#x0a;-d&#x20;domain&#x20;to&#x20;check&#x20;&#40;for&#x20;example&#x20;pandorafms.com&#41;&#x0d;&#x0a;-s&#x20;DNS&#x20;Server&#x20;to&#x20;check&#x20;&#x20;&#40;for&#x20;example&#x20;8.8.8.8&#41;&#x0d;&#x0a;&#x0d;&#x0a;Optional&#x20;parameters:&#x0d;&#x0a;&#x0d;&#x0a;-t&#x20;Do&#x20;a&#x20;DNS&#x20;time&#x20;response&#x20;check&#x20;instead&#x20;DNS&#x20;resolve&#x20;test&#x0d;&#x0a;&#x0d;&#x0a;',15,'/usr/share/pandora_server/util/plugin/dns_plugin.sh',0,'{"1":{"macro":"_field1_","desc":"Target&#x20;IP","help":"","value":""},"2":{"macro":"_field2_","desc":"Domain&#x20;to&#x20;check","help":"For&#x20;example&#x20;pandorafms.com","value":""},"3":{"macro":"_field3_","desc":"DNS&#x20;Server&#x20;to&#x20;check","help":"For&#x20;example&#x20;8.8.8.8","value":""},"4":{"macro":"_field4_","desc":"Optional&#x20;parameters","help":"","value":""}}','-i&#x20;_field1_&#x20;-d&#x20;_field2_&#x20;-s&#x20;_field3_&#x20;_field4_', 1);

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `execute`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (3,'UDP&#x20;port&#x20;check','Check&#x20;a&#x20;remote&#x20;UDP&#x20;port&#x20;&#40;by&#x20;using&#x20;NMAP&#41;.&#x20;Use&#x20;IP&#x20;address&#x20;and&#x20;Port&#x20;options.',5,'/usr/share/pandora_server/util/plugin/udp_nmap_plugin.sh',0,'{"1":{"macro":"_field1_","desc":"Target&#x20;IP","help":"","value":""},"2":{"macro":"_field2_","desc":"Port","help":"","value":""}}','-t&#x20;_field1_&#x20;-p&#x20;_field2_', 1);

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `execute`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (4,'SMTP&#x20;Check','This&#x20;plugin&#x20;is&#x20;used&#x20;to&#x20;send&#x20;a&#x20;mail&#x20;to&#x20;a&#x20;SMTP&#x20;server&#x20;and&#x20;check&#x20;if&#x20;works.&#x20;&#x0d;&#x0a;&#x0d;&#x0a;Parameters&#x20;in&#x20;the&#x20;plugin:&#x0d;&#x0a;&#x0d;&#x0a;IP&#x20;Address&#x20;-&#x20;SMTP&#x20;Server&#x20;IP&#x20;address&#x0d;&#x0a;User&#x20;-&#x20;AUTH&#x20;login&#x20;&#x20;&#x0d;&#x0a;Pass&#x20;-&#x20;AUTH&#x20;password&#x0d;&#x0a;Port&#x20;-&#x20;SMTP&#x20;port&#x20;&#40;optional&#41;&#x0d;&#x0a;&#x0d;&#x0a;Optional&#x20;parameters:&#x0d;&#x0a;&#x0d;&#x0a;-d&#x20;Destination&#x20;email&#x0d;&#x0a;-f&#x20;Email&#x20;of&#x20;the&#x20;sender&#x0d;&#x0a;-a&#x20;Authentication&#x20;system.&#x20;Could&#x20;be&#x20;LOGIN,&#x20;PLAIN,&#x20;CRAM-MD5&#x20;or&#x20;DIGEST-MD',10,'/usr/share/pandora_server/util/plugin/SMTP_check.pl',0,'{"1":{"macro":"_field1_","desc":"Target&#x20;IP","help":"","value":""},"2":{"macro":"_field2_","desc":"Port","help":"","value":""},"3":{"macro":"_field3_","desc":"Username","help":"","value":""},"4":{"macro":"_field4_","desc":"Password","help":"","value":""},"5":{"macro":"_field5_","desc":"Optional&#x20;parameters","help":"","value":""}}','-h&#x20;_field1_&#x20;-o&#x20;_field2_&#x20;-u&#x20;_field3_&#x20;-p&#x20;_field4_&#x20;_field5_', 1);

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `execute`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (6,'MySQL&#x20;Plugin','Samples:&#x0d;&#x0a;&#x20;&#x20;&#x20;./mysql_plugin.sh&#x20;-u&#x20;root&#x20;-p&#x20;none&#x20;-s&#x20;localhost&#x20;-q&#x20;Com_select&#x0d;&#x0a;&#x20;&#x20;&#x20;./mysql_plugin.sh&#x20;-u&#x20;root&#x20;-p&#x20;none&#x20;-s&#x20;localhost&#x20;-q&#x20;Com_update&#x0d;&#x0a;&#x20;&#x20;&#x20;./mysql_plugin.sh&#x20;-u&#x20;root&#x20;-p&#x20;none&#x20;-s&#x20;localhost&#x20;-q&#x20;Connections&#x0d;&#x0a;&#x20;&#x20;&#x20;./mysql_plugin.sh&#x20;-u&#x20;root&#x20;-p&#x20;anypass&#x20;-s&#x20;192.168.50.24&#x20;-q&#x20;Innodb_rows_read&#x0d;&#x0a;',15,'/usr/share/pandora_server/util/plugin/mysql_plugin.sh',0,'{"1":{"macro":"_field1_","desc":"IP&#x20;address","help":"IP&#x20;address","value":""},"2":{"macro":"_field2_","desc":"Username","help":"Username&#x20;to&#x20;access&#x20;to&#x20;database","value":""},"3":{"macro":"_field3_","desc":"Password","help":"Password&#x20;to&#x20;access&#x20;to&#x20;database","value":""},"4":{"macro":"_field4_","desc":"Query&#x20;string","help":"Query&#x20;string&#x20;of&#x20;global&#x20;status.&#x20;For&#x20;example&#x20;&#039;Aborted_connects&#039;&#x20;or&#x20;&#039;Innodb_rows_read&#039;","value":""}}', '-s&#x20;_field1_&#x20;-u&#x20;_field2_&#x20;-p&#x20;_field3_&#x20;-q&#x20;_field4_', 1);

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `execute`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (8,'SNMP&#x20;remote','Plugin&#x20;that&#x20;gets&#x20;remotely,&#x20;using&#x20;SNMP,&#x20;values&#x20;such&#x20;as&#x20;the&#x20;percentage&#x20;of&#x20;disk&#x20;or&#x20;memory&#x20;used,&#x20;the&#x20;status&#x20;of&#x20;a&#x20;process&#x20;or&#x20;the&#x20;CPU&#x20;load',0,'perl&#x20;/usr/share/pandora_server/util/plugin/snmp_remote.pl',0,'{"1":{"macro":"_field1_","desc":"Target&#x20;IP","help":"","value":"_address_"},"2":{"macro":"_field2_","desc":"Community","help":"","value":"public"},"3":{"macro":"_field3_","desc":"Plug-in&#x20;Parameters","help":"Memory&#x20;use&#x20;&#40;%&#41;&#x0d;&#x0a;-m&#x20;memuse&#x0d;&#x0a;&#x0d;&#x0a;Disk&#x20;use&#x20;&#40;%&#41;&#x0d;&#x0a;-m&#x20;diskuse&#x20;-d&#x20;[disk&#x20;name]&#x0d;&#x0a;&#x0d;&#x0a;Status&#x20;of&#x20;a&#x20;process&#x20;&#40;0/1&#41;&#x0d;&#x0a;-m&#x20;process&#x20;-p&#x20;[process_name]&#x20;&#x0d;&#x0a;&#x0d;&#x0a;Average&#x20;of&#x20;CPUs&#x20;Load&#x20;&#40;%&#41;&#x0d;&#x0a;-m&#x20;cpuload","value":""}}', '-H&#x20;_field1_&#x20;-c&#x20;_field2_&#x20;_field3_', 1);

INSERT INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `max_retries`, `execute`, `net_dst_opt`, `net_port_opt`, `user_opt`, `pass_opt`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (9,'Packet&#x20;Loss','Checks&#x20;for&#x20;dropped&#x20;packages&#x20;after&#x20;X&#x20;seconds&#x20;of&#x20;testing.&#x20;It&#x20;returns&#x20;%&#x20;of&#x20;dropped&#x20;packets.&#x20;It&#x20;uses&#x20;ping&#x20;flood&#x20;mode&#x20;to&#x20;launch&#x20;50&#x20;consecutive&#x20;pings&#x20;to&#x20;a&#x20;remote&#x20;destination.&#x20;On&#x20;local,&#x20;stable&#x20;networks,&#x20;value&#x20;should&#x20;be&#x20;0.&#x0d;&#x0a;',30,0,'/usr/share/pandora_server/util/plugin/packet_loss.sh','','','','',0,'{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Test&#x20;time\",\"help\":\"\",\"value\":\"8\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Target&#x20;IP\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"}}','_field1_&#x20;_field2_', 1);

INSERT INTO `tagent_custom_fields` VALUES (1,'Serial&#x20;Number',0,0,'',0),(2,'Department',0,0,'',0),(3,'Additional&#x20;ID',0,0,'',0),(4,'eHorusID',0,0,'',0);

INSERT INTO `ttag` VALUES (1,'network','Network&#x20;equipment','http://artica.es','','',''),(2,'critical','Critical&#x20;modules','','','',''),(3,'dmz','DMZ&#x20;Network&#x20;Zone','','','',''),(4,'performance','Performance&#x20;anda&#x20;capacity&#x20;modules','','','',''),(5,'configuration','','','','','');

INSERT INTO `tevent_response` VALUES (1,'Ping&#x20;to&#x20;host','Ping&#x20;to&#x20;the&#x20;agent&#x20;host','ping&#x20;-c&#x20;5&#x20;_agent_address_','command',0,620,500,0,'',0,90,0),(3,'Create&#x20;incident&#x20;from&#x20;event','Create&#x20;a&#x20;incident&#x20;from&#x20;the&#x20;event&#x20;with&#x20;the&#x20;standard&#x20;incidents&#x20;system&#x20;of&#x20;Pandora&#x20;FMS','index.php?sec=workspace&amp;sec2=operation/incidents/incident_detail&amp;insert_form&amp;from_event=_event_id_','url',0,0,0,1,'',0,90,0),(5,'Restart&#x20;agent','Restart&#x20;the&#x20;agent&#x20;with&#x20;using&#x20;UDP&#x20;protocol.&#x0d;&#x0a;&#x0d;&#x0a;To&#x20;use&#x20;this&#x20;response&#x20;is&#x20;necessary&#x20;to&#x20;have&#x20;installed&#x20;Pandora&#x20;FMS&#x20;server&#x20;and&#x20;console&#x20;in&#x20;the&#x20;same&#x20;machine.','/usr/share/pandora_server/util/udp_client.pl&#x20;_agent_address_&#x20;41122&#x20;&quot;REFRESH&#x20;AGENT&quot;','command',0,620,500,0,'',0,90,0),(6,'Ping&#x20;to&#x20;module&#x20;agent&#x20;host','Ping&#x20;to&#x20;the&#x20;module&#x20;agent&#x20;host','ping&#x20;-c&#x20;5&#x20;_module_address_','command',0,620,500,0,'',0,90,0),(7,'Create&#x20;ticket&#x20;in&#x20;Pandora&#x20;ITSM&#x20;from&#x20;event','Create&#x20;a&#x20;ticket&#x20;in&#x20;Pandora&#x20;ITSM&#x20;from&#x20;an&#x20;event','index.php?sec=manageTickets&amp;sec2=operation/ITSM/itsm&amp;operation=edit&amp;from_event=_event_id_','url',0,0,0,1,'',0,90,1);

INSERT INTO `tupdate_settings` VALUES  ('current_update', '412'), ('customer_key', 'PANDORA-FREE'), ('updating_binary_path', 'Path where the updated binary files will be stored'), ('updating_code_path', 'Path where the updated code is stored'), ('dbname', ''), ('dbhost', ''), ('dbpass', ''), ('dbuser', ''), ('dbport', ''), ('proxy', ''), ('proxy_port', ''), ('proxy_user', ''), ('proxy_pass', '');

--
-- Dumping data for table `tskin`
--
INSERT INTO `tskin` VALUES (1,'Default&#x20;theme', 'pandora.css', 'Default&#x20;skin&#x20;for&#x20;Pandora&#x20;FMS&#x20;web&#x20;console', 0);
INSERT INTO `tskin` VALUES (2,'Black&#x20;theme', 'pandora_black.css', 'Black&#x20;theme', 0);

--
-- Dumping data for table `tcollection`
--
INSERT INTO `tcollection` VALUES (1,'Apache&#x20;Enterprise&#x20;Plugin','apache_plugin',0,'Apache&#x20;Enterprise&#x20;Plugin&#x20;to&#x20;monitor&#x20;Apache&#x20;web&#x20;server&#x20;using&#x20;a&#x20;Perl&#x20;script.',0);


INSERT INTO `tpolicies` VALUES (1,'Basic&#x20;Windows&#x20;Monitoring','Basic&#x20;local&#x20;checks&#x20;to&#x20;monitor&#x20;Windows&#x20;Systems.&#x0d;&#x0a;Requires&#x20;Powershell&#x20;3+.',2,0,0,0);
INSERT INTO `tpolicies` VALUES (2,'Basic&#x20;Linux&#x20;Monitoring','Basic&#x20;local&#x20;checks&#x20;to&#x20;monitor:&#x20;&#x0d;&#x0a;-&#x20;CentOS&#x0d;&#x0a;-&#x20;RedHat&#x0d;&#x0a;-&#x20;Debian&#x0d;&#x0a;-&#x20;SUSE',2,0,0,0);
INSERT INTO `tpolicies` VALUES (3,'Basic&#x20;Solaris&#x20;Local&#x20;Monitoring','Basic&#x20;local&#x20;checks&#x20;to&#x20;monitor&#x20;Solaris&#x20;systems.',2,0,0,0);
INSERT INTO `tpolicies` VALUES (4,'Basic&#x20;AIX&#x20;Local&#x20;Monitoring','Basic&#x20;local&#x20;checks&#x20;to&#x20;monitoring&#x20;AIX&#x20;systems.',2,0,0,0);
INSERT INTO `tpolicies` VALUES (5,'Basic&#x20;HP-UX&#x20;Local&#x20;Monitoring','Basic&#x20;local&#x20;checks&#x20;to&#x20;monitoring&#x20;HP/UX&#x20;systems.',2,0,0,0);
INSERT INTO `tpolicies` VALUES (6,'Basic&#x20;Remote&#x20;Checks','Basic&#x20;Remote&#x20;Checks&#x20;&#40;ping,&#x20;latency,&#x20;ports&#41;.',9,0,0,0);

INSERT INTO `tpolicy_modules` VALUES (1,1,'module_begin&#x0a;module_name&#x20;Bytes&#x20;per&#x20;second&#x20;&#40;Received&#41;&#x0a;module_type&#x20;generic_data_inc&#x0a;module_exec&#x20;powershell&#x20;-c&#x20;&quot;Get-NetAdapterStatistics&#x20;|Measure-Object&#x20;-Sum&#x20;ReceivedBytes&#x20;|Select&#x20;-ExpandProperty&#x20;Sum&quot;&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;',4,'','Bytes&#x20;per&#x20;second&#x20;&#40;Received&#41;','',0,0,1,'',0,'','','','',1,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (2,1,'module_begin&#x0a;module_name&#x20;Bytes&#x20;per&#x20;second&#x20;&#40;Sent&#41;&#x0a;module_type&#x20;generic_data_inc&#x0a;module_exec&#x20;powershell&#x20;-c&#x20;&quot;Get-NetAdapterStatistics&#x20;|Measure-Object&#x20;-Sum&#x20;SentBytes&#x20;|Select&#x20;-ExpandProperty&#x20;Sum&quot;&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;',4,'','Bytes&#x20;per&#x20;second&#x20;&#40;Sent&#41;','',0,0,1,'',0,'','','','',1,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (3,1,'module_begin&#x0a;module_name&#x20;CPU&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_cpuusage&#x20;all&#x0a;module_unit&#x20;%&#x0a;module_min_warning&#x20;79.00&#x0a;module_max_warning&#x20;90.00;module_min_critical&#x20;91.00&#x0a;module_max_critical&#x20;00.00;&#x0amodule_end&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;',1,'CPU&#x20;usage&#x20;&#40;%&#41;','CPU&#x20;%','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,79.00,90.00,'',91.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (4,1,'module_begin&#x0a;module_name&#x20;Total&#x20;processes&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;tasklist&#x20;|&#x20;wc&#x20;-l&#x20;|&#x20;gawk&#x20;&quot;{print&#x20;$1}&quot;&#x0a;module_end&#x0a;&#x0a;&#x0a;',1,'','Total&#x20;processes','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (5,1,'module_begin&#x0a;module_name&#x20;Uptime&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;powershell&#x20;-c&#x20;&quot;&#40;&#40;get-date&#41;&#x20;-&#x20;&#40;gcim&#x20;Win32_OperatingSystem&#41;.LastBootUpTime&#x20;|&#x20;Select&#x20;-ExpandProperty&#x20;Ticks&#41;&#x20;/&#x20;100000&quot;&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;',1,'','Uptime','_timeticks_',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (6,1,'module_begin&#x0a;module_name&#x20;WMI&#x20;Service&#x0a;module_type&#x20;generic_proc&#x0a;module_service&#x20;winmgmt&#x0a;module_end&#x0a;&#x0a;',2,'WMI&#x20;Service&#x20;enabled','WMI&#x20;Service','',0,0,1,'',0,'','','','',3,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (7,2,'module_begin&#x0a;module_name&#x20;Bytes&#x20;per&#x20;second&#x20;&#40;Received&#41;&#x0a;module_type&#x20;generic_data_inc&#x0a;module_exec&#x20;awk&#x20;&#039;!/lo:/&#x20;{s+=$2}END{print&#x20;s}&#039;&#x20;/proc/net/dev&#x0a;module_min_warning&#x20;0&#x0a;module_max_warning&#x20;0&#x0a;module_min_critical&#x20;0&#x0a;module_max_critical&#x20;0&#x0a;module_end&#x0a;&#x0a;',4,'','Bytes&#x20;per&#x20;second&#x20;&#40;Received&#41;','bytes/sec',0,0,1,'',0,'','','','',1,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (8,2,'module_begin&#x0a;module_name&#x20;Bytes&#x20;per&#x20;second&#x20;&#40;Sent&#41;&#x0a;module_type&#x20;generic_data_inc&#x0a;module_exec&#x20;awk&#x20;&#039;!/lo:/&#x20;{s+=$10}END{print&#x20;s}&#039;&#x20;/proc/net/dev&#x0a;module_min_warning&#x20;0&#x0a;module_max_warning&#x20;0&#x0a;module_min_critical&#x20;0&#x0a;module_max_critical&#x20;0&#x0a;module_end&#x0a;',4,'','Bytes&#x20;per&#x20;second&#x20;&#40;Sent&#41;','bytes/sec',0,0,1,'',0,'','','','',1,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (9,2,'module_begin&#x0a;module_name&#x20;CPU&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;1&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$13&#x20;+&#x20;$14&#x20;}&#039;&#x0a;module_unit&#x20;%&#x0a;module_end&#x0a;&#x0a;',1,'Current&#x20;use&#x20;of&#x20;CPU&#x20;&#40;System&#x20;+&#x20;User&#41;.','CPU&#x20;%','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (10,2,'module_begin&#x0a;module_name&#x20;I/O&#x20;Lock&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;1&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$16}&#039;&#x0a;module_description&#x20;I/O&#x20;Wait&#x20;Disk&#x0a;module_end&#x0a;&#x0a;&#x0a;',1,'','I/O&#x20;Lock','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (11,2,'module_begin&#x20;&#x0a;module_name&#x20;Load&#x20;Average&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;cat&#x20;/proc/loadavg&#x20;|awk&#x20;&#039;{print&#x20;$2}&#039;&#x0a;module_end&#x0a;&#x0a;',1,'Average&#x20;process&#x20;in&#x20;CPU&#x20;&#40;Last&#x20;5&#x20;minutes&#41;.','Load&#x20;Average','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (12,2,'module_begin&#x0a;module_name&#x20;Port&#x20;22&#x20;Open&#x20;&#40;SSH&#41;&#x0a;module_type&#x20;generic_proc&#x0a;module_exec&#x20;echo&#x20;&gt;&#x20;/dev/tcp/127.0.0.1/22&#x20;&gt;/dev/null&#x20;2&gt;&amp;1&#x20;&amp;&amp;&#x20;echo&#x20;1&#x20;||&#x20;echo&#x20;0&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;',2,'Checks&#x20;if&#x20;port&#x20;22&#x20;&#40;SSH&#41;&#x20;is&#x20;listening.','Port&#x20;22&#x20;Open&#x20;&#40;SSH&#41;','',0,0,1,'',0,'','','','',3,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (13,2,'module_begin&#x0a;module_name&#x20;Total&#x20;processes&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;ps&#x20;ax&#x20;|&#x20;tail&#x20;-n&#x20;+2&#x20;|&#x20;wc&#x20;-l&#x0a;module_description&#x20;Total&#x20;processes&#x0a;module_end',1,'','Total&#x20;processes','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (14,2,'module_begin&#x0a;module_name&#x20;Uptime&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;awk&#x20;&#039;{print&#x20;$1*100}&#039;&#x20;/proc/uptime&#x0a;module_end&#x0a;',1,'Host&#x20;Up&#x20;time&#x20;&#40;Timeticks&#41;','Uptime','_timeticks_',0,0,1,'',0,'','','','',1,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (15,3,'module_begin&#x0a;module_name&#x20;CPU&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;1&#x20;|&#x20;tail&#x20;-1|&#x20;awk&#x20;&#039;{print&#x20;&#40;100-$NF&#41;}&#039;&#x0a;module_unit&#x20;%&#x0a;module_end&#x0a;',1,'CPU&#x20;usage&#x20;%','CPU&#x20;%','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (16,3,'module_begin&#x0d;&#x0a;module_name&#x20;Disk&#x20;/&#x20;usage&#x20;&#40;%&#41;&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-k&#x20;/&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;tr&#x20;-d&#x20;&quot;%&quot;&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$5}&#039;&#x0d;&#x0a;module_end&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;',1,'Disk&#x20;use&#x20;percentage&#x20;for&#x20;root&#x20;partition&#x20;&#40;/&#41;','Disk&#x20;/&#x20;usage&#x20;&#40;%&#41;','',0,0,1,'',0,'','','','',1,1,1,0,0,'','','',0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *','','{\"going_unknown\":0}','W10=',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (17,3,'module_begin&#x0d;&#x0a;module_name&#x20;Disk&#x20;/var&#x20;usage&#x20;&#40;%&#41;&#x0d;&#x0a;module_type&#x20;generic_data&#x0d;&#x0a;module_exec&#x20;df&#x20;-k&#x20;/var&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;tr&#x20;-d&#x20;&quot;%&quot;&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$5}&#039;&#x0d;&#x0a;module_end&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;&#x0d;&#x0a;',1,'Disk&#x20;use&#x20;percentage&#x20;for&#x20;var&#x20;partition&#x20;&#40;/var&#41;','Disk&#x20;/var&#x20;usage&#x20;&#40;%&#41;','',0,0,1,'',0,'','','','',1,1,1,0,0,'','','',0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *','','{\"going_unknown\":0}','W10=',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (18,3,'module_begin&#x0a;module_name&#x20;Load&#x20;Average&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;uptime&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$&#40;NF-2&#41;}&#039;&#x20;|&#x20;tr&#x20;-d&#x20;&#039;,&#039;&#x0a;module_end&#x0a;',1,'Load&#x20;average','Load&#x20;Average','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (19,3,'module_begin&#x0a;module_name&#x20;Memory&#x20;Free&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_freepercentmemory&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;',1,'Percentage&#x20;Mem&#x20;Free','Memory&#x20;Free&#x20;%','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,8.00,15.00,'',0.00,7.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (20,3,'module_begin&#x0a;module_name&#x20;Port&#x20;22&#x20;Open&#x20;&#40;SSH&#41;&#x0a;module_type&#x20;generic_proc&#x0a;module_exec&#x20;timeout&#x20;1&#x20;bash&#x20;-c&#x20;&quot;echo&#x20;&gt;&#x20;/dev/tcp/127.0.0.1/22&quot;&#x20;&gt;/dev/null&#x20;2&gt;&amp;1&#x20;&amp;&amp;&#x20;echo&#x20;1&#x20;||&#x20;echo&#x20;0&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;',2,'Checks&#x20;if&#x20;port&#x20;22&#x20;&#40;SSH&#41;&#x20;is&#x20;listening.','Port&#x20;22&#x20;Open&#x20;&#40;SSH&#41;','',0,0,1,'',0,'','','','',3,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (21,3,'module_begin&#x0a;module_name&#x20;Swap&#x20;Used&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;swap&#x20;-l&#x20;|tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;100&#x20;-&#x20;&#40;$NF&#x20;/&#x20;$&#40;NF-1&#41;&#x20;*&#x20;100&#41;}&#039;&#x0a;module_unit&#x20;%&#x0a;module_end&#x0a;&#x0a;&#x0a;',1,'Swap&#x20;memory&#x20;available&#x20;in&#x20;%','Swap&#x20;Used&#x20;%','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (22,3,'module_begin&#x0a;module_name&#x20;Total&#x20;processes&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;ps&#x20;-A&#x20;|&#x20;wc&#x20;-l&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$1}&#039;&#x0a;module_end',1,'Total&#x20;processes','Total&#x20;processes','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (23,3,'module_beg&#x0a;module_name&#x20;Uptime&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;perl&#x20;-e&#x20;&quot;print&#x20;100*&#40;time&#x20;-&#x20;$&#40;kstat&#x20;-p&#x20;unix:0:system_misc:boot_time&#x20;|awk&#x20;&#039;{print&#x20;$2}&#039;&#41;&#41;&quot;&#x0a;module_end&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;&#x0a;',1,'Host&#x20;Up&#x20;time&#x20;&#40;Timeticks&#41;','Uptime','_timeticks_',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (24,4,'module_begin&#x0a;module_name&#x20;CPU&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;sar&#x20;1&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;100&#x20;-&#x20;$5}&#039;&#x0a;module_description&#x20;CPU&#x20;usage&#x20;in&#x20;%&#x0a;module_unit&#x20;%&#x0a;module_end',1,'','CPU&#x20;%','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (25,4,'module_begin&#x0a;module_name&#x20;CPU&#x20;User&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;sar&#x20;1&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$2}&#039;&#x0a;module_description&#x20;CPU&#x20;usage&#x20;in&#x20;%&#x0a;module_unit&#x20;%&#x0a;module_end',1,'','CPU&#x20;User','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (26,4,'module_begin&#x20;&#x0a;module_name&#x20;Load&#x20;Average&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;uptime&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$&#40;NF-2&#41;*1}&#039;&#x20;&#x0a;module_description&#x20;Average&#x20;process&#x20;in&#x20;CPU&#x20;&#40;Last&#x20;minute&#41;&#x20;&#x0a;module_end',1,'','Load&#x20;Average','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (27,4,'module_begin&#x0a;module_name&#x20;Memory&#x20;Free&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;svmon&#x20;-G|grep&#x20;memory&#x20;|&#x20;awk&#x20;&#039;{print&#x20;&#40;1-&#x20;$3/$2&#x20;&#41;*100}&#039;&#x0a;module_description&#x20;Percentage&#x20;Mem&#x20;Free&#x0a;module_end&#x0a;',1,'','Memory&#x20;Free&#x20;%','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (28,4,'module_begin&#x0a;module_name&#x20;Pagination&#x20;use&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;&#x20;lsps&#x20;-s&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$2+0}&#039;&#x0a;module_end',1,'','Pagination&#x20;use','',0,0,1,'',0,'','','','',1,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (29,4,'module_begin&#x0a;module_name&#x20;Service&#x20;sshd&#x20;status&#x0a;module_type&#x20;generic_proc&#x0a;module_exec&#x20;lssrc&#x20;-a&#x20;|&#x20;grep&#x20;ssh&#x20;|&#x20;grep&#x20;active&#x0a;module_end',2,'','Service&#x20;sshd&#x20;status','',0,0,1,'',0,'','','','',3,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (30,4,'module_begin&#x0a;module_name&#x20;Uptime&#x0a;module_type&#x20;generic_data_string&#x0a;module_exec&#x20;uptime&#x20;|sed&#x20;&quot;s/us&#92;.*$//g&quot;&#x20;|&#x20;sed&#x20;&quot;s/,&#92;.*$//g&quot;&#x0a;module_description&#x20;Host&#x20;Up&#x20;time&#x0a;module_end&#x0a;',1,'','Uptime','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (31,5,'module_begin&#x0a;module_name&#x20;CPU&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_cpuusage&#x20;all&#x0a;module_unit&#x20;%&#x0a;module_end&#x0a;',1,'','CPU&#x20;%','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (32,5,'module_begin&#x0a;module_name&#x20;CPU&#x20;User&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;vmstat&#x20;1&#x20;2&#x20;|&#x20;tail&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{&#x20;print&#x20;$&#40;16&#41;&#x20;}&#039;&#x0a;module_description&#x20;%&#x20;of&#x20;User&#x20;CPU&#x0a;module_unit&#x20;%&#x0a;module_end&#x0a;&#x0a;',1,'','CPU&#x20;User','%',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (33,5,'module_begin&#x0a;module_name&#x20;Load&#x20;Average&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;uptime&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$&#40;NF-2&#41;}&#039;&#x20;|&#x20;tr&#x20;-d&#x20;&#039;,&#039;&#x0a;module_description&#x20;System&#x20;load&#x20;average&#x0a;module_end&#x0a;',1,'','Load&#x20;Average','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (34,5,'module_begin&#x0a;module_name&#x20;Memory&#x20;Free&#x20;%&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;echo&#x20;&quot;&quot;&#x20;&gt;&#x20;/tmp/hpvm_toptest;&#x20;top&#x20;-d&#x20;1&#x20;-f&#x20;/tmp/hpvm_toptest&#x20;2&gt;/dev/null&#x20;1&gt;/dev/null;&#x20;cat&#x20;/tmp/hpvm_toptest&#x20;|&#x20;grep&#x20;-i&#x20;Memory&#x20;|&#x20;head&#x20;-1&#x20;|&#x20;awk&#x20;&#039;{print&#x20;$8/&#40;$2+$5&#41;&#x20;*&#x20;100}&#039;&#x0a;module_end&#x0a;&#x0a;&#x0a;',1,'','Memory&#x20;Free&#x20;%','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (35,5,'module_begin&#x0a;module_name&#x20;&#x20;Service&#x20;sshd&#x20;status&#x0a;module_type&#x20;generic_proc&#x0a;module_exec&#x20;ps&#x20;-ef&#x20;|&#x20;grep&#x20;&#x20;-v&#x20;grep&#x20;|&#x20;grep&#x20;&quot;/opt/ssh/sbin/sshd&quot;&#x20;|&#x20;wc&#x20;-l&#x0a;module_description&#x20;SSH&#x20;running&#x0a;module_end&#x0a;&#x0a;',2,'','Service&#x20;sshd&#x20;status','',0,0,1,'',0,'','','','',3,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (36,5,'module_begin&#x0a;module_name&#x20;Total&#x20;processes&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;echo&#x20;$&#40;&#40;&#40;`ps&#x20;-e&#x20;|&#x20;wc&#x20;-l`&#41;-1&#41;&#41;&#x20;|&#x20;tr&#x20;-d&#x20;&ldquo;&#92;n&rdquo;&#x0a;module_description&#x20;Total&#x20;processes&#x0a;module_end&#x0a;&#x0a;',1,'','Total&#x20;processes','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (37,5,'module_begin&#x0a;module_name&#x20;Uptime&#x0a;module_type&#x20;generic_data_string&#x0a;module_exec&#x20;uptime&#x20;|sed&#x20;s/us&#92;.*$//g&#x20;|&#x20;sed&#x20;s/,&#92;.*$//g&#x0a;module_description&#x20;Host&#x20;Up&#x20;time&#x0a;module_end&#x0a;',3,'','Uptime','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (38,5,'module_begin&#x0a;module_name&#x20;Zombie&#x20;processes&#x0a;module_type&#x20;generic_data&#x0a;module_exec&#x20;ps&#x20;-&shy;elf&#x20;|&#x20;awk&#x20;&#039;$2~/&#039;Z&#039;/{print&#x20;$2}&#039;&#x20;|&#x20;wc&#x20;-l&#x20;|&#x20;tr&#x20;-d&#x20;&quot;&#92;n&quot;&#x0a;module_description&#x20;Zombie&#x20;processes&#x0a;module_end&#x0a;',1,'','Zombie&#x20;processes','',0,0,1,'',0,'','','','',4,1,1,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (39,6,'',6,'','Host&#x20;Alive','',0,0,300,'',0,'','','','',2,1,2,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (40,6,'',7,'','Host&#x20;Latency','',0,0,300,'',0,'','','','',2,1,2,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,80.00,149.00,'',150.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (41,6,'',2,'Checks&#x20;if&#x20;port&#x20;161&#x20;is&#x20;open&#x20;and&#x20;reachable&#x20;for&#x20;Pandora&#x20;FMS&#x20;server.','SNMP&#x20;Available','',0,0,300,'',0,'','','','',1,1,4,0,0,'','','_field1_;Target&#x20;IP;;_address_--_field2_;Port;;161',3,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *','{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Target IP\",\"help\":\"\",\"value\":\"_address_\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Port\",\"help\":\"\",\"value\":\"161\"}}','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
INSERT INTO `tpolicy_modules` VALUES (42,6,'',9,'Checks&#x20;if&#x20;port&#x20;22&#x20;is&#x20;open&#x20;and&#x20;reachable&#x20;for&#x20;Pandora&#x20;FMS&#x20;server.','SSH&#x20;Reachable','',0,0,300,'',22,'','','','',2,1,2,0,0,NULL,NULL,NULL,0,0.000000000000000,0,0,0,'',1,0.00,0.00,'',0.00,0.00,'',0,NULL,NULL,NULL,0,0,0,'','','',0,0,0,0,0,'* * * * *',NULL,'{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);

INSERT INTO `tpolicy_plugins` VALUES (1,1,'cscript.exe&#x20;//B&#x20;&quot;%ProgramFiles%&#92;Pandora_Agent&#92;util&#92;df_percent_used.vbs&quot;',0);
INSERT INTO `tpolicy_plugins` VALUES (2,1,'cscript.exe&#x20;//B&#x20;&quot;%ProgramFiles%&#92;Pandora_Agent&#92;util&#92;mem_percent_used.vbs&quot;',0);
INSERT INTO `tpolicy_plugins` VALUES (3,2,'/etc/pandora/plugins/pandora_df_used',0);
INSERT INTO `tpolicy_plugins` VALUES (4,2,'/etc/pandora/plugins/pandora_mem_used',0);

--
-- Dumping data for table `tprofile_view`
--
INSERT INTO `tprofile_view` (`id_profile`, `sec`, `sec2`, `sec3`) VALUES (5, '*', '*','*');

--
-- Dumping data for table `tcontainer`
--
INSERT INTO `tcontainer` SET `name` = 'Default graph container';

--
-- Dumping data for table `tlog_graph_models`
--
INSERT INTO tlog_graph_models VALUES (1, 'Apache&#x20;log&#x20;model',
	'^.*?&#92;s+.*&quot;.*?&#92;s&#40;&#92;/.*?&#41;&#92;?.*1.1&quot;&#92;s+&#40;.*?&#41;&#92;s+&#40;.*?&#41;&#92;s+',
	'pagina,&#x20;html_err_code,&#x20;_tiempo_', 1);

INSERT INTO tlog_graph_models VALUES (2, 'Apache&#x20;accesses&#x20;per&#x20;client&#x20;and&#x20;status',
'&#40;.*?&#41;&#92;&#x20;-.*1.1&quot;&#92;&#x20;&#40;&#92;d+&#41;&#92;&#x20;&#92;d+',
'host,status', 1);

INSERT INTO tlog_graph_models VALUES (3, 'Apache&#x20;time&#x20;per&#x20;requester&#x20;and&#x20;html&#x20;code',
'&#40;.*?&#41;&#92;&#x20;-.*1.1&quot;&#92;&#x20;&#40;&#92;d+&#41;&#92;&#x20;&#40;&#92;d+&#41;',
'origin,respose,_time_', 1);

INSERT INTO tlog_graph_models VALUES (4, 'Count&#x20;output',
'.*',
'Coincidences', 0);

INSERT INTO tlog_graph_models VALUES (5, 'Events&#x20;replicated&#x20;to&#x20;metaconsole',
'.*&#x20;&#40;.*?&#41;&#x20;.*&#x20;&#40;&#92;d+&#41;&#x20;events&#x20;replicated&#x20;to&#x20;metaconsole',
'server,_events_', 0);

INSERT INTO tlog_graph_models VALUES (6, 'Pages&#x20;with&#x20;warnings',
'PHP&#x20;Warning:.*in&#x20;&#40;.*?&#41;&#x20;on',
'page', 0);

INSERT INTO tlog_graph_models VALUES (7, 'Users&#x20;login',
'Starting&#x20;Session&#x20;&#92;d+&#92;&#x20;of&#x20;user&#x20;&#40;.*&#41;',
'user', 0);

--
-- Dumping data for table `tnotification_source`
--
INSERT INTO `tnotification_source`(`description`, `icon`, `max_postpone_time`, `enabled`, `user_editable`, `also_mail`) VALUES
  ("System&#x20;status", "icono_info_mr.png", 86400, 1, 1, 0),
  ("Message", "icono_info_mr.png", 86400, 1, 1, 0),
  ("Pending&#x20;task", "icono_info_mr.png", 86400, 1, 1, 0),
  ("Advertisement", "icono_info_mr.png", 86400, 1, 1, 0),
  ("Official&#x20;communication", "icono_logo_pandora.png", 86400, 1, 1, 0),
  ("Sugerence", "icono_info_mr.png", 86400, 1, 1, 0);

-- 
-- Dumping data for table `tnotification_source_user`
-- 
INSERT INTO `tnotification_source_user`(`id_source`,`id_user`,`enabled`,`also_mail`) VALUES
  ((SELECT `id` FROM `tnotification_source` WHERE `description`="System&#x20;status"), "admin",1,0);

INSERT INTO `tnotification_source_group` SELECT `id`,0 FROM `tnotification_source` WHERE `description`="Message";

INSERT INTO `tnotification_source_user` (`id_source`, `id_user`, `enabled`, `also_mail`) VALUES
  ((SELECT `id` FROM `tnotification_source` WHERE `description`="Official&#x20;communication"), "admin", 1, 0);

UPDATE `tnotification_source` SET `enabled`=1 WHERE `description` = 'System&#x20;status' OR `description` = 'Official&#x20;communication';

-- 
-- Dumping data for table `tpen`
-- 

INSERT INTO `tpen`
VALUES
	(9,'cisco','Cisco&#x20;System'),
	(11,'hp','Hewlett&#x20;Packard'),
	(2021,'general_snmp','U.C.&#x20;Davis,&#x20;ECE&#x20;Dept.&#x20;Tom'),
	(2636,'juniper','Juniper&#x20;Networks'),
	(3375,'f5','F5&#x20;Labs'),
	(8072,'general_snmp','Net&#x20;SNMP'),
	(12356,'fortinet','Fortinet')
;

-- 
-- Dumping data for table `tnetwork_profile` and `tnetwork_profile_pen`
-- 

SET @template_name = 'Network&#x20;Management';
SET @template_description = 'Basic network monitoring template';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Network Management')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Cisco&#x20;MIBS';
SET @template_description = 'Cisco devices monitoring template (SNMP)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Cisco MIBS' OR g.name = 'Catalyst 2900')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);
INSERT INTO tnetwork_profile_pen (pen, id_np) SELECT * FROM (SELECT p.pen pen, np.id_np id_np FROM tnetwork_profile np, tpen p WHERE np.name = @template_name AND (p.pen = 9)) AS tmp WHERE NOT EXISTS (SELECT pp.id_np FROM tnetwork_profile p, tnetwork_profile_pen pp WHERE p.id_np = pp.id_np AND p.name = @template_name);

SET @template_name = 'Linux&#x20;System';
SET @template_description = 'Linux system monitoring template (SNMP)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);

SET @module_group = 'Linux';

INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Linux' OR g.name = 'UCD Mibs (Linux, UCD-SNMP)')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);
INSERT INTO tnetwork_profile_pen (pen, id_np) SELECT * FROM (SELECT p.pen pen, np.id_np id_np FROM tnetwork_profile np, tpen p WHERE np.name = @template_name AND (p.pen = 2021 OR p.pen = 2636)) AS tmp WHERE NOT EXISTS (SELECT pp.id_np FROM tnetwork_profile p, tnetwork_profile_pen pp WHERE p.id_np = pp.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;System';
SET @template_description = 'Windows system monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Microsoft&#x20;Windows' OR g.name = 'Windows System')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;Hardware';
SET @template_description = 'Windows hardware monitoring templae (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows Hardware Layer')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;Active&#x20;Directory';
SET @template_description = 'Active directory monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows AD' OR g.name = 'AD&#x20;Counters')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;IIS';
SET @template_description = 'IIS monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows IIS' OR g.name = 'IIS&#x20;services')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;Exchange';
SET @template_description = 'Exchange monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows Exchange' OR g.name = 'Exchange&#x20;Services' OR g.name = 'Exchange&#x20;TCP&#x20;Ports')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;LDAP';
SET @template_description = 'LDAP monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows LDAP')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;MDSTC';
SET @template_description = 'MDSTC monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows MSDTC')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;Printers';
SET @template_description = 'Windows printers monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows Printers')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;DNS';
SET @template_description = 'Windows DNS monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Windows&#x20;DNS' OR g.name = 'DNS&#x20;Counters')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;MS&#x20;SQL&#x20;Server';
SET @template_description = 'MS SQL Server monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'MS&#x20;SQL&#x20;Server')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Oracle';
SET @template_description = 'Oracle monitoring template';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Oracle')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'MySQL';
SET @template_description = 'MySQL monitoring template';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'MySQL')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

SET @template_name = 'Windows&#x20;Antivirus';
SET @template_description = 'Windows antivirus monitoring template (WMI)';

INSERT INTO tnetwork_profile (name, description) SELECT * FROM (SELECT @template_name name, @template_description description) AS tmp WHERE NOT EXISTS (SELECT id_np FROM tnetwork_profile WHERE name = @template_name);
INSERT INTO tnetwork_profile_component (id_nc, id_np) SELECT * FROM (SELECT c.id_nc id_nc, p.id_np id_np FROM tnetwork_profile p, tnetwork_component c, tnetwork_component_group g WHERE g.id_sg = c.id_group AND p.name = @template_name AND (g.name = 'Norton' OR g.name = 'Panda' OR g.name = 'McAfee' OR g.name = 'Bitdefender' OR g.name = 'BullGuard' OR g.name = 'AVG' OR g.name = 'Kaspersky')) AS tmp WHERE NOT EXISTS (SELECT pc.id_np FROM tnetwork_profile p, tnetwork_profile_component pc WHERE p.id_np = pc.id_np AND p.name = @template_name);

-- ------------------------------------------------------------------------
-- New wizards components and plugins
-- ------------------------------------------------------------------------
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';
SET @plugin_description = 'Get&#x20;the&#x20;result&#x20;of&#x20;an&#x20;arithmetic&#x20;operation&#x20;using&#x20;several&#x20;OIDs&#x20;values.';
SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;
INSERT IGNORE INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `max_retries`, `execute`, `net_dst_opt`, `net_port_opt`, `user_opt`, `pass_opt`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (@plugin_id,@plugin_name,@plugin_description,20,0,'/usr/share/pandora_server/util/plugin/wizard_snmp_module',NULL,NULL,NULL,NULL,0,'{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Host\",\"help\":\"\",\"value\":\"_address_\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Port\",\"help\":\"\",\"value\":\"161\",\"hide\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Version\",\"help\":\"1,&#x20;2c,&#x20;3\",\"value\":\"1\",\"hide\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Community\",\"help\":\"\",\"value\":\"public\",\"hide\":\"\"},\"5\":{\"macro\":\"_field5_\",\"desc\":\"Security&#x20;level&#x20;&#40;v3&#41;\",\"help\":\"noAuthNoPriv,&#x20;authNoPriv,&#x20;authPriv\",\"value\":\"\",\"hide\":\"\"},\"6\":{\"macro\":\"_field6_\",\"desc\":\"Username&#x20;&#40;v3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"7\":{\"macro\":\"_field7_\",\"desc\":\"Authentication&#x20;method&#x20;&#40;v3&#41;\",\"help\":\"MD5,&#x20;SHA\",\"value\":\"\",\"hide\":\"\"},\"8\":{\"macro\":\"_field8_\",\"desc\":\"Authentication&#x20;password&#x20;&#40;v3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"1\"},\"9\":{\"macro\":\"_field9_\",\"desc\":\"Privacy&#x20;method&#x20;&#40;v3&#41;\",\"help\":\"DES,&#x20;AES\",\"value\":\"\",\"hide\":\"\"},\"10\":{\"macro\":\"_field10_\",\"desc\":\"Privacy&#x20;password&#x20;&#40;v3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"1\"},\"11\":{\"macro\":\"_field11_\",\"desc\":\"OID&#x20;list\",\"help\":\"Comma&#x20;separated&#x20;OIDs&#x20;used\",\"value\":\"\",\"hide\":\"\"},\"12\":{\"macro\":\"_field12_\",\"desc\":\"Operation\",\"help\":\"Aritmetic&#x20;operation&#x20;to&#x20;get&#x20;data.&#x20;Macros&#x20;_oN_&#x20;will&#x20;be&#x20;changed&#x20;by&#x20;OIDs&#x20;in&#x20;list.&#x20;Example:&#x20;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_\",\"value\":\"\",\"hide\":\"\"}}','-host&#x20;&#039;_field1_&#039;&#x20;-port&#x20;&#039;_field2_&#039;&#x20;-version&#x20;&#039;_field3_&#039;&#x20;-community&#x20;&#039;_field4_&#039;&#x20;-secLevel&#x20;&#039;_field5_&#039;&#x20;-user&#x20;&#039;_field6_&#039;&#x20;-authMethod&#x20;&#039;_field7_&#039;&#x20;-authPass&#x20;&#039;_field8_&#039;&#x20;-privMethod&#x20;&#039;_field9_&#039;&#x20;-privPass&#x20;&#039;_field10_&#039;&#x20;-oidList&#x20;&#039;_field11_&#039;&#x20;-operation&#x20;&#039;_field12_&#039;', 1);

SET @plugin_name = 'Wizard&#x20;SNMP&#x20;process';
SET @plugin_description = 'Check&#x20;if&#x20;a&#x20;process&#x20;is&#x20;running&#x20;&#40;1&#41;&#x20;or&#x20;not&#x20;&#40;0&#41;&#x20;in&#x20;OID&#x20;.1.3.6.1.2.1.25.4.2.1.2&#x20;SNMP&#x20;tree.';
SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;
INSERT IGNORE INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `max_retries`, `execute`, `net_dst_opt`, `net_port_opt`, `user_opt`, `pass_opt`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (@plugin_id,@plugin_name,@plugin_description,20,0,'/usr/share/pandora_server/util/plugin/wizard_snmp_process',NULL,NULL,NULL,NULL,0,'{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Host\",\"help\":\"\",\"value\":\"_address_\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Port\",\"help\":\"\",\"value\":\"161\",\"hide\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Version\",\"help\":\"1,&#x20;2c,&#x20;3\",\"value\":\"1\",\"hide\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Community\",\"help\":\"\",\"value\":\"public\",\"hide\":\"\"},\"5\":{\"macro\":\"_field5_\",\"desc\":\"Security&#x20;level&#x20;&#40;v3&#41;\",\"help\":\"noAuthNoPriv,&#x20;authNoPriv,&#x20;authPriv\",\"value\":\"\",\"hide\":\"\"},\"6\":{\"macro\":\"_field6_\",\"desc\":\"Username&#x20;&#40;v3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"7\":{\"macro\":\"_field7_\",\"desc\":\"Authentication&#x20;method&#x20;&#40;v3&#41;\",\"help\":\"MD5,&#x20;SHA\",\"value\":\"\",\"hide\":\"\"},\"8\":{\"macro\":\"_field8_\",\"desc\":\"Authentication&#x20;password&#x20;&#40;v3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"1\"},\"9\":{\"macro\":\"_field9_\",\"desc\":\"Privacy&#x20;method&#x20;&#40;v3&#41;\",\"help\":\"DES,&#x20;AES\",\"value\":\"\",\"hide\":\"\"},\"10\":{\"macro\":\"_field10_\",\"desc\":\"Privacy&#x20;password&#x20;&#40;v3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"1\"},\"11\":{\"macro\":\"_field11_\",\"desc\":\"Process\",\"help\":\"Process&#x20;name&#x20;to&#x20;check&#x20;if&#x20;is&#x20;running&#x20;&#40;case&#x20;sensitive&#41;\",\"value\":\"\",\"hide\":\"\"}}','-host&#x20;&#039;_field1_&#039;&#x20;-port&#x20;&#039;_field2_&#039;&#x20;-version&#x20;&#039;_field3_&#039;&#x20;-community&#x20;&#039;_field4_&#039;&#x20;-secLevel&#x20;&#039;_field5_&#039;&#x20;-user&#x20;&#039;_field6_&#039;&#x20;-authMethod&#x20;&#039;_field7_&#039;&#x20;-authPass&#x20;&#039;_field8_&#039;&#x20;-privMethod&#x20;&#039;_field9_&#039;&#x20;-privPass&#x20;&#039;_field10_&#039;&#x20;-process&#x20;&#039;_field11_&#039;', 1);

SET @plugin_name = 'Wizard&#x20;WMI&#x20;module';
SET @plugin_description = 'Get&#x20;the&#x20;result&#x20;of&#x20;an&#x20;arithmetic&#x20;operation&#x20;using&#x20;distinct&#x20;fields&#x20;in&#x20;a&#x20;WMI&#x20;query&#x20;&#40;Query&#x20;must&#x20;return&#x20;only&#x20;1&#x20;row&#41;.';
SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;
INSERT IGNORE INTO `tplugin` (`id`, `name`, `description`, `max_timeout`, `max_retries`, `execute`, `net_dst_opt`, `net_port_opt`, `user_opt`, `pass_opt`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES (@plugin_id,@plugin_name,@plugin_description,20,0,'/usr/share/pandora_server/util/plugin/wizard_wmi_module',NULL,NULL,NULL,NULL,0,'{\"1\":{\"macro\":\"_field1_\",\"desc\":\"Host\",\"help\":\"\",\"value\":\"_address_\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Namespace&#x20;&#40;Optional&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"User\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Password\",\"help\":\"\",\"value\":\"\",\"hide\":\"1\"},\"5\":{\"macro\":\"_field5_\",\"desc\":\"WMI&#x20;Class\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"6\":{\"macro\":\"_field6_\",\"desc\":\"Fields&#x20;list\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"7\":{\"macro\":\"_field7_\",\"desc\":\"Query&#x20;filter&#x20;&#40;Optional&#41;\",\"help\":\"Use&#x20;single&#x20;quotes&#x20;for&#x20;query&#x20;conditions\",\"value\":\"\",\"hide\":\"\"},\"8\":{\"macro\":\"_field8_\",\"desc\":\"Operation\",\"help\":\"Aritmetic&#x20;operation&#x20;to&#x20;get&#x20;data.&#x20;Macros&#x20;_fN_&#x20;will&#x20;be&#x20;changed&#x20;by&#x20;fields&#x20;in&#x20;list.&#x20;Example:&#x20;&#40;&#40;_f1_&#x20;-&#x20;_f2_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_f1_\",\"value\":\"\",\"hide\":\"\"}}','-host&#x20;&#039;_field1_&#039;&#x20;-namespace&#x20;&#039;_field2_&#039;&#x20;-user&#x20;&#039;_field3_&#039;&#x20;-pass&#x20;&#039;_field4_&#039;&#x20;-wmiClass&#x20;&#039;_field5_&#039;&#x20;-fieldsList&#x20;&#039;_field6_&#039;&#x20;-queryFilter&#x20;&quot;_field7_&quot;&#x20;-operation&#x20;&#039;_field8_&#039;&#x20;-wmicPath&#x20;/usr/bin/wmic', 1);

SET @plugin_name = 'Network&#x20;bandwidth&#x20;SNMP';
SET @plugin_description = 'Retrieves&#x20;amount&#x20;of&#x20;digital&#x20;information&#x20;sent&#x20;and&#x20;received&#x20;from&#x20;device&#x20;or&#x20;filtered&#x20;&#x20;interface&#x20;index&#x20;over&#x20;a&#x20;particular&#x20;time&#x20;&#40;agent/module&#x20;interval&#41;.';
SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;
INSERT IGNORE INTO `tplugin`  (`id`, `name`, `description`, `max_timeout`, `max_retries`, `execute`, `net_dst_opt`, `net_port_opt`, `user_opt`, `pass_opt`, `plugin_type`, `macros`, `parameters`, `no_delete`) VALUES  (@plugin_id,@plugin_name,@plugin_description,300,0,'perl&#x20;/usr/share/pandora_server/util/plugin/pandora_snmp_bandwidth.pl','','','','',0,'{\"1\":{\"macro\":\"_field1_\",\"desc\":\"SNMP&#x20;Version&#40;1,2c,3&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"2\":{\"macro\":\"_field2_\",\"desc\":\"Community\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"3\":{\"macro\":\"_field3_\",\"desc\":\"Host\",\"help\":\"\",\"value\":\"_address_\",\"hide\":\"\"},\"4\":{\"macro\":\"_field4_\",\"desc\":\"Port\",\"help\":\"\",\"value\":\"161\",\"hide\":\"\"},\"5\":{\"macro\":\"_field5_\",\"desc\":\"Interface&#x20;Index&#x20;&#40;filter&#41;\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"6\":{\"macro\":\"_field6_\",\"desc\":\"securityName\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"7\":{\"macro\":\"_field7_\",\"desc\":\"context\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"8\":{\"macro\":\"_field8_\",\"desc\":\"securityLevel\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"9\":{\"macro\":\"_field9_\",\"desc\":\"authProtocol\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"10\":{\"macro\":\"_field10_\",\"desc\":\"authKey\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"11\":{\"macro\":\"_field11_\",\"desc\":\"privProtocol\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"12\":{\"macro\":\"_field12_\",\"desc\":\"privKey\",\"help\":\"\",\"value\":\"\",\"hide\":\"\"},\"13\":{\"macro\":\"_field13_\",\"desc\":\"UniqId\",\"help\":\"This&#x20;plugin&#x20;needs&#x20;to&#x20;store&#x20;information&#x20;in&#x20;temporary&#x20;directory&#x20;to&#x20;calculate&#x20;bandwidth.&#x20;Set&#x20;here&#x20;an&#x20;unique&#x20;identifier&#x20;with&#x20;no&#x20;spaces&#x20;or&#x20;symbols.\",\"value\":\"\",\"hide\":\"\"},\"14\":{\"macro\":\"_field14_\",\"desc\":\"inUsage\",\"help\":\"Retrieve&#x20;input&#x20;usage&#x20;&#40;%&#41;\",\"value\":\"\",\"hide\":\"\"},\"15\":{\"macro\":\"_field15_\",\"desc\":\"outUsage\",\"help\":\"Retrieve&#x20;output&#x20;usage&#x20;&#40;%&#41;\",\"value\":\"\",\"hide\":\"\"}}','-version&#x20;&#039;_field1_&#039;&#x20;-community&#x20;&#039;_field2_&#039;&#x20;-host&#x20;&#039;_field3_&#039;&#x20;-port&#x20;&#039;_field4_&#039;&#x20;-ifIndex&#x20;&#039;_field5_&#039;&#x20;-securityName&#x20;&#039;_field6_&#039;&#x20;-context&#x20;&#039;_field7_&#039;&#x20;-securityLevel&#x20;&#039;_field8_&#039;&#x20;-authProtocol&#x20;&#039;_field9_&#039;&#x20;-authKey&#x20;&#039;_field10_&#039;&#x20;-privProtocol&#x20;&#039;_field11_&#039;&#x20;-privKey&#x20;&#039;_field12_&#039;&#x20;-uniqid&#x20;&#039;_field13_&#039;&#x20;-inUsage&#x20;&#039;_field14_&#039;&#x20;-outUsage&#x20;&#039;_field15_&#039;', 1);

SET @main_component_group_name = 'Wizard';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @main_component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@main_component_group_name,0);

SELECT @component_group_parent := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @main_component_group_name;

SET @component_group_name = 'CPU';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Memory';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Disk&#x20;devices';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Storage';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Temperature&#x20;sensors';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Processes';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Other';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Power&#x20;supply';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Fans';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Temperature';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Sessions';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'VPN';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Intrussions';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Antivirus';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Services';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'Disks';
SET @component_id = '';
SELECT @component_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;
INSERT IGNORE INTO `tnetwork_component_group` (`id_sg`, `name`, `parent`) VALUES (@component_id,@component_group_name,@component_group_parent);

SET @component_group_name = 'CPU';

SET @component_name = 'CPU&#x20;User&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;percentage&#x20;of&#x20;CPU&#x20;time&#x20;spent&#x20;processing&#x20;user-level&#x20;code,&#x20;calculated&#x20;over&#x20;the&#x20;last&#x20;minute';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,1,'1.3.6.1.4.1.2021.11.9.0','',1,'','','','','',1);

SET @component_name = 'CPU&#x20;System&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;percentage&#x20;of&#x20;CPU&#x20;time&#x20;spent&#x20;processing&#x20;system-level&#x20;code,&#x20;calculated&#x20;over&#x20;the&#x20;last&#x20;minute';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,1,'1.3.6.1.4.1.2021.11.10.0','',1,'','','','','',1);

SET @component_name = 'CPU&#x20;Idle&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;percentage&#x20;of&#x20;CPU&#x20;time&#x20;spent&#x20;idle,&#x20;calculated&#x20;over&#x20;the&#x20;last&#x20;minute';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,1,'1.3.6.1.4.1.2021.11.11.0','',0,'','','','','',1);

SET @component_name = 'Load&#x20;average&#x20;-&#x20;_nameOID_';
SET @component_description = 'The&#x20;1,&#x20;5&#x20;or&#x20;15&#x20;minutes&#x20;load&#x20;average';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,2,'1.3.6.1.4.1.2021.10.1.3','',0,'1.3.6.1.4.1.2021.10.1.2','','','','',1);

SET @component_name = 'Cisco&#x20;CPU&#x20;_nameOID_&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;overall&#x20;CPU&#x20;busy&#x20;percentage&#x20;in&#x20;the&#x20;last&#x20;5&#x20;minute&#x20;period';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','cisco',1,2,'1.3.6.1.4.1.9.9.109.1.1.1.1.8','',1,'1.3.6.1.4.1.9.9.109.1.1.1.1.2','','','','',1);

SET @component_name = 'F5&#x20;CPU&#x20;_nameOID_&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'This&#x20;is&#x20;average&#x20;usage&#x20;ratio&#x20;of&#x20;CPU&#x20;for&#x20;the&#x20;associated&#x20;host&#x20;in&#x20;the&#x20;last&#x20;five&#x20;minutes';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,2,'1.3.6.1.4.1.3375.2.1.7.5.2.1.35','',1,'1.3.6.1.4.1.3375.2.1.7.5.2.1.3','','','','',1);

SET @component_name = 'Juniper&#x20;_nameOID_&#x20;CPU&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;average&#x20;usage&#x20;ratio&#x20;of&#x20;CPU&#x20;in&#x20;the&#x20;last&#x20;five&#x20;minutes';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.2636.3.1.13.1.21','',1,'1.3.6.1.4.1.2636.3.1.13.1.5','','','','',1);

SET @component_name = 'HP&#x20;CPU&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;CPU&#x20;utilization&#x20;in&#x20;percent&#40;%&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','hp',1,1,'1.3.6.1.4.1.11.2.14.11.5.1.9.6.1.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;system&#x20;CPU&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'CPU&#x20;usage&#x20;of&#x20;the&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.1.3.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;CPU&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'CPU&#x20;usage&#x20;of&#x20;the&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.3.2.1.1.5','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'WMI&#x20;_DeviceID_&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'Load&#x20;capacity&#x20;of&#x20;each&#x20;processor,&#x20;averaged&#x20;to&#x20;the&#x20;last&#x20;second';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','{\"extra_field_1\":\"LoadPercentage\",\"satellite_execution\":\"\",\"value_operation\":\"\",\"server_plugin\":\"\",\"_field11__wmi_field\":\"_field11_\",\"_field12__wmi_field\":\"_field12_\",\"_field9__wmi_field\":\"_field9_\",\"_field10__wmi_field\":\"_field10_\",\"_field7__wmi_field\":\"_field7_\",\"_field8__wmi_field\":\"_field8_\",\"_field5__wmi_field\":\"_field5_\",\"_field6__wmi_field\":\"_field6_\",\"_field3__wmi_field\":\"_field3_\",\"_field4__wmi_field\":\"_field4_\",\"_field1__wmi_field\":\"_field1_\",\"_field2__wmi_field\":\"_field2_\",\"field0_wmi_field\":\"\"}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',1,2,'','',1,'','Win32_Processor','DeviceID','','{\"scan\":\"\",\"execution\":\"DeviceID&#x20;=&#x20;&#039;_DeviceID_&#039;\",\"field\":\"1\",\"key_string\":\"\"}',1);

SET @component_group_name = 'Memory';

SET @component_name = 'Total&#x20;RAM&#x20;used&#x20;&#40;%&#41;';
SET @component_description = 'Total&#x20;real/physical&#x20;memory&#x20;used&#x20;on&#x20;the&#x20;host';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.4.1.2021.4.6.0\",\"extra_field_2\":\"1.3.6.1.4.1.2021.4.5.0\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_oid_2_\",\"server_plugin\":\"',@plugin_id,'\",\"_field2__snmp_field\":\"_port_\",\"_field1__snmp_field\":\"_address_\",\"_field4__snmp_field\":\"_community_\",\"_field3__snmp_field\":\"_version_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field12__snmp_field\":\"&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',2,1,'','',1,'','','','','',1);

SET @component_name = 'F5&#x20;host&#x20;RAM&#x20;used&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;host&#x20;memory&#x20;percentage&#x20;currently&#x20;in&#x20;use';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.4.1.3375.2.1.7.1.2.0\",\"extra_field_2\":\"1.3.6.1.4.1.3375.2.1.7.1.1.0\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_oid_2_\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"_field12__snmp_field\":\"(_o1_ * 100) / _o2_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',2,1,'','',1,'','','','','',1);

SET @component_name = 'F5&#x20;Host&#x20;_nameOID_&#x20;RAM&#x20;used&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;host&#x20;memory&#x20;percentage&#x20;currently&#x20;in&#x20;use&#x20;for&#x20;the&#x20;specified&#x20;host';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.4.1.3375.2.1.7.4.2.1.3\",\"extra_field_2\":\"1.3.6.1.4.1.3375.2.1.7.4.2.1.2\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_oid_2_\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"_field12__snmp_field\":\"(_o1_ * 100) / _o2_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',2,2,'','',1,'1.3.6.1.4.1.3375.2.1.7.4.2.1.1','','','','',1);

SET @component_name = 'Fortinet&#x20;system&#x20;RAM&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'Memory&#x20;usage&#x20;of&#x20;the&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.1.4.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;RAM&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'Memory&#x20;usage&#x20;of&#x20;the&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.3.2.1.1.6','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'WMI&#x20;total&#x20;RAM&#x20;used&#x20;&#40;%&#41;';
SET @component_description = 'Percentage&#x20;of&#x20;physical&#x20;memory&#x20;currently&#x20;used';
SET @plugin_name = 'Wizard&#x20;WMI&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"TotalVisibleMemorySize\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_wmi_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-namespace&#x20;&quot;_namespace_wmi_&quot;&#x20;-user&#x20;&quot;_user_wmi_&quot;&#x20;-pass&#x20;&quot;_pass_wmi_&quot;&#x20;-wmiClass&#x20;&quot;_class_wmi_&quot;&#x20;-fieldsList&#x20;&quot;_field_wmi_0_,_field_wmi_1_&quot;&#x20;-queryFilter&#x20;&quot;&quot;&#x20;-operation&#x20;&quot;&#40;&#40;_f2_&#x20;-&#x20;_f1_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_f2_&quot;&#x20;-wmicPath&#x20;/usr/bin/wmic\",\"value_operation\":\"&#40;&#40;_TotalVisibleMemorySize_&#x20;-&#x20;_FreePhysicalMemory_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_TotalVisibleMemorySize_\",\"server_plugin\":\"',@plugin_id,'\",\"_field2__wmi_field\":\"_namespace_wmi_\",\"_field1__wmi_field\":\"_address_\",\"_field4__wmi_field\":\"_pass_wmi_\",\"_field3__wmi_field\":\"_user_wmi_\",\"_field6__wmi_field\":\"_field_wmi_0_,_field_wmi_1_\",\"_field5__wmi_field\":\"_class_wmi_\",\"_field8__wmi_field\":\"&#40;&#40;_f2_&#x20;-&#x20;_f1_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_f2_\",\"_field7__wmi_field\":\"\",\"field0_wmi_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',2,1,'','',1,'','Win32_OperatingSystem','FreePhysicalMemory','','{\"scan\":\"\",\"execution\":\"\",\"field\":\"\",\"key_string\":\"\"}',1);

SET @component_name = 'Total&#x20;Swap&#x20;used&#x20;&#40;%&#41;';
SET @component_description = 'Total&#x20;swap&#x20;memory&#x20;used&#x20;on&#x20;the&#x20;host';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.4.1.2021.4.4.0\",\"extra_field_2\":\"1.3.6.1.4.1.2021.4.3.0\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_oid_2_\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"_field12__snmp_field\":\"(_o1_ * 100) / _o2_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',2,1,'','',1,'','','','','',1);

SET @component_name = 'Cisco&#x20;memory&#x20;pool&#x20;_nameOID_&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'Indicates&#x20;the&#x20;percentage&#x20;of&#x20;bytes&#x20;from&#x20;the&#x20;memory&#x20;pool&#x20;that&#x20;are&#x20;currently&#x20;in&#x20;use&#x20;by&#x20;applications&#x20;on&#x20;the&#x20;managed&#x20;device';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.4.1.9.9.48.1.1.1.5\",\"extra_field_2\":\"1.3.6.1.4.1.9.9.48.1.1.1.6\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;&#40;_o1_&#x20;+&#x20;_o2_&#41;&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;&#40;_oid_1_&#x20;+&#x20;_oid_2_&#41;\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"_field12__snmp_field\":\"(_o1_ * 100) / (_o1_ + _o2_)\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','cisco',2,2,'','',1,'1.3.6.1.4.1.9.9.48.1.1.1.2','','','','',1);

SET @component_name = 'Juniper&#x20;_nameOID_&#x20;memory&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;buffer&#x20;pool&#x20;utilization&#x20;in&#x20;percentage&#x20;of&#x20;this&#x20;subject';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.2636.3.1.13.1.11','',1,'1.3.6.1.4.1.2636.3.1.13.1.5','','','','',1);

SET @component_name = 'HP&#x20;memory&#x20;slot&#x20;_nameOID_&#x20;usage&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;percentage&#x20;of&#x20;currently&#x20;allocated&#x20;bytes';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.4.1.11.2.14.11.5.1.1.2.1.1.1.7\",\"extra_field_2\":\"1.3.6.1.4.1.11.2.14.11.5.1.1.2.1.1.1.5\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_oid_2_\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"_field12__snmp_field\":\"(_o1_ * 100) / _o2_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','hp',2,2,'','',1,'1.3.6.1.4.1.11.2.14.11.5.1.1.2.1.1.1.1','','','','',1);

SET @component_group_name = 'Disk&#x20;devices';

SET @component_name = 'Disk&#x20;_nameOID_&#x20;bytes&#x20;read';
SET @component_description = 'The&#x20;number&#x20;of&#x20;bytes&#x20;read&#x20;from&#x20;this&#x20;device&#x20;since&#x20;boot';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,16,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'bytes/sec','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,2,'1.3.6.1.4.1.2021.13.15.1.1.3','',0,'1.3.6.1.4.1.2021.13.15.1.1.2','','','','',1);

SET @component_name = 'Disk&#x20;_nameOID_&#x20;bytes&#x20;written';
SET @component_description = 'The&#x20;number&#x20;of&#x20;bytes&#x20;written&#x20;to&#x20;this&#x20;device&#x20;since&#x20;boot';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,16,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'bytes/sec','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,2,'1.3.6.1.4.1.2021.13.15.1.1.4','',0,'1.3.6.1.4.1.2021.13.15.1.1.2','','','','',1);

SET @component_name = 'Disk&#x20;_nameOID_&#x20;read&#x20;accesses';
SET @component_description = 'The&#x20;number&#x20;of&#x20;read&#x20;accesses&#x20;from&#x20;this&#x20;device&#x20;since&#x20;boot';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,16,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'accesses/sec','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,2,'1.3.6.1.4.1.2021.13.15.1.1.5','',0,'1.3.6.1.4.1.2021.13.15.1.1.2','','','','',1);

SET @component_name = 'Disk&#x20;_nameOID_&#x20;write&#x20;accesses';
SET @component_description = 'The&#x20;number&#x20;of&#x20;write&#x20;accesses&#x20;to&#x20;this&#x20;device&#x20;since&#x20;boot';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,16,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'accesses/sec','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,2,'1.3.6.1.4.1.2021.13.15.1.1.6','',0,'1.3.6.1.4.1.2021.13.15.1.1.2','','','','',1);

SET @component_group_name = 'Storage';

SET @component_name = 'Storage&#x20;_nameOID_&#x20;&#40;%&#41;';
SET @component_description = 'The&#x20;amount&#x20;of&#x20;the&#x20;storage&#x20;represented&#x20;by&#x20;this&#x20;entry&#x20;that&#x20;is&#x20;allocated';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.2.1.25.2.3.1.6\",\"extra_field_2\":\"1.3.6.1.2.1.25.2.3.1.5\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-oidList&#x20;&quot;_oid_1_,_oid_2_&quot;&#x20;-operation&#x20;&quot;&#40;_o1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_o2_&quot;\",\"value_operation\":\"&#40;_oid_1_&#x20;*&#x20;100&#41;&#x20;/&#x20;_oid_2_\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_oid_1_,_oid_2_\",\"_field12__snmp_field\":\"(_o1_ * 100) / _o2_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',2,2,'','',1,'1.3.6.1.2.1.25.2.3.1.3','','','','',1);

SET @component_group_name = 'Temperature&#x20;sensors';

SET @component_name = 'Temperature&#x20;_nameOID_';
SET @component_description = 'The&#x20;temperature&#x20;of&#x20;this&#x20;sensor';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'&#xba;C','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,2,'1.3.6.1.4.1.2021.13.16.2.1.3','',0,'1.3.6.1.4.1.2021.13.16.2.1.2','','','','',1);

SET @component_group_name = 'Processes';

SET @component_name = 'Process&#x20;_nameOID_';
SET @component_description = 'Check&#x20;if&#x20;the&#x20;process&#x20;is&#x20;running';
SET @plugin_name = 'Wizard&#x20;SNMP&#x20;process';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,2,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard',CONCAT('{\"extra_field_1\":\"1.3.6.1.2.1.25.4.2.1.7\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_snmp_process&#x20;-host&#x20;&quot;_address_&quot;&#x20;-port&#x20;&quot;_port_&quot;&#x20;-version&#x20;&quot;_version_&quot;&#x20;-community&#x20;&quot;_community_&quot;&#x20;-secLevel&#x20;&quot;_sec_level_&quot;&#x20;-user&#x20;&quot;_auth_user_&quot;&#x20;-authMethod&#x20;&quot;_auth_method_&quot;&#x20;-authPass&#x20;&quot;_auth_pass_&quot;&#x20;-privMethod&#x20;&quot;_priv_method_&quot;&#x20;-privPass&#x20;&quot;_priv_pass_&quot;&#x20;-process&#x20;&quot;_nameOID_&quot;\",\"value_operation\":\"1\",\"server_plugin\":\"',@plugin_id,'\",\"_field11__snmp_field\":\"_nameOID_\",\"_field9__snmp_field\":\"_priv_method_\",\"_field10__snmp_field\":\"_priv_pass_\",\"_field7__snmp_field\":\"_auth_method_\",\"_field8__snmp_field\":\"_auth_pass_\",\"_field5__snmp_field\":\"_sec_level_\",\"_field6__snmp_field\":\"_auth_user_\",\"_field3__snmp_field\":\"_version_\",\"_field4__snmp_field\":\"_community_\",\"_field1__snmp_field\":\"_address_\",\"_field2__snmp_field\":\"_port_\",\"field0_snmp_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',2,2,'','',0,'1.3.6.1.2.1.25.4.2.1.2','','','','',1);

SET @component_name = 'WMI&#x20;Number&#x20;of&#x20;processes';
SET @component_description = 'Number&#x20;of&#x20;process&#x20;contexts&#x20;currently&#x20;loaded&#x20;or&#x20;running&#x20;on&#x20;the&#x20;operating&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','{\"extra_field_1\":\"\",\"satellite_execution\":\"\",\"value_operation\":\"\",\"server_plugin\":\"0\",\"field0_wmi_field\":\"\"}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',1,1,'','',1,'','Win32_OperatingSystem','NumberOfProcesses','','{\"scan\":\"\",\"execution\":\"\",\"field\":\"0\",\"key_string\":\"\"}',1);

SET @component_name = 'WMI&#x20;&#x20;process&#x20;_Name_&#x20;running';
SET @component_description = 'Check&#x20;if&#x20;process&#x20;is&#x20;running';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,2,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','{\"extra_field_1\":\"Name\",\"satellite_execution\":\"\",\"value_operation\":\"\",\"server_plugin\":\"0\",\"field0_wmi_field\":\"\"}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',1,2,'','',0,'','Win32_Process','Handle','','{\"scan\":\"\",\"execution\":\"Name&#x20;=&#x20;&#039;_Name_&#039;\",\"field\":\"1\",\"key_string\":\"_Name_\"}',1);

SET @component_group_name = 'Other';

SET @component_name = 'Wizard&#x20;system&#x20;uptime';
SET @component_description = 'The&#x20;time&#x20;&#40;in&#x20;hundredths&#x20;of&#x20;a&#x20;second&#41;&#x20;since&#x20;the&#x20;network&#x20;management&#x20;portion&#x20;of&#x20;the&#x20;system&#x20;was&#x20;last&#x20;re-initialized';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;


INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'_timeticks_','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','all',1,1,'1.3.6.1.2.1.25.1.1.0','',1,'','','','','',1);

SET @component_name = 'Wizard&#x20;network&#x20;uptime';
SET @component_description = 'The&#x20;time&#x20;&#40;in&#x20;hundredths&#x20;of&#x20;a&#x20;second&#41;&#x20;since&#x20;the&#x20;network&#x20;management&#x20;portion&#x20;of&#x20;the&#x20;system&#x20;was&#x20;last&#x20;re-initialized';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;


INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'_timeticks_','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','all',1,1,'1.3.6.1.2.1.1.3.0','',1,'','','','','',1);

SET @component_name = 'Blocks&#x20;sent';
SET @component_description = 'Number&#x20;of&#x20;blocks&#x20;sent&#x20;to&#x20;a&#x20;block&#x20;device';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,1,'1.3.6.1.4.1.2021.11.57.0','',0,'','','','','',1);

SET @component_name = 'Blocks&#x20;received';
SET @component_description = 'Number&#x20;of&#x20;blocks&#x20;received&#x20;from&#x20;a&#x20;block&#x20;device';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,1,'1.3.6.1.4.1.2021.11.58.0','',0,'','','','','',1);

SET @component_name = 'Interrupts&#x20;processed';
SET @component_description = 'Number&#x20;of&#x20;interrupts&#x20;processed';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','general_snmp',1,1,'1.3.6.1.4.1.2021.11.59.0','',0,'','','','','',1);

SET @component_group_name = 'Power&#x20;supply';

SET @component_name = 'Cisco&#x20;_nameOID_&#x20;power&#x20;state';
SET @component_description = 'The&#x20;current&#x20;state&#x20;of&#x20;the&#x20;power&#x20;supply:&#x20;normal&#40;1&#41;,&#x20;warning&#40;2&#41;,&#x20;critical&#40;3&#41;,&#x20;shutdown&#40;4&#41;,&#x20;notPresent&#40;5&#41;,&#x20;notFunctioning&#40;6&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','cisco',1,2,'1.3.6.1.4.1.9.9.13.1.5.1.3','',1,'1.3.6.1.4.1.9.9.13.1.5.1.2','','','','',1);

SET @component_name = 'F5&#x20;Power&#x20;supply&#x20;_nameOID_&#x20;status';
SET @component_description = 'The&#x20;status&#x20;of&#x20;the&#x20;indexed&#x20;power&#x20;supply&#x20;on&#x20;the&#x20;system:&#x20;bad&#40;0&#41;,&#x20;good&#40;1&#41;,&#x20;notpresent&#40;2&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,2,'1.3.6.1.4.1.3375.2.1.3.2.2.2.1.2','',1,'1.3.6.1.4.1.3375.2.1.3.2.2.2.1','','','','',1);

SET @component_name = 'WMI&#x20;_Name_&#x20;power&#x20;supply&#x20;state';
SET @component_description = 'State&#x20;of&#x20;the&#x20;power&#x20;supply&#x20;or&#x20;supplies&#x20;when&#x20;last&#x20;booted:&#x20;Other&#x20;&#40;1&#41;,&#x20;Unknown&#x20;&#40;2&#41;,&#x20;Safe&#x20;&#40;3&#41;,&#x20;Warning&#x20;&#40;4&#41;,&#x20;Critical&#x20;&#40;5&#41;,&#x20;Non-recoverable&#x20;&#40;6&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','{\"extra_field_1\":\"PowerSupplyState\",\"satellite_execution\":\"\",\"value_operation\":\"\",\"server_plugin\":\"0\",\"field0_wmi_field\":\"\"}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',1,2,'','',0,'','Win32_ComputerSystem','Name','','{\"scan\":\"\",\"execution\":\"Name&#x20;=&#x20;&#039;_Name_&#039;\",\"field\":\"1\",\"key_string\":\"\"}',1);

SET @component_name = 'WMI&#x20;_Name_&#x20;Power&#x20;state';
SET @component_description = 'Current&#x20;power&#x20;state&#x20;of&#x20;a&#x20;computer&#x20;and&#x20;its&#x20;associated&#x20;operating&#x20;system:&#x20;Unknown&#x20;&#40;0&#41;,&#x20;Full&#x20;Power&#x20;&#40;1&#41;,&#x20;Low&#x20;Power&#x20;Mode&#x20;&#40;2&#41;,&#x20;Standby&#x20;&#40;3&#41;,&#x20;Unknown&#x20;&#40;4&#41;,&#x20;Power&#x20;Cycle&#x20;&#40;5&#41;,&#x20;Power&#x20;Off&#x20;&#40;6&#41;,&#x20;Warning&#x20;&#40;7&#41;,&#x20;Hibernate&#x20;&#40;8&#41;,&#x20;Soft&#x20;Off&#x20;&#40;9&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','{\"extra_field_1\":\"PowerState\",\"satellite_execution\":\"\",\"value_operation\":\"\",\"server_plugin\":\"0\",\"field0_wmi_field\":\"\"}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',1,1,'','',0,'','Win32_ComputerSystem','Name','','{\"scan\":\"\",\"execution\":\"Name&#x20;=&#x20;&#039;_Name_&#039;\",\"field\":\"1\",\"key_string\":\"\"}',1);

SET @component_group_name = 'Fans';

SET @component_name = 'Cisco&#x20;_nameOID_&#x20;fan&#x20;state';
SET @component_description = 'The&#x20;current&#x20;state&#x20;of&#x20;the&#x20;fan:&#x20;normal&#40;1&#41;,&#x20;warning&#40;2&#41;,&#x20;critical&#40;3&#41;,&#x20;shutdown&#40;4&#41;,&#x20;notPresent&#40;5&#41;,&#x20;notFunctioning&#40;6&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','cisco',1,2,'1.3.6.1.4.1.9.9.13.1.4.1.3','',1,'1.3.6.1.4.1.9.9.13.1.4.1.2','','','','',1);

SET @component_name = 'F5&#x20;Fan&#x20;_nameOID_&#x20;status';
SET @component_description = 'The&#x20;status&#x20;of&#x20;the&#x20;indexed&#x20;chassis&#x20;fan&#x20;on&#x20;the&#x20;system:&#x20;bad&#40;0&#41;,&#x20;good&#40;1&#41;,&#x20;notpresent&#40;2&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,2,'1.3.6.1.4.1.3375.2.1.3.2.1.2.1.2','',1,'1.3.6.1.4.1.3375.2.1.3.2.1.2.1.1','','','','',1);

SET @component_name = 'HP&#x20;fan&#x20;tray&#x20;_nameOID_&#x20;state';
SET @component_description = 'Current&#x20;state&#x20;of&#x20;the&#x20;fan:&#x20;failed&#40;0&#41;,&#x20;removed&#40;1&#41;,&#x20;off&#40;2&#41;,&#x20;underspeed&#40;3&#41;,&#x20;overspeed&#40;4&#41;,&#x20;ok&#40;5&#41;,&#x20;maxstate&#40;6&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.11.2.14.11.5.1.54.2.1.1.4','',1,'1.3.6.1.4.1.11.2.14.11.5.1.54.2.1.1.2','','','','',1);

SET @component_group_name = 'Temperature';

SET @component_name = 'Cisco&#x20;_nameOID_&#x20;temperature';
SET @component_description = 'The&#x20;current&#x20;measurement&#x20;of&#x20;the&#x20;testpoint&#x20;being&#x20;instrumented';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'&#xba;C','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','cisco',1,2,'1.3.6.1.4.1.9.9.13.1.3.1.3','',1,'1.3.6.1.4.1.9.9.13.1.3.1.2','','','','',1);

SET @component_name = 'F5&#x20;Temperature&#x20;sensor&#x20;_nameOID_';
SET @component_description = 'The&#x20;chassis&#x20;temperature&#x20;of&#x20;the&#x20;indexed&#x20;sensor&#x20;on&#x20;the&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'&#xba;C','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,2,'1.3.6.1.4.1.3375.2.1.3.2.3.2.1.2','',1,'1.3.6.1.4.1.3375.2.1.3.2.3.2.1.1','','','','',1);

SET @component_name = 'Juniper&#x20;_nameOID_&#x20;temperature';
SET @component_description = 'The&#x20;temperature&#x20;of&#x20;this&#x20;subject';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'&#xba;C','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.2636.3.1.13.1.7','',1,'1.3.6.1.4.1.2636.3.1.13.1.5','','','','',1);

SET @component_name = 'HP&#x20;_nameOID_&#x20;temperature';
SET @component_description = 'The&#x20;current&#x20;temperature&#x20;given&#x20;by&#x20;the&#x20;indexed&#x20;chassis';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'&#xba;C','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','hp',1,2,'1.3.6.1.4.1.11.2.14.11.1.2.8.1.1.3','',0,'1.3.6.1.4.1.11.2.14.11.1.2.8.1.1.2','','','','',1);

SET @component_group_name = 'Sessions';

SET @component_name = 'F5&#x20;Current&#x20;auth&#x20;sessions';
SET @component_description = 'The&#x20;current&#x20;number&#x20;of&#x20;concurrent&#x20;auth&#x20;sessions';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.1.1.2.2.3.0','',1,'','','','','',1);

SET @component_name = 'F5&#x20;Total&#x20;auth&#x20;success&#x20;results';
SET @component_description = 'The&#x20;total&#x20;number&#x20;of&#x20;auth&#x20;success&#x20;results';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.1.1.2.2.5.0','',1,'','','','','',1);

SET @component_name = 'F5&#x20;Total&#x20;auth&#x20;failure&#x20;results';
SET @component_description = 'The&#x20;total&#x20;number&#x20;of&#x20;auth&#x20;failure&#x20;results';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.1.1.2.2.6.0','',1,'','','','','',1);

SET @component_name = 'F5&#x20;Total&#x20;auth&#x20;error&#x20;results';
SET @component_description = 'The&#x20;total&#x20;number&#x20;of&#x20;auth&#x20;error&#x20;results';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.1.1.2.2.8.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;ephemeral&#x20;sessions&#x20;count';
SET @component_description = 'The&#x20;current&#x20;number&#x20;of&#x20;ephemeral&#x20;sessions&#x20;on&#x20;the&#x20;device';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.6.2.1.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;direct&#x20;requests&#x20;count';
SET @component_description = 'The&#x20;number&#x20;of&#x20;direct&#x20;requests&#x20;to&#x20;Fortigate&#x20;local&#x20;stack&#x20;from&#x20;external,&#x20;reflecting&#x20;DOS&#x20;attack&#x20;towards&#x20;the&#x20;Fortigate';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.6.2.7.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;clash&#x20;sessions&#x20;count';
SET @component_description = 'The&#x20;number&#x20;of&#x20;new&#x20;sessions&#x20;which&#x20;have&#x20;collision&#x20;with&#x20;existing&#x20;sessions.&#x20;This&#x20;generally&#x20;highlights&#x20;a&#x20;shortage&#x20;of&#x20;ports&#x20;or&#x20;IP&#x20;in&#x20;ip-pool&#x20;during&#x20;source&#x20;natting&#x20;&#40;PNAT&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.6.2.3.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;expectation&#x20;sessions&#x20;count';
SET @component_description = 'The&#x20;number&#x20;of&#x20;current&#x20;expectation&#x20;sessions';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.6.2.4.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;sync&#x20;queue&#x20;sessions&#x20;count';
SET @component_description = 'The&#x20;sync&#x20;queue&#x20;full&#x20;counter,&#x20;reflecting&#x20;bursts&#x20;on&#x20;the&#x20;sync&#x20;queue';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.6.2.5.0','',1,'','','','','',1);

SET @component_name = 'Fortinet&#x20;accept&#x20;queue&#x20;sessions&#x20;count';
SET @component_description = 'The&#x20;accept&#x20;queue&#x20;full&#x20;counter,&#x20;reflecting&#x20;bursts&#x20;on&#x20;the&#x20;accept&#x20;queue';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,1,'1.3.6.1.4.1.12356.101.4.6.2.6.0','',1,'','','','','',1);

SET @component_group_name = 'VPN';

SET @component_name = 'F5&#x20;Current&#x20;SSL/VPN&#x20;connections';
SET @component_description = 'The&#x20;total&#x20;current&#x20;SSL/VPN&#x20;connections&#x20;in&#x20;the&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.6.1.5.3.0','',1,'','','','','',1);

SET @component_name = 'F5&#x20;Total&#x20;SSL/VPN&#x20;bytes&#x20;received';
SET @component_description = 'The&#x20;total&#x20;raw&#x20;bytes&#x20;received&#x20;by&#x20;SSL/VPN&#x20;connections&#x20;in&#x20;the&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'bytes','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.6.1.5.5.0','',1,'','','','','',1);

SET @component_name = 'F5&#x20;Total&#x20;SSL/VPN&#x20;bytes&#x20;transmitted';
SET @component_description = 'The&#x20;total&#x20;raw&#x20;bytes&#x20;transmitted&#x20;by&#x20;SSL/VPN&#x20;connections&#x20;in&#x20;the&#x20;system';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'bytes','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','f5',1,1,'1.3.6.1.4.1.3375.2.6.1.5.6.0','',1,'','','','','',1);

SET @component_name = 'Juniper&#x20;_nameOID_&#x20;active&#x20;sites';
SET @component_description = 'The&#x20;number&#x20;of&#x20;active&#x20;sites&#x20;in&#x20;the&#x20;VPN';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.2636.3.26.1.2.1.9','',1,'1.3.6.1.4.1.2636.3.26.1.2.1.2','','','','',1);

SET @component_name = 'Juniper&#x20;_nameOID_&#x20;age';
SET @component_description = 'The&#x20;age&#x20;&#40;i.e.,&#x20;time&#x20;from&#x20;creation&#x20;till&#x20;now&#41;&#x20;of&#x20;this&#x20;VPN&#x20;in&#x20;hundredths&#x20;of&#x20;a&#x20;second';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'_timeticks_','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.2636.3.26.1.2.1.12','',1,'1.3.6.1.4.1.2636.3.26.1.2.1.2','','','','',1);

SET @component_name = 'Juniper&#x20;_nameOID_&#x20;interface&#x20;status';
SET @component_description = 'Status&#x20;of&#x20;this&#x20;interface:&#x20;unknown&#40;0&#41;,&#x20;noLocalInterface&#40;1&#41;,&#x20;disabled&#40;2&#41;,&#x20;encapsulationMismatch&#40;3&#41;,&#x20;down&#40;4&#41;,&#x20;up&#40;5&#41;';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','juniper',1,2,'1.3.6.1.4.1.2636.3.26.1.3.1.10','',1,'1.3.6.1.4.1.2636.3.26.1.3.1.2','','','','',1);

SET @component_group_name = 'Intrussions';

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;intrussions&#x20;detected';
SET @component_description = 'Number&#x20;of&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.1','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;intrussions&#x20;blocked';
SET @component_description = 'Number&#x20;of&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.1','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;critical&#x20;severity&#x20;intrussions';
SET @component_description = 'Number&#x20;of&#x20;critical&#x20;severity&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.3','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;high&#x20;severity&#x20;intrussions';
SET @component_description = 'Number&#x20;of&#x20;high&#x20;severity&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.4','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;medium&#x20;severity&#x20;intrussions';
SET @component_description = 'Number&#x20;of&#x20;medium&#x20;severity&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.5','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;low&#x20;severity&#x20;intrussions';
SET @component_description = 'Number&#x20;of&#x20;low&#x20;severity&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.6','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;informational&#x20;severity&#x20;intrussions';
SET @component_description = 'Number&#x20;of&#x20;informational&#x20;severity&#x20;intrusions&#x20;detected&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.7','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;signature&#x20;detections';
SET @component_description = 'Number&#x20;of&#x20;intrusions&#x20;detected&#x20;by&#x20;signature&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.8','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;anomaly&#x20;detections';
SET @component_description = 'Number&#x20;of&#x20;intrusions&#x20;DECed&#x20;as&#x20;anomalies&#x20;since&#x20;start-up&#x20;in&#x20;this&#x20;virtual&#x20;domain';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.9.2.1.1.9','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_group_name = 'Antivirus';

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;virus&#x20;detected';
SET @component_description = 'Number&#x20;of&#x20;virus&#x20;transmissions&#x20;detected&#x20;in&#x20;the&#x20;virtual&#x20;domain&#x20;since&#x20;start-up';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.8.2.1.1.1','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;virus&#x20;blocked';
SET @component_description = 'Number&#x20;of&#x20;virus&#x20;transmissions&#x20;blocked&#x20;in&#x20;the&#x20;virtual&#x20;domain&#x20;since&#x20;start-up';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.8.2.1.1.2','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;oversized&#x20;detected';
SET @component_description = 'Number&#x20;of&#x20;over-sized&#x20;file&#x20;transmissions&#x20;detected&#x20;in&#x20;the&#x20;virtual&#x20;domain&#x20;since&#x20;start-up';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.8.2.1.1.17','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_name = 'Fortinet&#x20;virtual&#x20;domain&#x20;_nameOID_&#x20;oversized&#x20;blocked';
SET @component_description = 'Number&#x20;of&#x20;over-sized&#x20;file&#x20;transmissions&#x20;blocked&#x20;in&#x20;the&#x20;virtual&#x20;domain&#x20;since&#x20;start-up';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,15,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','Array','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'snmp','fortinet',1,2,'1.3.6.1.4.1.12356.101.8.2.1.1.18','',1,'1.3.6.1.4.1.12356.101.3.2.1.1.2','','','','',1);

SET @component_group_name = 'Services';

SET @component_name = 'WMI&#x20;Service&#x20;_Name_&#x20;running';
SET @component_description = '_Caption_';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,2,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,0.00,0.00,'',0.00,0.00,'',0,'','','',0,0,0.000000000000000,'','nowizard','{\"extra_field_1\":\"State\",\"extra_field_2\":\"Caption\",\"satellite_execution\":\"\",\"value_operation\":\"\",\"server_plugin\":\"0\",\"field0_wmi_field\":\"\"}','','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',1,2,'','',0,'','Win32_Service','Name','','{\"scan\":\"\",\"execution\":\"Name&#x20;=&#x20;&#039;_Name_&#039;\",\"field\":\"1\",\"key_string\":\"Running\"}',1);

SET @component_group_name = 'Disks';

SET @component_name = 'WMI&#x20;disk&#x20;_DeviceID_&#x20;used&#x20;&#40;%&#41;';
SET @component_description = 'Space&#x20;percentage&#x20;used&#x20;on&#x20;the&#x20;logical&#x20;disk';
SET @plugin_name = 'Wizard&#x20;WMI&#x20;module';

SET @component_id = '';
SELECT @component_id := `id_nc` FROM `tnetwork_component` WHERE `name` = @component_name;

SET @group_id = '';
SELECT @group_id := `id_sg` FROM `tnetwork_component_group` WHERE `name` = @component_group_name;

SET @plugin_id = '';
SELECT @plugin_id := `id` FROM `tplugin` WHERE `name` = @plugin_name;

INSERT IGNORE INTO `tnetwork_component` (`id_nc`, `name`, `description`, `id_group`, `type`, `max`, `min`, `module_interval`, `tcp_port`, `tcp_send`, `tcp_rcv`, `snmp_community`, `snmp_oid`, `id_module_group`, `id_modulo`, `id_plugin`, `plugin_user`, `plugin_pass`, `plugin_parameter`, `max_timeout`, `max_retries`, `history_data`, `min_warning`, `max_warning`, `str_warning`, `min_critical`, `max_critical`, `str_critical`, `min_ff_event`, `custom_string_1`, `custom_string_2`, `custom_string_3`, `custom_integer_1`, `custom_integer_2`, `post_process`, `unit`, `wizard_level`, `macros`, `critical_instructions`, `warning_instructions`, `unknown_instructions`, `critical_inverse`, `warning_inverse`, `id_category`, `tags`, `disabled_types_event`, `module_macros`, `min_ff_event_normal`, `min_ff_event_warning`, `min_ff_event_critical`, `ff_type`, `each_ff`, `dynamic_interval`, `dynamic_max`, `dynamic_min`, `dynamic_next`, `dynamic_two_tailed`, `module_type`, `protocol`, `manufacturer_id`, `execution_type`, `scan_type`, `value`, `value_operations`, `module_enabled`, `name_oid`, `query_class`, `query_key_field`, `scan_filters`, `query_filters`, `enabled`) VALUES (@component_id,@component_name,@component_description,@group_id,1,0,0,0,0,'','','','',0,9,0,'','','',0,0,0,80.00,90.00,'',90.00,0.00,'',0,'','','',0,0,0.000000000000000,'%','nowizard',CONCAT('{\"extra_field_1\":\"Size\",\"extra_field_2\":\"FreeSpace\",\"satellite_execution\":\"/etc/pandora/satellite_plugins/wizard_wmi_module&#x20;-host&#x20;&quot;_address_&quot;&#x20;-namespace&#x20;&quot;_namespace_wmi_&quot;&#x20;-user&#x20;&quot;_user_wmi_&quot;&#x20;-pass&#x20;&quot;_pass_wmi_&quot;&#x20;-wmiClass&#x20;&quot;_class_wmi_&quot;&#x20;-fieldsList&#x20;&quot;_field_wmi_1_,_field_wmi_2_&quot;&#x20;-queryFilter&#x20;&quot;DeviceID&#x20;=&#x20;&#039;_DeviceID_&#039;&quot;&#x20;-operation&#x20;&quot;&#40;&#40;_f1_&#x20;-&#x20;_f2_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_f1_&quot;&#x20;-wmicPath&#x20;/usr/bin/wmic\",\"value_operation\":\"&#40;&#40;_Size_&#x20;-&#x20;_FreeSpace_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_Size_\",\"server_plugin\":\"',@plugin_id,'\",\"_field2__wmi_field\":\"_namespace_wmi_\",\"_field1__wmi_field\":\"_address_\",\"_field4__wmi_field\":\"_pass_wmi_\",\"_field3__wmi_field\":\"_user_wmi_\",\"_field6__wmi_field\":\"_field_wmi_1_,_field_wmi_2_\",\"_field5__wmi_field\":\"_class_wmi_\",\"_field8__wmi_field\":\"&#40;&#40;_f1_&#x20;-&#x20;_f2_&#41;&#x20;*&#x20;100&#41;&#x20;/&#x20;_f1_\",\"_field7__wmi_field\":\"DeviceID&#x20;=&#x20;&#039;_DeviceID_&#039;\",\"field0_wmi_field\":\"\"}'),'','','',0,0,0,'','{\"going_unknown\":0}','',0,0,0,0,0,0,0,0,0,0,1,'wmi','',2,2,'','',1,'','Win32_LogicalDisk','DeviceID','','{\"scan\":\"DriveType&#x20;=&#x20;3\",\"execution\":\"\",\"field\":\"\",\"key_string\":\"\"}',1);

INSERT IGNORE INTO `tpen` VALUES (171,'dlink','D-Link Systems, Inc.'),(14988,'mikrotik','MikroTik'),(6486,'alcatel','Alcatel-Lucent Enterprise'),(41112,'ubiquiti','Ubiquiti Networks, Inc.'),(207,'telesis','Allied Telesis, Inc.'),(10002,'frogfoot','Frogfoot Networks'),(2,'ibm','IBM'),(4,'unix','Unix'),(63,'apple','Apple Computer, Inc.'),(674,'dell','Dell Inc.'),(111,'oracle','Oracle'),(116,'hitachi','Hitachi, Ltd.'),(173,'netlink','Netlink'),(188,'ascom','Ascom'),(6574,'synology','Synology Inc.'),(3861,'fujitsu','Fujitsu Network Communications, Inc.'),(53526,'dell','Dell ATC'),(52627,'apple','Apple Inc'),(19464,'hitachi','Hitachi Communication Technologies, Ltd.'),(13062,'ascom','Ascom');

INSERT INTO `tncm_vendor` (`id`, `name`) VALUES
    (1,'Cisco'),
	(2, 'D-Link Systems, Inc.'),
    (3, 'MikroTik'),
    (4, 'Alcatel-Lucent Enterprise'),
    (5, 'Ubiquiti Networks, Inc.'),
    (6, 'Allied Telesis, Inc.'),
    (7, 'Frogfoot Networks'),
    (8, 'IBM'),
    (9, 'Dell Inc.'),
    (10, 'Hitachi Communication Technologies, Ltd.'),
    (11, 'Netlink'),
    (12, 'Ascom'),
    (13, 'Synology Inc.'),
    (14, 'Fujitsu Network Communications, Inc.');

INSERT INTO `tncm_model` VALUES (1,1,'7200');

INSERT INTO `tncm_template` VALUES (1,'cisco-base','[\"1\"]','[\"1\"]');

INSERT INTO `tncm_script` VALUES 
    (1,0,'enable&#x0d;&#x0a;expect:Password:&#92;s*&#x0d;&#x0a;_enablepass_&#x0d;&#x0a;exit'),
    (2,1,'enable&#x0d;&#x0a;expect:Password:&#92;s*&#x0d;&#x0a;_enablepass_&#x0d;&#x0a;term&#x20;length&#x20;0&#x0d;&#x0a;capture:show&#x20;running-config&#x0d;&#x0a;exit&#x0d;&#x0a;'),
	(3,2,'enable&#x0d;&#x0a;expect:Password:&#92;s*&#x0d;&#x0a;_enablepass_&#x0d;&#x0a;term&#x20;length&#x20;0&#x0d;&#x0a;config&#x20;terminal&#x0d;&#x0a;_applyconfigbackup_&#x0d;&#x0a;exit&#x0d;&#x0a;'),
	(4,3,'enable&#x0d;&#x0a;expect:Password:&#92;s*&#x0d;&#x0a;_enablepass_&#x0d;&#x0a;term&#x20;length&#x20;0&#x0d;&#x0a;capture:show&#x20;version&#x20;|&#x20;i&#x20;IOS&#x20;Software&#x0d;&#x0a;exit&#x0d;&#x0a;'),
	(5,5,'enable&#x0d;&#x0a;expect:Password:&#92;s*&#x0d;&#x0a;_enablepass_&#x0d;&#x0a;term&#x20;length&#x20;0&#x0d;&#x0a;config&#x20;term&#x0d;&#x0a;end&#x0d;&#x0a;end&#x0d;&#x0a;exit&#x0d;&#x0a;'),
	(6,4,'copy&#x20;tftp&#x20;flash&#x0d;&#x0a;expect:&#92;]&#92;?&#x0d;&#x0a;_TFTP_SERVER_IP_&#x0d;&#x0a;expect:&#92;]&#92;?&#x0d;&#x0a;_SOURCE_FILE_NAME_&#x0d;&#x0a;expect:&#92;]&#92;?&#x0d;&#x0a;_DESTINATION_FILE_NAME_&#x0d;&#x0a;show&#x20;flash&#x0d;&#x0a;reload&#x0d;&#x0a;expect:confirm&#x0d;&#x0a;y&#x0d;&#x0a;config&#x20;terminal&#x0d;&#x0a;boot&#x20;system&#x20;_DESTINATION_FILE_NAME_');

INSERT INTO `tncm_template_scripts`(`id_template`, `id_script`) VALUES (1,1),(1,2),(1,3),(1,4),(1,5),(1,6);

INSERT INTO `talert_calendar` VALUES (1, 'Default', 0, 'Default calendar');

INSERT INTO `twelcome_tip` VALUES
(1,'es',0,'¿Sab&iacute;as&#x20;que&#x20;puedes&#x20;monitorizar&#x20;webs?','De&#x20;manera&#x20;sencilla&#x20;a&#x20;trav&eacute;s&#x20;de&#x20;chequeos&#x20;HTTP&#x20;est&aacute;ndar&#x20;o&#x20;transaccional&#x20;mediante&#x20;transacciones&#x20;centralizadas&#x20;WUX,&#x20;o&#x20;descentralizadas&#x20;con&#x20;el&#x20;plugin&#x20;UX&#x20;de&#x20;agente.','https://pandorafms.com/manual/es/documentation/03_monitoring/06_web_monitoring','1'),
(2,'es',0,'Monitorizaci&oacute;n&#x20;remota&#x20;de&#x20;dispositivos&#x20;SNMP','Los&#x20;dispositivos&#x20;de&#x20;red&#x20;como&#x20;switches,&#x20;AP,&#x20;routers&#x20;y&#x20;firewalls&#x20;se&#x20;pueden&#x20;monitorizar&#x20;remotamente&#x20;usando&#x20;el&#x20;protocolo&#x20;SNMP.&#x20;Basta&#x20;con&#x20;saber&#x20;su&#x20;IP,&#x20;la&#x20;comunidad&#x20;SNMP&#x20;y&#x20;lanzar&#x20;un&#x20;wizard&#x20;SNMP&#x20;desde&#x20;la&#x20;consola.','https://pandorafms.com/manual/es/documentation/03_monitoring/03_remote_monitoring#monitorizacion_snmp','1'),
(3,'es',0,'Monitorizar&#x20;rutas&#x20;desde&#x20;una&#x20;IP&#x20;a&#x20;otra','Existe&#x20;un&#x20;plugin&#x20;especial&#x20;que&#x20;sirve&#x20;para&#x20;monitorizar&#x20;visualmente&#x20;las&#x20;rutas&#x20;desde&#x20;una&#x20;IP&#x20;a&#x20;otra&#x20;de&#x20;manera&#x20;visual&#x20;y&#x20;din&aacute;mica,&#x20;seg&uacute;n&#x20;va&#x20;cambiando&#x20;con&#x20;el&#x20;tiempo.','https://pandorafms.com/manual/es/documentation/03_monitoring/03_remote_monitoring#monitorizacion_de_rutas','1'),
(4,'es',0,'¿Tu&#x20;red&#x20;pierde&#x20;paquetes?','Se&#x20;puede&#x20;medir&#x20;la&#x20;p&eacute;rdida&#x20;de&#x20;paquetes&#x20;en&#x20;tu&#x20;red&#x20;usando&#x20;un&#x20;agente&#x20;y&#x20;un&#x20;plugin&#x20;libre&#x20;llamado&#x20;&ldquo;Packet&#x20;Loss&rdquo;.&#x20;Esto&#x20;es&#x20;especialmente&#x20;&uacute;til&#x20;en&#x20;redes&#x20;Wifi&#x20;o&#x20;redes&#x20;compartidas&#x20;con&#x20;muchos&#x20;usuarios.&#x20;Escribimos&#x20;un&#x20;art&iacute;culo&#x20;en&#x20;nuestro&#x20;blog&#x20;hablando&#x20;de&#x20;ello,&#x20;echale&#x20;un&#x20;vistazo','https://pandorafms.com/blog/es/perdida-de-paquetes/','1'),
(5,'es',0,'Usar&#x20;Telegram&#x20;con&#x20;Pandora&#x20;FMS','Perfecto&#x20;para&#x20;recibir&#x20;alertas&#x20;con&#x20;gr&aacute;ficas&#x20;empotradas&#x20;y&#x20;personalizar&#x20;as&iacute;&#x20;la&#x20;recepci&oacute;n&#x20;de&#x20;avisos&#x20;de&#x20;manera&#x20;individual&#x20;o&#x20;en&#x20;un&#x20;canal&#x20;com&uacute;n&#x20;con&#x20;mas&#x20;personas.&#x20;','https://pandorafms.com/library/telegram-bot-cli/','1'),
(6,'es',0,'Monitorizar&#x20;JMX&#x20;&#40;Tomcat,&#x20;Websphere,&#x20;Weblogic,&#x20;Jboss,&#x20;Apache&#x20;Kafka,&#x20;Jetty,&#x20;GlassFish&hellip;&#41;','Existe&#x20;un&#x20;plugin&#x20;Enterprise&#x20;que&#x20;sirve&#x20;para&#x20;monitorizar&#x20;cualquier&#x20;tecnolog&iacute;a&#x20;JMX.&#x20;Se&#x20;puede&#x20;usar&#x20;de&#x20;manera&#x20;local&#x20;&#40;como&#x20;plugin&#x20;local&#41;&#x20;o&#x20;de&#x20;manera&#x20;remota&#x20;con&#x20;el&#x20;plugin&#x20;server.','https://pandorafms.com/library/jmx-monitoring/','1'),
(7,'es',0,'¿Sabes&#x20;que&#x20;cada&#x20;usuario&#x20;puede&#x20;tener&#x20;su&#x20;propia&#x20;Zona&#x20;Horaria?','Se&#x20;puede&#x20;establecer&#x20;zonas&#x20;horarias&#x20;diferentes&#x20;para&#x20;cada&#x20;usuario,&#x20;de&#x20;manera&#x20;que&#x20;interprete&#x20;los&#x20;datos&#x20;teniendo&#x20;en&#x20;cuenta&#x20;la&#x20;diferencia&#x20;horaria.&#x20;Pandora&#x20;FMS&#x20;tambi&eacute;n&#x20;puede&#x20;tener&#x20;servidores&#x20;y&#x20;agentes&#x20;en&#x20;diferentes&#x20;zonas&#x20;horarias.&#x20;¡Por&#x20;todo&#x20;el&#x20;mundo!','','1'),
(8,'es',0,'Paradas&#x20;planificadas','Se&#x20;puede&#x20;definir,&#x20;a&#x20;nivel&#x20;de&#x20;agente&#x20;y&#x20;a&#x20;nivel&#x20;de&#x20;m&oacute;dulo,&#x20;per&iacute;odos&#x20;en&#x20;los&#x20;cuales&#x20;se&#x20;ignoren&#x20;las&#x20;alertas&#x20;y/o&#x20;los&#x20;datos&#x20;recogidos.&#x20;Es&#x20;perfecto&#x20;para&#x20;planificar&#x20;paradas&#x20;de&#x20;servicio&#x20;o&#x20;desconexi&oacute;n&#x20;de&#x20;los&#x20;sistemas&#x20;monitorizados.&#x20;Tambi&eacute;n&#x20;afecta&#x20;a&#x20;los&#x20;informes&#x20;SLA,&#x20;evitando&#x20;que&#x20;se&#x20;tengan&#x20;en&#x20;cuenta&#x20;esos&#x20;intervalos&#x20;de&#x20;tiempo.&#x20;&#x20;&#x20;&#x20;','https://pandorafms.com/manual/es/documentation/04_using/11_managing_and_administration#paradas_de_servicio_planificadas','1'),
(9,'es',0,'Personalizar&#x20;los&#x20;emails&#x20;de&#x20;alerta&#x20;','¿Sab&iacute;as&#x20;que&#x20;se&#x20;pueden&#x20;personalizar&#x20;los&#x20;mails&#x20;de&#x20;alertas&#x20;de&#x20;Pandora?&#x20;Solo&#x20;tienes&#x20;que&#x20;editar&#x20;el&#x20;c&oacute;digo&#x20;HTML&#x20;por&#x20;defecto&#x20;de&#x20;las&#x20;acciones&#x20;de&#x20;alerta&#x20;de&#x20;tipo&#x20;email.&#x20;&#x20;','https://pandorafms.com/manual/en/documentation/04_using/01_alerts#editing_an_action','1'),
(10,'es',0,'Usando&#x20;iconos&#x20;personalizados&#x20;en&#x20;consolas&#x20;visuales&#x20;','Gracias&#x20;a&#x20;los&#x20;iconos&#x20;personalizados&#x20;se&#x20;pueden&#x20;crear&#x20;vistas&#x20;muy&#x20;personalizadas,&#x20;como&#x20;la&#x20;de&#x20;la&#x20;imagen,&#x20;que&#x20;representa&#x20;racks&#x20;con&#x20;los&#x20;tipos&#x20;de&#x20;servidores&#x20;en&#x20;el&#x20;orden&#x20;que&#x20;est&aacute;n&#x20;colocados&#x20;dentro&#x20;del&#x20;rack.&#x20;Perfecto&#x20;para&#x20;que&#x20;un&#x20;t&eacute;cnico&#x20;sepa&#x20;exactamente&#x20;qu&eacute;&#x20;m&aacute;quina&#x20;esta&#x20;fallando.&#x20;M&aacute;s&#x20;visual&#x20;no&#x20;puede&#x20;ser,&#x20;de&#x20;ahi&#x20;el&#x20;nombre.&#x20;&#x20;','https://pandorafms.com/manual/start?id=es/documentation/04_using/05_data_presentation_visual_maps','1'),
(11,'es',0,'Consolas&#x20;visuales:&#x20;mapas&#x20;de&#x20;calor&#x20;','La&#x20;consola&#x20;permite&#x20;integrar&#x20;en&#x20;un&#x20;fondo&#x20;personalizado&#x20;una&#x20;serie&#x20;de&#x20;datos,&#x20;que&#x20;en&#x20;funci&oacute;n&#x20;de&#x20;su&#x20;valor&#x20;se&#x20;representen&#x20;con&#x20;unos&#x20;colores&#x20;u&#x20;otros,&#x20;en&#x20;tiempo&#x20;real.&#x20;Las&#x20;aplicaciones&#x20;son&#x20;infinitas,&#x20;solo&#x20;depende&#x20;de&#x20;tu&#x20;imaginaci&oacute;n.&#x20;&#x20;&#x20;','https://pandorafms.com/manual/es/documentation/04_using/05_data_presentation_visual_maps#mapa_de_calor_o_nube_de_color','1'),
(12,'es',0,'Auditor&iacute;a&#x20;interna&#x20;de&#x20;la&#x20;consola&#x20;','La&#x20;consola&#x20;registra&#x20;todas&#x20;las&#x20;actividades&#x20;relevantes&#x20;de&#x20;cada&#x20;usuario&#x20;conectado&#x20;a&#x20;la&#x20;consola.&#x20;Esto&#x20;incluye&#x20;la&#x20;aplicaci&oacute;n&#x20;de&#x20;configuraciones,&#x20;validaciones&#x20;de&#x20;eventos&#x20;y&#x20;alertas,&#x20;conexi&oacute;n&#x20;y&#x20;desconexi&oacute;n&#x20;y&#x20;cientos&#x20;de&#x20;otras&#x20;operaciones.&#x20;La&#x20;seguridad&#x20;en&#x20;Pandora&#x20;FMS&#x20;ha&#x20;sido&#x20;siempre&#x20;una&#x20;de&#x20;las&#x20;caracter&iacute;sticas&#x20;del&#x20;dise&ntilde;o&#x20;de&#x20;su&#x20;arquitectura.&#x20;&#x20;','https://pandorafms.com/manual/es/documentation/04_using/11_managing_and_administration#log_de_auditoria','1'),
(13,'es',0,'Sistema&#x20;de&#x20;provisi&oacute;n&#x20;autom&aacute;tica&#x20;de&#x20;agentes&#x20;','El&#x20;sistema&#x20;de&#x20;autoprovisi&oacute;n&#x20;de&#x20;agentes,&#x20;permite&#x20;que&#x20;un&#x20;agente&#x20;reci&eacute;n&#x20;ingresado&#x20;en&#x20;el&#x20;sistema&#x20;aplique&#x20;autom&aacute;ticamente&#x20;cambios&#x20;en&#x20;su&#x20;configuraci&oacute;n&#x20;&#40;como&#x20;moverlo&#x20;de&#x20;grupo,&#x20;asignarle&#x20;ciertos&#x20;valores&#x20;en&#x20;campos&#x20;personalizados&#41;&#x20;y&#x20;por&#x20;supuesto&#x20;aplicarle&#x20;determinadas&#x20;politicas&#x20;de&#x20;monitorizaci&oacute;n.&#x20;Es&#x20;una&#x20;de&#x20;las&#x20;funcionalidades&#x20;m&aacute;s&#x20;potentes,&#x20;orientadas&#x20;a&#x20;gestionar&#x20;parques&#x20;de&#x20;sistemas&#x20;muy&#x20;extensos.&#x20;&#x20;','https://pandorafms.com/manual/start?id=es/documentation/02_installation/05_configuration_agents#configuracion_automatica_de_agentes','1'),
(14,'es',0,'Modo&#x20;oscuro&#x20;','¿Sabes&#x20;que&#x20;existe&#x20;un&#x20;modo&#x20;oscuro&#x20;en&#x20;Pandora&#x20;FMS?&#x20;Un&#x20;administrador&#x20;lo&#x20;puede&#x20;activar&#x20;a&#x20;nivel&#x20;global&#x20;desde&#x20;las&#x20;opciones&#x20;de&#x20;configuraci&oacute;n&#x20;visuales&#x20;o&#x20;cualquier&#x20;usuario&#x20;a&#x20;nivel&#x20;individual,&#x20;en&#x20;las&#x20;opciones&#x20;de&#x20;usuario.&#x20;','','1'),
(15,'es',0,'Google&#x20;Sheet&#x20;','¿Sabes&#x20;que&#x20;se&#x20;puede&#x20;coger&#x20;el&#x20;valor&#x20;de&#x20;una&#x20;celda&#x20;de&#x20;una&#x20;hoja&#x20;de&#x20;c&aacute;lculo&#x20;de&#x20;Google&#x20;Sheet?,&#x20;utilizamos&#x20;la&#x20;API&#x20;para&#x20;pedir&#x20;el&#x20;dato&#x20;a&#x20;trav&eacute;s&#x20;de&#x20;un&#x20;plugin&#x20;remoto.&#x20;Es&#x20;perfecto&#x20;para&#x20;construir&#x20;cuadros&#x20;de&#x20;mando&#x20;de&#x20;negocio,&#x20;obtener&#x20;alertas&#x20;en&#x20;tiempo&#x20;real&#x20;y&#x20;crear&#x20;tus&#x20;propios&#x20;informes&#x20;a&#x20;medida.&#x20;&#x20;','https://pandorafms.com/library/google-sheets-plugin/','1'),
(16,'es',0,'Tablas&#x20;de&#x20;ARP','¿Sabes&#x20;que&#x20;existe&#x20;un&#x20;m&oacute;dulo&#x20;de&#x20;inventario&#x20;para&#x20;sacar&#x20;las&#x20;tablas&#x20;ARP&#x20;de&#x20;tus&#x20;servidores&#x20;windows?&#x20;Es&#x20;f&aacute;cil&#x20;de&#x20;instalar&#x20;y&#x20;puede&#x20;darte&#x20;informaci&oacute;n&#x20;muy&#x20;detallada&#x20;de&#x20;tus&#x20;equipos.','https://pandorafms.com/library/arp-table-windows-local/','1'),
(17,'es',0,'Enlaces&#x20;de&#x20;red&#x20;en&#x20;la&#x20;consola&#x20;visual&#x20;','Existe&#x20;un&#x20;elemento&#x20;de&#x20;consola&#x20;visual&#x20;llamado&#x20;&ldquo;Network&#x20;link&rdquo;&#x20;que&#x20;permite&#x20;mostrar&#x20;visualmente&#x20;la&#x20;uni&oacute;n&#x20;de&#x20;dos&#x20;interfaces&#x20;de&#x20;red,&#x20;su&#x20;estado&#x20;y&#x20;el&#x20;tr&aacute;fico&#x20;de&#x20;subida/bajada,&#x20;de&#x20;una&#x20;manera&#x20;muy&#x20;visual.&#x20;&#x20;','https://pandorafms.com/manual/es/documentation/04_using/05_data_presentation_visual_maps#enlace_de_red','1'),
(18,'es',0,'¿Conoces&#x20;los&#x20;informes&#x20;de&#x20;disponibilidad?&#x20;','Son&#x20;muy&#x20;&uacute;tiles&#x20;ya&#x20;que&#x20;te&#x20;dicen&#x20;el&#x20;tiempo&#x20;&#40;%&#41;&#x20;que&#x20;un&#x20;chequeo&#x20;ha&#x20;estado&#x20;en&#x20;diferentes&#x20;estados&#x20;a&#x20;lo&#x20;largo&#x20;de&#x20;un&#x20;lapso&#x20;de&#x20;tiempo,&#x20;por&#x20;ejemplo,&#x20;una&#x20;semana.&#x20;Ofrece&#x20;datos&#x20;crudos&#x20;completos&#x20;de&#x20;lo&#x20;que&#x20;se&#x20;ha&#x20;hecho&#x20;con&#x20;el&#x20;detalle&#x20;suficiente&#x20;para&#x20;convencer&#x20;a&#x20;un&#x20;proveedor&#x20;o&#x20;un&#x20;cliente.&#x20;&#x20;','','1'),
(19,'es',0,'Gr&aacute;ficas&#x20;de&#x20;disponibilidad&#x20;','Parecidos&#x20;a&#x20;los&#x20;informes&#x20;de&#x20;disponibilidad,&#x20;pero&#x20;mucho&#x20;mas&#x20;visuales,&#x20;ofrecen&#x20;el&#x20;detalle&#x20;de&#x20;estado&#x20;de&#x20;un&#x20;monitor&#x20;a&#x20;lo&#x20;largo&#x20;del&#x20;tiempo.&#x20;Se&#x20;pueden&#x20;agrupar&#x20;con&#x20;otro&#x20;m&oacute;dulo&#x20;para&#x20;ofrecer&#x20;datos&#x20;finales&#x20;teniendo&#x20;en&#x20;cuenta&#x20;la&#x20;alta&#x20;disponibilidad&#x20;de&#x20;un&#x20;servicio.&#x20;Son&#x20;perfectos&#x20;para&#x20;su&#x20;uso&#x20;en&#x20;informes&#x20;a&#x20;proveedores&#x20;y/o&#x20;clientes.&#x20;&#x20;','https://pandorafms.com/manual/es/documentation/04_using/08_data_presentation_reports#grafico_de_disponibilidad','1'),
(20,'es',0,'Zoom&#x20;en&#x20;gr&aacute;ficas&#x20;de&#x20;datos&#x20;','¿Sabes&#x20;que&#x20;Pandora&#x20;FMS&#x20;permite&#x20;hacer&#x20;zoom&#x20;en&#x20;una&#x20;parte&#x20;de&#x20;la&#x20;gr&aacute;fica.&#x20;Con&#x20;eso&#x20;ampliar&aacute;s&#x20;la&#x20;informaci&oacute;n&#x20;de&#x20;la&#x20;gr&aacute;fica.&#x20;Si&#x20;est&aacute;s&#x20;viendo&#x20;una&#x20;gr&aacute;fica&#x20;de&#x20;un&#x20;mes&#x20;y&#x20;ampl&iacute;as,&#x20;podr&aacute;s&#x20;ver&#x20;los&#x20;datos&#x20;de&#x20;ese&#x20;intervalo.&#x20;Si&#x20;utilizas&#x20;una&#x20;gr&aacute;fica&#x20;con&#x20;datos&#x20;de&#x20;resoluci&oacute;n&#x20;completa&#x20;&#40;los&#x20;llamamos&#x20;gr&aacute;ficas&#x20;TIP&#41;&#x20;podr&aacute;s&#x20;ver&#x20;el&#x20;detalle&#x20;de&#x20;cada&#x20;dato,&#x20;aunque&#x20;tu&#x20;gr&aacute;fica&#x20;tenga&#x20;miles&#x20;de&#x20;muestras.&#x20;&#x20;','','1'),
(21,'es',0,'Gr&aacute;ficas&#x20;de&#x20;resoluci&oacute;n&#x20;completa&#x20;','Pandora&#x20;FMS&#x20;y&#x20;otras&#x20;herramientas&#x20;cuando&#x20;tienen&#x20;que&#x20;mostrar&#x20;una&#x20;gr&aacute;fica&#x20;obtienen&#x20;los&#x20;datos&#x20;de&#x20;la&#x20;fuente&#x20;de&#x20;datos&#x20;y&#x20;luego&#x20;&ldquo;simplifican&rdquo;&#x20;la&#x20;gr&aacute;fica,&#x20;ya&#x20;que&#x20;si&#x20;la&#x20;serie&#x20;de&#x20;datos&#x20;tiene&#x20;10,000&#x20;elementos&#x20;y&#x20;la&#x20;gr&aacute;fica&#x20;solo&#x20;tiene&#x20;300&#x20;pixeles&#x20;de&#x20;ancho&#x20;no&#x20;pueden&#x20;caber&#x20;todos,&#x20;asi&#x20;que&#x20;se&#x20;&ldquo;simplifican&rdquo;&#x20;esos&#x20;10,000&#x20;puntos&#x20;en&#x20;solo&#x20;300.&#x20;&#x20;&#x20;Sin&#x20;embargo&#x20;al&#x20;simplificar&#x20;se&#x20;pierde&#x20;&ldquo;detalle&rdquo;&#x20;en&#x20;la&#x20;gr&aacute;fica,&#x20;y&#x20;por&#x20;supuesto&#x20;no&#x20;podemos&#x20;&ldquo;hacer&#x20;zoom&rdquo;.&#x20;Las&#x20;gr&aacute;ficas&#x20;de&#x20;Pandora&#x20;FMS&#x20;permiten&#x20;mostrar&#x20;y&#x20;usar&#x20;todos&#x20;los&#x20;datos&#x20;en&#x20;una&#x20;gr&aacute;fica,&#x20;que&#x20;llamamos&#x20;&ldquo;TIP&rdquo;&#x20;que&#x20;muestra&#x20;todos&#x20;los&#x20;puntos&#x20;superpuestos&#x20;y&#x20;adem&aacute;s&#x20;permite&#x20;que&#x20;al&#x20;hacer&#x20;zoom&#x20;no&#x20;se&#x20;pierda&#x20;resoluci&oacute;n.&#x20;&#x20;&#x20;','','1'),
(22,'es',0,'Pol&iacute;tica&#x20;de&#x20;contrase&ntilde;as','La&#x20;consola&#x20;de&#x20;Pandora&#x20;FMS&#x20;tiene&#x20;un&#x20;sistema&#x20;de&#x20;gesti&oacute;n&#x20;de&#x20;pol&iacute;tica&#x20;de&#x20;credenciales,&#x20;para&#x20;reforzar&#x20;la&#x20;seguridad&#x20;local&#x20;&#40;adem&aacute;s&#x20;de&#x20;permitir&#x20;la&#x20;autenticaci&oacute;n&#x20;externa&#x20;contra&#x20;un&#x20;LDAP,&#x20;Active&#x20;Directory&#x20;o&#x20;SAML&#41;.&#x20;A&#x20;trav&eacute;s&#x20;de&#x20;este&#x20;sistema&#x20;podemos&#x20;forzar&#x20;cambios&#x20;de&#x20;password&#x20;cada&#x20;X&#x20;d&iacute;as,&#x20;guardar&#x20;un&#x20;hist&oacute;rico&#x20;de&#x20;passwords&#x20;usadas&#x20;o&#x20;evitar&#x20;el&#x20;uso&#x20;de&#x20;ciertas&#x20;contrase&ntilde;as&#x20;entre&#x20;otras&#x20;acciones.&#x20;&#x20;','https://pandorafms.com/manual/es/documentation/04_using/12_console_setup?s%5B%5D%3Dcontrase%25C3%25B1as#password_policy','1'),
(23,'es',0,'Autenticaci&oacute;n&#x20;de&#x20;doble&#x20;factor&#x20;','Es&#x20;posible&#x20;activar&#x20;&#40;y&#x20;forzar&#x20;su&#x20;uso&#x20;a&#x20;todos&#x20;los&#x20;usuarios&#41;&#x20;un&#x20;sistema&#x20;de&#x20;doble&#x20;autenticaci&oacute;n&#x20;&#40;usando&#x20;Google&#x20;Auth&#41;&#x20;para&#x20;que&#x20;cualquier&#x20;usuario&#x20;se&#x20;autentique&#x20;adem&aacute;s&#x20;de&#x20;con&#x20;una&#x20;contrase&ntilde;a,&#x20;con&#x20;un&#x20;sistema&#x20;de&#x20;token&#x20;de&#x20;un&#x20;solo&#x20;uso,&#x20;dando&#x20;al&#x20;sistema&#x20;mucha&#x20;m&aacute;s&#x20;seguridad.&#x20;&#x20;','https://pandorafms.com/manual/en/documentation/04_using/12_console_setup?s%5B%5D%3Dgoogle%26s%5B%5D%3Dauth#authentication','1');

INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`, `filename`, `path`) VALUES 
(1, 'monitorizar_web.png', 'images/tips/'),
(2, 'monitorizar_snmp.png', 'images/tips/'),
(3, 'monitorizar_desde_ip.png', 'images/tips/'),
(4, 'tu_red_pierde_paquetes.png', 'images/tips/'),
(5, 'telegram_con_pandora.png', 'images/tips/'),
(6, 'monitorizar_con_jmx.png', 'images/tips/'),
(7, 'usuario_zona_horaria.png', 'images/tips/'),
(8, 'paradas_planificadas.png', 'images/tips/'),
(9, 'personalizar_los_emails.png', 'images/tips/'),
(10, 'iconos_personalizados.png', 'images/tips/'),
(11, 'mapa_de_calor.png', 'images/tips/'),
(12, 'auditoria.png', 'images/tips/'),
(15, 'google_sheets.png', 'images/tips/'),
(17, 'enlaces_consola_visual.png', 'images/tips/'),
(18, 'informe_disponibiliad.png', 'images/tips/'),
(19, 'graficas_disponibilidad.png', 'images/tips/'),
(20, 'zoom_en_graficas.png', 'images/tips/'),
(22, 'politica_de_pass.png', 'images/tips/');

INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'You&#x20;know&#x20;reports&#x20;of&#x20;Availability?','They&#x20;are&#x20;very&#x20;useful&#x20;as&#x20;they&#x20;tell&#x20;you&#x20;how&#x20;long&#x20;&#40;%&#41;&#x20;a&#x20;check&#x20;has&#x20;been&#x20;in&#x20;different&#x20;states&#x20;over&#x20;a&#x20;period&#x20;of&#x20;time,&#x20;say&#x20;a&#x20;week.&#x20;It&#x20;offers&#x20;complete&#x20;raw&#x20;data&#x20;of&#x20;what&#x20;has&#x20;been&#x20;done&#x20;in&#x20;enough&#x20;detail&#x20;to&#x20;convince&#x20;a&#x20;vendor&#x20;or&#x20;customer.','',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'informe_disponibiliad.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Did&#x20;you&#x20;know&#x20;that&#x20;you&#x20;can&#x20;monitor&#x20;websites?','In&#x20;a&#x20;simple&#x20;way&#x20;through&#x20;standard&#x20;or&#x20;transactional&#x20;HTTP&#x20;checks&#x20;through&#x20;centralized&#x20;WUX&#x20;transactions,&#x20;or&#x20;decentralized&#x20;with&#x20;the&#x20;UX&#x20;agent&#x20;plugin.','https://pandorafms.com/manual/en/documentation/03_monitoring/06_web_monitoring',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'monitorizar_web.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Did&#x20;you&#x20;know&#x20;that&#x20;each&#x20;user&#x20;can&#x20;have&#x20;their&#x20;own&#x20;Time&#x20;Zone?','Different&#x20;time&#x20;zones&#x20;can&#x20;be&#x20;established&#x20;for&#x20;each&#x20;user,&#x20;so&#x20;that&#x20;it&#x20;interprets&#x20;the&#x20;data&#x20;taking&#x20;into&#x20;account&#x20;the&#x20;time&#x20;difference.&#x20;Pandora&#x20;FMS&#x20;can&#x20;also&#x20;have&#x20;servers&#x20;and&#x20;agents&#x20;in&#x20;different&#x20;time&#x20;zones.&#x20;All&#x20;over&#x20;the&#x20;world!','',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'usuario_zona_horaria.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Does&#x20;your&#x20;network&#x20;lose&#x20;packets?','You&#x20;can&#x20;measure&#x20;the&#x20;packet&#x20;loss&#x20;in&#x20;your&#x20;network&#x20;using&#x20;an&#x20;agent&#x20;and&#x20;a&#x20;free&#x20;plugin&#x20;called&#x20;&ldquo;Packet&#x20;Loss&rdquo;.&#x20;This&#x20;is&#x20;especially&#x20;useful&#x20;on&#x20;Wi-Fi&#x20;networks&#x20;or&#x20;networks&#x20;shared&#x20;with&#x20;many&#x20;users.&#x20;We&#x20;wrote&#x20;an&#x20;article&#x20;on&#x20;our&#x20;blog&#x20;talking&#x20;about&#x20;it,&#x20;check&#x20;it&#x20;out','https://pandorafms.com/blog/packet-loss/',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'tu_red_pierde_paquetes.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Console&#x20;Internal&#x20;Audit','The&#x20;console&#x20;logs&#x20;all&#x20;relevant&#x20;activities&#x20;of&#x20;each&#x20;user&#x20;connected&#x20;to&#x20;the&#x20;console.&#x20;This&#x20;includes&#x20;the&#x20;application&#x20;of&#x20;configurations,&#x20;validation&#x20;of&#x20;events&#x20;and&#x20;alerts,&#x20;connection&#x20;and&#x20;disconnection,&#x20;and&#x20;hundreds&#x20;of&#x20;other&#x20;operations.&#x20;Security&#x20;in&#x20;Pandora&#x20;FMS&#x20;has&#x20;always&#x20;been&#x20;one&#x20;of&#x20;the&#x20;design&#x20;characteristics&#x20;of&#x20;its&#x20;architecture.','https://pandorafms.com/manual/en/documentation/04_using/11_managing_and_administration#log_de_auditoria',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'auditoria.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Two-factor&#x20;authentication','It&#x20;is&#x20;possible&#x20;to&#x20;activate&#x20;&#40;and&#x20;force&#x20;its&#x20;use&#x20;to&#x20;all&#x20;users&#41;&#x20;a&#x20;double&#x20;authentication&#x20;system&#x20;&#40;using&#x20;Google&#x20;Auth&#41;&#x20;so&#x20;that&#x20;any&#x20;user&#x20;authenticates&#x20;in&#x20;addition&#x20;to&#x20;a&#x20;password,&#x20;with&#x20;a&#x20;single-use&#x20;token&#x20;system,&#x20;giving&#x20;the&#x20;system&#x20;much&#x20;more&#x20;security.','https://pandorafms.com/manual/en/documentation/04_using/12_console_setup?s%5B%5D%3Dgoogle%26s%5B%5D%',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'politica_de_pass.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Visual&#x20;consoles:&#x20;heat&#x20;maps','The&#x20;console&#x20;allows&#x20;a&#x20;series&#x20;of&#x20;data&#x20;to&#x20;be&#x20;integrated&#x20;into&#x20;a&#x20;personalized&#x20;background,&#x20;which,&#x20;depending&#x20;on&#x20;their&#x20;value,&#x20;is&#x20;represented&#x20;with&#x20;one&#x20;color&#x20;or&#x20;another,&#x20;in&#x20;real&#x20;time.&#x20;The&#x20;applications&#x20;are&#x20;endless,&#x20;it&#x20;just&#x20;depends&#x20;on&#x20;your&#x20;imagination.','https://pandorafms.com/manual/en/documentation/04_using/05_data_presentation_visual_maps#mapa_de_cal',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'mapa_de_calor.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Network&#x20;links&#x20;in&#x20;the&#x20;visual&#x20;console','There&#x20;is&#x20;a&#x20;visual&#x20;console&#x20;element&#x20;called&#x20;&ldquo;Network&#x20;link&rdquo;&#x20;that&#x20;allows&#x20;to&#x20;visually&#x20;show&#x20;the&#x20;union&#x20;of&#x20;two&#x20;network&#x20;interfaces,&#x20;their&#x20;status&#x20;and&#x20;the&#x20;upload/download&#x20;traffic,&#x20;in&#x20;a&#x20;very&#x20;visual&#x20;way.','https://pandorafms.com/manual/en/documentation/04_using/05_data_presentation_visual_maps#enlace_de_red',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'enlaces_consola_visual.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Google&#x20;Sheet&#x20;','Do&#x20;you&#x20;know&#x20;that&#x20;you&#x20;can&#x20;get&#x20;the&#x20;value&#x20;of&#x20;a&#x20;cell&#x20;from&#x20;a&#x20;Google&#x20;Sheet&#x20;spreadsheet?&#x20;We&#x20;use&#x20;the&#x20;API&#x20;to&#x20;request&#x20;the&#x20;data&#x20;through&#x20;a&#x20;remote&#x20;plugin.&#x20;It&#039;s&#x20;perfect&#x20;for&#x20;building&#x20;business&#x20;dashboards,&#x20;getting&#x20;real-time&#x20;alerts,&#x20;and&#x20;creating&#x20;your&#x20;own&#x20;custom&#x20;reports.','https://pandorafms.com/library/google-sheets-plugin/',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'google_sheets.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Availability&#x20;graphs','Similar&#x20;to&#x20;availability&#x20;reports,&#x20;but&#x20;much&#x20;more&#x20;visual,&#x20;they&#x20;offer&#x20;detailed&#x20;status&#x20;of&#x20;a&#x20;monitor&#x20;over&#x20;time.&#x20;They&#x20;can&#x20;be&#x20;grouped&#x20;with&#x20;another&#x20;module&#x20;to&#x20;offer&#x20;final&#x20;data&#x20;taking&#x20;into&#x20;account&#x20;the&#x20;high&#x20;availability&#x20;of&#x20;a&#x20;service.&#x20;They&#x20;are&#x20;perfect&#x20;for&#x20;use&#x20;in&#x20;reports&#x20;to&#x20;suppliers&#x20;and/or&#x20;customers.','https://pandorafms.com/manual/en/documentation/04_using/08_data_presentation_reports#grafico_de_disp',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'graficas_disponibilidad.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Full&#x20;resolution&#x20;graphics','Pandora&#x20;FMS&#x20;and&#x20;other&#x20;tools,&#x20;when&#x20;they&#x20;have&#x20;to&#x20;display&#x20;a&#x20;graph,&#x20;obtain&#x20;the&#x20;data&#x20;from&#x20;the&#x20;data&#x20;source&#x20;and&#x20;then&#x20;&ldquo;simplify&rdquo;&#x20;the&#x20;graph,&#x20;since&#x20;if&#x20;the&#x20;data&#x20;series&#x20;has&#x20;10,000&#x20;elements&#x20;and&#x20;the&#x20;graph&#x20;is&#x20;only&#x20;300&#x20;pixels&#x20;wide,&#x20;they&#x20;cannot&#x20;fit&#x20;all&#x20;of&#x20;them.&#x20;,&#x20;so&#x20;those&#x20;10,000&#x20;points&#x20;are&#x20;&ldquo;simplified&rdquo;&#x20;into&#x20;only&#x20;300.&#x20;However,&#x20;when&#x20;simplifying,&#x20;&ldquo;detail&rdquo;&#x20;is&#x20;lost&#x20;in&#x20;the&#x20;graph,&#x20;and&#x20;of&#x20;course&#x20;we&#x20;cannot&#x20;&ldquo;zoom&#x20;in&rdquo;.&#x20;Pandora&#x20;FMS&#x20;graphs&#x20;allow&#x20;you&#x20;to&#x20;display&#x20;and&#x20;use&#x20;all&#x20;the&#x20;data&#x20;in&#x20;a&#x20;graph,&#x20;which&#x20;we&#x20;call&#x20;&quot;TIP&quot;&#x20;that&#x20;shows&#x20;all&#x20;the&#x20;overlapping&#x20;points&#x20;and&#x20;also&#x20;allows&#x20;you&#x20;not&#x20;to&#x20;lose&#x20;resolution&#x20;when&#x20;zooming.','',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'dark&#x20;mode','Do&#x20;you&#x20;know&#x20;that&#x20;there&#x20;is&#x20;a&#x20;dark&#x20;mode&#x20;in&#x20;Pandora&#x20;FMS?&#x20;An&#x20;administrator&#x20;can&#x20;activate&#x20;it&#x20;at&#x20;a&#x20;global&#x20;level&#x20;from&#x20;the&#x20;visual&#x20;configuration&#x20;options&#x20;or&#x20;any&#x20;user&#x20;at&#x20;an&#x20;individual&#x20;level,&#x20;in&#x20;the&#x20;user&#x20;options.','',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Remote&#x20;monitoring&#x20;of&#x20;SNMP&#x20;devices','Network&#x20;devices&#x20;such&#x20;as&#x20;switches,&#x20;APs,&#x20;routers,&#x20;and&#x20;firewalls&#x20;can&#x20;be&#x20;remotely&#x20;monitored&#x20;using&#x20;the&#x20;SNMP&#x20;protocol.&#x20;It&#x20;is&#x20;enough&#x20;to&#x20;know&#x20;your&#x20;IP,&#x20;the&#x20;SNMP&#x20;community&#x20;and&#x20;launch&#x20;an&#x20;SNMP&#x20;wizard&#x20;from&#x20;the&#x20;console.','https://pandorafms.com/manual/en/documentation/03_monitoring/03_remote_monitoring#monitorizacion_snmp',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'monitorizar_snmp.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Monitoring&#x20;JMX&#x20;&#40;Tomcat,&#x20;Websphere,&#x20;Weblogic,&#x20;Jboss,&#x20;Apache&#x20;Kafka,&#x20;Jetty,&#x20;GlassFish&hellip;&#41;','There&#x20;is&#x20;an&#x20;Enterprise&#x20;plugin&#x20;that&#x20;is&#x20;used&#x20;to&#x20;monitor&#x20;any&#x20;JMX&#x20;technology.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;locally&#x20;&#40;as&#x20;a&#x20;local&#x20;plugin&#41;&#x20;or&#x20;remotely&#x20;with&#x20;the&#x20;plugin&#x20;server.','https://pandorafms.com/library/jmx-monitoring/',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'monitorizar_con_jmx.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Monitor&#x20;routes&#x20;from&#x20;one&#x20;IP&#x20;to&#x20;another','There&#x20;is&#x20;a&#x20;special&#x20;plugin&#x20;that&#x20;is&#x20;used&#x20;to&#x20;visually&#x20;monitor&#x20;the&#x20;routes&#x20;from&#x20;one&#x20;IP&#x20;to&#x20;another&#x20;in&#x20;a&#x20;visual&#x20;and&#x20;dynamic&#x20;way,&#x20;as&#x20;it&#x20;changes&#x20;over&#x20;time.','https://pandorafms.com/manual/en/documentation/03_monitoring/03_remote_monitoring#monitorizacion_de_rutas',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'monitorizar_desde_ip.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Scheduled&#x20;downtimes','It&#x20;is&#x20;possible&#x20;to&#x20;define,&#x20;at&#x20;the&#x20;agent&#x20;level&#x20;and&#x20;at&#x20;the&#x20;module&#x20;level,&#x20;periods&#x20;in&#x20;which&#x20;the&#x20;alerts&#x20;and/or&#x20;the&#x20;collected&#x20;data&#x20;are&#x20;ignored.&#x20;It&#x20;is&#x20;perfect&#x20;for&#x20;planning&#x20;service&#x20;stops&#x20;or&#x20;disconnection&#x20;of&#x20;monitored&#x20;systems.&#x20;It&#x20;also&#x20;affects&#x20;SLA&#x20;reporting,&#x20;preventing&#x20;those&#x20;time&#x20;intervals&#x20;from&#x20;being&#x20;taken&#x20;into&#x20;account.','https://pandorafms.com/manual/en/documentation/04_using/11_managing_and_administration#scheduled_downtimes',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'paradas_planificadas.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Customize&#x20;alert&#x20;emails','Did&#x20;you&#x20;know&#x20;that&#x20;Pandora&#x20;alert&#x20;emails&#x20;can&#x20;be&#x20;customized?&#x20;You&#x20;only&#x20;have&#x20;to&#x20;edit&#x20;the&#x20;default&#x20;HTML&#x20;code&#x20;of&#x20;the&#x20;email&#x20;type&#x20;alert&#x20;actions.','https://pandorafms.com/manual/en/documentation/04_using/01_alerts#editing_an_action',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'personalizar_los_emails.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'password&#x20;policy','The&#x20;Pandora&#x20;FMS&#x20;console&#x20;has&#x20;a&#x20;credential&#x20;policy&#x20;management&#x20;system,&#x20;to&#x20;reinforce&#x20;local&#x20;security&#x20;&#40;in&#x20;addition&#x20;to&#x20;allowing&#x20;external&#x20;authentication&#x20;against&#x20;LDAP,&#x20;Active&#x20;Directory&#x20;or&#x20;SAML&#41;.&#x20;Through&#x20;this&#x20;system&#x20;we&#x20;can&#x20;force&#x20;password&#x20;changes&#x20;every&#x20;X&#x20;days,&#x20;save&#x20;a&#x20;history&#x20;of&#x20;passwords&#x20;used&#x20;or&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;certain&#x20;passwords,&#x20;among&#x20;other&#x20;actions.','https://pandorafms.com/manual/en/documentation/04_using/12_console_setup?s%5B%5D%3Dcontrase%25C3%25B',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Automatic&#x20;agent&#x20;provision&#x20;system','The&#x20;agent&#x20;self-provisioning&#x20;system&#x20;allows&#x20;an&#x20;agent&#x20;recently&#x20;entered&#x20;into&#x20;the&#x20;system&#x20;to&#x20;automatically&#x20;apply&#x20;changes&#x20;to&#x20;their&#x20;configuration&#x20;&#40;such&#x20;as&#x20;moving&#x20;them&#x20;from&#x20;group,&#x20;assigning&#x20;them&#x20;certain&#x20;values&#x20;in&#x20;custom&#x20;fields&#41;&#x20;and&#x20;of&#x20;course&#x20;applying&#x20;certain&#x20;monitoring&#x20;policies.&#x20;It&#x20;is&#x20;one&#x20;of&#x20;the&#x20;most&#x20;powerful&#x20;functionalities,&#x20;aimed&#x20;at&#x20;managing&#x20;very&#x20;large&#x20;system&#x20;parks.','https://pandorafms.com/manual/start?id=en/documentation/02_installation/05_configuration_agents#conf',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Automatic&#x20;agent&#x20;provision&#x20;system','The&#x20;agent&#x20;self-provisioning&#x20;system&#x20;allows&#x20;an&#x20;agent&#x20;recently&#x20;entered&#x20;into&#x20;the&#x20;system&#x20;to&#x20;automatically&#x20;apply&#x20;changes&#x20;to&#x20;their&#x20;configuration&#x20;&#40;such&#x20;as&#x20;moving&#x20;them&#x20;from&#x20;group,&#x20;assigning&#x20;them&#x20;certain&#x20;values&#x20;in&#x20;custom&#x20;fields&#41;&#x20;and&#x20;of&#x20;course&#x20;applying&#x20;certain&#x20;monitoring&#x20;policies.&#x20;It&#x20;is&#x20;one&#x20;of&#x20;the&#x20;most&#x20;powerful&#x20;functionalities,&#x20;aimed&#x20;at&#x20;managing&#x20;very&#x20;large&#x20;system&#x20;parks.','https://pandorafms.com/manual/start?id=en/documentation/02_installation/05_configuration_agents#conf',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Automatic&#x20;agent&#x20;provision&#x20;system','The&#x20;agent&#x20;self-provisioning&#x20;system&#x20;allows&#x20;an&#x20;agent&#x20;recently&#x20;entered&#x20;into&#x20;the&#x20;system&#x20;to&#x20;automatically&#x20;apply&#x20;changes&#x20;to&#x20;their&#x20;configuration&#x20;&#40;such&#x20;as&#x20;moving&#x20;them&#x20;from&#x20;group,&#x20;assigning&#x20;them&#x20;certain&#x20;values&#x20;in&#x20;custom&#x20;fields&#41;&#x20;and&#x20;of&#x20;course&#x20;applying&#x20;certain&#x20;monitoring&#x20;policies.&#x20;It&#x20;is&#x20;one&#x20;of&#x20;the&#x20;most&#x20;powerful&#x20;functionalities,&#x20;aimed&#x20;at&#x20;managing&#x20;very&#x20;large&#x20;system&#x20;parks.','https://pandorafms.com/manual/start?id=en/documentation/02_installation/05_configuration_agents#conf',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'ARP&#x20;tables','Do&#x20;you&#x20;know&#x20;that&#x20;there&#x20;is&#x20;an&#x20;inventory&#x20;module&#x20;to&#x20;get&#x20;the&#x20;ARP&#x20;tables&#x20;from&#x20;your&#x20;windows&#x20;servers?&#x20;It&#x20;is&#x20;easy&#x20;to&#x20;install&#x20;and&#x20;can&#x20;give&#x20;you&#x20;very&#x20;detailed&#x20;information&#x20;about&#x20;your&#x20;equipment.','https://pandorafms.com/library/arp-table-windows-local/',1);
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Using&#x20;custom&#x20;icons&#x20;in&#x20;visual&#x20;consoles','Thanks&#x20;to&#x20;the&#x20;custom&#x20;icons,&#x20;you&#x20;can&#x20;create&#x20;highly&#x20;customized&#x20;views,&#x20;such&#x20;as&#x20;the&#x20;one&#x20;in&#x20;the&#x20;image,&#x20;which&#x20;represents&#x20;racks&#x20;with&#x20;the&#x20;types&#x20;of&#x20;servers&#x20;in&#x20;the&#x20;order&#x20;they&#x20;are&#x20;placed&#x20;within&#x20;the&#x20;rack.&#x20;Perfect&#x20;for&#x20;a&#x20;technician&#x20;to&#x20;know&#x20;exactly&#x20;what&#x20;machine&#x20;is&#x20;failing.&#x20;It&#x20;couldn&#039;t&#x20;be&#x20;more&#x20;visual,&#x20;hence&#x20;the&#x20;name.','https://pandorafms.com/manual/start?id=en/documentation/04_using/05_data_presentation_visual_maps',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'iconos_personalizados.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Use&#x20;Telegram&#x20;with&#x20;Pandora&#x20;FMS','Perfect&#x20;to&#x20;receive&#x20;alerts&#x20;with&#x20;embedded&#x20;graphics&#x20;and&#x20;thus&#x20;customize&#x20;the&#x20;reception&#x20;of&#x20;notices&#x20;individually&#x20;or&#x20;in&#x20;a&#x20;common&#x20;channel&#x20;with&#x20;more&#x20;people.','https://pandorafms.com/library/telegram-bot-cli/',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'telegram_con_pandora.png','images/tips/');
INSERT INTO `twelcome_tip` (`id_lang`,`id_profile`,`title`,`text`,`url`,`enable`) VALUES ('en_GB',0,'Zoom&#x20;on&#x20;data&#x20;graphs','Do&#x20;you&#x20;know&#x20;that&#x20;Pandora&#x20;FMS&#x20;allows&#x20;you&#x20;to&#x20;zoom&#x20;in&#x20;on&#x20;a&#x20;part&#x20;of&#x20;the&#x20;graph.&#x20;With&#x20;that&#x20;you&#x20;will&#x20;expand&#x20;the&#x20;information&#x20;of&#x20;the&#x20;graph.&#x20;If&#x20;you&#x20;are&#x20;looking&#x20;at&#x20;a&#x20;graph&#x20;for&#x20;a&#x20;month&#x20;and&#x20;you&#x20;zoom&#x20;in,&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;see&#x20;the&#x20;data&#x20;for&#x20;that&#x20;interval.&#x20;If&#x20;you&#x20;use&#x20;a&#x20;graph&#x20;with&#x20;full&#x20;resolution&#x20;data&#x20;&#40;we&#x20;call&#x20;them&#x20;TIP&#x20;graphs&#41;&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;see&#x20;the&#x20;detail&#x20;of&#x20;each&#x20;piece&#x20;of&#x20;data,&#x20;even&#x20;if&#x20;your&#x20;graph&#x20;has&#x20;thousands&#x20;of&#x20;samples.','',1);
SELECT @last_id := LAST_INSERT_ID();
INSERT INTO `twelcome_tip_file` (`twelcome_tip_file`,`filename`,`path`) VALUES (@last_id,'zoom_en_graficas.png','images/tips/');

-- Insert new VMware APP
SET @short_name = 'pandorafms.vmware';
SET @name = 'VMware';
SET @section = 'app';
SET @description = 'Monitor&#x20;ESXi&#x20;hosts,&#x20;datastores&#x20;and&#x20;VMs&#x20;from&#x20;a&#x20;specific&#x20;datacenter';
SET @version = '1.1';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_vmware');
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec2_', 'bin/vmware_instances');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;&#039;_tempfileVMware_&#039;&#x20;--as_discovery_plugin&#x20;1');

-- Insert new MySQL APP
SET @short_name = 'pandorafms.mysql';
SET @name = 'MySQL';
SET @section = 'app';
SET @description = 'Monitor&#x20;MySQL&#x20;databases';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_mysql');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileConf_&#039;&#x20;--target_databases&#x20;&#039;_tempfileTargetDatabases_&#039;&#x20;--target_agents&#x20;&#039;_tempfileTargetAgents_&#039;&#x20;--custom_queries&#x20;&#039;_tempfileCustomQueries_&#039;');

-- Insert new MSSQL APP
SET @short_name = 'pandorafms.mssql';
SET @name = 'Microsoft&#x20;SQL&#x20;Server';
SET @section = 'app';
SET @description = 'Monitor&#x20;Microsoft&#x20;SQL&#x20;Server&#x20;databases';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_mssql');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileConf_&#039;&#x20;--target_databases&#x20;&#039;_tempfileTargetDatabases_&#039;&#x20;--target_agents&#x20;&#039;_tempfileTargetAgents_&#039;&#x20;--custom_queries&#x20;&#039;_tempfileCustomQueries_&#039;');

-- Insert new Oracle APP
SET @short_name = 'pandorafms.oracle';
SET @name = 'Oracle';
SET @section = 'app';
SET @description = 'Monitor&#x20;Oracle&#x20;databases';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_oracle');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileConf_&#039;&#x20;--target_databases&#x20;&#039;_tempfileTargetDatabases_&#039;&#x20;--target_agents&#x20;&#039;_tempfileTargetAgents_&#039;&#x20;--custom_queries&#x20;&#039;_tempfileCustomQueries_&#039;');

-- Insert new DB2 APP
SET @short_name = 'pandorafms.db2';
SET @name = 'DB2';
SET @section = 'app';
SET @description = 'Monitor&#x20;DB2&#x20;databases';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_db2');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileConf_&#039;&#x20;--target_databases&#x20;&#039;_tempfileTargetDatabases_&#039;&#x20;--target_agents&#x20;&#039;_tempfileTargetAgents_&#039;&#x20;--custom_queries&#x20;&#039;_tempfileCustomQueries_&#039;');

-- Insert new Proxmox APP
SET @short_name = 'pandorafms.proxmox';
SET @name = 'Proxmox';
SET @section = 'app';
SET @description = 'Monitor&#x20;Proxmox&#x20;VMs,&#x20;LXC,&#x20;backups&#x20;and&#x20;nodes&#x20;from&#x20;a&#x20;specific&#x20;host';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_proxmox');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;-g&#x20;&#039;__taskGroup__&#039;&#x20;--host&#x20;&#039;_host_&#039;&#x20;--port&#x20;&#039;_port_&#039;&#x20;--user&#x20;&#039;_user_&#039;&#x20;--password&#x20;&#039;_password_&#039;&#x20;--vm&#x20;&#039;_scanVM_&#039;&#x20;--lxc&#x20;&#039;_scanLXC_&#039;&#x20;--backups&#x20;&#039;_scanBackups_&#039;&#x20;--nodes&#x20;&#039;_scanNodes_&#039;&#x20;--transfer_mode&#x20;tentacle&#x20;--tentacle_address&#x20;&#039;_tentacleIP_&#039;&#x20;--tentacle_port&#x20;&#039;_tentaclePort_&#039;&#x20;--as_discovery_plugin&#x20;1');

-- Insert new EC2 APP
SET @short_name = 'pandorafms.aws.ec2';
SET @name = 'Amazon&#x20;EC2';
SET @section = 'cloud';
SET @description = 'Monitor&#x20;AWS&#x20;EC2&#x20;instances';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_aws_ec2');
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec2_', 'bin/aws_ec2');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileEC2_&#039;');

-- Insert new RDS APP
SET @short_name = 'pandorafms.aws.rds';
SET @name = 'Amazon&#x20;RDS';
SET @section = 'cloud';
SET @description = 'Monitor&#x20;AWS&#x20;RDS&#x20;instances';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_aws_rds');
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec2_', 'bin/aws_rds');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileRDS_&#039;');

-- Insert new S3 APP
SET @short_name = 'pandorafms.aws.s3';
SET @name = 'Amazon&#x20;S3';
SET @section = 'cloud';
SET @description = 'Monitor&#x20;AWS&#x20;S3&#x20;buckets';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_aws_s3');
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec2_', 'bin/aws_s3');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileS3_&#039;');

-- Insert new Azure APP
SET @short_name = 'pandorafms.azure.mc';
SET @name = 'Azure&#x20;Microsoft&#x20;Compute';
SET @section = 'cloud';
SET @description = 'Monitor&#x20;Azure&#x20;Microsoft&#x20;Compute&#x20;VMs';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_azure_mc');
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec2_', 'bin/azure_vm');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileAzureMC_&#039;');

-- Insert new Google APP
SET @short_name = 'pandorafms.gcp.ce';
SET @name = 'Google&#x20;Cloud&#x20;Compute&#x20;Engine';
SET @section = 'cloud';
SET @description = 'Monitor&#x20;Google&#x20;Cloud&#x20;Platform&#x20;Compute&#x20;Engine&#x20;VMs';
SET @version = '1.0';
INSERT IGNORE INTO `tdiscovery_apps` (`id_app`, `short_name`, `name`, `section`, `description`, `version`) VALUES ('', @short_name, @name, @section, @description, @version);
SELECT @id_app := `id_app` FROM `tdiscovery_apps` WHERE `short_name` = @short_name;

-- Insert into tdiscovery_apps_scripts
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec1_', 'bin/pandora_gcp_ce');
INSERT IGNORE INTO `tdiscovery_apps_scripts` (`id_app`, `macro`, `value`) VALUES (@id_app, '_exec2_', 'bin/google_instances');

-- Insert into tdiscovery_apps_executions
INSERT IGNORE INTO `tdiscovery_apps_executions` (`id`, `id_app`, `execution`) VALUES (1, @id_app, '&#039;_exec1_&#039;&#x20;--conf&#x20;&#039;_tempfileGoogleCE_&#039;');

INSERT INTO `tsca` VALUES (1000,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate&#x20;or&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;systemctl&#x20;umask&#x20;tmp.mount;&#x20;systemctl&#x20;enable&#x20;tmp.mount.&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount.','[{\"cis\": [\"2.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1001,'Set&#x20;nodev&#x20;option&#x20;for&#x20;/tmp&#x20;Partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"2.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1002,'Set&#x20;nosuid&#x20;option&#x20;for&#x20;/tmp&#x20;Partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"2.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1003,'Set&#x20;noexec&#x20;option&#x20;for&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"2.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1004,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1005,'Bind&#x20;mount&#x20;the&#x20;/var/tmp&#x20;directory&#x20;to&#x20;/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;normally&#x20;a&#x20;standalone&#x20;directory&#x20;in&#x20;the&#x20;/var&#x20;file&#x20;system.&#x20;Binding&#x20;/var/tmp&#x20;to&#x20;/tmp&#x20;establishes&#x20;an&#x20;unbreakable&#x20;link&#x20;to&#x20;/tmp&#x20;that&#x20;cannot&#x20;be&#x20;removed&#x20;&#40;even&#x20;by&#x20;the&#x20;root&#x20;user&#41;.&#x20;It&#x20;also&#x20;allows&#x20;/var/tmp&#x20;to&#x20;inherit&#x20;the&#x20;same&#x20;mount&#x20;options&#x20;that&#x20;/tmp&#x20;owns,&#x20;allowing&#x20;/var/tmp&#x20;to&#x20;be&#x20;protected&#x20;in&#x20;the&#x20;same&#x20;manner&#x20;/tmp&#x20;is&#x20;protected.&#x20;It&#x20;will&#x20;also&#x20;prevent&#x20;/var&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;temporary&#x20;files&#x20;as&#x20;the&#x20;contents&#x20;of&#x20;/var/tmp&#x20;will&#x20;actually&#x20;reside&#x20;in&#x20;the&#x20;file&#x20;system&#x20;containing&#x20;/tmp.','All&#x20;programs&#x20;that&#x20;use&#x20;/var/tmp&#x20;and&#x20;/tmp&#x20;to&#x20;read/write&#x20;temporary&#x20;files&#x20;will&#x20;always&#x20;be&#x20;write&#x20;to&#x20;tmp&#x20;file&#x20;system,&#x20;preventing&#x20;a&#x20;user&#x20;from&#x20;running&#x20;the&#x20;/var&#x20;file&#x20;system&#x20;out&#x20;of&#x20;space&#x20;or&#x20;trying&#x20;to&#x20;perform&#x20;operations&#x20;that&#x20;have&#x20;been&#x20;blocked&#x20;in&#x20;the&#x20;/tmp&#x20;filesystem.','','#&#x20;mount&#x20;--bind&#x20;/tmp&#x20;/var/tmp&#x20;&#x20;and&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;to&#x20;contain&#x20;the&#x20;following&#x20;line:&#x20;/tmp&#x20;/var/tmp&#x20;none&#x20;bind&#x20;0&#x20;0','[{\"cis\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1006,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"2.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1007,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"2.8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1008,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"2.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1009,'Add&#x20;nodev&#x20;Option&#x20;to&#x20;/home','When&#x20;set&#x20;on&#x20;a&#x20;file&#x20;system,&#x20;this&#x20;option&#x20;prevents&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices&#x20;from&#x20;being&#x20;defined,&#x20;or&#x20;if&#x20;they&#x20;exist,&#x20;from&#x20;being&#x20;used&#x20;as&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"2.10\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1010,'Add&#x20;nodev&#x20;Option&#x20;to&#x20;/run/shm&#x20;Partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;/run/shm&#x20;&#40;temporary&#x20;filesystem&#x20;stored&#x20;in&#x20;memory&#41;&#x20;cannot&#x20;contain&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','Since&#x20;the&#x20;/run/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/run/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#x20;of&#x20;entries&#x20;that&#x20;have&#x20;mount&#x20;points&#x20;that&#x20;contain&#x20;/run/shm.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/run/shm','[{\"cis\": [\"2.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1011,'Add&#x20;nosuid&#x20;Option&#x20;to&#x20;/run/shm&#x20;Partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;/run/shm&#x20;&#40;temporary&#x20;filesystem&#x20;stored&#x20;in&#x20;memory&#41;&#x20;will&#x20;not&#x20;execute&#x20;setuid&#x20;and&#x20;setgid&#x20;on&#x20;executable&#x20;programs&#x20;as&#x20;such,&#x20;but&#x20;rather&#x20;execute&#x20;them&#x20;with&#x20;the&#x20;uid&#x20;and&#x20;gid&#x20;of&#x20;the&#x20;user&#x20;executing&#x20;the&#x20;program.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;Look&#x20;for&#x20;entries&#x20;that&#x20;have&#x20;mount&#x20;points&#x20;that&#x20;contain&#x20;/run/shm.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/run/shm','[{\"cis\": [\"2.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1012,'Add&#x20;noexec&#x20;Option&#x20;to&#x20;/run/shm&#x20;Partition','Set&#x20;noexec&#x20;on&#x20;the&#x20;shared&#x20;memory&#x20;partition&#x20;to&#x20;prevent&#x20;programs&#x20;from&#x20;executing&#x20;from&#x20;there.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;Look&#x20;for&#x20;entries&#x20;that&#x20;have&#x20;mount&#x20;points&#x20;that&#x20;contain&#x20;/run/shm.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/run/shm','[{\"cis\": [\"2.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1013,'Disable&#x20;Mounting&#x20;of&#x20;cramfs&#x20;Filesystems','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true','[{\"cis\": [\"2.18\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1014,'Disable&#x20;Mounting&#x20;of&#x20;freevxfs&#x20;Filesystems','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true','[{\"cis\": [\"2.19\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1015,'Disable&#x20;Mounting&#x20;of&#x20;jffs2&#x20;Filesystems','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true','[{\"cis\": [\"2.20\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1016,'Disable&#x20;Mounting&#x20;of&#x20;hfs&#x20;Filesystems','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true','[{\"cis\": [\"2.21\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1017,'Disable&#x20;Mounting&#x20;of&#x20;hfsplus&#x20;Filesystems','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true','[{\"cis\": [\"2.22\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1018,'Disable&#x20;Mounting&#x20;of&#x20;squashfs&#x20;Filesystems','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true','[{\"cis\": [\"2.23\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1019,'Disable&#x20;Mounting&#x20;of&#x20;udf&#x20;Filesystems','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true','[{\"cis\": [\"2.24\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(1020,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Disable&#x20;autofs:&#x20;#&#x20;update-rc.d&#x20;autofs&#x20;disable','[{\"cis\": [\"2.25\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1021,'Set&#x20;User/Group&#x20;Owner&#x20;on&#x20;bootloader&#x20;config','Set&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;your&#x20;boot&#x20;loaders&#x20;config&#x20;file&#x20;to&#x20;the&#x20;root&#x20;user.&#x20;These&#x20;instructions&#x20;default&#x20;to&#x20;GRUB&#x20;stored&#x20;at&#x20;/boot/grub/grub.cfg&#x20;.','Setting&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;to&#x20;root&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;changing&#x20;the&#x20;file.','','Run&#x20;the&#x20;following&#x20;to&#x20;change&#x20;ownership&#x20;of&#x20;/boot/grub/grub.cfg&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"3.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1022,'Set&#x20;Permissions&#x20;on&#x20;bootloader&#x20;config','Set&#x20;permission&#x20;on&#x20;the&#x20;your&#x20;boot&#x20;loaders&#x20;config&#x20;file&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;to&#x20;set&#x20;the&#x20;permissions&#x20;fro&#x20;/boot/grub/grub.cfg&#x20;:&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"3.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1023,'Set&#x20;Boot&#x20;Loader&#x20;Password','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-md5-crypt:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;Your&#x20;PBKDF2&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/00_header&#x20;or&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;set&#x20;superusers=&quot;&lt;user-list&gt;&quot;&#x20;password_pbkdf2&#x20;&lt;user&gt;&#x20;&lt;encrypted-password&gt;&#x20;EOF&#x20;Unless&#x20;the&#x20;--unrestricted&#x20;option&#x20;is&#x20;added&#x20;to&#x20;CLASS&#x20;in&#x20;/etc/grub.d/10_linux&#x20;a&#x20;password&#x20;will&#x20;be&#x20;required&#x20;to&#x20;boot&#x20;in&#x20;addition&#x20;to&#x20;editing&#x20;boot&#x20;parameters:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;grub&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"3.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1024,'Require&#x20;authentication&#x20;for&#x20;Single-User&#x20;mode','Setting&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user&#x20;will&#x20;force&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"3.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1025,'Restrict&#x20;Core&#x20;Dumps','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/security/limits.conf&#x20;file.&#x20;&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file.&#x20;&#x20;fs.suid_dumpable&#x20;=&#x20;0','[{\"cis\": [\"4.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1026,'Enable&#x20;XD/NX&#x20;Support&#x20;on&#x20;32-bit&#x20;x86&#x20;Systems','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"4.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1027,'Enable&#x20;Randomized&#x20;Virtual&#x20;Memory&#x20;Region&#x20;Placement','Set&#x20;the&#x20;system&#x20;flag&#x20;to&#x20;force&#x20;randomized&#x20;virtual&#x20;memory&#x20;region&#x20;placement.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file.&#x20;&#x20;kernel.randomize_va_space&#x20;=&#x20;2','[{\"cis\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1028,'Disable&#x20;Prelink','The&#x20;prelinking&#x20;feature&#x20;changes&#x20;binaries&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;decrease&#x20;their&#x20;startup&#x20;time.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;command:&#x20;#&#x20;/usr/sbin/prelink&#x20;-ua&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;a&#x20;normal,&#x20;non-prelinked&#x20;state,&#x20;then&#x20;remove&#x20;prelink:&#x20;#&#x20;apt-get&#x20;purge&#x20;prelink','[{\"cis\": [\"4.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1029,'Activate&#x20;AppArmor','AppArmor&#x20;provides&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;system&#x20;that&#x20;greatly&#x20;augments&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;&#40;DAC&#41;&#x20;model.','For&#x20;an&#x20;action&#x20;to&#x20;occur,&#x20;both&#x20;the&#x20;traditional&#x20;DAC&#x20;permissions&#x20;must&#x20;be&#x20;satisfied&#x20;as&#x20;well&#x20;as&#x20;the&#x20;AppArmor&#x20;MAC&#x20;rules.&#x20;The&#x20;action&#x20;will&#x20;not&#x20;be&#x20;allowed&#x20;if&#x20;either&#x20;one&#x20;of&#x20;these&#x20;models&#x20;does&#x20;not&#x20;permit&#x20;the&#x20;action.&#x20;In&#x20;this&#x20;way,&#x20;AppArmor&#x20;rules&#x20;can&#x20;only&#x20;make&#x20;a&#x20;system&#039;s&#x20;permissions&#x20;more&#x20;restrictive&#x20;and&#x20;secure.','','Install&#x20;apparmor&#x20;and&#x20;apparmor-utils&#x20;if&#x20;missing&#x20;&#40;additional&#x20;profiles&#x20;can&#x20;be&#x20;found&#x20;in&#x20;the&#x20;apparmor-profiles&#x20;package&#41;:&#x20;#&#x20;apt-get&#x20;install&#x20;apparmor&#x20;apparmor-profiles&#x20;apparmor-utils&#x20;Add&#x20;apparmor=1&#x20;and&#x20;security=apparmor&#x20;to&#x20;GRUB_CMDLINE_LINUX&#x20;in&#x20;/etc/default/grub:&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;Update&#x20;grub&#x20;configuration&#x20;&#40;reboot&#x20;will&#x20;be&#x20;required&#x20;to&#x20;apply&#x20;changes&#41;:&#x20;#&#x20;update-grub&#x20;Set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"4.5\"]}]'),(1030,'Ensure&#x20;NIS&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;the&#x20;nis&#x20;package:&#x20;#&#x20;apt-get&#x20;purge&#x20;nis','[{\"cis\": [\"5.1.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1031,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;rsh,&#x20;rlogin,&#x20;rcp&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;service&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;shell,&#x20;login,&#x20;or&#x20;exec&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#shell&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;/usr/sbin/tcpd&#x20;/usr/sbin/in.rshd&#x20;&#x20;&#x20;&#x20;#login&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;/usr/sbin/tcpd&#x20;/usr/sbin/in.rlogind&#x20;&#x20;&#x20;&#x20;#exec&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;/usr/sbin/tcpd&#x20;/usr/sbin/in.rexecd','[{\"cis\": [\"5.1.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1032,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Uninstall&#x20;the&#x20;rsh-client&#x20;and&#x20;rsh-reload-client&#x20;packages:&#x20;#&#x20;apt-get&#x20;purge&#x20;rsh-client&#x20;rsh-reload-client','[{\"cis\": [\"5.1.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1033,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;talk&#x20;or&#x20;ntalk&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#talk&#x20;dgram&#x20;udp&#x20;wait&#x20;nobody.tty&#x20;/usr/sbin/in.talkd&#x20;in.talkd&#x20;&#x20;&#x20;&#x20;#ntalk&#x20;dgram&#x20;udp&#x20;wait&#x20;nobody.tty&#x20;/usr/sbin/in.ntalkd&#x20;in.ntalkd','[{\"cis\": [\"5.1.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1034,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Uninstall&#x20;the&#x20;talk&#x20;package:&#x20;#&#x20;apt-get&#x20;purge&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1035,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;telnet&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#telnet&#x20;stream&#x20;tcp&#x20;nowait&#x20;telnetd&#x20;/usr/sbin/tcpd&#x20;/usr/sbin/in.telnetd','[{\"cis\": [\"5.1.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1036,'Ensure&#x20;tftp-server&#x20;is&#x20;not&#x20;enabled','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;packages&#x20;tftp&#x20;and&#x20;atftp&#x20;are&#x20;both&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;tftp&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#tftp&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;internal','[{\"cis\": [\"5.1.7\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1037,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.&#x20;&#x20;Note:&#x20;Several&#x20;other&#x20;services&#x20;recommended&#x20;to&#x20;be&#x20;disabled&#x20;in&#x20;this&#x20;benchmark&#x20;have&#x20;xinetd&#x20;versions&#x20;as&#x20;well,&#x20;if&#x20;xinetd&#x20;is&#x20;required&#x20;in&#x20;your&#x20;environment&#x20;ensure&#x20;they&#x20;are&#x20;disabled&#x20;in&#x20;xinetd&#x20;configuration&#x20;as&#x20;well.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Disable&#x20;xinetd:&#x20;#&#x20;update-rc.d&#x20;xinetd&#x20;disable','[{\"cis\": [\"5.1.8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1038,'Ensure&#x20;chargen&#x20;is&#x20;not&#x20;enabled','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;chargen&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#chargen&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;internal','[{\"cis\": [\"5.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1039,'Ensure&#x20;daytime&#x20;is&#x20;not&#x20;enabled','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;daytime&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#daytime&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;internal','[{\"cis\": [\"5.3\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1040,'Ensure&#x20;echo&#x20;is&#x20;not&#x20;enabled','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;echo&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#echo&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;internal','[{\"cis\": [\"5.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1041,'Ensure&#x20;discard&#x20;is&#x20;not&#x20;enabled','discard&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;discard&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#discard&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;internal','[{\"cis\": [\"5.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1042,'Ensure&#x20;time&#x20;is&#x20;not&#x20;enabled','time&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;time&#x20;lines&#x20;in&#x20;/etc/inetd.conf:&#x20;#time&#x20;stream&#x20;tcp&#x20;nowait&#x20;root&#x20;internal','[{\"cis\": [\"5.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1043,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;system&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;desktops&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Uninstall&#x20;X&#x20;Windows:&#x20;#&#x20;apt-get&#x20;purge&#x20;xserver-xorg-core*','[{\"cis\": [\"6.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1044,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Since&#x20;servers&#x20;are&#x20;not&#x20;normally&#x20;used&#x20;for&#x20;printing,&#x20;this&#x20;service&#x20;is&#x20;not&#x20;needed&#x20;unless&#x20;dependencies&#x20;require&#x20;it.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case,&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;avahi-daemon:&#x20;#&#x20;update-rc.d&#x20;avahi-daemon&#x20;disable','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1045,'Ensure&#x20;print&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;cups:&#x20;#&#x20;update-rc.d&#x20;cups&#x20;disable','[{\"cis\": [\"6.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1046,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;server&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;isc-dhcp-server:&#x20;#&#x20;update-rc.d&#x20;isc-dhcp-server&#x20;disable','[{\"cis\": [\"6.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1047,'Configure&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;','The&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;NTP&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','It&#x20;is&#x20;recommended&#x20;that&#x20;physical&#x20;systems&#x20;and&#x20;virtual&#x20;guests&#x20;lacking&#x20;direct&#x20;access&#x20;to&#x20;the&#x20;physical&#x20;host&#039;s&#x20;clock&#x20;be&#x20;configured&#x20;as&#x20;NTP&#x20;clients&#x20;to&#x20;synchronize&#x20;their&#x20;clocks&#x20;&#40;especially&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#41;.&#x20;This&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','Install&#x20;ntp:&#x20;#&#x20;apt-get&#x20;install&#x20;ntp&#x20;&#x20;&#x20;&#x20;Ensure&#x20;the&#x20;following&#x20;lines&#x20;are&#x20;in&#x20;/etc/ntp.conf:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;&#x20;&#x20;&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;&#x20;&#x20;Also,&#x20;make&#x20;sure&#x20;/etc/ntp.conf&#x20;has&#x20;at&#x20;least&#x20;one&#x20;NTP&#x20;server&#x20;specified:&#x20;server&#x20;&lt;ntp-server&gt;&#x20;&#x20;&#x20;&#x20;Note:&#x20;&lt;ntp-server&gt;&#x20;is&#x20;the&#x20;IP&#x20;address&#x20;or&#x20;hostname&#x20;of&#x20;a&#x20;trusted&#x20;time&#x20;server.&#x20;Configuring&#x20;an&#x20;NTP&#x20;server&#x20;is&#x20;outside&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;benchmark.','[{\"cis\": [\"6.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1048,'Ensure&#x20;LDAP&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;server&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client&#x20;or&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Uninstall&#x20;the&#x20;slapd&#x20;package:&#x20;#&#x20;apt-get&#x20;purge&#x20;slapd','[{\"cis\": [\"6.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1049,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;server&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Disable&#x20;rpcbind:&#x20;#&#x20;update-rc.d&#x20;rpcbind&#x20;disable&#x20;&#x20;&#x20;&#x20;Disable&#x20;nfs-kernel-server:&#x20;#&#x20;update-rc.d&#x20;nfs-kernel-server&#x20;disable','[{\"cis\": [\"6.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1050,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;server&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;bind9:&#x20;#&#x20;update-rc.d&#x20;bind9&#x20;disable','[{\"cis\": [\"6.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1051,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;vsftpd:&#x20;#&#x20;update-rc.d&#x20;vsftpd&#x20;disable','[{\"cis\": [\"6.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1052,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;apache2:&#x20;#&#x20;update-rc.d&#x20;apache2&#x20;disable','[{\"cis\": [\"6.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1053,'Ensure&#x20;IMAP&#x20;and&#x20;POP&#x20;server&#x20;is&#x20;not&#x20;enabled','Dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;to&#x20;this&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;dovecot:&#x20;#&#x20;update-rc.d&#x20;dovecot&#x20;disable','[{\"cis\": [\"6.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1054,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;samba:&#x20;#&#x20;update-rc.d&#x20;samba&#x20;disable','[{\"cis\": [\"6.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1055,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Disable&#x20;squid3:&#x20;#&#x20;update-rc.d&#x20;squid3&#x20;disable','[{\"cis\": [\"6.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1056,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;communicates&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.','','Disable&#x20;snmpd:&#x20;#&#x20;update-rc.d&#x20;snmpd&#x20;disable','[{\"cis\": [\"6.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1057,'Configure&#x20;Mail&#x20;Transfer&#x20;Agent&#x20;for&#x20;Local-Only&#x20;Mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.&#x20;Note:&#x20;The&#x20;remediation&#x20;given&#x20;here&#x20;provides&#x20;instructions&#x20;for&#x20;configuring&#x20;the&#x20;postfix&#x20;mail&#x20;server,&#x20;depending&#x20;on&#x20;your&#x20;environment&#x20;you&#x20;may&#x20;have&#x20;an&#x20;alternative&#x20;MTA&#x20;installed&#x20;such&#x20;as&#x20;sendmail.&#x20;&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case&#x20;consult&#x20;the&#x20;documentation&#x20;for&#x20;your&#x20;installed&#x20;MTA&#x20;to&#x20;configure&#x20;the&#x20;recommended&#x20;state.','','Edit&#x20;/etc/exim4/update-exim4.conf.conf&#x20;and&#x20;edit&#x20;the&#x20;dc_local_interfaces&#x20;line&#x20;to&#x20;remove&#x20;non&#x20;loopback&#x20;addresses:&#x20;dc_local_interfaces=&#039;127.0.0.1&#x20;;&#x20;::1&#039;&#x20;&#x20;&#x20;&#x20;Run&#x20;update-exim4.conf:&#x20;#&#x20;update-exim4.conf&#x20;&#x20;&#x20;&#x20;Reload&#x20;exim4&#x20;configuration:&#x20;#&#x20;service&#x20;exim4&#x20;reload','[{\"cis\": [\"6.15\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1058,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Set&#x20;RSYNC_ENABLE&#x20;to&#x20;false&#x20;in&#x20;/etc/default/rsync:&#x20;RSYNC_ENABLE=false','[{\"cis\": [\"6.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1059,'Disable&#x20;IP&#x20;Forwarding','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;server&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.&#x20;If&#x20;the&#x20;server&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used&#x20;as&#x20;a&#x20;router,&#x20;set&#x20;the&#x20;flag&#x20;to&#x20;0.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;server&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;net.ipv4.ip_forward&#x20;parameter&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.ip_forward=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1060,'Disable&#x20;Send&#x20;Packet&#x20;Redirects','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;net.ipv4.conf.all.send_redirects&#x20;and&#x20;net.ipv4.conf.default.send_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1061,'Disable&#x20;Source&#x20;Routed&#x20;Packet&#x20;Acceptance','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;server&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;server&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;servers.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1062,'Disable&#x20;ICMP&#x20;Redirect&#x20;Acceptance','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;net.ipv4.conf.all.accept_redirects&#x20;and&#x20;net.ipv4.conf.default.accept_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1063,'Disable&#x20;Secure&#x20;ICMP&#x20;Redirect&#x20;Acceptance','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;net.ipv4.conf.all.secure_redirects&#x20;and&#x20;net.ipv4.conf.default.secure_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1064,'Log&#x20;Suspicious&#x20;Packets','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;net.ipv4.conf.all.log_martians&#x20;and&#x20;net.ipv4.conf.default.log_martians&#x20;parameters&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.log_martians=1&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.log_martians=1&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1065,'Enable&#x20;Ignore&#x20;Broadcast&#x20;Requests','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1066,'Enable&#x20;Bad&#x20;Error&#x20;Message&#x20;Protection','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1067,'Enable&#x20;RFC-recommended&#x20;Source&#x20;Route&#x20;Validation','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;server,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;parameters&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.rp_filter=1&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.rp_filter=1&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1068,'Enable&#x20;TCP&#x20;SYN&#x20;Cookies','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;server&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;server&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;server&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;net.ipv4.tcp_syncookies&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.tcp_syncookies=1&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"7.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1069,'Disable&#x20;IPv6&#x20;Router&#x20;Advertisements','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;net.ipv6.conf.all.accept_ra&#x20;and&#x20;net.ipv6.conf.default.accept_ra&#x20;parameter&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv6.conf.all.accept_ra=0&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.accept_ra=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"7.3.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1070,'Disable&#x20;IPv6&#x20;Redirect&#x20;Acceptance','This&#x20;setting&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;ICMP&#x20;redirects.&#x20;ICMP&#x20;redirects&#x20;tell&#x20;the&#x20;system&#x20;about&#x20;alternate&#x20;routes&#x20;for&#x20;sending&#x20;traffic.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;ICMP&#x20;redirects&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;net.ipv6.conf.all.accept_redirects&#x20;and&#x20;net.ipv6.conf.default.accept_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"7.3.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1071,'Disable&#x20;IPv6','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/sysctl.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;net.ipv6.conf.all.disable_ipv6=1&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.disable_ipv6=1&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.lo.disable_ipv6=1&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;or&#x20;reboot&#x20;to&#x20;apply&#x20;the&#x20;changes:&#x20;#&#x20;sysctl&#x20;-p','[{\"cis\": [\"7.3.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1072,'Install&#x20;TCP&#x20;Wrappers','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Install&#x20;tcpd&#x20;:&#x20;#&#x20;apt-get&#x20;install&#x20;tcpd&#x20;To&#x20;verify&#x20;if&#x20;a&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;ldd&#x20;&lt;path-to-daemon&gt;&#x20;|&#x20;grep&#x20;libwrap.so&#x20;If&#x20;there&#x20;is&#x20;any&#x20;output,&#x20;then&#x20;the&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers.','[{\"cis\": [\"7.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1073,'Create&#x20;/etc/hosts.allow','The&#x20;/etc/hosts.allow&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.deny&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;server.','','Create&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;/etc/hosts.allow&#x20;&#x20;where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#x20;&#40;for&#x20;example,&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;represents&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.','[{\"cis\": [\"7.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1074,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.allow','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','If&#x20;the&#x20;permissions&#x20;of&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"7.4.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1075,'Create&#x20;/etc/hosts.deny','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.deny&#x20;file&#x20;serves&#x20;as&#x20;a&#x20;failsafe&#x20;so&#x20;that&#x20;any&#x20;host&#x20;not&#x20;specified&#x20;in&#x20;/etc/hosts.allow&#x20;is&#x20;denied&#x20;access&#x20;to&#x20;the&#x20;server.','','Create&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"7.4.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1076,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.deny','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','If&#x20;the&#x20;permissions&#x20;of&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"7.4.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1077,'Disable&#x20;DCCP','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;echo&#x20;&quot;install&#x20;dccp&#x20;/bin/true&quot;&#x20;&gt;&gt;&#x20;/etc/modprobe.d/CIS.conf','[{\"cis\": [\"7.5.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1078,'Disable&#x20;SCTP','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;echo&#x20;&quot;install&#x20;sctp&#x20;/bin/true&quot;&#x20;&gt;&gt;&#x20;/etc/modprobe.d/CIS.conf','[{\"cis\": [\"7.5.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1079,'Disable&#x20;RDS','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;echo&#x20;&quot;install&#x20;rds&#x20;/bin/true&quot;&#x20;&gt;&gt;&#x20;/etc/modprobe.d/CIS.conf','[{\"cis\": [\"7.5.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1080,'Disable&#x20;TIPC','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;echo&#x20;&quot;install&#x20;tipc&#x20;/bin/true&quot;&#x20;&gt;&gt;&#x20;/etc/modprobe.d/CIS.conf','[{\"cis\": [\"7.5.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1081,'Deactivate&#x20;Wireless&#x20;Interfaces','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.&#x20;Debian&#x20;provides&#x20;the&#x20;nmcli&#x20;interface&#x20;which&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;and&#x20;use&#x20;wireless&#x20;networks.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Use&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;wireless:&#x20;#&#x20;nmcli&#x20;nm&#x20;wifi&#x20;off','[{\"cis\": [\"7.6\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.6\"]}]'),(1082,'Ensure&#x20;Firewall&#x20;is&#x20;active','IPtables&#x20;is&#x20;an&#x20;application&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;IPv4&#x20;tables,&#x20;chains&#x20;and&#x20;rules&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall.&#x20;&#x20;The&#x20;iptables-persistent&#x20;package&#x20;in&#x20;Debian&#x20;provides&#x20;one&#x20;way&#x20;to&#x20;ensure&#x20;iptables&#x20;rules&#x20;are&#x20;reapplied&#x20;on&#x20;reboot.&#x20;Note:&#x20;the&#x20;audit&#x20;and&#x20;remediation&#x20;included&#x20;provide&#x20;instructions&#x20;for&#x20;using&#x20;iptables-persistent&#x20;to&#x20;reapply&#x20;iptables&#x20;rules.&#x20;&#x20;Other&#x20;methods&#x20;are&#x20;available&#x20;which&#x20;may&#x20;be&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;may&#x20;conflict&#x20;with&#x20;these&#x20;steps.','IPtables&#x20;provides&#x20;extra&#x20;protection&#x20;for&#x20;the&#x20;Linux&#x20;system&#x20;by&#x20;limiting&#x20;communications&#x20;in&#x20;and&#x20;out&#x20;of&#x20;the&#x20;box&#x20;to&#x20;specific&#x20;IPv4&#x20;addresses&#x20;and&#x20;ports.','','Install&#x20;the&#x20;iptables&#x20;and&#x20;iptables-persistent&#x20;packages:&#x20;#&#x20;apt-get&#x20;install&#x20;iptables&#x20;iptables-persistent&#x20;&#x20;&#x20;&#x20;Enable&#x20;the&#x20;iptables-persistent&#x20;service:&#x20;#&#x20;update-rc.d&#x20;iptables-persistent&#x20;enable','[{\"cis\": [\"7.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.1\"]}]'),(1083,'Configure&#x20;Audit&#x20;Log&#x20;Storage&#x20;Size','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;max_log_file&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Note:&#x20;MB&#x20;is&#x20;the&#x20;number&#x20;of&#x20;MegaBytes&#x20;the&#x20;file&#x20;can&#x20;be.','[{\"cis\": [\"8.1.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(1084,'Disable&#x20;System&#x20;on&#x20;Audit&#x20;Log&#x20;Full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/auditd.conf&#x20;file.&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"8.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(1085,'Keep&#x20;All&#x20;Auditing&#x20;Information','Normally,&#x20;auditd&#x20;will&#x20;hold&#x20;4&#x20;logs&#x20;of&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;before&#x20;deleting&#x20;older&#x20;log&#x20;files.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/auditd.conf&#x20;file.&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"8.1.1.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(1086,'Install&#x20;and&#x20;Enable&#x20;auditd&#x20;Service','Install&#x20;and&#x20;turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Install&#x20;auditd:&#x20;#&#x20;apt-get&#x20;install&#x20;auditd&#x20;If&#x20;needed&#x20;enable&#x20;auditd&#x20;in&#x20;/etc/rc*.d:&#x20;#&#x20;update-rc.d&#x20;auditd&#x20;enable','[{\"cis\": [\"8.1.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1087,'Enable&#x20;Auditing&#x20;for&#x20;Processes&#x20;That&#x20;Start&#x20;Prior&#x20;to&#x20;auditd','Configure&#x20;grub&#x20;or&#x20;lilo&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;to&#x20;include&#x20;audit=1&#x20;as&#x20;part&#x20;of&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;And&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"8.1.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}]'),(1088,'Record&#x20;Events&#x20;That&#x20;Modify&#x20;Date&#x20;and&#x20;Time&#x20;Information','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd','[{\"cis\": [\"8.1.4\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1089,'Record&#x20;Events&#x20;That&#x20;Modify&#x20;User/Group&#x20;Information','Record&#x20;events&#x20;affecting&#x20;the&#x20;group,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd','[{\"cis\": [\"8.1.5\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1090,'Record&#x20;Events&#x20;That&#x20;Modify&#x20;the&#x20;System&#039;s&#x20;Network&#x20;Environment','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;prelogin&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;exit,always&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;-a&#x20;exit,always&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;exit,always&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd','[{\"cis\": [\"8.1.6\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1091,'Record&#x20;Events&#x20;That&#x20;Modify&#x20;the&#x20;System&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;directory.','Changes&#x20;to&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;/etc/audit/audit.rules&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd','[{\"cis\": [\"8.1.7\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1092,'Collect&#x20;Login&#x20;and&#x20;Logout&#x20;Events','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.&amp;&amp;&#x20;r:rules&#x20;file.&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd','[{\"cis\": [\"8.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1093,'Collect&#x20;Session&#x20;Initiation&#x20;Information','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown&#x20;and&#x20;reboot&#x20;events.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd&#x20;Note:&#x20;Use&#x20;the&#x20;last&#x20;command&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;','[{\"cis\": [\"8.1.9\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.3\"]}]'),(1094,'Collect&#x20;Discretionary&#x20;Access&#x20;Control&#x20;Permission&#x20;Modification&#x20;Events','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permis&amp;&amp;&#x20;r:sions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown,&#x20;fchown,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr,&#x20;lsetxattr,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr,&#x20;lremovexattr,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;userids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd','[{\"cis\": [\"8.1.10\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1095,'Collect&#x20;Unsuccessful&#x20;Unauthorized&#x20;Access&#x20;Attempts&#x20;to&#x20;Files','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;creat&#41;,&#x20;opening&#x20;&#40;open,&#x20;openat&#41;&#x20;and&#x20;truncation&#x20;&#40;truncate,&#x20;ftruncate&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;nonprivileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;500&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd','[{\"cis\": [\"8.1.11\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1096,'Collect&#x20;Successful&#x20;File&#x20;System&#x20;Mounts','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd','[{\"cis\": [\"8.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1097,'Collect&#x20;File&#x20;Deletion&#x20;Events&#x20;by&#x20;User','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;the&#x20;following&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-P&#x20;1-HUP&#x20;auditd','[{\"cis\": [\"8.1.14\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(1098,'Collect&#x20;Changes&#x20;to&#x20;System&#x20;Administration&#x20;Scope&#x20;&#40;sudoers&#41;','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd','[{\"cis\": [\"8.1.15\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1099,'Collect&#x20;System&#x20;Administrator&#x20;Actions&#x20;&#40;sudolog&#41;','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;auditd&#x20;#&#x20;pkill&#x20;-HUP&#x20;-P&#x20;1&#x20;auditd&#x20;Note:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;su&#x20;disabled&#x20;&#40;See&#x20;Item&#x20;9.5&#x20;Restrict&#x20;Access&#x20;to&#x20;the&#x20;su&#x20;Command&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root','[{\"cis\": [\"8.1.16\"]}, {\"cis_csc\": [\"5.1\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.3\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1100,'Collect&#x20;Kernel&#x20;Module&#x20;Loading&#x20;and&#x20;Unloading','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;For&#x20;32&#x20;bit&#x20;systems,&#x20;add&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;For&#x20;64&#x20;bit&#x20;systems,&#x20;add&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules','[{\"cis\": [\"8.1.17\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC7.3\", \"CC7.4\", \"CC6.8\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1101,'Make&#x20;the&#x20;Audit&#x20;Configuration&#x20;Immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;-e&#x20;2&#x20;Note:&#x20;This&#x20;must&#x20;be&#x20;the&#x20;last&#x20;line&#x20;in&#x20;the&#x20;/etc/audit/audit.rules&#x20;file','[{\"cis\": [\"8.1.18\"]}, {\"cis_csc\": [\"3\", \"6\"]}, {\"pci_dss\": [\"10.5\"]}]'),(1102,'Install&#x20;the&#x20;rsyslog&#x20;package','The&#x20;rsyslog&#x20;package&#x20;is&#x20;a&#x20;third&#x20;party&#x20;package&#x20;that&#x20;provides&#x20;many&#x20;enhancements&#x20;to&#x20;syslog,&#x20;such&#x20;as&#x20;multi-threading,&#x20;TCP&#x20;communication,&#x20;message&#x20;filtering&#x20;and&#x20;data&#x20;base&#x20;support.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;the&#x20;rsyslog&#x20;package:&#x20;#&#x20;apt-get&#x20;install&#x20;rsyslog','[{\"cis\": [\"8.2.2\"]}, {\"cis_csc\": [\"6.2\"]}]'),(1103,'Ensure&#x20;the&#x20;rsyslog&#x20;Service&#x20;is&#x20;activated','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Enable&#x20;rsyslog:&#x20;#&#x20;update-rc.d&#x20;rsyslog&#x20;enable','[{\"cis\": [\"8.2.2\"]}, {\"cis_csc\": [\"6.2\"]}]'),(1104,'Configure&#x20;rsyslog&#x20;to&#x20;Send&#x20;Logs&#x20;to&#x20;a&#x20;Remote&#x20;Log&#x20;Host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;&#x20;#&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;rsyslogd&#x20;&#x20;&#x20;&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd&#x20;&#x20;&#x20;&#x20;Note:&#x20;The&#x20;double&#x20;&quot;at&quot;&#x20;sign&#x20;&#40;@@&#41;&#x20;directs&#x20;rsyslog&#x20;to&#x20;use&#x20;TCP&#x20;to&#x20;send&#x20;log&#x20;messages&#x20;to&#x20;the&#x20;server,&#x20;which&#x20;is&#x20;a&#x20;more&#x20;reliable&#x20;transport&#x20;mechanism&#x20;than&#x20;the&#x20;default&#x20;UDP&#x20;protocol.','[{\"cis\": [\"8.2.5\"]}, {\"cis_csc\": [\"6.6\"]}]'),(1105,'Accept&#x20;Remote&#x20;rsyslog&#x20;Messages&#x20;Only&#x20;on&#x20;Designated&#x20;Log&#x20;Hosts','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;the&#x20;following&#x20;lines:&#x20;$ModLoad&#x20;imtcp.so&#x20;&#x20;&#x20;&#x20;$InputTCPServerRun&#x20;514&#x20;&#x20;&#x20;&#x20;Execute&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;rsyslogd:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"8.2.6\"]}, {\"cis_csc\": [\"9.1\"]}]'),(1106,'Install&#x20;AIDE','In&#x20;some&#x20;installations,&#x20;AIDE&#x20;is&#x20;not&#x20;installed&#x20;automatically','Install&#x20;AIDE&#x20;to&#x20;make&#x20;use&#x20;of&#x20;the&#x20;file&#x20;integrity&#x20;features&#x20;to&#x20;monitor&#x20;critical&#x20;files&#x20;for&#x20;changes&#x20;that&#x20;could&#x20;affect&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','Install&#x20;AIDE:&#x20;#&#x20;apt-get&#x20;install&#x20;aide&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit&#x20;#&#x20;cp&#x20;/var/lib/aide/aide.db.new&#x20;/var/lib/aide/aide.db&#x20;Note:&#x20;The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;AIDE&#x20;because&#x20;it&#x20;alters&#x20;binaries&#x20;to&#x20;speed&#x20;up&#x20;their&#x20;start&#x20;up&#x20;times.&#x20;Run&#x20;/usr/sbin/prelink&#x20;-ua&#x20;to&#x20;restore&#x20;the&#x20;binaries&#x20;to&#x20;their&#x20;prelinked&#x20;state,&#x20;thus&#x20;avoiding&#x20;false&#x20;positives&#x20;from&#x20;AIDE.','[{\"cis\": [\"8.3.1\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}]'),(1107,'Implement&#x20;Periodic&#x20;Execution&#x20;of&#x20;File&#x20;Integrity','Implement&#x20;periodic&#x20;file&#x20;checking,&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Execute&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;Note:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;instance&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.','[{\"cis\": [\"8.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1108,'Enable&#x20;cron&#x20;Daemon','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Enable&#x20;cron:&#x20;#&#x20;update-rc.d&#x20;cron&#x20;enable&#x20;&#x20;&#x20;&#x20;Enable&#x20;anacron:&#x20;#&#x20;update-rc.d&#x20;anacron&#x20;enable','[{\"cis\": [\"9.1.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1109,'Set&#x20;User/Group&#x20;Owner&#x20;and&#x20;Permission&#x20;on&#x20;/etc/crontab','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"9.1.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1110,'Set&#x20;User/Group&#x20;Owner&#x20;and&#x20;Permission&#x20;on&#x20;/etc/cron.hourly','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"9.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1111,'Set&#x20;User/Group&#x20;Owner&#x20;and&#x20;Permission&#x20;on&#x20;/etc/cron.daily','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"9.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1112,'Set&#x20;User/Group&#x20;Owner&#x20;and&#x20;Permission&#x20;on&#x20;/etc/cron.weekly','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"9.1.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1113,'Set&#x20;User/Group&#x20;Owner&#x20;and&#x20;Permission&#x20;on&#x20;/etc/cron.monthly','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"9.1.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1114,'Set&#x20;User/Group&#x20;Owner&#x20;and&#x20;Permission&#x20;on&#x20;/etc/cron.d','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"9.1.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1115,'Restrict&#x20;at/cron&#x20;to&#x20;Authorized&#x20;Users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','#&#x20;/bin/rm&#x20;/etc/cron.deny&#x20;&#x20;&#x20;&#x20;#&#x20;/bin/rm&#x20;/etc/at.deny&#x20;&#x20;&#x20;&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;&#x20;&#x20;&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"9.1.8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1116,'Set&#x20;Password&#x20;Creation&#x20;Requirement&#x20;Parameters&#x20;Using&#x20;pam_cracklib','The&#x20;pam_cracklib&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_cracklib.so&#x20;options.&#x20;&#x20;#&#x20;retry=3&#x20;-&#x20;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure.&#x20;&#x20;#&#x20;minlen=14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more&#x20;#&#x20;dcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit&#x20;#&#x20;ucredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character&#x20;#&#x20;ocredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character&#x20;#&#x20;lcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character&#x20;&#x20;&#x20;&#x20;The&#x20;setting&#x20;shown&#x20;above&#x20;is&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Install&#x20;the&#x20;libpam-cracklib&#x20;package:&#x20;#&#x20;apt-get&#x20;install&#x20;libpam-cracklib&#x20;2&#41;&#x20;Set&#x20;the&#x20;pam_cracklib.so&#x20;parameters&#x20;as&#x20;follows&#x20;in&#x20;/etc/pam.d/common-password:&#x20;password&#x20;required&#x20;pam_cracklib.so&#x20;retry=3&#x20;minlen=14&#x20;dcredit=-1&#x20;ucredit=-1&#x20;ocredit=-1&#x20;lcredit=-1','[{\"cis\": [\"9.2.1\"]}, {\"pci_dss\": [\"8.2.3\"]}]'),(1117,'Set&#x20;Lockout&#x20;for&#x20;Failed&#x20;Password&#x20;Attempts','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;file&#x20;/etc/pam.d/login.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;userIDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/login&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900&#x20;&#x20;&#x20;&#x20;Note:&#x20;If&#x20;a&#x20;user&#x20;has&#x20;been&#x20;locked&#x20;out&#x20;because&#x20;they&#x20;have&#x20;reached&#x20;the&#x20;maximum&#x20;consecutive&#x20;failure&#x20;count&#x20;defined&#x20;by&#x20;deny=&#x20;in&#x20;the&#x20;pam_tally2.so&#x20;module,&#x20;the&#x20;user&#x20;can&#x20;be&#x20;unlocked&#x20;by&#x20;issuing&#x20;the&#x20;command&#x20;/sbin/pam_tally2&#x20;-u&#x20;&lt;username&gt;&#x20;--reset.&#x20;This&#x20;command&#x20;sets&#x20;the&#x20;failed&#x20;count&#x20;to&#x20;0,&#x20;effectively&#x20;unlocking&#x20;the&#x20;user.','[{\"cis\": [\"9.2.2\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(1118,'Limit&#x20;Password&#x20;Reuse','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;the&#x20;pam_unix.so&#x20;remember&#x20;parameter&#x20;to&#x20;5&#x20;in&#x20;/etc/pam.d/common-password:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;&#x20;pam_unix.so&#x20;obscure&#x20;sha512&#x20;remember=5&#x20;&#x20;&#x20;&#x20;Note:&#x20;The&#x20;default&#x20;password&#x20;setting&#x20;in&#x20;this&#x20;document&#x20;is&#x20;the&#x20;last&#x20;5&#x20;passwords.&#x20;Change&#x20;this&#x20;number&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;site&#039;s&#x20;password&#x20;policy.','[{\"cis\": [\"9.2.3\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(1119,'Set&#x20;SSH&#x20;Protocol&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"9.3.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1120,'Set&#x20;LogLevel&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifices&#x20;that&#x20;record&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.&#x20;INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"9.3.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1121,'Set&#x20;Permissions&#x20;on&#x20;/etc/ssh/sshd_config','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','If&#x20;the&#x20;user&#x20;and&#x20;group&#x20;ownership&#x20;of&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;If&#x20;the&#x20;permissions&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;chmod&#x20;600&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"9.3.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1122,'Disable&#x20;SSH&#x20;X11&#x20;Forwarding','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"9.3.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1123,'Set&#x20;SSH&#x20;MaxAuthTries&#x20;to&#x20;4&#x20;or&#x20;Less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;it&#x20;is&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"9.3.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1124,'Set&#x20;SSH&#x20;IgnoreRhosts&#x20;to&#x20;Yes','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"9.3.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1125,'Set&#x20;SSH&#x20;HostbasedAuthentication&#x20;to&#x20;No','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"9.3.7\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1126,'Disable&#x20;SSH&#x20;Root&#x20;Login','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"9.3.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1127,'Set&#x20;SSH&#x20;PermitEmptyPasswords&#x20;to&#x20;No','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"9.3.9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1128,'Do&#x20;Not&#x20;Allow&#x20;Users&#x20;to&#x20;Set&#x20;Environment&#x20;Options','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"9.3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(1129,'Use&#x20;Only&#x20;Approved&#x20;Cipher&#x20;in&#x20;Counter&#x20;Mode','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Based&#x20;on&#x20;research&#x20;conducted&#x20;at&#x20;various&#x20;institutions,&#x20;it&#x20;was&#x20;determined&#x20;that&#x20;the&#x20;symmetric&#x20;portion&#x20;of&#x20;the&#x20;SSH&#x20;Transport&#x20;Protocol&#x20;&#40;as&#x20;described&#x20;in&#x20;RFC&#x20;4253&#41;&#x20;has&#x20;security&#x20;weaknesses&#x20;that&#x20;allowed&#x20;recovery&#x20;of&#x20;up&#x20;to&#x20;32&#x20;bits&#x20;of&#x20;plaintext&#x20;from&#x20;a&#x20;block&#x20;of&#x20;ciphertext&#x20;that&#x20;was&#x20;encrypted&#x20;with&#x20;the&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBD&#41;&#x20;method.&#x20;From&#x20;that&#x20;research,&#x20;new&#x20;Counter&#x20;mode&#x20;algorithms&#x20;&#40;as&#x20;described&#x20;in&#x20;RFC4344&#41;&#x20;were&#x20;designed&#x20;that&#x20;are&#x20;not&#x20;vulnerable&#x20;to&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;and&#x20;these&#x20;algorithms&#x20;are&#x20;now&#x20;recommended&#x20;for&#x20;standard&#x20;use.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Ciphers&#x20;aes128-ctr,aes192-ctr,aes256-ctr','[{\"cis\": [\"9.3.11\"]}]'),(1130,'Set&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;for&#x20;User&#x20;Login','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening..&#x20;&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"9.3.12\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(1131,'Limit&#x20;Access&#x20;via&#x20;SSH','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"9.3.13\"]}, {\"pci_dss\": [\"8.1\"]}]'),(1132,'Set&#x20;SSH&#x20;Banner','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Consult&#x20;with&#x20;your&#x20;legal&#x20;department&#x20;for&#x20;the&#x20;appropriate&#x20;warning&#x20;banner&#x20;for&#x20;your&#x20;site.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"9.3.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1133,'Restrict&#x20;Access&#x20;to&#x20;the&#x20;su&#x20;Command','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','1&#41;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;2&#41;&#x20;Once&#x20;this&#x20;is&#x20;done,&#x20;create&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;statement&#x20;in&#x20;the&#x20;/etc/group&#x20;file.','[{\"cis\": [\"9.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1134,'Set&#x20;Password&#x20;Expiration&#x20;Days','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;90&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;90&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90&#x20;&#x20;&#x20;&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"10.1.1\"]}, {\"pci_dss\": [\"8.2.4\"]}]'),(1135,'Set&#x20;Password&#x20;Change&#x20;Minimum&#x20;Number&#x20;of&#x20;Days','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;&#x20;&#x20;&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"10.1.2\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1136,'Set&#x20;Password&#x20;Expiring&#x20;Warning&#x20;Days','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;&#x20;&#x20;&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"10.1.3\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1137,'Set&#x20;Default&#x20;Group&#x20;for&#x20;root&#x20;Account','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"10.3\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1138,'Set&#x20;Default&#x20;umask&#x20;for&#x20;Users','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;.profile,&#x20;.bashrc,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;&#x20;Note:&#x20;The&#x20;directives&#x20;in&#x20;this&#x20;section&#x20;apply&#x20;to&#x20;bash&#x20;and&#x20;shell.&#x20;If&#x20;other&#x20;shells&#x20;are&#x20;supported&#x20;on&#x20;the&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;their&#x20;configuration&#x20;files&#x20;also&#x20;are&#x20;checked.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;and&#x20;/etc/profile.d/cis.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;the&#x20;UMASK&#x20;parameter&#x20;as&#x20;shown:&#x20;umask&#x20;077','[{\"cis\": [\"10.4\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1139,'Lock&#x20;Inactive&#x20;User&#x20;Accounts','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;35&#x20;or&#x20;more&#x20;days&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','#&#x20;useradd&#x20;-D&#x20;-f&#x20;35','[{\"cis\": [\"10.5\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1140,'Set&#x20;Warning&#x20;Banner&#x20;for&#x20;Standard&#x20;Login&#x20;Services','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;prior&#x20;to&#x20;the&#x20;login&#x20;prompt&#x20;on&#x20;the&#x20;system&#039;s&#x20;console&#x20;and&#x20;serial&#x20;devices,&#x20;and&#x20;also&#x20;prior&#x20;to&#x20;logins&#x20;via&#x20;telnet.&#x20;The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;is&#x20;generally&#x20;displayed&#x20;after&#x20;all&#x20;successful&#x20;logins,&#x20;no&#x20;matter&#x20;where&#x20;the&#x20;user&#x20;is&#x20;logging&#x20;in&#x20;from,&#x20;but&#x20;is&#x20;thought&#x20;to&#x20;be&#x20;less&#x20;useful&#x20;because&#x20;it&#x20;only&#x20;provides&#x20;notification&#x20;to&#x20;the&#x20;user&#x20;after&#x20;the&#x20;machine&#x20;has&#x20;been&#x20;accessed.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Consult&#x20;with&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;counsel&#x20;for&#x20;the&#x20;appropriate&#x20;wording&#x20;for&#x20;your&#x20;specific&#x20;organization.','','#&#x20;touch&#x20;/etc/motd&#x20;&#x20;&#x20;&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue&#x20;&#x20;&#x20;&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"11.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1141,'Remove&#x20;OS&#x20;Information&#x20;from&#x20;Login&#x20;Warning&#x20;Banners','Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.','Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;uname&#x20;-a&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd,&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;and&#x20;remove&#x20;any&#x20;lines&#x20;containing&#x20;m,&#x20;&#x0d;,&#x20;s&#x20;or&#x20;v.','[{\"cis\": [\"11.2\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1142,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','Debian&#x20;defaults&#x20;to&#x20;using&#x20;GNOME&#x20;Display&#x20;Manager&#x20;for&#x20;graphical&#x20;login&#x20;session&#x20;management.&#x20;KDM&#x20;is&#x20;also&#x20;available&#x20;as&#x20;well&#x20;as&#x20;lightdm.&#x20;Instructions&#x20;are&#x20;provided&#x20;for&#x20;GDM&#x20;only,&#x20;if&#x20;you&#x20;are&#x20;using&#x20;another&#x20;display&#x20;manager&#x20;you&#x20;will&#x20;need&#x20;to&#x20;follow&#x20;different&#x20;procedures&#x20;to&#x20;audit&#x20;and&#x20;remediate&#x20;this&#x20;setting.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Consult&#x20;with&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;counsel&#x20;for&#x20;the&#x20;appropriate&#x20;wording&#x20;for&#x20;your&#x20;specific&#x20;organization.','','Uncomment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;/etc/gdm3/greeter.gsettings&#x20;:&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;&lt;banner-text&gt;&#039;','[{\"cis\": [\"11.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(1143,'Verify&#x20;permissions&#x20;on&#x20;/etc/passwd','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','If&#x20;the&#x20;permissions&#x20;of&#x20;the&#x20;/etc/passwd&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"12.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1144,'Verify&#x20;permissions&#x20;on&#x20;/etc/shadow','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','If&#x20;the&#x20;permissions&#x20;of&#x20;the&#x20;/etc/shadow&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chmod&#x20;644&#x20;/etc/shadow','[{\"cis\": [\"12.2\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1145,'Verify&#x20;permissions&#x20;on&#x20;/etc/group','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','If&#x20;the&#x20;permissions&#x20;of&#x20;the&#x20;/etc/group&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"12.3\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1146,'Verify&#x20;User/Group&#x20;Ownership&#x20;on&#x20;/etc/passwd','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;userIDs&#x20;defined&#x20;in&#x20;the&#x20;system,&#x20;but&#x20;not&#x20;the&#x20;passwords.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/passwd&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','If&#x20;the&#x20;user&#x20;and&#x20;group&#x20;ownership&#x20;of&#x20;the&#x20;/etc/passwd&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chown&#x20;root:root&#x20;/etc/passwd','[{\"cis\": [\"12.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1147,'Verify&#x20;User/Group&#x20;Ownership&#x20;on&#x20;/etc/shadow','The&#x20;/etc/shadow&#x20;file&#x20;contains&#x20;the&#x20;one-way&#x20;cipher&#x20;text&#x20;passwords&#x20;for&#x20;each&#x20;user&#x20;defined&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;user&#x20;and&#x20;group&#x20;ownership&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','If&#x20;the&#x20;ownership&#x20;of&#x20;the&#x20;/etc/shadow&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chown&#x20;root:shadow&#x20;/etc/shadow','[{\"cis\": [\"12.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1148,'Verify&#x20;User/Group&#x20;Ownership&#x20;on&#x20;/etc/group','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','If&#x20;the&#x20;ownership&#x20;of&#x20;the&#x20;/etc/group&#x20;file&#x20;are&#x20;incorrect,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;correct&#x20;them:&#x20;#&#x20;/bin/chown&#x20;root:root&#x20;/etc/group','[{\"cis\": [\"12.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1149,'Ensure&#x20;Password&#x20;Fields&#x20;are&#x20;Not&#x20;Empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;/usr/bin/passwd&#x20;-l&#x20;&lt;username&gt;&#x20;&#x20;&#x20;&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"13.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}]'),(1150,'Verify&#x20;No&#x20;Legacy&#x20;&quot;+&quot;&#x20;Entries&#x20;Exist&#x20;in&#x20;/etc/passwd&#x20;File','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Delete&#x20;these&#x20;entries&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"13.2\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1151,'Verify&#x20;No&#x20;Legacy&#x20;&quot;+&quot;&#x20;Entries&#x20;Exist&#x20;in&#x20;/etc/shadow&#x20;File','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Delete&#x20;these&#x20;entries&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"13.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1152,'Verify&#x20;No&#x20;Legacy&#x20;&quot;+&quot;&#x20;Entries&#x20;Exist&#x20;in&#x20;/etc/group&#x20;File','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Delete&#x20;these&#x20;entries&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"13.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1153,'Verify&#x20;No&#x20;UID&#x20;0&#x20;Accounts&#x20;Exist&#x20;Other&#x20;Than&#x20;root','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;9.4&#x20;Restrict&#x20;root&#x20;Login&#x20;to&#x20;System&#x20;Console.','','Delete&#x20;any&#x20;other&#x20;entries&#x20;that&#x20;are&#x20;displayed.','[{\"cis\": [\"13.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\", \"CC8.1\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1154,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"13.20\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1501,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1502,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1503,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1504,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1505,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;#&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1506,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(1507,'Ensure&#x20;/tmp&#x20;is&#x20;configured','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate&#x20;or&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;systemctl&#x20;umask&#x20;tmp.mount;&#x20;systemctl&#x20;enable&#x20;tmp.mount.&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1508,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1509,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1510,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1511,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1512,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1513,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1514,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1515,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1516,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1517,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1518,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','When&#x20;set&#x20;on&#x20;a&#x20;file&#x20;system,&#x20;this&#x20;option&#x20;prevents&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices&#x20;from&#x20;being&#x20;defined,&#x20;or&#x20;if&#x20;they&#x20;exist,&#x20;from&#x20;being&#x20;used&#x20;as&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"13\", \"15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1519,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/run/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1520,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1521,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/run/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1522,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Disable&#x20;autofs:&#x20;#&#x20;update-rc.d&#x20;autofs&#x20;disable','[{\"cis\": [\"1.1.21\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1523,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Install&#x20;AIDE:&#x20;#&#x20;apt-get&#x20;install&#x20;aide&#x20;aide-common.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1524,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Execute&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check.&#x20;Note:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;instance&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1525,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg,&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1526,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','1&#41;&#x20;Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-md5-crypt:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;Your&#x20;PBKDF2&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;2&#41;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/00_header&#x20;or&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;set&#x20;superusers=&quot;&lt;user-list&gt;&quot;&#x20;password_pbkdf2&#x20;&lt;user&gt;&#x20;&lt;encrypted-password&gt;&#x20;EOF&#x20;Unless&#x20;the&#x20;--unrestricted&#x20;option&#x20;is&#x20;added&#x20;to&#x20;CLASS&#x20;in&#x20;/etc/grub.d/10_linux&#x20;a&#x20;password&#x20;will&#x20;be&#x20;required&#x20;to&#x20;boot&#x20;in&#x20;addition&#x20;to&#x20;editing&#x20;boot&#x20;parameters:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;&#x20;3&#41;&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;grub&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1527,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1528,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/security/limits.conf&#x20;file.&#x20;&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1529,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1530,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;and&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1531,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;apt-get&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1532,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1533,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1534,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1535,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1536,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwrittenby&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;appermor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;update&#x20;the&#x20;grub&#x20;configuration&#x20;#&#x20;update-grub&#x20;&#x20;&#x20;&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"1.6.2.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1537,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.2.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1538,'Ensure&#x20;SELinux&#x20;or&#x20;AppArmor&#x20;are&#x20;installed','SELinux&#x20;and&#x20;AppArmor&#x20;provide&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;SELinux&#x20;or&#x20;apparmor:&#x20;#&#x20;apt-get&#x20;install&#x20;selinux-basics&#x20;Or:&#x20;#&#x20;apt-get&#x20;install&#x20;apparmor&#x20;apparmor-profiles&#x20;apparmor-utils','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1539,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"7.1\"]}]'),(1540,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x0d;,s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"7.1\"]}]'),(1541,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"7.1\"]}]'),(1542,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1543,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1544,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1545,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add:&#x20;[org/gnome/login-screen],&#x20;banner-message-enable=true,&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;','[{\"cis\": [\"1.7.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1546,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Notes:&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(1547,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;xinetd:&#x20;#&#x20;apt-get&#x20;remove&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1548,'Ensure&#x20;inetd&#x20;is&#x20;not&#x20;installed','The&#x20;inetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;inetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;uninstall&#x20;openbsd-inetd&#x20;and&#x20;inetutils-inetd:&#x20;#&#x20;apt-get&#x20;remove&#x20;openbsd-inetd&#x20;#&#x20;apt-get&#x20;remove&#x20;inetutils-inetd','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1549,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;install&#x20;NTP&#x20;or&#x20;chrony&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;ntp&#x20;#&#x20;apt-get&#x20;install&#x20;chrony&#x20;&#x20;&#x20;&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1550,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;&#x20;&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;.&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;&#x20;&#x20;server&#x20;&lt;remote-server&gt;&#x20;.&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;&#x20;&#x20;RUNASUSER=ntp','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1551,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1552,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt-get&#x20;remove&#x20;xserver-xorg*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(1553,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attach&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1554,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1555,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;isc-dhcp-server&#x20;#&#x20;systemctl&#x20;disable&#x20;isc-dhcp-server6','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1556,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1557,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind:&#x20;#&#x20;systemctl&#x20;disable&#x20;nfs-server&#x20;#&#x20;systemctl&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1558,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;systemctl&#x20;disable&#x20;bind9','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1559,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1560,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2:&#x20;#&#x20;systemctl&#x20;disable&#x20;apache2','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1561,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','exim&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;exim:&#x20;#&#x20;apt-get&#x20;remove&#x20;exim4;&#x20;#&#x20;apt-get&#x20;purge&#x20;exim4','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1562,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smbd:&#x20;#&#x20;systemctl&#x20;disable&#x20;smbd','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1563,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1564,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1565,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(1566,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;disable&#x20;rsync','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(1567,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;nis:&#x20;#&#x20;systemctl&#x20;disable&#x20;nis','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1568,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;the&#x20;nis&#x20;package:&#x20;#&#x20;apt-get&#x20;remove&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1569,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rshpackage&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcpand&#x20;rlogin.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;apt-get&#x20;remove&#x20;rsh-client&#x20;rsh-redone-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1570,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talkclient,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;apt-get&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1571,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;apt-get&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1572,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Uninstall&#x20;ldap-utils&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;&#x20;&#x20;#&#x20;apt-get&#x20;remove&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1573,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0&#x20;net.ipv6.conf.all.forwarding&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1574,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;net.ipv4.conf.all.send_redirects&#x20;and&#x20;net.ipv4.conf.default.send_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1575,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1576,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1577,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1578,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1579,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1580,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1581,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1582,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1583,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.9\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1584,'Install&#x20;TCP&#x20;Wrappers','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Install&#x20;tcpd&#x20;:&#x20;#&#x20;apt-get&#x20;install&#x20;tcpd&#x20;&#x20;&#x20;&#x20;Notes:&#x20;To&#x20;verify&#x20;if&#x20;a&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;ldd&#x20;&lt;path-to-daemon&gt;&#x20;|&#x20;grep&#x20;libwrap.so&#x20;If&#x20;there&#x20;is&#x20;any&#x20;output,&#x20;then&#x20;the&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers.','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1585,'Ensure&#x20;/etc/hosts.allow&#x20;is&#x20;configured','The&#x20;/etc/hosts.allow&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.deny&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;/etc/hosts.allow.&#x20;Where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#x20;&#40;for&#x20;example,&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;represents&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1586,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.deny&#x20;file&#x20;serves&#x20;as&#x20;a&#x20;failsafe&#x20;so&#x20;that&#x20;any&#x20;host&#x20;not&#x20;specified&#x20;in&#x20;/etc/hosts.allow&#x20;is&#x20;denied&#x20;access&#x20;to&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(1587,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.allow','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1588,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.deny','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1589,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-&#x20;sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1590,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1591,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1592,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1593,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(1594,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(1595,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(1596,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(1597,'Ensure&#x20;iptables&#x20;is&#x20;installed','iptables&#x20;allows&#x20;configuration&#x20;of&#x20;the&#x20;IPv4&#x20;tables&#x20;in&#x20;the&#x20;linux&#x20;kernel&#x20;and&#x20;the&#x20;rules&#x20;stored&#x20;within&#x20;them.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;iptables.','iptables&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables:&#x20;#&#x20;apt-get&#x20;install&#x20;iptables','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(1598,'Disable&#x20;IPv6','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;&#x20;#&#x20;update-grub','[{\"cis\": [\"3.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1599,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Notes:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.3\"]}]'),(1600,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}]'),(1601,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.3\"]}]'),(1602,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\"\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1603,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;or&#x20;lilo&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','1&#41;&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1604,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-&#x20;change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.3\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1605,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1606,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-&#x20;login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/sysconfig/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;Notes:&#x20;/etc/sysconfig/network&#x20;is&#x20;common&#x20;to&#x20;Red&#x20;Hat&#x20;and&#x20;SUSE&#x20;based&#x20;distributions.&#x20;You&#x20;should&#x20;expand&#x20;or&#x20;replace&#x20;this&#x20;coverage&#x20;to&#x20;any&#x20;network&#x20;configuration&#x20;files&#x20;on&#x20;your&#x20;system&#x20;such&#x20;as&#x20;/etc/network&#x20;on&#x20;Debian&#x20;based&#x20;distributions.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1607,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux/AppArmor&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','On&#x20;systems&#x20;using&#x20;SELinux&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;&#x20;|&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;On&#x20;systems&#x20;using&#x20;AppArmor&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;|&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1608,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1609,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;|&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1610,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1611,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1612,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1613,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(1614,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;|&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1615,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions.&#x20;Notes:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;sudisabled&#x20;&#40;See&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1616,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(1617,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-e&#x20;2.&#x20;Notes:&#x20;This&#x20;setting&#x20;will&#x20;ensure&#x20;reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"3\", \"6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\"]}]'),(1618,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1619,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(1620,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;:&#x20;*.*&#x20;@@loghost.example.com.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1621,'Ensure&#x20;remote&#x20;rsyslog&#x20;messages&#x20;are&#x20;only&#x20;accepted&#x20;on&#x20;designated&#x20;log&#x20;hosts','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:$ModLoad&#x20;imtcp&#x20;&amp;&#x20;$InputTCPServerRun&#x20;514.&#x20;For&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;comment&#x20;or&#x20;remove&#x20;the&#x20;following&#x20;lines:&#x20;#&#x20;$ModLoad&#x20;imtcp&#x20;#&#x20;$InputTCPServerRun&#x20;514.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"10.5.1\"]}]'),(1622,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;syslog-ng','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1623,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(1624,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1625,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;rsyslog&#x20;#&#x20;apt-get&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1626,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron:&#x20;systemctl&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1627,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1628,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1629,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1630,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1631,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1632,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1633,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1634,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-&#x20;privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1635,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(1636,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;or&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(1637,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1638,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1639,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhostsand&#x20;.shostsfiles&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthenticationor&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(1640,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(1641,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(1642,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(1643,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(1644,'Ensure&#x20;only&#x20;strong&#x20;ciphers&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involving&#x20;LSB&#x20;values,&#x20;aka&#x20;the&#x20;&quot;Bar&#x20;Mitzvah&quot;&#x20;issue&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(1645,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-&#x20;512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(1646,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(1647,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(1648,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}]'),(1649,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"5.1\", \"5.8\"]}, {\"pci_dss\": [\"8.1\"]}]'),(1650,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1651,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options:&#x20;-&#x20;retry=3&#x20;&#40;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure&#41;.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#40;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#41;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt-get&#x20;install&#x20;libpam-pwquality&#x20;2&#41;&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3&#x20;3&#41;&#x20;Edit&#x20;/etc/security/pwquality.conf&#x20;to&#x20;add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;settings&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;requirements&#x20;only&#x20;cover&#x20;including&#x20;try_first_pass&#x20;and&#x20;minlen&#x20;set&#x20;to&#x20;14&#x20;or&#x20;more.&#x20;Settings&#x20;in&#x20;/etc/security/pwquality.conf&#x20;must&#x20;use&#x20;spaces&#x20;around&#x20;the&#x20;=&#x20;symbol.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"5.7\", \"16.12\"]}, {\"pci_dss\": [\"8.2.3\"]}]'),(1652,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900.&#x20;Note:&#x20;If&#x20;a&#x20;user&#x20;has&#x20;been&#x20;locked&#x20;out&#x20;because&#x20;they&#x20;have&#x20;reached&#x20;the&#x20;maximum&#x20;consecutive&#x20;failure&#x20;count&#x20;defined&#x20;by&#x20;deny=&#x20;in&#x20;the&#x20;pam_tally2.so&#x20;module,&#x20;the&#x20;user&#x20;can&#x20;be&#x20;unlocked&#x20;by&#x20;issuing&#x20;the&#x20;command&#x20;/sbin/pam_tally2&#x20;-u&#x20;&lt;username&gt;&#x20;--reset.&#x20;This&#x20;command&#x20;sets&#x20;the&#x20;failed&#x20;count&#x20;to&#x20;0,&#x20;effectively&#x20;unlocking&#x20;the&#x20;user.&#x20;Notes:&#x20;Use&#x20;of&#x20;the&#x20;&quot;audit&quot;&#x20;keyword&#x20;may&#x20;log&#x20;credentials&#x20;in&#x20;the&#x20;case&#x20;of&#x20;user&#x20;error&#x20;during&#x20;authentication.&#x20;This&#x20;risk&#x20;should&#x20;be&#x20;evaluated&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;site&#x20;policies&#x20;of&#x20;your&#x20;organization.','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(1653,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(1654,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1655,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;5th&#x20;field&#x20;should&#x20;be&#x20;365&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;will&#x20;disable&#x20;password&#x20;expiration.&#x20;Additionally&#x20;the&#x20;password&#x20;expiration&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;the&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;or&#x20;users&#x20;will&#x20;be&#x20;unable&#x20;to&#x20;change&#x20;their&#x20;password.','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}]'),(1656,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;4th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1657,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;6th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1658,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;7th&#x20;field&#x20;should&#x20;be&#x20;30&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;would&#x20;disable&#x20;this&#x20;setting.','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1659,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1660,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(1661,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;files,&#x20;and&#x20;/etc/profile.d*.sh&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(1662,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;sudo&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','1&#41;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;2&#41;&#x20;Create&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;users&#x20;in&#x20;the&#x20;sudo&#x20;statement&#x20;in&#x20;the&#x20;/etc/group&#x20;file:&#x20;sudo:x:10:root,&lt;user&#x20;list&gt;&#x20;Notes:&#x20;The&#x20;use_uid&#x20;option&#x20;to&#x20;pam_wheel.so&#x20;is&#x20;a&#x20;no-op&#x20;on&#x20;debian&#x20;based&#x20;systems.&#x20;It&#x20;is&#x20;acceptable&#x20;but&#x20;not&#x20;required&#x20;as&#x20;these&#x20;systems&#x20;use&#x20;its&#x20;behavior&#x20;as&#x20;default.','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1663,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1664,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1665,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1666,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1667,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1668,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1669,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1670,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(1671,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;&lt;username&gt;&lt;/em&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}]'),(1672,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1673,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1674,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(1675,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(1676,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"6.2.20\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2000,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/freevxfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2001,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/jffs2.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2002,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/hfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2003,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.confExample:&#x20;vim&#x20;/etc/modprobe.d/hfsplus.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2004,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2005,'Ensure&#x20;/tmp&#x20;is&#x20;configured','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;or&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;systemctl&#x20;enable&#x20;tmp.mount&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2006,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount:&#x20;[Mount]&#x20;What=tmpfs&#x20;&#x20;Where=/tmp&#x20;&#x20;Type=tmpfs&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;and&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;systemctl&#x20;enable&#x20;tmp.mount','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2007,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2008,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp&#x20;.','','Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2.6\", \"8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2009,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2010,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2011,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2012,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2013,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2014,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2015,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2016,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2017,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','When&#x20;set&#x20;on&#x20;a&#x20;file&#x20;system,&#x20;this&#x20;option&#x20;prevents&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices&#x20;from&#x20;being&#x20;defined,&#x20;or&#x20;if&#x20;they&#x20;exist,&#x20;from&#x20;being&#x20;used&#x20;as&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2018,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/run/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2019,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2020,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2.6\", \"8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2021,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2022,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;#&#x20;apt-get&#x20;install&#x20;aide&#x20;aide-common.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2023,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;&#x20;&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2024,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg,&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2025,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2&#x20;Create&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;If&#x20;there&#x20;is&#x20;a&#x20;requirement&#x20;to&#x20;be&#x20;able&#x20;to&#x20;boot/reboot&#x20;without&#x20;entering&#x20;the&#x20;password,&#x20;edit&#x20;/etc/grub.d/10_linux&#x20;and&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;line&#x20;CLASS=&#x20;Example:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2026,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2027,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2028,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2029,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2030,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2031,'Ensure&#x20;SELinux&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;configure&#x20;GRUB&#x20;and&#x20;PAM&#x20;and&#x20;to&#x20;create&#x20;/.autorelabel:&#x20;&#x20;#&#x20;selinux-activate&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;following&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line:&#x20;&#x20;&#x20;&#x20;&#x20;selinux=1&#x20;&#x20;security=selinux&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;example:&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;&#x20;&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;selinux=1&#x20;security=selinux&#x20;enforcing=1&#x20;audit=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2configuration:&#x20;&#x20;&#x20;&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2032,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing&#x20;&#x20;&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;following&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line:&#x20;enforcing=1&#x20;&#x20;&#x20;&#x20;Example:&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;selinux=1&#x20;security=selinux&#x20;enforcing=1&#x20;audit=1&quot;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2033,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2034,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2035,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwrittenby&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;appermor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;update&#x20;the&#x20;grub&#x20;configuration&#x20;#&#x20;update-grub&#x20;&#x20;&#x20;&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"1.6.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2036,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2037,'Ensure&#x20;SELinux&#x20;or&#x20;AppArmor&#x20;are&#x20;installed','SELinux&#x20;and&#x20;AppArmor&#x20;provide&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;SELinux&#x20;or&#x20;apparmor:&#x20;#&#x20;apt-get&#x20;install&#x20;selinux-basics&#x20;Or:&#x20;#&#x20;apt-get&#x20;install&#x20;apparmor&#x20;apparmor-profiles&#x20;apparmor-utils','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2038,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(2039,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;,&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(2040,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(2041,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2042,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2043,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2044,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add:&#x20;[org/gnome/login-screen],&#x20;banner-message-enable=true,&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;','[{\"cis\": [\"1.7.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2045,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Notes:&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(2046,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetddaemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;apt-get&#x20;remove&#x20;xinetd&#x20;#&#x20;apt-get&#x20;purge&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2047,'Ensure&#x20;openbsd-inetd&#x20;is&#x20;not&#x20;installed','The&#x20;inetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;inetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openbsd-inetd:&#x20;apt-get&#x20;remove&#x20;openbsd-inetd','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2048,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;install&#x20;NTP&#x20;or&#x20;chrony&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;ntp&#x20;#&#x20;apt-get&#x20;install&#x20;chrony&#x20;&#x20;&#x20;&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2049,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;RUNASUSER=ntp','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2050,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2051,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt-get&#x20;remove&#x20;xserver-xorg*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(2052,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attach&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2053,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2054,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;isc-dhcp-server&#x20;#&#x20;systemctl&#x20;disable&#x20;isc-dhcp-server6','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2055,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2056,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind:&#x20;#&#x20;systemctl&#x20;disable&#x20;nfs-server&#x20;#&#x20;systemctl&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2057,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;systemctl&#x20;disable&#x20;bind9','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2058,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2059,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2:&#x20;#&#x20;systemctl&#x20;disable&#x20;apache2','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2060,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','exim&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;exim:&#x20;#&#x20;apt-get&#x20;remove&#x20;exim4;&#x20;#&#x20;apt-get&#x20;purge&#x20;exim4','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2061,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smbd:&#x20;#&#x20;systemctl&#x20;disable&#x20;smbd','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2062,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2063,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2064,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(2065,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;disable&#x20;rsync','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(2066,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;nis:&#x20;#&#x20;systemctl&#x20;disable&#x20;nis','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2067,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;the&#x20;nis&#x20;package:&#x20;#&#x20;apt-get&#x20;remove&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2068,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rshpackage&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rshpackage&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcpand&#x20;rlogin.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;apt-get&#x20;remove&#x20;rsh-client&#x20;rsh-redone-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2.6\", \"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2069,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talksoftware&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talkclient,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;apt-get&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2070,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;apt-get&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2.6\", \"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2071,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;apt-get&#x20;remove&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2072,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0&#x20;net.ipv6.conf.all.forwarding&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2073,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;net.ipv4.conf.all.send_redirects&#x20;and&#x20;net.ipv4.conf.default.send_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2074,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2075,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;and&#x20;net.ipv6.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2076,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2077,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2078,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2079,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2080,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2081,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2082,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2083,'Install&#x20;TCP&#x20;Wrappers','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Install&#x20;tcpd&#x20;:&#x20;#&#x20;apt-get&#x20;install&#x20;tcpd&#x20;To&#x20;verify&#x20;if&#x20;a&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;ldd&#x20;&lt;path-to-daemon&gt;&#x20;|&#x20;grep&#x20;libwrap.so&#x20;If&#x20;there&#x20;is&#x20;any&#x20;output,&#x20;then&#x20;the&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers.','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(2084,'Ensure&#x20;/etc/hosts.allow&#x20;is&#x20;configured','The&#x20;/etc/hosts.allow&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.deny&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;/etc/hosts.allow.&#x20;Where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#x20;&#40;for&#x20;example,&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;represents&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(2085,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.deny&#x20;file&#x20;serves&#x20;as&#x20;a&#x20;failsafe&#x20;so&#x20;that&#x20;any&#x20;host&#x20;not&#x20;specified&#x20;in&#x20;/etc/hosts.allow&#x20;is&#x20;denied&#x20;access&#x20;to&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(2086,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.allow','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2087,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.deny','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2088,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-&#x20;sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2089,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2090,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2091,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2092,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2093,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2094,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2095,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2096,'Ensure&#x20;iptables&#x20;is&#x20;installed','iptables&#x20;allows&#x20;configuration&#x20;of&#x20;the&#x20;IPv4&#x20;tables&#x20;in&#x20;the&#x20;linux&#x20;kernel&#x20;and&#x20;the&#x20;rules&#x20;stored&#x20;within&#x20;them.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;iptables.','iptables&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables:&#x20;#&#x20;apt-get&#x20;install&#x20;iptables','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2097,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Notes:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.4\"]}]'),(2098,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.4\"]}]'),(2099,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.4\"]}]'),(2100,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\"\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2101,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;or&#x20;lilo&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','1&#41;&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2102,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-&#x20;change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.3\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2103,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2104,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-&#x20;login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/sysconfig/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;Notes:&#x20;/etc/sysconfig/network&#x20;is&#x20;common&#x20;to&#x20;Red&#x20;Hat&#x20;and&#x20;SUSE&#x20;based&#x20;distributions.&#x20;You&#x20;should&#x20;expand&#x20;or&#x20;replace&#x20;this&#x20;coverage&#x20;to&#x20;any&#x20;network&#x20;configuration&#x20;files&#x20;on&#x20;your&#x20;system&#x20;such&#x20;as&#x20;/etc/network&#x20;on&#x20;Debian&#x20;based&#x20;distributions.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2105,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux/AppArmor&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','On&#x20;systems&#x20;using&#x20;SELinux&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;&#x20;|&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;On&#x20;systems&#x20;using&#x20;AppArmor&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;|&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2106,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2107,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;|&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2108,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2109,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2110,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2111,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"6,2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2112,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;|&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2113,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions.&#x20;Notes:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;sudisabled&#x20;&#40;See&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2114,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(2115,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-e&#x20;2.&#x20;Notes:&#x20;This&#x20;setting&#x20;will&#x20;ensure&#x20;reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\"]}]'),(2116,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2117,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(2118,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;:&#x20;*.*&#x20;@@loghost.example.com.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2119,'Ensure&#x20;remote&#x20;rsyslog&#x20;messages&#x20;are&#x20;only&#x20;accepted&#x20;on&#x20;designated&#x20;log&#x20;hosts','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:$ModLoad&#x20;imtcp&#x20;&amp;&#x20;$InputTCPServerRun&#x20;514.&#x20;For&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;comment&#x20;or&#x20;remove&#x20;the&#x20;following&#x20;lines:&#x20;#&#x20;$ModLoad&#x20;imtcp&#x20;#&#x20;$InputTCPServerRun&#x20;514.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"10.5.1\"]}]'),(2120,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;syslog-ng','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2121,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(2122,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2123,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;rsyslog&#x20;#&#x20;apt-get&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2124,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron:&#x20;systemctl&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2125,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2126,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2127,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2128,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2129,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2130,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2131,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2132,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-&#x20;privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2133,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','Older&#x20;versions&#x20;of&#x20;SSH&#x20;support&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.&#x20;Notes:&#x20;This&#x20;command&#x20;not&#x20;longer&#x20;exists&#x20;in&#x20;newer&#x20;versions&#x20;of&#x20;SSH.&#x20;This&#x20;check&#x20;is&#x20;still&#x20;being&#x20;included&#x20;for&#x20;systems&#x20;that&#x20;may&#x20;be&#x20;running&#x20;an&#x20;older&#x20;version&#x20;of&#x20;SSH.&#x20;As&#x20;of&#x20;openSSH&#x20;version&#x20;7.4&#x20;this&#x20;parameter&#x20;will&#x20;not&#x20;cause&#x20;an&#x20;issue&#x20;when&#x20;included.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2134,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;or&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2135,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2136,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2137,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhostsand&#x20;.shostsfiles&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthenticationor&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2138,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2139,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2140,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2141,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2142,'Ensure&#x20;only&#x20;strong&#x20;ciphers&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involving&#x20;LSB&#x20;values,&#x20;aka&#x20;the&#x20;&quot;Bar&#x20;Mitzvah&quot;&#x20;issue&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2143,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-&#x20;512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2144,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-&#x20;group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-&#x20;sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-&#x20;hellman-group-exchange-sha256','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2145,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(2146,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}]'),(2147,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}]'),(2148,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2149,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options:&#x20;-&#x20;retry=3&#x20;&#40;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure&#41;.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#40;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#41;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt-get&#x20;install&#x20;libpam-pwquality&#x20;2&#41;&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3&#x20;3&#41;&#x20;Edit&#x20;/etc/security/pwquality.conf&#x20;to&#x20;add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;settings&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;requirements&#x20;only&#x20;cover&#x20;including&#x20;try_first_pass&#x20;and&#x20;minlen&#x20;set&#x20;to&#x20;14&#x20;or&#x20;more.&#x20;Settings&#x20;in&#x20;/etc/security/pwquality.conf&#x20;must&#x20;use&#x20;spaces&#x20;around&#x20;the&#x20;=&#x20;symbol.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}]'),(2150,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900.&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;and&#x20;add&#x20;the&#x20;account&#x20;line&#x20;bellow:&#x20;account&#x20;&#x20;&#x20;&#x20;required&#x20;&#x20;&#x20;&#x20;pam_tally2.so.&#x20;Note:&#x20;If&#x20;a&#x20;user&#x20;has&#x20;been&#x20;locked&#x20;out&#x20;because&#x20;they&#x20;have&#x20;reached&#x20;the&#x20;maximum&#x20;consecutive&#x20;failure&#x20;count&#x20;defined&#x20;by&#x20;deny=&#x20;in&#x20;the&#x20;pam_tally2.so&#x20;module,&#x20;the&#x20;user&#x20;can&#x20;be&#x20;unlocked&#x20;by&#x20;issuing&#x20;the&#x20;command&#x20;/sbin/pam_tally2&#x20;-u&#x20;&lt;username&gt;&#x20;--reset.&#x20;This&#x20;command&#x20;sets&#x20;the&#x20;failed&#x20;count&#x20;to&#x20;0,&#x20;effectively&#x20;unlocking&#x20;the&#x20;user.&#x20;Notes:BUG&#x20;In&#x20;pam_tally2.so&#x20;To&#x20;work&#x20;around&#x20;this&#x20;issue&#x20;the&#x20;addition&#x20;of&#x20;pam_tally2.so&#x20;in&#x20;the&#x20;accounts&#x20;section&#x20;of&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;audit&#x20;and&#x20;remediation&#x20;sections.&#x20;pam_tally2&#x20;line&#x20;must&#x20;be&#x20;added&#x20;for&#x20;the&#x20;counter&#x20;to&#x20;reset&#x20;to&#x20;0&#x20;when&#x20;using&#x20;sudo.&#x20;&#x20;&#x20;&#x20;&#x20;Use&#x20;of&#x20;the&#x20;&quot;audit&quot;&#x20;keyword&#x20;may&#x20;log&#x20;credentials&#x20;in&#x20;the&#x20;case&#x20;of&#x20;user&#x20;error&#x20;during&#x20;authentication.&#x20;This&#x20;risk&#x20;should&#x20;be&#x20;evaluated&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;site&#x20;policies&#x20;of&#x20;your&#x20;organization.','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(2151,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(2152,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(2153,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;5th&#x20;field&#x20;should&#x20;be&#x20;365&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;will&#x20;disable&#x20;password&#x20;expiration.&#x20;Additionally&#x20;the&#x20;password&#x20;expiration&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;the&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;or&#x20;users&#x20;will&#x20;be&#x20;unable&#x20;to&#x20;change&#x20;their&#x20;password.','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2.4\"]}]'),(2154,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;4th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(2155,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;6th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(2156,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;7th&#x20;field&#x20;should&#x20;be&#x20;30&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;would&#x20;disable&#x20;this&#x20;setting.','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(2157,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(2158,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(2159,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;files,&#x20;and&#x20;/etc/profile.d*.sh&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(2160,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;sudo&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','1&#41;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;2&#41;&#x20;Create&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;users&#x20;in&#x20;the&#x20;sudo&#x20;statement&#x20;in&#x20;the&#x20;/etc/group&#x20;file:&#x20;sudo:x:10:root,&lt;user&#x20;list&gt;&#x20;Notes:&#x20;The&#x20;use_uid&#x20;option&#x20;to&#x20;pam_wheel.so&#x20;is&#x20;a&#x20;no-op&#x20;on&#x20;debian&#x20;based&#x20;systems.&#x20;It&#x20;is&#x20;acceptable&#x20;but&#x20;not&#x20;required&#x20;as&#x20;these&#x20;systems&#x20;use&#x20;its&#x20;behavior&#x20;as&#x20;default.','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2161,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2162,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/shadow-','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2163,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2164,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2165,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;one&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2166,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2167,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2168,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2169,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;&lt;username&gt;&lt;/em&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}]'),(2170,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2171,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2172,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2173,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2174,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"6.2.20\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2500,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/freevxfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2501,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/jffs2.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2502,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/hfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2503,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.confExample:&#x20;vi&#x20;/etc/modprobe.d/hfsplus.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2504,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/squashfs.confand&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfsmodule:&#x20;#&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2505,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2506,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/vfat.conf:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2507,'Ensure&#x20;/tmp&#x20;is&#x20;configured','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;or&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;systemctl&#x20;enable&#x20;tmp.mount&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount:&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2508,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodevto&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2509,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuidto&#x20;the&#x20;/tmp&#x20;mount&#x20;options:[Mount]&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2510,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexecto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexecto&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;[Mount]&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2511,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2512,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2513,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2514,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2515,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2516,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2517,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2518,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2519,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2520,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2521,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2522,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2.6\", \"8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2523,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;autofs&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;autofs:&#x20;&#x20;#&#x20;apt&#x20;purge&#x20;autofs','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2524,'Disable&#x20;USB&#x20;Storage','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/usb_storage.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;#&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;#&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\"]}]'),(2525,'Ensure&#x20;sudo&#x20;is&#x20;installed','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Install&#x20;sudo&#x20;using&#x20;the&#x20;following&#x20;command.&#x20;#&#x20;apt&#x20;install&#x20;sudo&#x20;OR&#x20;#&#x20;apt&#x20;install&#x20;sudo-ldap','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2526,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;froma&#x20;pseudo-pty','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2527,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;&#x20;&#x20;&#x20;Example&#x20;&#x20;&#x20;&#x20;Defaults&#x20;logfile=&quot;/var/log/sudo.log&quot;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2528,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Install&#x20;AIDE:&#x20;#&#x20;apt&#x20;install&#x20;aide&#x20;aide-common.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit&#x20;.&#x20;&#x20;Notes:&#x20;The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;AIDE&#x20;because&#x20;it&#x20;alters&#x20;binaries&#x20;to&#x20;speed&#x20;up&#x20;their&#x20;start&#x20;up&#x20;times.&#x20;Run&#x20;prelink&#x20;-ua&#x20;to&#x20;restore&#x20;the&#x20;binaries&#x20;to&#x20;their&#x20;prelinked&#x20;state,&#x20;thus&#x20;avoiding&#x20;false&#x20;positives&#x20;from&#x20;AIDE.','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2529,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;&#x20;&#x20;&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;&#x20;&#x20;&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2530,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg,&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2531,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2&#x20;:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;&#x20;&#x20;&#x20;&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;PBKDF2&#x20;hash&#x20;of&#x20;your&#x20;password&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;&#x20;&#x20;&#x20;&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;&#x20;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;EOF&#x20;&#x20;&#x20;&#x20;&#x20;The&#x20;superuser/user&#x20;information&#x20;and&#x20;password&#x20;should&#x20;not&#x20;be&#x20;contained&#x20;in&#x20;the&#x20;/etc/grub.d/00_header&#x20;file&#x20;as&#x20;this&#x20;file&#x20;could&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;package&#x20;update.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;requirement&#x20;to&#x20;be&#x20;able&#x20;to&#x20;boot/reboot&#x20;without&#x20;entering&#x20;the&#x20;password,&#x20;edit&#x20;/etc/grub.d/10_linux&#x20;and&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;line&#x20;CLASS=&#x20;&#x20;Example:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2532,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2533,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2534,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2535,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;Uninstall&#x20;prelink&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;purge&#x20;prelink','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2536,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.6.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2537,'Ensure&#x20;AppArmor&#x20;is&#x20;installed','AppArmor&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Install&#x20;Apparmor.&#x20;#&#x20;apt&#x20;install&#x20;apparmor&#x20;#&#x20;apt&#x20;install&#x20;apparmor-utils','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2538,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwrittenby&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;apparmor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration&#x20;#&#x20;update-grub&#x20;&#x20;&#x20;&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2539,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;in&#x20;enforce&#x20;or&#x20;complain&#x20;mode','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;complain&#x20;mode:&#x20;#&#x20;aa-complain&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2540,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2541,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;OR&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(2542,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;,&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(2543,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(2544,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/motd','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2545,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2546,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2547,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add:&#x20;[org/gnome/login-screen],&#x20;banner-message-enable=true,&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;','[{\"cis\": [\"1.8.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2548,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Notes:&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.','[{\"cis\": [\"1.9\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(2549,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetddaemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;apt&#x20;purge&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2550,'Ensure&#x20;openbsd-inetd&#x20;is&#x20;not&#x20;installed','The&#x20;inetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;inetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openbsd-inetd:&#x20;apt&#x20;purge&#x20;openbsd-inetd','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2551,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available,&#x20;configure&#x20;systemd-timesyncd.&#x20;If&#x20;&quot;full&#x20;featured&quot;&#x20;and/or&#x20;encrypted&#x20;time&#x20;synchronization&#x20;is&#x20;required,&#x20;install&#x20;chrony&#x20;or&#x20;NTP.&#x20;To&#x20;install&#x20;chrony:&#x20;#&#x20;apt&#x20;install&#x20;chrony&#x20;To&#x20;install&#x20;ntp:&#x20;#&#x20;apt&#x20;install&#x20;ntp&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2552,'Ensure&#x20;systemd-timesyncd&#x20;is&#x20;configured','systemd-timesyncd&#x20;is&#x20;a&#x20;daemon&#x20;that&#x20;has&#x20;been&#x20;added&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.&#x20;It&#x20;implements&#x20;an&#x20;SNTP&#x20;client.&#x20;In&#x20;contrast&#x20;to&#x20;NTP&#x20;implementations&#x20;such&#x20;as&#x20;chrony&#x20;or&#x20;the&#x20;NTP&#x20;reference&#x20;server&#x20;this&#x20;only&#x20;implements&#x20;a&#x20;client&#x20;side,&#x20;and&#x20;does&#x20;not&#x20;bother&#x20;with&#x20;the&#x20;full&#x20;NTP&#x20;complexity,&#x20;focusing&#x20;only&#x20;on&#x20;querying&#x20;time&#x20;from&#x20;one&#x20;remote&#x20;server&#x20;and&#x20;synchronizing&#x20;the&#x20;local&#x20;clock&#x20;to&#x20;it.&#x20;The&#x20;daemon&#x20;runs&#x20;with&#x20;minimal&#x20;privileges,&#x20;and&#x20;has&#x20;been&#x20;hooked&#x20;up&#x20;with&#x20;networkd&#x20;to&#x20;only&#x20;operate&#x20;when&#x20;network&#x20;connectivity&#x20;is&#x20;available.&#x20;The&#x20;daemon&#x20;saves&#x20;the&#x20;current&#x20;clock&#x20;to&#x20;disk&#x20;every&#x20;time&#x20;a&#x20;new&#x20;NTP&#x20;sync&#x20;has&#x20;been&#x20;acquired,&#x20;and&#x20;uses&#x20;this&#x20;to&#x20;possibly&#x20;correct&#x20;the&#x20;system&#x20;clock&#x20;early&#x20;at&#x20;bootup,&#x20;in&#x20;order&#x20;to&#x20;accommodate&#x20;for&#x20;systems&#x20;that&#x20;lack&#x20;an&#x20;RTC&#x20;such&#x20;as&#x20;the&#x20;Raspberry&#x20;Pi&#x20;and&#x20;embedded&#x20;devices,&#x20;and&#x20;make&#x20;sure&#x20;that&#x20;time&#x20;monotonically&#x20;progresses&#x20;on&#x20;these&#x20;systems,&#x20;even&#x20;if&#x20;it&#x20;is&#x20;not&#x20;always&#x20;correct.&#x20;To&#x20;make&#x20;use&#x20;of&#x20;this&#x20;daemon&#x20;a&#x20;new&#x20;system&#x20;user&#x20;and&#x20;group&#x20;&quot;systemd-&#x20;timesync&quot;&#x20;needs&#x20;to&#x20;be&#x20;created&#x20;on&#x20;installation&#x20;of&#x20;systemd.&#x20;Note:&#x20;The&#x20;systemd-timesyncd&#x20;service&#x20;specifically&#x20;implements&#x20;only&#x20;SNTP.&#x20;This&#x20;minimalistic&#x20;service&#x20;will&#x20;set&#x20;the&#x20;system&#x20;clock&#x20;for&#x20;large&#x20;offsets&#x20;or&#x20;slowly&#x20;adjust&#x20;it&#x20;for&#x20;smaller&#x20;deltas.&#x20;More&#x20;complex&#x20;use&#x20;cases&#x20;are&#x20;not&#x20;covered&#x20;by&#x20;systemd-timesyncd.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','Proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;systemd-timesyncd&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;systemd-timesyncd.service&#x20;&#x20;||&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/systemd/timesyncd.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;NTP=0.debian.pool.ntp.org&#x20;1.debian.pool.ntp.org&#x20;&#x20;&#x20;FallbackNTP=2.debian.pool.ntp.org&#x20;3.debian.pool.ntp.org&#x20;&#x20;&#x20;&#x20;RootDistanceMax=1&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;start&#x20;systemd-timesyncd.service&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;start&#x20;systemd-timesyncd.service&#x20;&#x20;&#x20;#&#x20;timedatectl&#x20;set-ntp&#x20;true&#x20;&#x20;||&#x20;Notes:&#x20;Servers&#x20;listed&#x20;and&#x20;RootDistanceMax&#x20;should&#x20;be&#x20;In&#x20;Accordance&#x20;With&#x20;Local&#x20;Policy&#x20;some&#x20;versions&#x20;of&#x20;systemd&#x20;have&#x20;been&#x20;compiled&#x20;without&#x20;systemd-timesycnd.&#x20;On&#x20;these&#x20;distributions,&#x20;chrony&#x20;or&#x20;NTP&#x20;should&#x20;be&#x20;used&#x20;instead&#x20;of&#x20;systemd-timesycnd.&#x20;Not&#x20;all&#x20;options&#x20;are&#x20;available&#x20;on&#x20;all&#x20;versions&#x20;of&#x20;systemd-timesyncd','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2553,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;chrony&#x20;to&#x20;run&#x20;as&#x20;the&#x20;chrony&#x20;user&#x20;by&#x20;configuring&#x20;the&#x20;appropriate&#x20;startup&#x20;script&#x20;for&#x20;your&#x20;distribution.&#x20;Startup&#x20;scripts&#x20;are&#x20;typically&#x20;stored&#x20;in&#x20;/etc/init.d&#x20;or&#x20;/etc/systemd&#x20;.','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2554,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;RUNASUSER=ntp','[{\"cis\": [\"2.2.1.4\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2555,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt&#x20;purge&#x20;xserver-xorg*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(2556,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attach&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2557,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2558,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;isc-dhcp-server&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;isc-dhcp-server6','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2559,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2560,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;nfs-server&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2561,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;bind9','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2562,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2563,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;apache2','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2564,'Ensure&#x20;email&#x20;services&#x20;are&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;mail&#x20;submission&#x20;and&#x20;transport&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;mail&#x20;transport&#x20;services&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;or&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dovecot&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;dovecot','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2565,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smbd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;smbd','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2566,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2567,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2568,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/exim4/update-exim4.conf.conf&#x20;and&#x20;and&#x20;or&#x20;modify&#x20;following&#x20;lines&#x20;to&#x20;look&#x20;like&#x20;the&#x20;lines&#x20;below:&#x20;dc_eximconfig_configtype=&#039;local&#039;&#x20;dc_local_interfaces=&#039;127.0.0.1&#x20;;&#x20;::1&#039;&#x20;dc_readhost=&#039;&#039;&#x20;dc_relay_domains=&#039;&#039;&#x20;dc_minimaldns=&#039;false&#039;&#x20;dc_relay_nets=&#039;&#039;&#x20;dc_smarthost=&#039;&#039;&#x20;dc_use_split_config=&#039;false&#039;&#x20;dc_hide_mailname=&#039;&#039;&#x20;dc_mailname_in_oh=&#039;true&#039;&#x20;dc_localdelivery=&#039;mail_spool&#039;&#x20;Restart&#x20;exim4:&#x20;#&#x20;systemctl&#x20;restart&#x20;exim4','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(2569,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rsync','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(2570,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;nis:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;nis','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2571,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;nis&#x20;:&#x20;apt&#x20;purge&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2572,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rsh-client&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Uninstall&#x20;rsh&#x20;:&#x20;apt&#x20;purge&#x20;rsh-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2573,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talkclient,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Uninstall&#x20;talk&#x20;:&#x20;apt&#x20;purge&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2574,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Uninstall&#x20;telnet&#x20;:&#x20;#&#x20;apt&#x20;purge&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2575,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Uninstall&#x20;ldap-utils&#x20;:&#x20;#&#x20;apt&#x20;purge&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2576,'Disable&#x20;IPv6','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.6\", \"CC5.2\"]}]'),(2577,'Ensure&#x20;wireless&#x20;interfaces&#x20;are&#x20;disabled','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.&#x20;Debian&#x20;contains&#x20;a&#x20;wireless&#x20;tool&#x20;kit&#x20;to&#x20;allow&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;and&#x20;use&#x20;wireless&#x20;networks.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;any&#x20;wireless&#x20;interfaces:&#x20;#&#x20;nmcli&#x20;radio&#x20;all&#x20;off','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2578,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2579,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.ip_forwards*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv6.conf.all.forwardings*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv6.conf.all.forwardings*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2580,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2581,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2582,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2583,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2584,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2585,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2586,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2587,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2588,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2589,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-&#x20;sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2590,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2591,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2592,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2593,'Ensure&#x20;a&#x20;Firewall&#x20;package&#x20;is&#x20;installed','A&#x20;Firewall&#x20;package&#x20;should&#x20;be&#x20;selected.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;nftables&#x20;or&#x20;iptables.','A&#x20;Firewall&#x20;package&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;the&#x20;Firewall&#x20;package&#x20;that&#x20;follows&#x20;local&#x20;site&#x20;policy:&#x20;To&#x20;install&#x20;UFW&#x20;,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;apt&#x20;install&#x20;ufw&#x20;To&#x20;install&#x20;nftables&#x20;,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;apt&#x20;install&#x20;nftables&#x20;To&#x20;install&#x20;iptables&#x20;,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;apt&#x20;install&#x20;iptables','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2594,'Ensure&#x20;ufw&#x20;service&#x20;is&#x20;enabled','UncomplicatedFirewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;and&#x20;available&#x20;graphical&#x20;user&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.&#x20;Ensure&#x20;that&#x20;the&#x20;ufw&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;protect&#x20;your&#x20;system.','The&#x20;ufw&#x20;service&#x20;must&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;for&#x20;ufw&#x20;to&#x20;protect&#x20;the&#x20;system','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;ufw:&#x20;#&#x20;ufw&#x20;enable','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2595,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;deny&#x20;policy:&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;incoming&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;outgoing&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;routed','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2596,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ufw&#x20;allow&#x20;in&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;allow&#x20;out&#x20;on&#x20;lo&#x20;#&#x20;sudo&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;127.0.0.0/8&#x20;#&#x20;sudo&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;::1','[{\"cis\": [\"3.5.2.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2597,'Ensure&#x20;a&#x20;table&#x20;exists','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;.Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.5.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2598,'Ensure&#x20;base&#x20;chains&#x20;exist','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.5.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2599,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept&#x20;,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;;&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;and&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.5.3.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2600,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.3.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2601,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.4.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2602,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.4.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(2603,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.5.4.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2604,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.4.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(2605,'Ensure&#x20;auditd&#x20;is&#x20;installed','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;apt&#x20;install&#x20;auditd&#x20;audispd-plugins','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2606,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Enable&#x20;and&#x20;start&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2607,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2608,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Notes:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2609,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2610,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(2611,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-&#x20;change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2612,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2613,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-&#x20;login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/sysconfig/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;&#x20;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2614,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;AppArmor&#x20;mandatory&#x20;access&#x20;control.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','On&#x20;systems&#x20;using&#x20;AppArmor&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;|&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2615,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2616,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;|&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2617,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2618,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/directory&#x20;ending&#x20;in&#x20;.rules&#x20;&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/audit.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;|&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/access.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;|&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;|&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;|&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;toset&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2619,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2620,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"6.2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(2621,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;|&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(2622,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;&lt;Path&#x20;to&#x20;sudo&#x20;logfile&gt;&#x20;-p&#x20;wa&#x20;-k&#x20;actions.&#x20;Notes:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;sudisabled&#x20;&#40;See&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2623,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(2624,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line:&#x20;-e&#x20;2.&#x20;Notes:&#x20;This&#x20;setting&#x20;will&#x20;ensure&#x20;reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2625,'Ensure&#x20;rsyslog&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslogsuch&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog:&#x20;#&#x20;apt&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2626,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2627,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(2628,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;one&#x20;of&#x20;the&#x20;following&#x20;lines:&#x20;Newer&#x20;syntax:&#x20;&lt;files&#x20;to&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;log&#x20;server&gt;&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;&lt;FQDN&#x20;or&#x20;ip&#x20;of&#x20;loghost&gt;&quot;&#x20;port=&quot;&lt;port&#x20;number&gt;&quot;&#x20;protocol=&quot;tcp&quot;&#x20;ction.resumeRetryCount=&quot;&lt;number&#x20;of&#x20;re-tries&gt;&quot;&#x20;&#x20;queue.type=&quot;linkList&quot;&#x20;queue.size=&lt;number&#x20;of&#x20;messages&#x20;to&#x20;queue&gt;&quot;&#41;&#x20;Example:&#x20;*.*&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;192.168.2.100&quot;&#x20;port&quot;514&quot;&#x20;protocol=&quot;tcp&quot;&#x20;action.resumeRetryCount=&quot;100&quot;&#x20;queue.type=&quot;linkList&quot;&#x20;queue.size=&quot;1000&quot;&#41;&#x20;Older&#x20;syntax:&#x20;*.*&#x20;@@&lt;FQDN&#x20;or&#x20;ip&#x20;of&#x20;loghost&gt;','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2629,'Ensure&#x20;remote&#x20;rsyslog&#x20;messages&#x20;are&#x20;only&#x20;accepted&#x20;on&#x20;designated&#x20;log&#x20;hosts','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;$ModLoad&#x20;imtcp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;$InputTCPServerRun&#x20;514.&#x20;For&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;comment&#x20;or&#x20;remove&#x20;the&#x20;following&#x20;lines:&#x20;#&#x20;$ModLoad&#x20;imtcp&#x20;#&#x20;$InputTCPServerRun&#x20;514.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"10.5.1\"]}]'),(2630,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(2631,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2632,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Storage=persistent','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2633,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitivebdata&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;&quot;{}&quot;&#x20;+&#x20;-o&#x20;-type&#x20;d&#x20;-exec&#x20;chmod&#x20;g-w,o-rwx&#x20;&quot;{}&quot;&#x20;+','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(2634,'Ensure&#x20;logrotate&#x20;assigns&#x20;appropriate&#x20;permissions','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;/etc/logrotate.conf&#x20;and&#x20;update&#x20;the&#x20;create&#x20;line&#x20;to&#x20;read&#x20;0640&#x20;or&#x20;more&#x20;restrictive,&#x20;following&#x20;local&#x20;site&#x20;policy&#x20;&#x20;&#x20;Example:&#x20;create&#x20;0640&#x20;root&#x20;utmp','[{\"cis\": [\"4.4\"]}, {\"cis_csc\": [\"14.6\"]}]'),(2635,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron:&#x20;systemctl&#x20;--now&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2636,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2637,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2638,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2639,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2640,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2641,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2642,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2643,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-&#x20;privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2644,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;0600&#x20;{}&#x20;;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2645,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;public&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;0644&#x20;{}&#x20;;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2646,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;not&#x20;set&#x20;to&#x20;1','Older&#x20;versions&#x20;of&#x20;SSH&#x20;support&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.&#x20;Notes:&#x20;This&#x20;command&#x20;not&#x20;longer&#x20;exists&#x20;in&#x20;newer&#x20;versions&#x20;of&#x20;SSH.&#x20;This&#x20;check&#x20;is&#x20;still&#x20;being&#x20;included&#x20;for&#x20;systems&#x20;that&#x20;may&#x20;be&#x20;running&#x20;an&#x20;older&#x20;version&#x20;of&#x20;SSH.&#x20;As&#x20;of&#x20;openSSH&#x20;version&#x20;7.4&#x20;this&#x20;parameter&#x20;will&#x20;not&#x20;cause&#x20;an&#x20;issue&#x20;when&#x20;included.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"4.5\", \"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2647,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;or&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2648,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2649,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2650,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhostsand&#x20;.shostsfiles&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthenticationor&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2651,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2652,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2653,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(2654,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2655,'Ensure&#x20;only&#x20;strong&#x20;ciphers&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involving&#x20;LSB&#x20;values,&#x20;aka&#x20;the&#x20;&quot;Bar&#x20;Mitzvah&quot;&#x20;issue&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2656,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2657,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(2658,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(2659,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2660,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2661,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2662,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2663,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(2664,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;maxstartups&#x20;10:30:60','[{\"cis\": [\"5.2.22\"]}, {\"cis_csc\": [\"5.1\"]}]'),(2665,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;limited','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2666,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options:&#x20;-&#x20;retry=3&#x20;&#40;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure&#41;.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#40;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#41;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt&#x20;install&#x20;libpam-pwquality&#x20;2&#41;&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3&#x20;3&#41;&#x20;Edit&#x20;/etc/security/pwquality.conf&#x20;to&#x20;add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;settings&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;requirements&#x20;only&#x20;cover&#x20;including&#x20;try_first_pass&#x20;and&#x20;minlen&#x20;set&#x20;to&#x20;14&#x20;or&#x20;more.&#x20;Settings&#x20;in&#x20;/etc/security/pwquality.conf&#x20;must&#x20;use&#x20;spaces&#x20;around&#x20;the&#x20;=&#x20;symbol.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2667,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900.&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;and&#x20;add&#x20;the&#x20;account&#x20;lines&#x20;below:&#x20;account&#x20;&#x20;&#x20;&#x20;requisite&#x20;&#x20;&#x20;&#x20;pam_deny.so&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;account&#x20;&#x20;&#x20;&#x20;required&#x20;&#x20;&#x20;&#x20;pam_tally2.so.&#x20;Note:&#x20;If&#x20;a&#x20;user&#x20;has&#x20;been&#x20;locked&#x20;out&#x20;because&#x20;they&#x20;have&#x20;reached&#x20;the&#x20;maximum&#x20;consecutive&#x20;failure&#x20;count&#x20;defined&#x20;by&#x20;deny=&#x20;in&#x20;the&#x20;pam_tally2.so&#x20;module,&#x20;the&#x20;user&#x20;can&#x20;be&#x20;unlocked&#x20;by&#x20;issuing&#x20;the&#x20;command&#x20;/sbin/pam_tally2&#x20;-u&#x20;&lt;username&gt;&#x20;--reset.&#x20;This&#x20;command&#x20;sets&#x20;the&#x20;failed&#x20;count&#x20;to&#x20;0,&#x20;effectively&#x20;unlocking&#x20;the&#x20;user.&#x20;Notes:BUG&#x20;In&#x20;pam_tally2.so&#x20;To&#x20;work&#x20;around&#x20;this&#x20;issue&#x20;the&#x20;addition&#x20;of&#x20;pam_tally2.so&#x20;in&#x20;the&#x20;accounts&#x20;section&#x20;of&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;audit&#x20;and&#x20;remediation&#x20;sections.&#x20;pam_tally2&#x20;line&#x20;must&#x20;be&#x20;added&#x20;for&#x20;the&#x20;counter&#x20;to&#x20;reset&#x20;to&#x20;0&#x20;when&#x20;using&#x20;sudo.&#x20;&#x20;&#x20;&#x20;&#x20;Use&#x20;of&#x20;the&#x20;&quot;audit&quot;&#x20;keyword&#x20;may&#x20;log&#x20;credentials&#x20;in&#x20;the&#x20;case&#x20;of&#x20;user&#x20;error&#x20;during&#x20;authentication.&#x20;This&#x20;risk&#x20;should&#x20;be&#x20;evaluated&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;site&#x20;policies&#x20;of&#x20;your&#x20;organization.','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2668,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2669,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(2670,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;5th&#x20;field&#x20;should&#x20;be&#x20;365&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;will&#x20;disable&#x20;password&#x20;expiration.&#x20;Additionally&#x20;the&#x20;password&#x20;expiration&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;the&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;or&#x20;users&#x20;will&#x20;be&#x20;unable&#x20;to&#x20;change&#x20;their&#x20;password.','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2671,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;4th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2672,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;6th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2673,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;7th&#x20;field&#x20;should&#x20;be&#x20;30&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;would&#x20;disable&#x20;this&#x20;setting.','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2674,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2675,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2676,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;readonly&#x20;TMOUT=900&#x20;;&#x20;export&#x20;TMOUT&#x20;.&#x20;Note&#x20;that&#x20;setting&#x20;the&#x20;value&#x20;to&#x20;readonly&#x20;prevents&#x20;unwanted&#x20;modification&#x20;during&#x20;runtime.','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(2677,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;sudo&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Create&#x20;an&#x20;empty&#x20;group&#x20;that&#x20;will&#x20;be&#x20;specified&#x20;for&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command.&#x20;The&#x20;group&#x20;should&#x20;be&#x20;named&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example&#x20;#&#x20;groupadd&#x20;sugroup&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file,&#x20;specifying&#x20;the&#x20;empty&#x20;group:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;group=sugroup','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2678,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2679,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2680,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;one&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2681,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2682,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2683,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2684,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2685,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(2686,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;&lt;username&gt;&lt;/em&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(2687,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2688,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2689,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(2690,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(2691,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"6.2.20\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(3000,'SSH&#x20;Hardening:&#x20;Port&#x20;should&#x20;not&#x20;be&#x20;22','The&#x20;ssh&#x20;daemon&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;on&#x20;port&#x20;22&#x20;&#40;the&#x20;default&#x20;value&#41;&#x20;for&#x20;incoming&#x20;connections.','Changing&#x20;the&#x20;default&#x20;port&#x20;you&#x20;may&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;successful&#x20;attacks&#x20;from&#x20;zombie&#x20;bots,&#x20;an&#x20;attacker&#x20;or&#x20;bot&#x20;doing&#x20;port-scanning&#x20;can&#x20;quickly&#x20;identify&#x20;your&#x20;SSH&#x20;port.','','Change&#x20;the&#x20;Port&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3001,'SSH&#x20;Hardening:&#x20;Protocol&#x20;should&#x20;be&#x20;set&#x20;to&#x20;2','The&#x20;SSH&#x20;protocol&#x20;should&#x20;not&#x20;be&#x20;1.','The&#x20;Protocol&#x20;parameter&#x20;dictates&#x20;which&#x20;version&#x20;of&#x20;the&#x20;SSH&#x20;communication&#x20;and&#x20;encryption&#x20;protocols&#x20;are&#x20;in&#x20;use.&#x20;Version&#x20;1&#x20;of&#x20;the&#x20;SSH&#x20;protocol&#x20;has&#x20;weaknesses.','','Change&#x20;the&#x20;Protocol&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3002,'SSH&#x20;Hardening:&#x20;Root&#x20;account&#x20;should&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;in','The&#x20;option&#x20;PermitRootLogin&#x20;should&#x20;be&#x20;set&#x20;to&#x20;no.','The&#x20;option&#x20;PermitRootLogin&#x20;specifies&#x20;whether&#x20;root&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;If&#x20;you&#x20;want&#x20;log&#x20;in&#x20;as&#x20;root,&#x20;you&#x20;should&#x20;use&#x20;the&#x20;option&#x20;&quot;Match&quot;&#x20;and&#x20;restrict&#x20;it&#x20;to&#x20;a&#x20;few&#x20;IP&#x20;addresses.','','Change&#x20;the&#x20;PermitRootLogin&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','\"\"'),(3003,'SSH&#x20;Hardening:&#x20;No&#x20;Public&#x20;Key&#x20;authentication','The&#x20;option&#x20;PubkeyAuthentication&#x20;should&#x20;be&#x20;set&#x20;yes.','Access&#x20;only&#x20;by&#x20;public&#x20;key.&#x20;Generally&#x20;people&#x20;will&#x20;use&#x20;weak&#x20;passwords&#x20;and&#x20;have&#x20;poor&#x20;password&#x20;practices.&#x20;Keys&#x20;are&#x20;considered&#x20;stronger&#x20;than&#x20;password.','','Change&#x20;the&#x20;PubkeyAuthentication&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3004,'SSH&#x20;Hardening:&#x20;Password&#x20;Authentication&#x20;should&#x20;be&#x20;disabled','The&#x20;option&#x20;PasswordAuthentication&#x20;should&#x20;be&#x20;set&#x20;to&#x20;no.','The&#x20;option&#x20;PasswordAuthentication&#x20;specifies&#x20;whether&#x20;we&#x20;should&#x20;use&#x20;password-based&#x20;authentication.&#x20;Use&#x20;public&#x20;key&#x20;authentication&#x20;instead&#x20;of&#x20;passwords.','','Change&#x20;the&#x20;PasswordAuthentication&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3005,'SSH&#x20;Hardening:&#x20;Empty&#x20;passwords&#x20;should&#x20;not&#x20;be&#x20;allowed','The&#x20;option&#x20;PermitEmptyPasswords&#x20;should&#x20;be&#x20;set&#x20;to&#x20;no.','The&#x20;option&#x20;PermitEmptyPasswords&#x20;specifies&#x20;whether&#x20;the&#x20;server&#x20;allows&#x20;logging&#x20;in&#x20;to&#x20;accounts&#x20;with&#x20;a&#x20;null&#x20;password.&#x20;Accounts&#x20;with&#x20;null&#x20;passwords&#x20;are&#x20;a&#x20;bad&#x20;practice.','','Change&#x20;the&#x20;PermitEmptyPasswords&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3006,'SSH&#x20;Hardening:&#x20;Rhost&#x20;or&#x20;shost&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;authentication','The&#x20;option&#x20;IgnoreRhosts&#x20;should&#x20;be&#x20;set&#x20;to&#x20;yes.','The&#x20;option&#x20;IgnoreRhosts&#x20;specifies&#x20;whether&#x20;rhosts&#x20;or&#x20;shosts&#x20;files&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;authentication.&#x20;For&#x20;security&#x20;reasons&#x20;it&#x20;is&#x20;recommended&#x20;to&#x20;no&#x20;use&#x20;rhosts&#x20;or&#x20;shosts&#x20;files&#x20;for&#x20;authentication.','','Change&#x20;the&#x20;IgnoreRhosts&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3007,'SSH&#x20;Hardening:&#x20;Grace&#x20;Time&#x20;should&#x20;be&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;option&#x20;LoginGraceTime&#x20;should&#x20;be&#x20;set&#x20;to&#x20;60&#x20;or&#x20;less.','The&#x20;option&#x20;LoginGraceTime&#x20;specifies&#x20;how&#x20;long&#x20;in&#x20;seconds&#x20;after&#x20;a&#x20;connection&#x20;request&#x20;the&#x20;server&#x20;will&#x20;wait&#x20;before&#x20;disconnecting&#x20;if&#x20;the&#x20;user&#x20;has&#x20;not&#x20;successfully&#x20;logged&#x20;in.&#x20;30&#x20;seconds&#x20;is&#x20;the&#x20;recommended&#x20;time&#x20;for&#x20;avoiding&#x20;open&#x20;connections&#x20;without&#x20;authenticate.','','Change&#x20;the&#x20;LoginGraceTime&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3008,'SSH&#x20;Hardening:&#x20;Wrong&#x20;Maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts','The&#x20;option&#x20;MaxAuthTries&#x20;should&#x20;be&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;Once&#x20;the&#x20;number&#x20;of&#x20;failures&#x20;reaches&#x20;half&#x20;this&#x20;value,&#x20;additional&#x20;failures&#x20;are&#x20;logged.&#x20;This&#x20;should&#x20;be&#x20;set&#x20;to&#x20;4.','','Change&#x20;the&#x20;MaxAuthTries&#x20;option&#x20;value&#x20;in&#x20;the&#x20;sshd_config&#x20;file.','[{\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3009,'SSH&#x20;Hardening:&#x20;Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv&#x20;,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3010,'Ensure&#x20;retry&#x20;option&#x20;for&#x20;passwords&#x20;is&#x20;less&#x20;than&#x20;3','The&#x20;pam_pwquality.so&#x20;module&#x20;and&#x20;pam_cracklib.so&#x20;module&#x20;&#40;depending&#x20;on&#x20;the&#x20;Linux&#x20;distribution&#x20;used&#41;&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;and&#x20;/etc/security/pwquality.conf&#x20;files,&#x20;or&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files,&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;or&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.','[{\"cis_csc\": [\"4.4\", \"5.7\", \"16.12\"]}]'),(3011,'Ensure&#x20;passwords&#x20;are&#x20;longer&#x20;than&#x20;14&#x20;characters','The&#x20;pam_pwquality.so&#x20;module&#x20;and&#x20;pam_cracklib.so&#x20;module&#x20;&#40;depending&#x20;on&#x20;the&#x20;Linux&#x20;distribution&#x20;used&#41;&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;and&#x20;/etc/security/pwquality.conf&#x20;files,&#x20;or&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files,&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;or&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.','[{\"cis_csc\": [\"4.4\", \"5.7\", \"16.12\"]}]'),(3012,'Ensure&#x20;passwords&#x20;contain&#x20;at&#x20;least&#x20;one&#x20;digit','The&#x20;pam_pwquality.so&#x20;module&#x20;and&#x20;pam_cracklib.so&#x20;module&#x20;&#40;depending&#x20;on&#x20;the&#x20;Linux&#x20;distribution&#x20;used&#41;&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;and&#x20;/etc/security/pwquality.conf&#x20;files,&#x20;or&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files,&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;or&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.','[{\"cis_csc\": [\"4.4\", \"5.7\", \"16.12\"]}]'),(3013,'Ensure&#x20;passwords&#x20;contain&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character','The&#x20;pam_pwquality.so&#x20;module&#x20;and&#x20;pam_cracklib.so&#x20;module&#x20;&#40;depending&#x20;on&#x20;the&#x20;Linux&#x20;distribution&#x20;used&#41;&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;and&#x20;/etc/security/pwquality.conf&#x20;files,&#x20;or&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files,&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;or&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.','[{\"cis_csc\": [\"4.4\", \"5.7\", \"16.12\"]}]'),(3014,'Ensure&#x20;passwords&#x20;contain&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character','The&#x20;pam_pwquality.so&#x20;module&#x20;and&#x20;pam_cracklib.so&#x20;module&#x20;&#40;depending&#x20;on&#x20;the&#x20;Linux&#x20;distribution&#x20;used&#41;&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;and&#x20;/etc/security/pwquality.conf&#x20;files,&#x20;or&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files,&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;or&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.','[{\"cis_csc\": [\"4.4\", \"5.7\", \"16.12\"]}]'),(3015,'Ensure&#x20;passwords&#x20;contain&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character','The&#x20;pam_pwquality.so&#x20;module&#x20;and&#x20;pam_cracklib.so&#x20;module&#x20;&#40;depending&#x20;on&#x20;the&#x20;Linux&#x20;distribution&#x20;used&#41;&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;and&#x20;/etc/security/pwquality.conf&#x20;files,&#x20;or&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files,&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;or&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.','[{\"cis_csc\": [\"4.4\", \"5.7\", \"16.12\"]}]'),(3016,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;#auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900','\"\"'),(3017,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_unix.so&#x20;sha512','[{\"cis_csc\": [\"16.14\"]}]'),(3018,'Ensure&#x20;passwords&#x20;in&#x20;/etc/shadow&#x20;are&#x20;hashed&#x20;with&#x20;SHA-512&#x20;or&#x20;SHA-256','SHA-512&#x20;and&#x20;SHA-256&#x20;are&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithms&#x20;than&#x20;MD5.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.','','Set&#x20;the&#x20;default&#x20;algorithm&#x20;for&#x20;password&#x20;hashing&#x20;in&#x20;/etc/shadow&#x20;to&#x20;SHA-512&#x20;or&#x20;SHA-256.','\"\"'),(3019,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs.','[{\"cis_csc\": [\"4.4\", \"16\"]}]'),(3020,'Ensure&#x20;SELinux&#x20;or&#x20;AppArmor&#x20;are&#x20;installed','SELinux&#x20;and&#x20;AppArmor&#x20;provide&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;SELinux&#x20;or&#x20;apparmor:&#x20;#&#x20;apt-get&#x20;install&#x20;selinux-basics&#x20;Or:&#x20;#&#x20;apt-get&#x20;install&#x20;apparmor&#x20;apparmor-profiles&#x20;apparmor-utils','[{\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(3021,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;disable&#x20;cups','[{\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(3022,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;enable&#x20;auditd','[{\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(3500,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;check&#x20;the&#x20;box&#x20;to&#x20;&#039;Review&#x20;and&#x20;modify&#x20;partitioning&#039;&#x20;and&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.1\"]}]'),(3501,'Set&#x20;nodev&#x20;option&#x20;for&#x20;/tmp&#x20;Partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3502,'Set&#x20;nosuid&#x20;option&#x20;for&#x20;/tmp&#x20;Partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.','[{\"cis\": [\"1.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3503,'Set&#x20;noexec&#x20;option&#x20;for&#x20;/tmp&#x20;Partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3504,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;check&#x20;the&#x20;box&#x20;to&#x20;&#039;Review&#x20;and&#x20;modify&#x20;partitioning&#039;&#x20;and&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.5\"]}]'),(3505,'Bind&#x20;Mount&#x20;the&#x20;/var/tmp&#x20;directory&#x20;to&#x20;/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;normally&#x20;a&#x20;standalone&#x20;directory&#x20;in&#x20;the&#x20;/var&#x20;file&#x20;system.&#x20;Binding&#x20;/var/tmp&#x20;to&#x20;/tmp&#x20;establishes&#x20;an&#x20;unbreakable&#x20;link&#x20;to&#x20;/tmp&#x20;that&#x20;cannot&#x20;be&#x20;removed&#x20;&#40;even&#x20;by&#x20;the&#x20;root&#x20;user&#41;.&#x20;It&#x20;also&#x20;allows&#x20;/var/tmp&#x20;to&#x20;inherit&#x20;the&#x20;same&#x20;mount&#x20;options&#x20;that&#x20;/tmp&#x20;owns,&#x20;allowing&#x20;/var/tmp&#x20;to&#x20;be&#x20;protected&#x20;in&#x20;the&#x20;same&#x20;/tmp&#x20;is&#x20;protected.','All&#x20;programs&#x20;that&#x20;use&#x20;/var/tmp&#x20;and&#x20;/tmp&#x20;to&#x20;read/write&#x20;temporary&#x20;files&#x20;will&#x20;always&#x20;be&#x20;written&#x20;to&#x20;the&#x20;/tmp&#x20;file&#x20;system,&#x20;preventing&#x20;a&#x20;user&#x20;from&#x20;running&#x20;the&#x20;/var&#x20;file&#x20;system&#x20;out&#x20;of&#x20;space&#x20;or&#x20;trying&#x20;to&#x20;perform&#x20;operations&#x20;that&#x20;have&#x20;been&#x20;blocked&#x20;in&#x20;the&#x20;/tmp&#x20;filesystem.','','#&#x20;mount&#x20;--bind&#x20;/tmp&#x20;/var/tmp&#x20;and&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;to&#x20;contain&#x20;the&#x20;following&#x20;line:&#x20;/tmp&#x20;/var/tmp&#x20;none&#x20;bind&#x20;0&#x20;0','[{\"cis\": [\"1.1.6\"]}]'),(3506,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;check&#x20;the&#x20;box&#x20;to&#x20;&#039;Review&#x20;and&#x20;modify&#x20;partitioning&#039;&#x20;and&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.7\"]}]'),(3507,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;check&#x20;the&#x20;box&#x20;to&#x20;&#039;Review&#x20;and&#x20;modify&#x20;partitioning&#039;&#x20;and&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.8\"]}]'),(3508,'Create&#x20;Separate&#x20;Partition&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;check&#x20;the&#x20;box&#x20;to&#x20;&#039;Review&#x20;and&#x20;modify&#x20;partitioning&#039;&#x20;and&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;use&#x20;the&#x20;Logical&#x20;Volume&#x20;Manager&#x20;&#40;LVM&#41;&#x20;to&#x20;create&#x20;partitions.','[{\"cis\": [\"1.1.9\"]}]'),(3509,'Add&#x20;nodev&#x20;Option&#x20;to&#x20;/home','When&#x20;set&#x20;on&#x20;a&#x20;file&#x20;system,&#x20;this&#x20;option&#x20;prevents&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices&#x20;from&#x20;being&#x20;defined,&#x20;or&#x20;if&#x20;they&#x20;exist,&#x20;from&#x20;being&#x20;used&#x20;as&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.10\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3510,'Add&#x20;nodev&#x20;Option&#x20;to&#x20;/dev/shm&#x20;Partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;/dev/shm&#x20;&#40;temporary&#x20;filesystem&#x20;stored&#x20;in&#x20;memory&#41;&#x20;cannot&#x20;contain&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#x20;of&#x20;entries&#x20;that&#x20;have&#x20;mount&#x20;points&#x20;that&#x20;contain&#x20;/dev/shm&#41;.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3511,'Add&#x20;nosuid&#x20;Option&#x20;to&#x20;/dev/shm&#x20;Partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;/dev/shm&#x20;&#40;temporary&#x20;filesystem&#x20;stored&#x20;in&#x20;memory&#41;&#x20;will&#x20;not&#x20;execute&#x20;setuid&#x20;and&#x20;setgid&#x20;on&#x20;executable&#x20;programs&#x20;as&#x20;such,&#x20;but&#x20;rather&#x20;execute&#x20;them&#x20;with&#x20;the&#x20;uid&#x20;and&#x20;gid&#x20;of&#x20;the&#x20;user&#x20;executing&#x20;the&#x20;program.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;Look&#x20;for&#x20;entries&#x20;that&#x20;have&#x20;mount&#x20;points&#x20;that&#x20;contain&#x20;/dev/shm.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]');
INSERT INTO `tsca` VALUES (3512,'Add&#x20;noexec&#x20;Option&#x20;to&#x20;/dev/shm&#x20;Partition','Set&#x20;noexec&#x20;on&#x20;the&#x20;shared&#x20;memory&#x20;partition&#x20;to&#x20;prevent&#x20;programs&#x20;from&#x20;executing&#x20;from&#x20;there.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;.&#x20;Look&#x20;for&#x20;entries&#x20;that&#x20;have&#x20;mount&#x20;points&#x20;that&#x20;contain&#x20;/dev/shm.&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3513,'Disable&#x20;yum-updatesd','The&#x20;yum-updatesd&#x20;utility&#x20;provides&#x20;notification&#x20;of&#x20;updates&#x20;that&#x20;are&#x20;available&#x20;for&#x20;your&#x20;system.','The&#x20;yum-updatesd&#x20;service&#x20;may&#x20;introduce&#x20;unnecessary&#x20;overhead&#x20;and&#x20;prevent&#x20;other&#x20;programs&#x20;from&#x20;running.&#x20;When&#x20;possible,&#x20;replace&#x20;this&#x20;service&#x20;with&#x20;a&#x20;cron&#x20;job&#x20;that&#x20;calls&#x20;yum&#x20;directly.','','Disable&#x20;the&#x20;yum-updatesd&#x20;daemon&#x20;by&#x20;running&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;chkconfig&#x20;yum-updatesd&#x20;off','[{\"cis\": [\"1.2.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(3514,'Enable&#x20;SELinux&#x20;in&#x20;/etc/grub.conf','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;/etc/grub.conf&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overwritten.','','Remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;/etc/grub.conf.','[{\"cis\": [\"1.4.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3515,'Set&#x20;the&#x20;SELinux&#x20;State','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.4.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3516,'Set&#x20;the&#x20;SELinux&#x20;Policy','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3517,'Remove&#x20;SETroubleshoot','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','rpm&#x20;-qa&#x20;setroubleshoot','[{\"cis\": [\"1.4.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3518,'Disable&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;disable&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','#&#x20;chkconfig&#x20;mctrans&#x20;off','[{\"cis\": [\"1.4.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3519,'Set&#x20;Boot&#x20;Loader&#x20;Password','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;the&#x20;person&#x20;who&#x20;is&#x20;rebooting&#x20;system&#x20;the&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Set&#x20;a&#x20;bootloader&#x20;password','[{\"cis\": [\"1.5.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3520,'Require&#x20;Authentication&#x20;for&#x20;Single-User&#x20;Mode','Since&#x20;/etc/init&#x20;determines&#x20;what&#x20;run&#x20;state&#x20;the&#x20;system&#x20;is&#x20;in,&#x20;setting&#x20;the&#x20;entry&#x20;in&#x20;/etc/inittab&#x20;will&#x20;force&#x20;single&#x20;user&#x20;authentication.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Add&#x20;the&#x20;following&#x20;to&#x20;/etc/inittab&#x20;:&#x20;~:S:wait:/sbin/sulogin','[{\"cis\": [\"1.5.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3521,'Disable&#x20;Interactive&#x20;Boot','The&#x20;PROMPT&#x20;option&#x20;provides&#x20;console&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;interactively&#x20;boot&#x20;the&#x20;system&#x20;and&#x20;select&#x20;which&#x20;services&#x20;to&#x20;start&#x20;on&#x20;boot&#x20;.','Turn&#x20;off&#x20;the&#x20;PROMPT&#x20;option&#x20;on&#x20;the&#x20;console&#x20;to&#x20;prevent&#x20;console&#x20;users&#x20;from&#x20;potentially&#x20;overriding&#x20;established&#x20;security&#x20;settings.','','Set&#x20;the&#x20;PROMPT&#x20;parameter&#x20;in&#x20;/etc/sysconfig/init&#x20;to&#x20;no&#x20;.','[{\"cis\": [\"1.5.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3522,'Restrict&#x20;Core&#x20;Dumps','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid.dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;file.&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file.&#x20;fs.suid_dumpable&#x20;=&#x20;0','[{\"cis\": [\"1.6.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3523,'Enable&#x20;Randomized&#x20;Virtual&#x20;Memory&#x20;Region&#x20;Placement','Set&#x20;the&#x20;system&#x20;flag&#x20;to&#x20;force&#x20;randomized&#x20;virtual&#x20;memory&#x20;region&#x20;placement.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;for&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file.&#x20;kernel.randomize_va_space&#x20;=&#x20;2','[{\"cis\": [\"1.6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3524,'Configure&#x20;ExecShield','Execshield&#x20;is&#x20;made&#x20;up&#x20;of&#x20;a&#x20;number&#x20;of&#x20;kernel&#x20;features&#x20;to&#x20;provide&#x20;protection&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks.&#x20;These&#x20;features&#x20;include&#x20;prevention&#x20;of&#x20;execution&#x20;in&#x20;memory&#x20;data&#x20;space,&#x20;and&#x20;special&#x20;handling&#x20;of&#x20;text&#x20;buffers.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysctl.conf&#x20;file.&#x20;kernel.exec-shield&#x20;=&#x20;1','[{\"cis\": [\"1.6.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3525,'Disable&#x20;Prelink','Prelinking&#x20;is&#x20;a&#x20;performance&#x20;enhancing&#x20;feature&#x20;that&#x20;decreases&#x20;process&#x20;start&#x20;up&#x20;time.&#x20;It&#x20;loads&#x20;shared&#x20;libraries&#x20;into&#x20;addresses&#x20;for&#x20;which&#x20;the&#x20;linking&#x20;of&#x20;required&#x20;symbols&#x20;has&#x20;already&#x20;been&#x20;performed.&#x20;After&#x20;a&#x20;binary&#x20;has&#x20;been&#x20;prelinked,&#x20;the&#x20;addresses&#x20;at&#x20;which&#x20;shared&#x20;libraries&#x20;is&#x20;not&#x20;changed,&#x20;even&#x20;if&#x20;kernel.randomize_va_space&#x20;is&#x20;set&#x20;to&#x20;1.','There&#x20;is&#x20;a&#x20;bug&#x20;in&#x20;prelink&#x20;that&#x20;interferes&#x20;with&#x20;AIDE,&#x20;the&#x20;Linux&#x20;file&#x20;integrity&#x20;checker.&#x20;This&#x20;has&#x20;been&#x20;fixed&#x20;in&#x20;RHEL6&#x20;&#40;so&#x20;prelink&#x20;does&#x20;not&#x20;need&#x20;to&#x20;be&#x20;disabled&#x20;in&#x20;RHEL6&#x20;systems&#41;.','','Edit&#x20;/etc/sysconfig/prelink&#x20;and&#x20;set&#x20;PRELINKING=no','[{\"cis\": [\"1.6.5\"]}]'),(3526,'Remove&#x20;telnet-server','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnetd&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Red&#x20;Hat&#x20;Linux&#x20;distributions.','','#&#x20;yum&#x20;erase&#x20;telnet-server','[{\"cis\": [\"2.1.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3527,'Remove&#x20;rsh-server','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;rcp&#x20;&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;service&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','#&#x20;yum&#x20;erase&#x20;rsh-server','[{\"cis\": [\"2.1.3\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3528,'Remove&#x20;NIS&#x20;Client','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;ypbind&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','#&#x20;yum&#x20;erase&#x20;ypbind','[{\"cis\": [\"2.1.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3529,'Remove&#x20;NIS&#x20;Server','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','#&#x20;yum&#x20;erase&#x20;ypserv','[{\"cis\": [\"2.1.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3530,'Remove&#x20;tftp-server','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;package&#x20;tftp-server&#x20;is&#x20;the&#x20;server&#x20;package&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;of&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','#&#x20;yum&#x20;erase&#x20;tftp-server','[{\"cis\": [\"2.1.8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3531,'Remove&#x20;talk-server','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','#&#x20;yum&#x20;erase&#x20;talk-server','[{\"cis\": [\"2.1.10\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3532,'Set&#x20;Daemon&#x20;umask','Set&#x20;the&#x20;default&#x20;umask&#x20;for&#x20;all&#x20;processes&#x20;started&#x20;at&#x20;boot&#x20;time.&#x20;The&#x20;settings&#x20;in&#x20;umask&#x20;selectively&#x20;turn&#x20;off&#x20;default&#x20;permission&#x20;when&#x20;a&#x20;file&#x20;is&#x20;created&#x20;by&#x20;a&#x20;daemon&#x20;process.','Setting&#x20;the&#x20;umask&#x20;to&#x20;027&#x20;will&#x20;make&#x20;sure&#x20;that&#x20;files&#x20;created&#x20;by&#x20;daemons&#x20;will&#x20;not&#x20;be&#x20;readable,&#x20;writable&#x20;or&#x20;executable&#x20;by&#x20;any&#x20;other&#x20;than&#x20;the&#x20;group&#x20;and&#x20;owner&#x20;of&#x20;the&#x20;daemon&#x20;process&#x20;and&#x20;will&#x20;not&#x20;be&#x20;writable&#x20;by&#x20;the&#x20;group&#x20;of&#x20;the&#x20;daemon&#x20;process.&#x20;The&#x20;daemon&#x20;process&#x20;can&#x20;manually&#x20;override&#x20;these&#x20;settings&#x20;if&#x20;these&#x20;files&#x20;need&#x20;additional&#x20;permission.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/sysconfig/init&#x20;file.&#x20;umask&#x20;027','[{\"cis\": [\"3.2\"]}]'),(3533,'Remove&#x20;X&#x20;Windows','The&#x20;X&#x20;Windows&#x20;system&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;/etc/inittab&#x20;set&#x20;default&#x20;runlevel&#x20;as&#x20;follows:&#x20;s/:5:/:3:/&#x20;Uninstall&#x20;the&#x20;X&#x20;Windows&#x20;System:&#x20;#&#x20;yum&#x20;groupremove&#x20;&#039;X&#x20;Window&#x20;System&#039;','[{\"cis\": [\"3.3\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3534,'Disable&#x20;Avahi&#x20;Server','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.','Since&#x20;servers&#x20;are&#x20;not&#x20;normally&#x20;used&#x20;for&#x20;printing,&#x20;this&#x20;service&#x20;is&#x20;not&#x20;needed&#x20;unless&#x20;dependencies&#x20;require&#x20;it.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case,&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;If&#x20;for&#x20;some&#x20;reason&#x20;the&#x20;service&#x20;is&#x20;required&#x20;on&#x20;the&#x20;server,&#x20;follow&#x20;the&#x20;recommendations&#x20;in&#x20;sub-sections&#x20;3.2.1&#x20;-&#x20;3.2.5&#x20;to&#x20;secure&#x20;it.','','#&#x20;chkconfig&#x20;avahi-daemon&#x20;off&#x20;In&#x20;addition,&#x20;edit&#x20;the&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;remove&#x20;zeroconf.','[{\"cis\": [\"3.1.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3535,'Disable&#x20;NFS&#x20;and&#x20;RPC','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;server&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','#&#x20;chkconfig&#x20;nfslock&#x20;off;&#x20;#chkconfig&#x20;rpcgssd&#x20;off;&#x20;#chkconfig&#x20;rpcidmapd&#x20;off;&#x20;#&#x20;chkconfig&#x20;portmap&#x20;off;','[{\"cis\": [\"3.8\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3536,'Remove&#x20;FTP&#x20;Server','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;yum&#x20;erase&#x20;vsftpd','[{\"cis\": [\"3.10\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3537,'Remove&#x20;HTTP&#x20;Server','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.&#x20;The&#x20;default&#x20;HTTP&#x20;server&#x20;shipped&#x20;with&#x20;Red&#x20;Hat&#x20;Linux&#x20;is&#x20;Apache.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;yum&#x20;erase&#x20;httpd','[{\"cis\": [\"3.11\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3538,'Remove&#x20;Dovecot','Dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;to&#x20;this&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;yum&#x20;erase&#x20;dovecot','[{\"cis\": [\"3.12\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3539,'Remove&#x20;Samba','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;yum&#x20;erase&#x20;samba','[{\"cis\": [\"3.13\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3540,'Remove&#x20;HTTP&#x20;Proxy&#x20;Server','The&#x20;default&#x20;HTTP&#x20;proxy&#x20;package&#x20;shipped&#x20;with&#x20;Red&#x20;Hat&#x20;Linux&#x20;is&#x20;squid.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','#&#x20;yum&#x20;erase&#x20;squid','[{\"cis\": [\"3.14\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3541,'Remove&#x20;SNMP&#x20;Server','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;communicates&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.','','#&#x20;yum&#x20;erase&#x20;net-snmp','[{\"cis\": [\"3.15\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3542,'Disable&#x20;IP&#x20;Forwarding','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;server&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.&#x20;If&#x20;the&#x20;server&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used&#x20;as&#x20;a&#x20;router,&#x20;set&#x20;the&#x20;flag&#x20;to&#x20;0.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;server&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;net.ipv4.ip_forward&#x20;parameter&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:','[{\"cis\": [\"4.1.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3543,'Disable&#x20;Send&#x20;Packet&#x20;Redirects','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;net.ipv4.conf.all.send_redirects&#x20;and&#x20;net.ipv4.conf.default.send_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf','[{\"cis\": [\"4.1.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3544,'Disable&#x20;Source&#x20;Routed&#x20;Packet&#x20;Acceptance','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;server&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.','','Set&#x20;the&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3545,'Disable&#x20;ICMP&#x20;Redirect&#x20;Acceptance','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;net.ipv4.conf.all.accept_redirects&#x20;and&#x20;net.ipv4.conf.default.accept_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3546,'Disable&#x20;Secure&#x20;ICMP&#x20;Redirect&#x20;Acceptance','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;net.ipv4.conf.all.secure_redirects&#x20;and&#x20;net.ipv4.conf.default.secure_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3547,'Log&#x20;Suspicious&#x20;Packets','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;net.ipv4.conf.all.log_martians&#x20;and&#x20;net.ipv4.conf.default.log_martians&#x20;parameters&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3548,'Enable&#x20;Ignore&#x20;Broadcast&#x20;Requests','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.','','Set&#x20;the&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3549,'Enable&#x20;Bad&#x20;Error&#x20;Message&#x20;Protection','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3550,'Enable&#x20;RFC-recommended&#x20;Source&#x20;Route&#x20;Validation','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.','','Set&#x20;the&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;parameters&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf&#x20;and&#x20;modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3551,'Enable&#x20;TCP&#x20;SYN&#x20;Cookies','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;server&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.','','Set&#x20;the&#x20;net.ipv4.tcp_syncookies&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.tcp_syncookies=1&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match.','[{\"cis\": [\"4.2.8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3552,'Set&#x20;SSH&#x20;Protocol&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"6.2.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3553,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3554,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(3555,'Set&#x20;SSH&#x20;IgnoreRhosts&#x20;to&#x20;Yes','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication&#x20;.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh&#x20;.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"6.2.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3556,'Set&#x20;SSH&#x20;HostbasedAuthentication&#x20;to&#x20;No','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv&#x20;,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf&#x20;,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"6.2.7\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3557,'Disable&#x20;SSH&#x20;Root&#x20;Login','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;&#x20;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"6.2.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3558,'Set&#x20;SSH&#x20;PermitEmptyPasswords&#x20;to&#x20;No','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"6.2.9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(3559,'Verify&#x20;No&#x20;UID&#x20;0&#x20;Accounts&#x20;Exist&#x20;Other&#x20;Than&#x20;root','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;7.5&#x20;Restrict&#x20;root&#x20;Login&#x20;to&#x20;System&#x20;Console.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"9.2.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4000,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4001,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4002,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4003,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4004,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4005,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4006,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4007,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4008,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4009,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstabfile&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4010,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4011,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4012,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4013,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4014,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4015,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4016,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4017,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4018,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4019,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4020,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4021,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4022,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4023,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4024,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;chkconfig&#x20;autofs&#x20;off','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4025,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(4026,'Disable&#x20;the&#x20;rhnsd&#x20;Daemon','The&#x20;rhnsd&#x20;daemon&#x20;polls&#x20;the&#x20;Red&#x20;Hat&#x20;Network&#x20;web&#x20;site&#x20;for&#x20;scheduled&#x20;actions&#x20;and,&#x20;if&#x20;there&#x20;are,&#x20;executes&#x20;those&#x20;actions.','Patch&#x20;management&#x20;policies&#x20;may&#x20;require&#x20;that&#x20;organizations&#x20;test&#x20;the&#x20;impact&#x20;of&#x20;a&#x20;patch&#x20;before&#x20;it&#x20;is&#x20;deployed&#x20;in&#x20;a&#x20;production&#x20;environment.&#x20;Having&#x20;patches&#x20;automatically&#x20;deployed&#x20;could&#x20;have&#x20;a&#x20;negative&#x20;impact&#x20;on&#x20;the&#x20;environment.&#x20;It&#x20;is&#x20;best&#x20;to&#x20;not&#x20;allow&#x20;an&#x20;action&#x20;by&#x20;default&#x20;but&#x20;only&#x20;after&#x20;appropriate&#x20;consideration&#x20;has&#x20;been&#x20;made.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;unless&#x20;the&#x20;risk&#x20;is&#x20;understood&#x20;and&#x20;accepted&#x20;or&#x20;you&#x20;are&#x20;running&#x20;your&#x20;own&#x20;satellite&#x20;.&#x20;This&#x20;item&#x20;is&#x20;not&#x20;scored&#x20;because&#x20;organizations&#x20;may&#x20;have&#x20;addressed&#x20;the&#x20;risk.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rhnsd&#x20;:&#x20;#&#x20;chkconfig&#x20;rhnsd&#x20;off','[{\"cis\": [\"1.2.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4027,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;aide:&#x20;yum&#x20;install&#x20;aide&#x20;//&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4028,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;//&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4029,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;located&#x20;at&#x20;/boot/grub/grub.conf&#x20;and&#x20;linked&#x20;as&#x20;/boot/grub/menu.lst&#x20;and&#x20;/etc/grub.conf&#x20;.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.conf&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.conf','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4030,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-md5-crypt:&#x20;#&#x20;grub-md5-crypt&#x20;Password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Retype&#x20;Password:&#x20;&lt;password&gt;&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Copy&#x20;and&#x20;paste&#x20;the&#x20;&lt;encrypted-password&gt;&#x20;into&#x20;the&#x20;global&#x20;section&#x20;of&#x20;/boot/grub/grub.conf&#x20;:&#x20;password&#x20;--md5&#x20;&lt;encrypted-password&gt;','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4031,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/etc/sysconfig/init&#x20;and&#x20;set&#x20;SINGLE&#x20;to&#x20;&#039;&#x20;/sbin/sulogin&#039;:&#x20;&#x20;SINGLE=/sbin/sulogin','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4032,'Ensure&#x20;interactive&#x20;boot&#x20;is&#x20;not&#x20;enabled','Interactive&#x20;boot&#x20;allows&#x20;console&#x20;users&#x20;to&#x20;interactively&#x20;select&#x20;which&#x20;services&#x20;start&#x20;on&#x20;boot.&#x20;The&#x20;PROMPT&#x20;option&#x20;provides&#x20;console&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;interactively&#x20;boot&#x20;the&#x20;system&#x20;and&#x20;select&#x20;which&#x20;services&#x20;to&#x20;start&#x20;on&#x20;boot&#x20;.&#x20;','Turn&#x20;off&#x20;the&#x20;PROMPT&#x20;option&#x20;on&#x20;the&#x20;console&#x20;to&#x20;prevent&#x20;console&#x20;users&#x20;from&#x20;potentially&#x20;overriding&#x20;established&#x20;security&#x20;settings.&#x20;','','Edit&#x20;the&#x20;/etc/sysconfig/init&#x20;file&#x20;and&#x20;set&#x20;PROMPT&#x20;to&#x20;&#039;&#x20;no&#x20;&#039;:&#x20;PROMPT=no','[{\"cis\": [\"1.4.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(4033,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4034,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4035,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4036,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4037,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/boot/grub/grub.conf&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;on&#x20;all&#x20;kernel&#x20;lines','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4038,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4039,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.6.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4040,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;yum&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.6.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4041,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;yum&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.6.1.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4042,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.6\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4043,'Ensure&#x20;SELinux&#x20;is&#x20;installed','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;libselinux:&#x20;yum&#x20;install&#x20;libselinux','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4044,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4045,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4046,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4047,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4048,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4049,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4050,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Create&#x20;the&#x20;/etc/dconf/profile/gdm&#x20;file&#x20;with&#x20;the&#x20;following&#x20;contents:&#x20;&#x20;user-db:user&#x20;&#x20;&#x20;system-db:gdm&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;file-db:/usr/share/gdm/greeter-dconf-defaults&#x20;&#x20;&#x20;&#x20;&#x20;||&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;banner-message-enable&#x20;and&#x20;banner-message-text&#x20;options&#x20;in&#x20;/etc/dconf/db/gdm.d/01-banner-message&#x20;:&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;&#x20;&#x20;&#x20;||&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;system&#x20;databases:&#x20;dconf&#x20;update','[{\"cis\": [\"1.7.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4051,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.&#x20;The&#x20;audit&#x20;and&#x20;remediation&#x20;here&#x20;only&#x20;cover&#x20;security&#x20;updates.&#x20;Non-security&#x20;updates&#x20;can&#x20;be&#x20;audited&#x20;with&#x20;and&#x20;comparing&#x20;against&#x20;site&#x20;policy:&#x20;#&#x20;yum&#x20;check-update','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(4052,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;chargen-dgram&#x20;and&#x20;chargen-stream:&#x20;#&#x20;chkconfig&#x20;chargen-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;chargen-stream&#x20;off','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4053,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;daytime-dgram&#x20;and&#x20;daytime-stream:&#x20;#&#x20;chkconfig&#x20;daytime-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;daytime-stream&#x20;off','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4054,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled','discardis&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;discard-dgram&#x20;and&#x20;discard-stream:&#x20;#&#x20;chkconfig&#x20;discard-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;discard-stream&#x20;off','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4055,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;echo-dgram&#x20;and&#x20;echo-stream:&#x20;#&#x20;chkconfig&#x20;echo-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;echo-stream&#x20;off','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4056,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled','time&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;time-dgram&#x20;and&#x20;time-stream:&#x20;#&#x20;chkconfig&#x20;time-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;time-stream&#x20;off','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4057,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;rexec&#x20;&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;rsh,&#x20;rlogin,&#x20;and&#x20;rexec:&#x20;#&#x20;chkconfig&#x20;rsh&#x20;off&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;rlogin&#x20;off&#x20;&#x20;#&#x20;chkconfig&#x20;rexec&#x20;off','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4058,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;talk:&#x20;#&#x20;chkconfig&#x20;talk&#x20;off','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4059,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;chkconfig&#x20;telnet&#x20;off','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4060,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;package&#x20;tftp-server&#x20;is&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;tftp:&#x20;#&#x20;chkconfig&#x20;tftp&#x20;off','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4061,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;chkconfig&#x20;rsyncd&#x20;off','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4062,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;xinetd:&#x20;#&#x20;chkconfig&#x20;xinetd&#x20;off','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4063,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;and&#x20;verify&#x20;either&#x20;ntp&#x20;or&#x20;chrony&#x20;is&#x20;installed:&#x20;#&#x20;rpm&#x20;-q&#x20;ntp&#x20;#&#x20;rpm&#x20;-q&#x20;chrony&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;verify&#x20;that&#x20;host&#x20;based&#x20;synchronization&#x20;is&#x20;in&#x20;use.','[{\"cis\": [\"2.2.2.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4064,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;and&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/ntpd&#x20;to&#x20;include&#x20;&#039;&#x20;-u&#x20;ntp:ntp&#x20;&#039;:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4065,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/chrony.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;chronyd&#039;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4066,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;yum&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4067,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;chkconfig&#x20;avahi-daemon&#x20;off','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4068,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups&#x20;:&#x20;#&#x20;chkconfig&#x20;cups&#x20;off','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4069,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;chkconfig&#x20;dhcpd&#x20;off','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4070,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;chkconfig&#x20;slapd&#x20;off','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4071,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs,&#x20;nfs-server&#x20;and&#x20;rpcbind:&#x20;#&#x20;chkconfig&#x20;nfs&#x20;off;&#x20;#&#x20;chkconfig&#x20;rpcbind&#x20;off','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4072,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;chkconfig&#x20;named&#x20;off','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4073,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;chkconfig&#x20;vsftpd&#x20;off','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4074,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;chkconfig&#x20;httpd&#x20;off','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4075,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;chkconfig&#x20;dovecot&#x20;off','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4076,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;chkconfig&#x20;smb&#x20;off','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4077,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;chkconfig&#x20;squid&#x20;off','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4078,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;chkconfig&#x20;snmpd&#x20;off','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4079,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;Restart&#x20;postfix:&#x20;#&#x20;service&#x20;postfix&#x20;restart','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(4080,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;chkconfig&#x20;ypserv&#x20;off','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4081,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;yum&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4082,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;rsh','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4083,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4084,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4085,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4086,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4087,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4088,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4089,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4090,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4091,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4092,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4093,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4094,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4095,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4096,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;and&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4097,'Ensure&#x20;IPv6&#x20;redirects&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;ICMP&#x20;redirects.&#x20;ICMP&#x20;redirects&#x20;tell&#x20;the&#x20;system&#x20;about&#x20;alternate&#x20;routes&#x20;for&#x20;sending&#x20;traffic.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;ICMP&#x20;redirects&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;||&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4098,'Ensure&#x20;IPv6&#x20;is&#x20;disabled','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/boot/grub/grub.conf&#x20;to&#x20;include&#x20;ipv6.disable=1&#x20;on&#x20;all&#x20;kernel&#x20;lines.','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4099,'Ensure&#x20;TCP&#x20;Wrappers&#x20;is&#x20;installed','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;tcp_wrappers:&#x20;yum&#x20;install&#x20;tcp_wrappers','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(4100,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;echo&#x20;&#039;ALL:&#x20;ALL&#039;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(4101,'Ensure&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;are&#x20;configured.','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;networking&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;and&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(4102,'Ensure&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;are&#x20;configured.','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;and&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4103,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.5.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4104,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.5.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4105,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4106,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.5.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4107,'Ensure&#x20;iptables&#x20;is&#x20;installed','iptables&#x20;allows&#x20;configuration&#x20;of&#x20;the&#x20;IPv4&#x20;tables&#x20;in&#x20;the&#x20;linux&#x20;kernel&#x20;and&#x20;the&#x20;rules&#x20;stored&#x20;within&#x20;them.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;iptables&#x20;.','iptables&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;:&#x20;yum&#x20;install&#x20;iptables','[{\"cis\": [\"3.6.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.1\"]}]'),(4108,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;and&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.6.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4109,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.6.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4110,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4111,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4112,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4113,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd&#x20;:&#x20;#&#x20;chkconfig&#x20;auditd&#x20;on','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4114,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/boot/grub/grub.conf&#x20;to&#x20;include&#x20;audit=1&#x20;on&#x20;all&#x20;kernel&#x20;lines.&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4115,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4116,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4117,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4118,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;directory.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4119,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;/var/run/failock&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4120,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.3\"]}]'),(4121,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;500&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4122,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;500&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4123,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4124,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete','[{\"cis\": [\"4.1.14\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(4125,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4126,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4127,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod&#x20;,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4128,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;&#x20;&#x20;-e&#x20;2','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"3\", \"6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4129,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lackblogging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;rsyslog&#x20;on','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4130,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(4131,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4132,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;syslog-ng&#x20;:&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;syslog-ng&#x20;on','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4133,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4134,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4135,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;&#x20;#&#x20;yum&#x20;install&#x20;rsyslog&#x20;&#x20;&#x20;#&#x20;yum&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4136,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitivebdata&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;{}&#x20;+','[{\"cis\": [\"4.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4137,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;chkconfig&#x20;crond&#x20;on','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4138,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4139,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4140,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4141,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4142,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4143,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4144,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4145,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4146,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4147,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4148,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4149,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4150,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4151,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4152,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4153,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4154,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4155,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.13\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4156,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;and&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\", \"5.8\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4157,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4158,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_cracklib.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_cracklib.so&#x20;try_first_pass&#x20;retry=3&#x20;minlen=14&#x20;dcredit=-1&#x20;ucredit=-1&#x20;ocredit=-1&#x20;lcredit=-1','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"5.7\", \"16.12\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4159,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;remember=5&#x20;&#x20;&#x20;or&#x20;&#x20;&#x20;&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4160,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(4161,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4162,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4163,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4164,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4165,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4166,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4167,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;and&#x20;/etc/profile&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4168,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo&#x20;,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su&#x20;,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4169,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4170,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4171,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4172,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4173,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4174,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4175,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4176,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4177,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4178,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4179,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4180,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4181,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/cramfs.confand&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4501,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4502,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4503,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12,&#x20;FAT16,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','If&#x20;utilizing&#x20;UEFI&#x20;the&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;required.&#x20;If&#x20;this&#x20;case,&#x20;ensure&#x20;that&#x20;the&#x20;FAT&#x20;filesystem&#x20;is&#x20;only&#x20;used&#x20;where&#x20;appropriate.&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;grep&#x20;-E&#x20;-i&#x20;&#039;svfats&#039;&#x20;/etc/fstab&#x20;And&#x20;review&#x20;that&#x20;any&#x20;output&#x20;is&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;&#x20;If&#x20;not&#x20;utilizing&#x20;UEFI:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/fat.conf&#x20;&#x20;&#x20;&#x20;install&#x20;fat&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;install&#x20;vfat&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;install&#x20;msdos&#x20;/bin/true&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;unload&#x20;the&#x20;msdos,&#x20;vfat,&#x20;and&#x20;fatmodules:&#x20;&#x20;#&#x20;rmmod&#x20;msdos&#x20;&#x20;&#x20;#&#x20;rmmod&#x20;vfat&#x20;&#x20;#&#x20;rmmod&#x20;fat&#x20;','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4504,'Ensure&#x20;/tmp&#x20;is&#x20;configured','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Create&#x20;or&#x20;update&#x20;an&#x20;entry&#x20;for&#x20;/tmp&#x20;in&#x20;either&#x20;/etc/fstab&#x20;&#x20;OR&#x20;&#x20;&#x20;in&#x20;a&#x20;systemd&#x20;tmp.mount&#x20;file:&#x20;&#x20;If&#x20;/etc/fstab&#x20;is&#x20;used:&#x20;&#x20;Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;&#x20;&#x20;&#x20;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;&#x20;0&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;systemd&#x20;tmp.mount&#x20;file&#x20;is&#x20;used:&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;file&#x20;/etc/systemd/system/tmp.mount&#x20;if&#x20;it&#x20;doesn&#039;t&#x20;exist:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;[&#x20;!&#x20;-f&#x20;/etc/systemd/system/tmp.mount&#x20;]&#x20;&amp;&amp;&#x20;cp&#x20;-v&#x20;/usr/lib/systemd/system/tmp.mount&#x20;/etc/systemd/system/&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/systemd/system/tmp.mount:&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;What=tmpfs&#x20;&#x20;&#x20;&#x20;Where=/tmp&#x20;&#x20;&#x20;&#x20;Type=tmpfs&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;systemd&#x20;daemon:#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;tmp.mount:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mpunt&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;tmp.mount:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;--now&#x20;tmp.mount','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"9.4\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4505,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;OR&#x20;&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstabfile&#x20;and&#x20;add&#x20;noexecto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4506,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;&#x20;&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4507,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;&#x20;&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nosuid,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4508,'Ensure&#x20;/dev/shm&#x20;is&#x20;configured&#x20;','/dev/shm&#x20;is&#x20;a&#x20;traditional&#x20;shared&#x20;memory&#x20;concept.&#x20;One&#x20;program&#x20;will&#x20;create&#x20;a&#x20;memory&#x20;portion,&#x20;which&#x20;other&#x20;processes&#x20;&#40;if&#x20;permitted&#41;&#x20;can&#x20;access.&#x20;Mounting&#x20;tmpfs&#x20;at&#x20;/dev/shm&#x20;is&#x20;handled&#x20;automatically&#x20;by&#x20;systemd.','Any&#x20;user&#x20;can&#x20;upload&#x20;and&#x20;execute&#x20;files&#x20;inside&#x20;the&#x20;/dev/shm&#x20;similar&#x20;to&#x20;the&#x20;/tmp&#x20;partition.&#x20;Configuring&#x20;/dev/shm&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/dev/shm&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Edit&#x20;/etc/fstab&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line:&#x20;tmpfs&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;/dev/shm&#x20;&#x20;&#x20;&#x20;tmpfs&#x20;&#x20;&#x20;defaults,noexec,nodev,nosuid,seclabel&#x20;&#x20;&#x20;0&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4509,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"2.6\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4510,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4511,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4512,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4513,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications&#x20;and&#x20;is&#x20;intended&#x20;for&#x20;temporary&#x20;files&#x20;that&#x20;are&#x20;preserved&#x20;across&#x20;reboots.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4514,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;un&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4515,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4516,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4517,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4518,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4519,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4520,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.18\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4521,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4522,'Disable&#x20;USB&#x20;Storage','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/usb_storage.conf&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4523,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(4524,'Disable&#x20;the&#x20;rhnsd&#x20;Daemon','The&#x20;rhnsd&#x20;daemon&#x20;polls&#x20;the&#x20;Red&#x20;Hat&#x20;Network&#x20;web&#x20;site&#x20;for&#x20;scheduled&#x20;actions&#x20;and,&#x20;if&#x20;there&#x20;are,&#x20;executes&#x20;those&#x20;actions.','Patch&#x20;management&#x20;policies&#x20;may&#x20;require&#x20;that&#x20;organizations&#x20;test&#x20;the&#x20;impact&#x20;of&#x20;a&#x20;patch&#x20;before&#x20;it&#x20;is&#x20;deployed&#x20;in&#x20;a&#x20;production&#x20;environment.&#x20;Having&#x20;patches&#x20;automatically&#x20;deployed&#x20;could&#x20;have&#x20;a&#x20;negative&#x20;impact&#x20;on&#x20;the&#x20;environment.&#x20;It&#x20;is&#x20;best&#x20;to&#x20;not&#x20;allow&#x20;an&#x20;action&#x20;by&#x20;default&#x20;but&#x20;only&#x20;after&#x20;appropriate&#x20;consideration&#x20;has&#x20;been&#x20;made.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;unless&#x20;the&#x20;risk&#x20;is&#x20;understood&#x20;and&#x20;accepted&#x20;or&#x20;you&#x20;are&#x20;running&#x20;your&#x20;own&#x20;satellite&#x20;.&#x20;This&#x20;item&#x20;is&#x20;not&#x20;scored&#x20;because&#x20;organizations&#x20;may&#x20;have&#x20;addressed&#x20;the&#x20;risk.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;rhnsd:&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rhnsd','[{\"cis\": [\"1.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(4525,'Ensure&#x20;sudo&#x20;is&#x20;installed','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo.&#x20;#&#x20;yum&#x20;install&#x20;sudo','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4526,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;configuring&#x20;sudo&#x20;to&#x20;run&#x20;other&#x20;commands&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty,&#x20;whether&#x20;I/O&#x20;logging&#x20;is&#x20;turned&#x20;on&#x20;or&#x20;not.','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4527,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&#039;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&#039;&#x20;&#x20;&#x20;Example:Defaults&#x20;&#x20;logfile=&quot;/var/log/sudo.log&quot;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4528,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;yum&#x20;install&#x20;aide&#x20;//&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4529,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;aidecheck.service&#x20;and&#x20;aidecheck.timer&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.service&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;[Unit]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Description=Aide&#x20;Check&#x20;&#x20;&#x20;&#x20;[Service]&#x20;&#x20;&#x20;&#x20;&#x20;Type=simpleExecStart=/usr/sbin/aide&#x20;--check&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Install]&#x20;&#x20;&#x20;&#x20;&#x20;WantedBy=multi-user.target&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;&#x20;/etc/systemd/system/aidecheck.timer&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;[Unit]&#x20;&#x20;&#x20;Description=Aide&#x20;check&#x20;every&#x20;day&#x20;at&#x20;5AM&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Timer]&#x20;&#x20;&#x20;&#x20;&#x20;OnCalendar=*-*-*&#x20;05:00:00&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Unit=aidecheck.service&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Install]&#x20;&#x20;&#x20;&#x20;&#x20;WantedBy=multi-user.target&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;aidecheck.service&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;aidecheck.timer&#x20;','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4530,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','For&#x20;newergrub2based&#x20;systems&#x20;&#40;centOS/RHEL&#x20;7.2&#x20;and&#x20;newer&#41;:&#x20;Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-setpassword:&#x20;#&#x20;grub2-setpassword&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;older&#x20;&#x20;grub2based&#x20;systems:&#x20;create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-mkpasswd-pbkdf2:&#x20;&#x20;&#x20;#&#x20;grub2-mkpasswd-pbkdf2&#x20;&#x20;&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;Your&#x20;PBKDF2&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/01_users&#x20;or&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;&#x20;cat&#x20;&lt;&lt;EOFset&#x20;superusers=&quot;&lt;username&gt;&quot;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;EOF&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4531,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;located&#x20;at&#x20;/boot/grub2/grub.cfg&#x20;and&#x20;linked&#x20;as&#x20;/etc/grub2.cfg&#x20;.&#x20;&#x20;On&#x20;newer&#x20;grub2&#x20;systems&#x20;the&#x20;encrypted&#x20;bootloader&#x20;password&#x20;is&#x20;contained&#x20;in&#x20;/boot/grub2/user.cfg','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/user.cfg&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/user.cfg','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4532,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/usr/lib/systemd/system/rescue.service&#x20;and&#x20;/usr/lib/systemd/system/emergency.service&#x20;and&#x20;set&#x20;ExecStart&#x20;to&#x20;use&#x20;/sbin/sulogin&#x20;or&#x20;/usr/sbin/sulogin:&#x20;ExecStart=-/bin/sh&#x20;-c&#x20;&quot;/sbin/sulogin;&#x20;/usr/bin/systemctl&#x20;--fail&#x20;--no-block&#x20;default&quot;&#x20;','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4533,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4534,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4535,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4536,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;prelink:&#x20;#&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.6.4\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4537,'Ensure&#x20;SELinux&#x20;is&#x20;installed','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;libselinux:&#x20;#&#x20;yum&#x20;install&#x20;libselinux','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4538,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4539,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4540,'Ensure&#x20;the&#x20;SELinux&#x20;mode&#x20;is&#x20;enforcing&#x20;or&#x20;permissive','SELinux&#x20;can&#x20;run&#x20;in&#x20;one&#x20;of&#x20;three&#x20;modes:&#x20;disabled,&#x20;permissive,&#x20;or&#x20;enforcing:&#x20;&#x20;Enforcing&#x20;-&#x20;Is&#x20;the&#x20;default,&#x20;and&#x20;recommended,&#x20;mode&#x20;of&#x20;operation;&#x20;in&#x20;enforcing&#x20;mode&#x20;SELinux&#x20;operates&#x20;normally,&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy&#x20;on&#x20;the&#x20;entire&#x20;system.&#x20;&#x20;Permissive&#x20;-&#x20;The&#x20;system&#x20;acts&#x20;as&#x20;if&#x20;SELinux&#x20;is&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy,&#x20;including&#x20;labeling&#x20;objects&#x20;and&#x20;emitting&#x20;access&#x20;denial&#x20;entries&#x20;in&#x20;the&#x20;logs,&#x20;but&#x20;it&#x20;does&#x20;not&#x20;actually&#x20;deny&#x20;any&#x20;operations.&#x20;While&#x20;not&#x20;recommended&#x20;for&#x20;production&#x20;systems,&#x20;permissive&#x20;mode&#x20;can&#x20;be&#x20;helpful&#x20;for&#x20;SELinux&#x20;policy&#x20;development.&#x20;&#x20;&#x20;Disabled&#x20;-Is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future','Running&#x20;SELinux&#x20;in&#x20;disabled&#x20;modeis&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;SELinux&#039;s&#x20;running&#x20;mode:&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Enforcing:&#x20;#&#x20;setenforce&#x20;1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Permissive:&#x20;#&#x20;setenforce&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/selinux/config&#x20;&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;For&#x20;Enforcing&#x20;mode:&#x20;SELINUX=enforcing&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;Permissive&#x20;mode:&#x20;&#x20;SELINUX=permissive','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4541,'Ensure&#x20;no&#x20;unconfined&#x20;services&#x20;exist','Unconfined&#x20;processes&#x20;run&#x20;in&#x20;unconfined&#x20;domains','For&#x20;unconfined&#x20;processes,&#x20;SELinux&#x20;policy&#x20;rules&#x20;are&#x20;applied,&#x20;but&#x20;policy&#x20;rules&#x20;exist&#x20;that&#x20;allow&#x20;processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;almost&#x20;all&#x20;access.&#x20;Processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;fall&#x20;back&#x20;to&#x20;using&#x20;DAC&#x20;rules&#x20;exclusively.&#x20;If&#x20;an&#x20;unconfined&#x20;process&#x20;is&#x20;compromised,&#x20;SELinux&#x20;does&#x20;not&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;system&#x20;resources&#x20;and&#x20;data,&#x20;but&#x20;of&#x20;course,&#x20;DAC&#x20;rules&#x20;are&#x20;still&#x20;used.&#x20;SELinux&#x20;is&#x20;a&#x20;security&#x20;enhancement&#x20;on&#x20;top&#x20;of&#x20;DAC&#x20;rules&#x20;&ndash;&#x20;it&#x20;does&#x20;not&#x20;replace&#x20;them','','Investigate&#x20;any&#x20;unconfined&#x20;processes&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4542,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;yum&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.7.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4543,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;yum&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.7.1.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4544,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;v&#x20;&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4545,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4546,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4547,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4548,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4549,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4550,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;install&#x20;all&#x20;available&#x20;packages&#x20;#&#x20;yum&#x20;update&#x20;--security&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Note:&#x20;The&#x20;audit&#x20;and&#x20;remediation&#x20;here&#x20;only&#x20;cover&#x20;security&#x20;updates.&#x20;Non-security&#x20;updates&#x20;can&#x20;be&#x20;audited&#x20;with&#x20;the&#x20;following&#x20;command&#x20;and&#x20;comparing&#x20;the&#x20;output&#x20;against&#x20;site&#x20;policy:&#x20;&#x20;#&#x20;yum&#x20;check-update','[{\"cis\": [\"1.9\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(4551,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','If&#x20;a&#x20;graphical&#x20;login&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;a&#x20;graphical&#x20;login&#x20;is&#x20;required,&#x20;last&#x20;logged&#x20;in&#x20;user&#x20;display&#x20;should&#x20;be&#x20;disabled,&#x20;and&#x20;a&#x20;warning&#x20;banner&#x20;should&#x20;be&#x20;configured.&#x20;Displaying&#x20;the&#x20;last&#x20;logged&#x20;in&#x20;user&#x20;eliminates&#x20;half&#x20;of&#x20;the&#x20;Userid/Password&#x20;equation&#x20;that&#x20;an&#x20;unauthorized&#x20;person&#x20;would&#x20;need&#x20;to&#x20;log&#x20;on.&#x20;Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;gdm:&#x20;#&#x20;yum&#x20;remove&#x20;gdm&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;GDM&#x20;is&#x20;required:&#x20;Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/dconf/profile/gdm&#x20;and&#x20;add&#x20;the&#x20;following:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;user-db:user&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;system-db:gdm&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;file-db:/usr/share/gdm/greeter-dconf-defaults&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/dconf/db/gdm.d/&#x20;&#x20;and&#x20;add&#x20;the&#x20;following:&#x20;&#40;This&#x20;is&#x20;typically&#x20;/etc/dconf/db/gdm.d/01-banner-message&#41;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;&lt;banner&#x20;message&gt;&#039;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Example&#x20;Banner&#x20;Text:&#x20;&#x20;&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#x20;&#039;Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/dconf/db/gdm.d/and&#x20;add&#x20;the&#x20;following:&#x20;&#40;This&#x20;is&#x20;typically&#x20;/etc/dconf/db/gdm.d/00-login-screen&#41;&#x20;&#x20;&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;Do&#x20;not&#x20;show&#x20;the&#x20;user&#x20;list&#x20;&#x20;&#x20;&#x20;&#x20;disable-user-list=true&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;system&#x20;databases:&#x20;&#x20;#&#x20;dconf&#x20;update','[{\"cis\": [\"1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(4552,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;If&#x20;an&#x20;xinetd&#x20;service&#x20;or&#x20;services&#x20;are&#x20;required,&#x20;ensure&#x20;that&#x20;any&#x20;xinetd&#x20;service&#x20;not&#x20;required&#x20;is&#x20;stopped&#x20;and&#x20;disabled','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;yum&#x20;remove&#x20;xinetd','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4553,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available,&#x20;install&#x20;chrony&#x20;or&#x20;NTP:&#x20;to&#x20;install&#x20;chrony&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;yum&#x20;install&#x20;chrony&#x20;OR&#x20;to&#x20;install&#x20;ntp:&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;yum&#x20;install&#x20;ntp','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4554,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;and&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include&#x20;&#039;-u&#x20;chrony&#039;:OPTIONS=&quot;-u&#x20;chrony&quot;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4555,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;and&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/ntpd&#x20;to&#x20;include&#x20;&#039;&#x20;-u&#x20;ntp:ntp&#x20;&#039;:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4556,'&#x20;Ensure&#x20;X11&#x20;Server&#x20;components&#x20;are&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;yum&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4557,'&#x20;Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop,&#x20;mask&#x20;and&#x20;remove&#x20;avahi-autoipd&#x20;and&#x20;avahi:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;avahi-daemon.service;&#x20;#&#x20;yum&#x20;remove&#x20;avahi-autoipd&#x20;avahi','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4558,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Disabling&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cups:&#x20;#&#x20;yum&#x20;remove&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4559,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;the&#x20;dhcp&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dhcpd:&#x20;#&#x20;yum&#x20;remove&#x20;dhcp','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4560,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;slapd:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-servers','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4561,'Ensure&#x20;nfs-utils&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;nfs-server&#x20;service&#x20;is&#x20;masked','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;require&#x20;network&#x20;shares,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;nfs-utils&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs-utils:&#x20;#&#x20;yum&#x20;remove&#x20;nfs-utils;&#x20;OR&#x20;if&#x20;the&#x20;nfs-package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;nfs-server&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4562,'Ensure&#x20;nfs-utils&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;nfs-server&#x20;service&#x20;is&#x20;masked','The&#x20;rpcbind&#x20;utility&#x20;maps&#x20;RPC&#x20;services&#x20;to&#x20;the&#x20;ports&#x20;on&#x20;which&#x20;they&#x20;listen.&#x20;RPC&#x20;processes&#x20;notify&#x20;rpcbind&#x20;when&#x20;they&#x20;start,&#x20;registering&#x20;the&#x20;ports&#x20;they&#x20;are&#x20;listening&#x20;on&#x20;and&#x20;the&#x20;RPC&#x20;program&#x20;numbers&#x20;they&#x20;expect&#x20;to&#x20;serve.&#x20;The&#x20;client&#x20;system&#x20;then&#x20;contacts&#x20;rpcbind&#x20;on&#x20;the&#x20;server&#x20;with&#x20;a&#x20;particular&#x20;RPC&#x20;program&#x20;number.&#x20;The&#x20;rpcbind&#x20;service&#x20;redirects&#x20;the&#x20;client&#x20;to&#x20;the&#x20;proper&#x20;port&#x20;number&#x20;so&#x20;it&#x20;can&#x20;communicate&#x20;with&#x20;the&#x20;requested&#x20;service&#x20;Portmapper&#x20;is&#x20;an&#x20;RPC&#x20;service,&#x20;which&#x20;always&#x20;listens&#x20;on&#x20;tcp&#x20;and&#x20;udp&#x20;111,&#x20;and&#x20;is&#x20;used&#x20;to&#x20;map&#x20;other&#x20;RPC&#x20;services&#x20;&#40;such&#x20;as&#x20;nfs,&#x20;nlockmgr,&#x20;quotad,&#x20;mountd,&#x20;etc.&#41;&#x20;to&#x20;their&#x20;corresponding&#x20;port&#x20;number&#x20;on&#x20;the&#x20;server.&#x20;When&#x20;a&#x20;remote&#x20;host&#x20;makes&#x20;an&#x20;RPC&#x20;call&#x20;to&#x20;that&#x20;server,&#x20;it&#x20;first&#x20;consults&#x20;with&#x20;portmap&#x20;to&#x20;determine&#x20;where&#x20;the&#x20;RPC&#x20;server&#x20;is&#x20;listening','A&#x20;small&#x20;request&#x20;&#40;~82&#x20;bytes&#x20;via&#x20;UDP&#41;&#x20;sent&#x20;to&#x20;the&#x20;Portmapper&#x20;generates&#x20;a&#x20;large&#x20;response&#x20;&#40;7x&#x20;to&#x20;28x&#x20;amplification&#41;,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;suitable&#x20;tool&#x20;for&#x20;DDoS&#x20;attacks.&#x20;If&#x20;rpcbind&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;rpcbind&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs-utils:&#x20;#&#x20;yum&#x20;remove&#x20;nfs-utils;&#x20;OR&#x20;if&#x20;the&#x20;nfs-package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;nfs-server&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4563,'&#x20;Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed&#x20;','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;yum&#x20;remove&#x20;bind','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4564,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed','FTP&#x20;&#40;File&#x20;Transfer&#x20;Protocol&#41;&#x20;is&#x20;a&#x20;traditional&#x20;and&#x20;widely&#x20;used&#x20;standard&#x20;tool&#x20;for&#x20;transferring&#x20;files&#x20;between&#x20;a&#x20;server&#x20;and&#x20;clients&#x20;over&#x20;a&#x20;network,&#x20;especially&#x20;where&#x20;no&#x20;authentication&#x20;is&#x20;necessary&#x20;&#40;permits&#x20;anonymous&#x20;users&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#41;','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;yum&#x20;remove&#x20;vsftpd','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4565,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;installed','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;yum&#x20;remove&#x20;httpd','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4566,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;installed','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;yum&#x20;remove&#x20;dovecot','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4567,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;package&#x20;can&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;yum&#x20;remove&#x20;samba','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4568,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;yum&#x20;remove&#x20;squid','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4569,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;installed','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;#&#x20;yum&#x20;remove&#x20;net-snmp','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4570,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(4571,'Ensure&#x20;rsync&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;masked','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','Unless&#x20;required,&#x20;the&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;rsync&#x20;package:&#x20;#&#x20;yum&#x20;remove&#x20;rsync;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;the&#x20;rsyncd&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rsyncd','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(4572,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;installed','The&#x20;ypserv&#x20;package&#x20;provides&#x20;the&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;.&#x20;This&#x20;service,&#x20;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;ypservpackage&#x20;be&#x20;removed,&#x20;and&#x20;if&#x20;required&#x20;a&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;yum&#x20;remove&#x20;ypserv','[{\"cis\": [\"2.2.18\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4573,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;installed','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;yum&#x20;remove&#x20;telnet-server','[{\"cis\": [\"2.2.19\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4574,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;yum&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4575,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;#&#x20;yum&#x20;remove&#x20;rsh','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4576,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;#&#x20;yum&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4577,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;yum&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4578,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4579,'Ensure&#x20;nonessential&#x20;services&#x20;are&#x20;removed&#x20;or&#x20;masked','A&#x20;network&#x20;port&#x20;is&#x20;identified&#x20;by&#x20;its&#x20;number,&#x20;the&#x20;associated&#x20;IP&#x20;address,&#x20;and&#x20;the&#x20;type&#x20;of&#x20;the&#x20;communication&#x20;protocol&#x20;such&#x20;as&#x20;TCP&#x20;or&#x20;UDP.A&#x20;listening&#x20;port&#x20;is&#x20;a&#x20;network&#x20;port&#x20;on&#x20;which&#x20;an&#x20;application&#x20;or&#x20;process&#x20;listens&#x20;on,&#x20;acting&#x20;as&#x20;a&#x20;communication&#x20;endpoint.&#x20;Each&#x20;listening&#x20;port&#x20;can&#x20;be&#x20;open&#x20;or&#x20;closed&#x20;&#40;filtered&#41;&#x20;using&#x20;a&#x20;firewall.&#x20;In&#x20;general&#x20;terms,&#x20;an&#x20;open&#x20;port&#x20;is&#x20;a&#x20;network&#x20;port&#x20;that&#x20;accepts&#x20;incoming&#x20;packets&#x20;from&#x20;remote&#x20;locations','Services&#x20;listening&#x20;on&#x20;the&#x20;system&#x20;pose&#x20;a&#x20;potential&#x20;risk&#x20;as&#x20;an&#x20;attack&#x20;vector.&#x20;These&#x20;services&#x20;should&#x20;be&#x20;reviewed,&#x20;and&#x20;if&#x20;not&#x20;required,&#x20;the&#x20;service&#x20;should&#x20;be&#x20;stopped,&#x20;and&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service&#x20;should&#x20;be&#x20;removed.&#x20;If&#x20;required&#x20;packages&#x20;have&#x20;a&#x20;dependency,&#x20;the&#x20;service&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Review&#x20;the&#x20;output&#x20;of:&#x20;#&#x20;lsof&#x20;-i&#x20;-P&#x20;-n&#x20;|&#x20;grep&#x20;-v&#x20;&#039;&#40;ESTABLISHED&#41;&#039;;&#x20;to&#x20;ensure&#x20;that&#x20;all&#x20;services&#x20;listed&#x20;are&#x20;required&#x20;on&#x20;the&#x20;system.&#x20;If&#x20;a&#x20;listed&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;remove&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service.&#x20;If&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service&#x20;is&#x20;required,&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;service.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service:#&#x20;yum&#x20;remove&#x20;&lt;package_name&gt;&#x20;OR&#x20;if&#x20;required&#x20;packages&#x20;have&#x20;a&#x20;dependency:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;service:#&#x20;systemctl&#x20;--now&#x20;mask&#x20;&lt;service_name&gt;','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4580,'Disable&#x20;IPv6','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;disable&#x20;IPv6&#x20;through&#x20;the&#x20;GRUB2&#x20;config:&#x20;edit&#x20;/etc/default/gruband&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:#&#x20;grub2-mkconfig&#x20;&ndash;o&#x20;/boot/grub2/grub.cfg;&#x20;OR&#x20;to&#x20;disable&#x20;IPv6&#x20;through&#x20;sysctl&#x20;settings:&#x20;set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;#&#x20;net.ipv6.conf.all.disable_ipv6&#x20;=&#x20;1;&#x20;#&#x20;net.ipv6.conf.default.disable_ipv6&#x20;=&#x20;1;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.disable_ipv6=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.disable_ipv6=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4581,'Ensure&#x20;wireless&#x20;interfaces&#x20;are&#x20;disabled','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;any&#x20;wireless&#x20;interfaces:&#x20;#&#x20;ip&#x20;link&#x20;set&#x20;&lt;interface&gt;&#x20;down','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4582,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&#039;^s*net.ipv4.ip_forwards*=s*1&#039;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&#039;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4583,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4584,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4585,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4586,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4587,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4588,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4589,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4590,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4591,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4592,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;and&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4593,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4594,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4595,'Ensure&#x20;FirewallD&#x20;or&#x20;nftables&#x20;or&#x20;iptables-services&#x20;is&#x20;installed','firewalld&#x20;is&#x20;a&#x20;firewall&#x20;management&#x20;tool&#x20;for&#x20;Linux&#x20;operating&#x20;systems.&#x20;It&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;net&#x20;filter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;backend&#x20;or&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;nftables&#x20;utility.&#x20;FirewallD&#x20;replaces&#x20;iptables&#x20;as&#x20;the&#x20;default&#x20;firewall&#x20;management&#x20;tool.&#x20;Use&#x20;the&#x20;firewalld&#x20;utility&#x20;to&#x20;configure&#x20;a&#x20;firewall&#x20;for&#x20;less&#x20;complex&#x20;firewalls.&#x20;The&#x20;utility&#x20;is&#x20;easy&#x20;to&#x20;use&#x20;and&#x20;covers&#x20;the&#x20;typical&#x20;use&#x20;cases&#x20;scenario.&#x20;FirewallD&#x20;supports&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6&#x20;networks&#x20;and&#x20;can&#x20;administer&#x20;separate&#x20;firewall&#x20;zones&#x20;with&#x20;varying&#x20;degrees&#x20;of&#x20;trust&#x20;as&#x20;defined&#x20;in&#x20;zone&#x20;profiles.','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x20;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;firewalld:&#x20;#&#x20;yum&#x20;install&#x20;firewalld&#x20;iptables;&#x20;OR&#x20;to&#x20;&#x20;install&#x20;nftables:&#x20;#&#x20;yum&#x20;install&#x20;nftables;&#x20;OR&#x20;to&#x20;install&#x20;&#x20;iptables-services:&#x20;#&#x20;yum&#x20;install&#x20;iptables-services&#x20;iptables','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4596,'Ensure&#x20;iptables-services&#x20;and&#x20;FirewallD&#x20;are&#x20;not&#x20;installed&#x20;at&#x20;the&#x20;same&#x20;time','The&#x20;iptables-services&#x20;package&#x20;contains&#x20;the&#x20;iptables.service&#x20;and&#x20;ip6tables.service.&#x20;These&#x20;services&#x20;allow&#x20;for&#x20;management&#x20;of&#x20;the&#x20;Host&#x20;Based&#x20;Firewall&#x20;provided&#x20;by&#x20;the&#x20;iptables&#x20;package.','iptables.service&#x20;and&#x20;ip6tables.service&#x20;are&#x20;still&#x20;supported&#x20;and&#x20;can&#x20;be&#x20;installed&#x20;with&#x20;the&#x20;iptables-services&#x20;package.&#x20;Running&#x20;both&#x20;firewalld&#x20;and&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-services&#x20;package&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-services&#x20;package&#x20;and&#x20;remove&#x20;the&#x20;iptables-services&#x20;package:&#x20;#&#x20;systemctl&#x20;stop&#x20;iptables;&#x20;#&#x20;systemctl&#x20;stop&#x20;ip6tables;&#x20;#&#x20;yum&#x20;remove&#x20;iptables-services.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;firewalld:&#x20;#&#x20;yum&#x20;remove&#x20;firewalld&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;firewalld','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4597,'Ensure&#x20;nftables&#x20;and&#x20;FirewallD&#x20;are&#x20;not&#x20;installed&#x20;at&#x20;the&#x20;same&#x20;time&#x20;or&#x20;ensure&#x20;one&#x20;of&#x20;them&#x20;is&#x20;stopped&#x20;and&#x20;masked','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.Note:&#x20;Support&#x20;for&#x20;using&#x20;nftables&#x20;as&#x20;the&#x20;back-end&#x20;for&#x20;firewalld&#x20;was&#x20;added&#x20;in&#x20;release&#x20;v0.6.0.&#x20;In&#x20;Fedora&#x20;19&#x20;Linux&#x20;derivatives,&#x20;firewalld&#x20;utilizes&#x20;iptables&#x20;as&#x20;its&#x20;back-end&#x20;by&#x20;default.','Running&#x20;both&#x20;firewalld&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:#&#x20;yum&#x20;remove&#x20;nftables;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;nftables:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;firewalld:&#x20;#&#x20;yum&#x20;remove&#x20;firewalld&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;firewalld','[{\"cis\": [\"3.5.1.3\", \"3.5.3.1.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4598,'Ensure&#x20;nftables&#x20;and&#x20;iptables-services&#x20;are&#x20;not&#x20;installed&#x20;at&#x20;the&#x20;same&#x20;time&#x20;or&#x20;ensure&#x20;one&#x20;of&#x20;them&#x20;is&#x20;stopped&#x20;and&#x20;masked','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.Note:&#x20;Support&#x20;for&#x20;using&#x20;nftables&#x20;as&#x20;the&#x20;back-end&#x20;for&#x20;firewalld&#x20;was&#x20;added&#x20;in&#x20;release&#x20;v0.6.0.&#x20;In&#x20;Fedora&#x20;19&#x20;Linux&#x20;derivatives,&#x20;firewalld&#x20;utilizes&#x20;iptables&#x20;as&#x20;its&#x20;back-end&#x20;by&#x20;default.','Running&#x20;both&#x20;nftables&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:#&#x20;yum&#x20;remove&#x20;nftables;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;nftables:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;iptables#&#x20;#&#x20;systemctl&#x20;stop&#x20;iptables;&#x20;#&#x20;systemctl&#x20;stop&#x20;ip6tables;&#x20;#&#x20;yum&#x20;remove&#x20;iptables-services','[{\"cis\": [\"3.5.1.3\", \"3.5.3.1.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4599,'Ensure&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running','firewalld.serviceenables&#x20;the&#x20;enforcement&#x20;of&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld','Ensure&#x20;that&#x20;the&#x20;firewalld.service&#x20;is&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;enforce&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;unmask&#x20;firewalld;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;firewalld','[{\"cis\": [\"3.5.1.4\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4600,'Ensure&#x20;a&#x20;table&#x20;exists','nTables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4601,'Ensure&#x20;base&#x20;chains&#x20;exist','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;createchain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;','[{\"cis\": [\"3.5.2.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4602,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;iif&#x20;lo&#x20;accept;&#x20;&#x20;&#x20;#&#x20;nft&#x20;create&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;saddr&#x20;127.0.0.0/8&#x20;counter&#x20;drop;&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;implement&#x20;the&#x20;IPv6&#x20;loopback&#x20;rules:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip6&#x20;saddr::1&#x20;counter&#x20;drop','[{\"cis\": [\"3.5.2.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4603,'Ensure&#x20;outbound&#x20;and&#x20;established&#x20;connections&#x20;are&#x20;configured','Configure&#x20;the&#x20;firewall&#x20;rules&#x20;for&#x20;new&#x20;outbound&#x20;and&#x20;established&#x20;connections.','If&#x20;rules&#x20;are&#x20;not&#x20;in&#x20;place&#x20;for&#x20;new&#x20;outbound&#x20;and&#x20;established&#x20;connections,&#x20;all&#x20;packets&#x20;will&#x20;be&#x20;dropped&#x20;by&#x20;the&#x20;default&#x20;policy&#x20;preventing&#x20;network&#x20;usage.','','Configure&#x20;nftables&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;commands&#x20;will&#x20;implement&#x20;a&#x20;policy&#x20;to&#x20;allow&#x20;all&#x20;outbound&#x20;connections&#x20;and&#x20;all&#x20;established&#x20;connections:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;protocol&#x20;tcp&#x20;ct&#x20;state&#x20;established&#x20;accept;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;protocol&#x20;udp&#x20;ct&#x20;state&#x20;established&#x20;accept;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;protocol&#x20;icmp&#x20;ct&#x20;state&#x20;established&#x20;accept;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;output&#x20;ip&#x20;protocol&#x20;tcp&#x20;ct&#x20;state&#x20;new,related,established&#x20;accept;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;output&#x20;ip&#x20;protocol&#x20;udp&#x20;ct&#x20;state&#x20;new,related,established&#x20;accept;&#x20;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;output&#x20;ip&#x20;protocol&#x20;icmp&#x20;ct&#x20;state&#x20;new,related,established&#x20;accept','[{\"cis\": [\"3.5.2.8\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4604,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;traversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.5.2.9\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4605,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conffile&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.2.10\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4606,'Ensure&#x20;nftables&#x20;rules&#x20;are&#x20;permanent','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames.&#x20;The&#x20;nftables&#x20;service&#x20;reads&#x20;the&#x20;/etc/sysconfig/nftables.conffile&#x20;for&#x20;a&#x20;nftables&#x20;file&#x20;or&#x20;files&#x20;to&#x20;include&#x20;in&#x20;the&#x20;nftables&#x20;ruleset.&#x20;A&#x20;nftables&#x20;ruleset&#x20;containing&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;base&#x20;chains&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;be&#x20;filtered.','Changes&#x20;made&#x20;to&#x20;nftables&#x20;ruleset&#x20;only&#x20;affect&#x20;the&#x20;live&#x20;system,&#x20;you&#x20;will&#x20;also&#x20;need&#x20;to&#x20;configure&#x20;the&#x20;nftables&#x20;ruleset&#x20;to&#x20;apply&#x20;on&#x20;boot','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.2.11\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4607,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4608,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4609,'Ensure&#x20;iptables&#x20;is&#x20;enabled&#x20;and&#x20;running','iptables.service&#x20;is&#x20;a&#x20;utility&#x20;for&#x20;configuring&#x20;and&#x20;maintaining&#x20;iptables.','iptables.service&#x20;willload&#x20;the&#x20;iptables&#x20;rules&#x20;saved&#x20;in&#x20;the&#x20;file&#x20;/etc/sysconfig/iptablesat&#x20;boot,&#x20;otherwise&#x20;the&#x20;iptables&#x20;rules&#x20;will&#x20;be&#x20;cleared&#x20;during&#x20;a&#x20;re-boot&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-PFORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.2.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4610,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-PFORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.3.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4611,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;tothe&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4612,'Ensure&#x20;IPv6&#x20;outbound&#x20;and&#x20;established&#x20;connections&#x20;are&#x20;configured','Configure&#x20;the&#x20;firewall&#x20;rules&#x20;for&#x20;new&#x20;outbound,&#x20;and&#x20;established&#x20;IPv6&#x20;connections.','If&#x20;rules&#x20;are&#x20;not&#x20;in&#x20;place&#x20;for&#x20;new&#x20;outbound,&#x20;and&#x20;established&#x20;connections&#x20;all&#x20;packets&#x20;will&#x20;be&#x20;dropped&#x20;by&#x20;the&#x20;default&#x20;policy&#x20;preventing&#x20;network&#x20;usage','','Configure&#x20;iptables&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;commands&#x20;will&#x20;implement&#x20;a&#x20;policy&#x20;to&#x20;allow&#x20;all&#x20;outbound&#x20;connections&#x20;and&#x20;all&#x20;established&#x20;connections:#&#x20;ip6tables&#x20;-AOUTPUT&#x20;-p&#x20;tcp&#x20;-m&#x20;state&#x20;--state&#x20;NEW,ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-p&#x20;udp&#x20;-m&#x20;state&#x20;--state&#x20;NEW,ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-p&#x20;icmp&#x20;-m&#x20;state&#x20;--state&#x20;NEW,ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-p&#x20;tcp&#x20;-m&#x20;state&#x20;--state&#x20;ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-p&#x20;udp&#x20;-m&#x20;state&#x20;--state&#x20;ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-p&#x20;icmp&#x20;-m&#x20;state&#x20;--state&#x20;ESTABLISHED&#x20;-j&#x20;ACCEPT','[{\"cis\": [\"3.5.3.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4613,'Ensure&#x20;ip6tables&#x20;is&#x20;enabled&#x20;and&#x20;running','ip6tables.service&#x20;is&#x20;a&#x20;utility&#x20;for&#x20;configuring&#x20;and&#x20;maintaining&#x20;ip6tables.','ip6tables.service&#x20;will&#x20;load&#x20;the&#x20;iptables&#x20;rules&#x20;saved&#x20;in&#x20;the&#x20;file&#x20;/etc/sysconfig/ip6tables&#x20;at&#x20;boot,&#x20;otherwise&#x20;the&#x20;ip6tables&#x20;rules&#x20;will&#x20;be&#x20;cleared&#x20;during&#x20;a&#x20;re-boot&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;ip6tables:&#x20;#&#x20;systemctl&#x20;--now&#x20;start&#x20;ip6tables','[{\"cis\": [\"3.5.3.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(4614,'Ensure&#x20;auditd&#x20;is&#x20;installed','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;&#x20;#&#x20;yum&#x20;install&#x20;audit&#x20;audit-libs','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4615,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4616,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub2&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4617,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4618,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.2\", \"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4619,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4620,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient','The&#x20;backlog&#x20;limit&#x20;has&#x20;a&#x20;default&#x20;setting&#x20;of&#x20;64','During&#x20;boot&#x20;if&#x20;audit=1,&#x20;then&#x20;the&#x20;backlog&#x20;will&#x20;hold&#x20;64&#x20;records.&#x20;If&#x20;more&#x20;than&#x20;64&#x20;records&#x20;are&#x20;created&#x20;during&#x20;boot,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit_backlog_limit=&lt;BACKLOG&#x20;SIZE&gt;&#x20;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;&#x20;&#x20;Example:&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;audit_backlog_limit=8192&quot;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(4621,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/time-change.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/time-change.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4622,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/identity.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4623,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.5\", \"6.2\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4624,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/MAC-policy.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4625,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;/var/run/faillock/&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/logins.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillog/&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;IF&#x20;&#x20;&#x20;the&#x20;pam_faillock.so&#x20;module&#x20;is&#x20;used:&#x20;Also&#x20;include&#x20;the&#x20;line:&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;OR&#x20;IF&#x20;the&#x20;pam_tally2.so&#x20;module&#x20;is&#x20;used:&#x20;Also&#x20;include&#x20;the&#x20;line:&#x20;&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4626,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/logins.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;&#x20;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;&#x20;last&#x20;-f&#x20;/var/run/utmp&#x20;&#41;&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}]'),(4627,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown,&#x20;fchown,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr,&#x20;lsetxattr,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr,&#x20;lremovexattr,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/perm_mod.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/perm_mod.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4628,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/access.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/access.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4629,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/mount.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/mounts.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4630,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;ollowing&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;:&#x20;unlink&#x20;-remove&#x20;a&#x20;file&#x20;&#x20;&#x20;&#x20;&#x20;unlinkat&#x20;-&#x20;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#x20;and&#x20;renameat&#x20;-&#x20;rename&#x20;a&#x20;file&#x20;attribute.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/delete.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/delete.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"6.2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(4631,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d&#x20;directory&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file,&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d/&#x20;directory&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/scope.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines::&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4632,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;The&#x20;sudo&#x20;log&#x20;file&#x20;is&#x20;configured&#x20;in&#x20;/etc/sudoersor&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;sudo&#x20;log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/action.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions&#x20;.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.9\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4633,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/modules.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/directory&#x20;ending&#x20;in&#x20;.rules&#x20;&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/modules.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4634,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rulesand&#x20;add&#x20;the&#x20;following&#x20;line&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file:&#x20;&#x20;-e&#x20;2','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4635,'Ensure&#x20;rsyslog&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;software&#x20;is&#x20;a&#x20;recommended&#x20;replacement&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon.&#x20;rsyslog&#x20;provides&#x20;improvements&#x20;over&#x20;syslogd,&#x20;including:&#x20;&#x20;&#x20;-&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs&#x20;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats&#x20;&#x20;&#x20;&#x20;-&#x20;Encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;#&#x20;yum&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4636,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled&#x20;and&#x20;running','rsyslogneeds&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;perform&#x20;logging','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lackblogging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4637,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4638,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;&#x20;systemctl&#x20;restart&#x20;rsyslog','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4639,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog&#x20;','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4640,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4641,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4642,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.&#x20;&#x20;Other/world&#x20;should&#x20;not&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;view&#x20;this&#x20;information.&#x20;Group&#x20;should&#x20;not&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;modify&#x20;this&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;&quot;{}&quot;&#x20;+&#x20;-o&#x20;-type&#x20;d&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;&quot;{}&quot;&#x20;+','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4643,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;systemctl&#x20;enable&#x20;crond;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4644,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4645,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4646,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily;&#x20;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4647,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4648,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4649,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','The&#x20;/etc/cron.d/directory&#x20;contains&#x20;system&#x20;cronjobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;:&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4650,'Ensure&#x20;cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','If&#x20;cronis&#x20;installed&#x20;in&#x20;the&#x20;system,&#x20;configure&#x20;/etc/cron.allowto&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allowdoes&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.denyis&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.alloware&#x20;allowed&#x20;to&#x20;use&#x20;cron.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allowfile&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cronjobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4651,'Ensure&#x20;at&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','If&#x20;atis&#x20;installed&#x20;in&#x20;the&#x20;system,&#x20;configure&#x20;/etc/at.allowto&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/at.allowdoes&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.denyis&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/at.alloware&#x20;allowed&#x20;to&#x20;use&#x20;at.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;atjobs.&#x20;Using&#x20;the&#x20;at.allowfile&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;atjobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4652,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4653,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions,&#x20;ownership,&#x20;and&#x20;group&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;{}&#x20;;&#x20;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:ssh_keys&#x20;{}&#x20;;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4654,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;u-x,go-wx&#x20;{}&#x20;;&#x20;&#x20;&#x20;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4655,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;#&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;#&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;#&#x20;DenyUsers&#x20;&lt;userlist&gt;;&#x20;#&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4656,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4657,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"pci_dss\": [\"9.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4658,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4659,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4660,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4661,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4662,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4663,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(4664,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.:&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&#039;Sweet32&#039;&#x20;attack;&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involvingLSB&#x20;values,&#x20;aka&#x20;the&#x20;&#039;Bar&#x20;Mitzvah&#039;&#x20;issue;&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session;&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors;&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;add/modify&#x20;the&#x20;Ciphersline&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphersExample:Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4665,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4666,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms.Example:&#039;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256&#039;','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4667,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4668,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4669,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4670,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthenticationand&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4671,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4672,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured','The&#x20;MaxStartupsparameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;maxstartups&#x20;10:30:60','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4673,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;limited','The&#x20;MaxSessionsparameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10','[{\"cis\": [\"5.2.22\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4674,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minclass&#x20;=&#x20;4&#x20;&#x20;&#x20;&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:password&#x20;requisite&#x20;pam_pwquality.so&#x20;try_first_pass&#x20;retry=3','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4675,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(4676,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;remember=5&#x20;&#x20;&#x20;or&#x20;&#x20;&#x20;&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4677,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4678,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;configured','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;1&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;1&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4679,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4680,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4681,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4682,'&#x20;Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;configured','TMOUT&#x20;is&#x20;an&#x20;environmental&#x20;setting&#x20;that&#x20;determines&#x20;the&#x20;timeout&#x20;of&#x20;a&#x20;shell&#x20;in&#x20;seconds.','Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;the&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;that&#x20;has&#x20;been&#x20;left&#x20;unattended.&#x20;It&#x20;also&#x20;ends&#x20;the&#x20;inactive&#x20;session&#x20;and&#x20;releases&#x20;the&#x20;resources&#x20;associated&#x20;with&#x20;that&#x20;session.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;and&#x20;/etc/profile&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(4683,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;configured','The&#x20;user&#x20;file-creation&#x20;mode&#x20;mask&#x20;&#40;umask&#41;&#x20;is&#x20;use&#x20;to&#x20;determine&#x20;the&#x20;file&#x20;permission&#x20;for&#x20;newly&#x20;created&#x20;directories&#x20;and&#x20;files.&#x20;In&#x20;Linux,&#x20;the&#x20;default&#x20;permissions&#x20;for&#x20;any&#x20;newly&#x20;created&#x20;directory&#x20;is&#x20;0777&#x20;&#40;rwxrwxrwx&#41;,&#x20;and&#x20;for&#x20;any&#x20;newly&#x20;created&#x20;file&#x20;it&#x20;is&#x20;0666&#x20;&#40;rw-rw-rw-&#41;.&#x20;The&#x20;umask&#x20;modifies&#x20;the&#x20;default&#x20;Linux&#x20;permissions&#x20;by&#x20;restricting&#x20;&#40;masking&#41;&#x20;these&#x20;permissions.&#x20;The&#x20;umask&#x20;is&#x20;not&#x20;simply&#x20;subtracted,&#x20;but&#x20;is&#x20;processed&#x20;bitwise.&#x20;Bits&#x20;set&#x20;in&#x20;the&#x20;umaskare&#x20;cleared&#x20;in&#x20;the&#x20;resulting&#x20;file&#x20;mode.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4684,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4685,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;&#x20;&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4686,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(4687,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4688,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4689,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4690,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4691,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4692,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(4693,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;The&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;one-way&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;xin&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.','','f&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/passwdfile&#x20;do&#x20;not&#x20;have&#x20;a&#x20;single&#x20;x&#x20;in&#x20;the&#x20;password&#x20;field,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;these&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwdInvestigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4694,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(4695,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(4696,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;runa&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.18\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5000,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/cramfs.conf:&#x20;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5001,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;limited','The&#x20;VFAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/vfat.conf:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;#&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5002,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/squashfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5003,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5004,'Ensure&#x20;/tmp&#x20;is&#x20;configured','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;example:&#x20;&quot;tmpfs&#x20;&#x20;/tmp&#x20;&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;&#x20;0&#x20;0&quot;&#x20;&#x20;OR&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;#&#x20;systemctl&#x20;enable&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount:&#x20;&#x20;&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5005,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;OR&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5006,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5007,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5008,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5009,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5010,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5011,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5012,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5013,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5014,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5015,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5016,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5017,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5018,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5019,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5020,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs&#x20;:&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5021,'Disable&#x20;USB&#x20;Storage','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/usb-storage.conf&#x20;&#x20;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;&#x20;#&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5022,'Disable&#x20;the&#x20;rhnsd&#x20;Daemon','The&#x20;rhnsd&#x20;daemon&#x20;polls&#x20;the&#x20;Red&#x20;Hat&#x20;Network&#x20;web&#x20;site&#x20;for&#x20;scheduled&#x20;actions&#x20;and,&#x20;if&#x20;there&#x20;are,&#x20;executes&#x20;those&#x20;actions.','Patch&#x20;management&#x20;policies&#x20;may&#x20;require&#x20;that&#x20;organizations&#x20;test&#x20;the&#x20;impact&#x20;of&#x20;a&#x20;patch&#x20;before&#x20;it&#x20;is&#x20;deployed&#x20;in&#x20;a&#x20;production&#x20;environment.&#x20;Having&#x20;patches&#x20;automatically&#x20;deployed&#x20;could&#x20;have&#x20;a&#x20;negative&#x20;impact&#x20;on&#x20;the&#x20;environment.&#x20;It&#x20;is&#x20;best&#x20;to&#x20;not&#x20;allow&#x20;an&#x20;action&#x20;by&#x20;default&#x20;but&#x20;only&#x20;after&#x20;appropriate&#x20;consideration&#x20;has&#x20;been&#x20;made.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;unless&#x20;the&#x20;risk&#x20;is&#x20;understood&#x20;and&#x20;accepted&#x20;or&#x20;you&#x20;are&#x20;running&#x20;your&#x20;own&#x20;satellite&#x20;.&#x20;This&#x20;item&#x20;is&#x20;not&#x20;scored&#x20;because&#x20;organizations&#x20;may&#x20;have&#x20;addressed&#x20;the&#x20;risk.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rhnsd&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rhnsd','[{\"cis\": [\"1.2.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5023,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.4\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(5024,'Ensure&#x20;sudo&#x20;is&#x20;installed','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo:&#x20;#&#x20;dnf&#x20;install&#x20;sudo','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5025,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo&#x20;which&#x20;would&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5026,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5027,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;aide:&#x20;#&#x20;dnf&#x20;install&#x20;aide&#x20;&#x20;||&#x20;&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5028,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;cp&#x20;./config/aidecheck.service&#x20;/etc/systemd/system/aidecheck.service&#x20;&#x20;#&#x20;cp&#x20;./config/aidecheck.timer&#x20;/etc/systemd/system/aidecheck.timer&#x20;&#x20;&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;#&#x20;systemctl&#x20;reenable&#x20;aidecheck.timer&#x20;#&#x20;systemctl&#x20;restart&#x20;aidecheck.timer&#x20;#&#x20;systemctl&#x20;daemon-reload.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;//&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5029,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;and&#x20;grubenv&#x20;stored&#x20;in&#x20;/boot/grub2/','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grubenv&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grubenv','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5030,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-setpassword:&#x20;#&#x20;grub2-setpassword&#x20;&#x20;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5031,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/usr/lib/systemd/system/rescue.service&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;line:&#x20;ExecStart=-/usr/lib/systemd/systemd-sulogin-shell&#x20;rescue&#x20;Edit&#x20;/usr/lib/systemd/system/emergency.service&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;line:&#x20;ExecStart=-/usr/lib/systemd/systemd-sulogin-shell&#x20;emergency','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5032,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0.&#x20;If&#x20;systemd-coredump&#x20;is&#x20;installed:&#x20;&#x20;edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;Storage=none&#x20;ProcessSizeMax=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;command:&#x20;#&#x20;systemctl&#x20;daemon-reload','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5033,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5034,'Ensure&#x20;SELinux&#x20;is&#x20;installed','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Control.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;SELinux&#x20;:&#x20;#&#x20;dnf&#x20;install&#x20;libselinux','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5035,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5036,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5037,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5038,'Ensure&#x20;no&#x20;unconfined&#x20;services&#x20;exist','Unconfined&#x20;processes&#x20;run&#x20;in&#x20;unconfined&#x20;domains','For&#x20;unconfined&#x20;processes,&#x20;SELinux&#x20;policy&#x20;rules&#x20;are&#x20;applied,&#x20;but&#x20;policy&#x20;rules&#x20;exist&#x20;that&#x20;allow&#x20;processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;almost&#x20;all&#x20;access.&#x20;Processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;fall&#x20;back&#x20;to&#x20;using&#x20;DAC&#x20;rules&#x20;exclusively.&#x20;If&#x20;an&#x20;unconfined&#x20;process&#x20;is&#x20;compromised,&#x20;SELinux&#x20;does&#x20;not&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;system&#x20;resources&#x20;and&#x20;data,&#x20;but&#x20;of&#x20;course,&#x20;DAC&#x20;rules&#x20;are&#x20;still&#x20;used.&#x20;SELinux&#x20;is&#x20;a&#x20;security&#x20;enhancement&#x20;on&#x20;top&#x20;of&#x20;DAC&#x20;rules&#x20;&ndash;&#x20;it&#x20;does&#x20;not&#x20;replace&#x20;them','','Investigate&#x20;any&#x20;unconfined&#x20;processes&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.&#x20;Notes:&#x20;Occasionally&#x20;certain&#x20;daemons&#x20;such&#x20;as&#x20;backup&#x20;or&#x20;centralized&#x20;management&#x20;software&#x20;may&#x20;require&#x20;running&#x20;unconfined.&#x20;Any&#x20;such&#x20;software&#x20;should&#x20;be&#x20;carefully&#x20;analyzed&#x20;and&#x20;documented&#x20;before&#x20;such&#x20;an&#x20;exception&#x20;is&#x20;made.','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5039,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;dnf&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5040,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;dnf&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5041,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5042,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5043,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5044,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5045,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5046,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5047,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add&#x20;the&#x20;following&#x20;in&#x20;3&#x20;lines:&#x20;&#40;1&#41;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#40;2&#41;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#40;3&#41;&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;','[{\"cis\": [\"1.8.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5048,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;install&#x20;all&#x20;available&#x20;security&#x20;updates:&#x20;#&#x20;dnf&#x20;update&#x20;--security&#x20;.&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.&#x20;The&#x20;audit&#x20;and&#x20;remediation&#x20;here&#x20;only&#x20;cover&#x20;security&#x20;updates.&#x20;Non-security&#x20;updates&#x20;can&#x20;be&#x20;audited&#x20;with&#x20;and&#x20;comparing&#x20;against&#x20;site&#x20;policy:&#x20;#&#x20;dnf&#x20;check-update','[{\"cis\": [\"1.9\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(5049,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;not&#x20;legacy','The&#x20;system-wide&#x20;crypto-policies&#x20;followed&#x20;by&#x20;the&#x20;crypto&#x20;core&#x20;components&#x20;allow&#x20;consistently&#x20;deprecating&#x20;and&#x20;disabling&#x20;algorithms&#x20;system-wide.&#x20;The&#x20;individual&#x20;policy&#x20;levels&#x20;&#40;DEFAULT,&#x20;LEGACY,&#x20;FUTURE,&#x20;and&#x20;FIPS&#41;&#x20;are&#x20;included&#x20;in&#x20;the&#x20;crypto-policies&#40;7&#41;&#x20;package.','If&#x20;the&#x20;Legacy&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;selected,&#x20;it&#x20;includes&#x20;support&#x20;for&#x20;TLS&#x20;1.0,&#x20;TLS&#x20;1.1,&#x20;and&#x20;SSH2&#x20;protocols&#x20;or&#x20;later.&#x20;The&#x20;algorithms&#x20;DSA,&#x20;3DES,&#x20;and&#x20;RC4&#x20;are&#x20;allowed,&#x20;while&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;1023-bits.&#x20;These&#x20;legacy&#x20;protocols&#x20;and&#x20;algorithms&#x20;can&#x20;make&#x20;the&#x20;system&#x20;vulnerable&#x20;to&#x20;attacks,&#x20;including&#x20;those&#x20;listed&#x20;in&#x20;RFC&#x20;7457','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;&lt;CRYPTO&#x20;POLICY&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Example:&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;DEFAULT&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;make&#x20;the&#x20;updated&#x20;system-wide&#x20;crypto&#x20;policy&#x20;active&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;update-crypto-policies','[{\"cis\": [\"1.10\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5050,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;FUTURE&#x20;or&#x20;FIPS','The&#x20;system-wide&#x20;crypto-policies&#x20;followed&#x20;by&#x20;the&#x20;crypto&#x20;core&#x20;components&#x20;allow&#x20;consistently&#x20;deprecating&#x20;and&#x20;disabling&#x20;algorithms&#x20;system-wide.&#x20;The&#x20;individual&#x20;policy&#x20;levels&#x20;&#40;DEFAULT,&#x20;LEGACY,&#x20;FUTURE,&#x20;and&#x20;FIPS&#41;&#x20;are&#x20;included&#x20;in&#x20;the&#x20;crypto-policies&#40;7&#41;&#x20;package.','If&#x20;the&#x20;Legacy&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;selected,&#x20;it&#x20;includes&#x20;support&#x20;for&#x20;TLS&#x20;1.0,&#x20;TLS&#x20;1.1,&#x20;and&#x20;SSH2&#x20;protocols&#x20;or&#x20;later.&#x20;The&#x20;algorithms&#x20;DSA,&#x20;3DES,&#x20;and&#x20;RC4&#x20;are&#x20;allowed,&#x20;while&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;1023-bits.&#x20;These&#x20;legacy&#x20;protocols&#x20;and&#x20;algorithms&#x20;can&#x20;make&#x20;the&#x20;system&#x20;vulnerable&#x20;to&#x20;attacks,&#x20;including&#x20;those&#x20;listed&#x20;in&#x20;RFC&#x20;7457&#x20;FUTURE:&#x20;Is&#x20;a&#x20;conservative&#x20;security&#x20;level&#x20;that&#x20;is&#x20;believed&#x20;to&#x20;withstand&#x20;any&#x20;near-term&#x20;future&#x20;attacks.&#x20;This&#x20;level&#x20;does&#x20;not&#x20;allow&#x20;the&#x20;use&#x20;of&#x20;SHA-1&#x20;in&#x20;signature&#x20;algorithms.&#x20;The&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;3071&#x20;bits.&#x20;The&#x20;level&#x20;provides&#x20;at&#x20;least&#x20;128-bit&#x20;security&#x20;FIPS:&#x20;Conforms&#x20;to&#x20;the&#x20;FIPS&#x20;140-2&#x20;requirements.&#x20;This&#x20;policy&#x20;is&#x20;used&#x20;internally&#x20;by&#x20;the&#x20;fips-mode-setup&#40;8&#41;&#x20;tool&#x20;which&#x20;can&#x20;switch&#x20;the&#x20;system&#x20;into&#x20;the&#x20;FIPS&#x20;140-2&#x20;compliance&#x20;mode.&#x20;The&#x20;level&#x20;provides&#x20;at&#x20;least&#x20;112-bit&#x20;security','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;FUTURE&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;To&#x20;switch&#x20;the&#x20;system&#x20;to&#x20;FIPS&#x20;mode,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;fips-mode-setup&#x20;--enable','[{\"cis\": [\"1.11\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5051,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;dnf&#x20;remove&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5052,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;install&#x20;chrony:&#x20;#&#x20;dnf&#x20;install&#x20;chrony&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;verify&#x20;that&#x20;host&#x20;based&#x20;synchronization&#x20;is&#x20;in&#x20;use.','[{\"cis\": [\"2.2.2.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5053,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;&#x20;&#x20;Configure&#x20;chrony&#x20;to&#x20;run&#x20;as&#x20;the&#x20;chrony&#x20;user','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5054,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;dnf&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5055,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rsyncd','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5056,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5057,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5058,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5059,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;smb','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5060,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;dovecot','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5061,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;httpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5062,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5063,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;named','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5064,'Ensure&#x20;NFS&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;NFS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;nfs','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5065,'Ensure&#x20;RPC&#x20;is&#x20;not&#x20;enabled','The&#x20;rpcbind&#x20;service&#x20;maps&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;services&#x20;to&#x20;the&#x20;ports&#x20;on&#x20;which&#x20;they&#x20;listen.&#x20;RPC&#x20;processes&#x20;notify&#x20;rpcbind&#x20;when&#x20;they&#x20;start,&#x20;registering&#x20;the&#x20;ports&#x20;they&#x20;are&#x20;listening&#x20;on&#x20;and&#x20;the&#x20;RPC&#x20;program&#x20;numbers&#x20;they&#x20;expect&#x20;to&#x20;serve.&#x20;The&#x20;client&#x20;system&#x20;then&#x20;contacts&#x20;rpcbind&#x20;on&#x20;the&#x20;server&#x20;with&#x20;a&#x20;particular&#x20;RPC&#x20;program&#x20;number.&#x20;The&#x20;rpcbind&#x20;service&#x20;redirects&#x20;the&#x20;client&#x20;to&#x20;the&#x20;proper&#x20;port&#x20;number&#x20;so&#x20;it&#x20;can&#x20;communicate&#x20;with&#x20;the&#x20;requested&#x20;service.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;require&#x20;rpc&#x20;based&#x20;services,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;rpcbind&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5066,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5067,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;dhcpd','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5068,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5069,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;ypserv','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5070,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.18\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(5071,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;dnf&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5072,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet&#x20;:&#x20;#&#x20;dnf&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5073,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;dnf&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5074,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.ip_forwards*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;&#x20;&#x20;&#x20;&amp;&amp;&#x20;&#x20;&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv6.conf.all.forwardings*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv6.conf.all.forwardings*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5075,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;.Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5076,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5077,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;and&#x20;net.ipv6.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;and&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5078,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;and&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5079,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;and&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5080,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.icmp_echo_ignore_broadcastss*=s*0&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;&quot;s/^s*&#40;net.ipv4.icmp_echo_ignore_broadcastss*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.icmp_echo_ignore_broadcasts=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5081,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.icmp_ignore_bogus_error_responsess*=s*0&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.icmp_ignore_bogus_error_responsess*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&quot;','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5082,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.conf.all.rp_filters*=s*0&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.net.ipv4.conf.all.rp_filters*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;.Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.default.rp_filter=1&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5083,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.tcp_syncookiess*=s*[02]*&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.tcp_syncookiess*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5084,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;do&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;and&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1;','[{\"cis\": [\"3.2.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5085,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5086,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5087,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5088,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5089,'Ensure&#x20;a&#x20;Firewall&#x20;package&#x20;is&#x20;installed','A&#x20;Firewall&#x20;package&#x20;should&#x20;be&#x20;selected.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;nftables&#x20;or&#x20;iptables.','A&#x20;Firewall&#x20;package&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;a&#x20;Firewall&#x20;package.&#x20;For&#x20;firewalld:&#x20;dnf&#x20;install&#x20;firewalld&#x20;.For&#x20;nftables:&#x20;#&#x20;dnf&#x20;install&#x20;nftables.&#x20;For&#x20;iptables:&#x20;#&#x20;dnf&#x20;install&#x20;iptables','[{\"cis\": [\"3.4.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5090,'Ensure&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running','Ensure&#x20;that&#x20;the&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;protect&#x20;your&#x20;system','firewalld&#x20;&#40;Dynamic&#x20;Firewall&#x20;Manager&#41;&#x20;tool&#x20;provides&#x20;a&#x20;dynamically&#x20;managed&#x20;firewall.&#x20;The&#x20;tool&#x20;enables&#x20;network/firewall&#x20;zones&#x20;to&#x20;define&#x20;the&#x20;trust&#x20;level&#x20;of&#x20;network&#x20;connections&#x20;and/or&#x20;interfaces.&#x20;It&#x20;has&#x20;support&#x20;both&#x20;for&#x20;IPv4&#x20;and&#x20;IPv6&#x20;firewall&#x20;settings.&#x20;Also,&#x20;it&#x20;supports&#x20;Ethernet&#x20;bridges&#x20;and&#x20;allow&#x20;you&#x20;to&#x20;separate&#x20;between&#x20;runtime&#x20;and&#x20;permanent&#x20;configuration&#x20;options.&#x20;Finally,&#x20;it&#x20;supports&#x20;an&#x20;interface&#x20;for&#x20;services&#x20;or&#x20;applications&#x20;to&#x20;add&#x20;firewall&#x20;rules&#x20;directly','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;firewalld','[{\"cis\": [\"3.4.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5091,'Ensure&#x20;iptables&#x20;is&#x20;not&#x20;enabled','IPtables&#x20;is&#x20;an&#x20;application&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;IPv4&#x20;and&#x20;IPv6&#x20;tables,&#x20;chains&#x20;and&#x20;rules&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall.&#x20;IPtables&#x20;is&#x20;installed&#x20;as&#x20;a&#x20;dependency&#x20;with&#x20;firewalld.','Running&#x20;firewalld&#x20;and&#x20;IPtables&#x20;concurrently&#x20;may&#x20;lead&#x20;to&#x20;conflict,&#x20;therefore&#x20;IPtables&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;when&#x20;using&#x20;firewalld.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;iptables:&#x20;systemctl&#x20;--now&#x20;mask&#x20;iptables','[{\"cis\": [\"3.4.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5092,'Ensure&#x20;nftables&#x20;is&#x20;not&#x20;enabled','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.&#x20;nftables&#x20;are&#x20;installed&#x20;as&#x20;a&#x20;dependency&#x20;with&#x20;firewalld.','Running&#x20;firewalld&#x20;and&#x20;nftables&#x20;concurrently&#x20;may&#x20;lead&#x20;to&#x20;conflict,&#x20;therefore&#x20;nftables&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;when&#x20;using&#x20;firewalld.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;and&#x20;stop&#x20;nftables:&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables','[{\"cis\": [\"3.4.2.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5093,'Ensure&#x20;iptables&#x20;are&#x20;flushed','nftables&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;iptables,&#x20;ip6tables,&#x20;ebtables&#x20;and&#x20;arptables','It&#x20;is&#x20;possible&#x20;to&#x20;mix&#x20;iptables&#x20;and&#x20;nftables.&#x20;However,&#x20;this&#x20;increases&#x20;complexity&#x20;and&#x20;also&#x20;the&#x20;chance&#x20;to&#x20;introduce&#x20;errors.&#x20;For&#x20;simplicity&#x20;flush&#x20;out&#x20;all&#x20;iptables&#x20;rules,&#x20;and&#x20;ensure&#x20;it&#x20;is&#x20;not&#x20;loaded.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;flush&#x20;iptables:&#x20;For&#x20;iptables:&#x20;#&#x20;iptables&#x20;-F&#x20;and&#x20;For&#x20;ip6tables:&#x20;#&#x20;ip6tables&#x20;-F','[{\"cis\": [\"3.4.3.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5094,'Ensure&#x20;a&#x20;table&#x20;exists','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;.Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.4.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5095,'Ensure&#x20;base&#x20;chains&#x20;exist','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.4.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5096,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept&#x20;,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;;&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;and&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.4.3.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5097,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;nftables','[{\"cis\": [\"3.4.3.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5098,'Ensure&#x20;iptables&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.4.4.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5099,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.4.4.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5100,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.4.4.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5101,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.4.4.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5102,'Ensure&#x20;wireless&#x20;interfaces&#x20;are&#x20;disabled','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.&#x20;Red&#x20;Hat&#x20;Enterprise&#x20;Linux&#x20;contains&#x20;a&#x20;wireless&#x20;tool&#x20;kit&#x20;to&#x20;allow&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;and&#x20;use&#x20;wireless&#x20;networks.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;any&#x20;wireless&#x20;interfaces:&#x20;#&#x20;nmcli&#x20;radio&#x20;all&#x20;off&#x20;.&#x20;Disable&#x20;any&#x20;wireless&#x20;interfaces&#x20;in&#x20;your&#x20;network&#x20;configuration.','[{\"cis\": [\"3.5\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.6\"]}]'),(5103,'Disable&#x20;IPv6','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;.Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"3.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.6\", \"CC5.2\"]}]'),(5104,'Ensure&#x20;rsyslog&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;software&#x20;is&#x20;a&#x20;recommended&#x20;replacement&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;&#x20;&#x20;#&#x20;dnf&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5105,'Ensure&#x20;auditd&#x20;is&#x20;installed','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;#&#x20;dnf&#x20;install&#x20;audit&#x20;audit-libs','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5106,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5107,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub2&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX&#x20;:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5108,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient','The&#x20;backlog&#x20;limit&#x20;has&#x20;a&#x20;default&#x20;setting&#x20;of&#x20;64.','During&#x20;boot&#x20;if&#x20;audit=1,&#x20;then&#x20;the&#x20;backlog&#x20;will&#x20;hold&#x20;64&#x20;records.&#x20;If&#x20;more&#x20;than&#x20;64&#x20;records&#x20;are&#x20;created&#x20;during&#x20;boot,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit_backlog_limit=&lt;BACKLOG&#x20;SIZE&gt;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(5109,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(5110,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(5111,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(5112,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5113,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.9\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5114,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"4.9\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(5115,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5116,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5117,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5118,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5119,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5120,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5121,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5122,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(5123,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod&#x20;,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5124,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5125,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line:&#x20;&#x20;&#x20;-e&#x20;2&#x20;&#x20;&#x20;&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(5126,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5127,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(5128,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5129,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(5130,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5131,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Compress=yes','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5132,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;{}&#x20;+','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(5133,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;crond','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5134,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5135,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5136,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5137,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5138,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5139,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5140,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5141,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5142,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;and&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5143,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;0600&#x20;{}&#x20;;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5144,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;public&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;0644&#x20;{}&#x20;;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5145,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;or&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5146,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5147,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5148,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Ignorerhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5149,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5150,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5151,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5152,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5153,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(5154,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5155,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5156,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5157,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5158,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;4','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5159,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;not&#x20;over-ridden','System-wide&#x20;Crypto&#x20;policy&#x20;can&#x20;be&#x20;over-ridden&#x20;or&#x20;opted&#x20;out&#x20;of&#x20;for&#x20;openSSH','Over-riding&#x20;or&#x20;opting&#x20;out&#x20;of&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;could&#x20;allow&#x20;for&#x20;the&#x20;use&#x20;of&#x20;less&#x20;secure&#x20;Ciphers,&#x20;MACs,&#x20;KexAlgoritms&#x20;and&#x20;GSSAPIKexAlgorithsm','','Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;CRYPTO_POLICYs*=.*&#41;$/#&#x20;1/&quot;&#x20;/etc/sysconfig/sshd;&#x20;#&#x20;systemctl&#x20;reload&#x20;sshd','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5160,'Create&#x20;custom&#x20;authselect&#x20;profile','A&#x20;custom&#x20;profile&#x20;can&#x20;be&#x20;created&#x20;by&#x20;copying&#x20;and&#x20;customizing&#x20;one&#x20;of&#x20;the&#x20;default&#x20;profiles.&#x20;The&#x20;default&#x20;profiles&#x20;include:&#x20;sssd,&#x20;winbind,&#x20;or&#x20;the&#x20;nis.','A&#x20;custom&#x20;profile&#x20;is&#x20;required&#x20;to&#x20;customize&#x20;many&#x20;of&#x20;the&#x20;pam&#x20;options','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;custom&#x20;authselect&#x20;profile:&#x20;#&#x20;authselect&#x20;create-profile&#x20;&lt;custom-profile&#x20;name&gt;&#x20;-b&#x20;&lt;default&#x20;profile&#x20;to&#x20;copy&gt;&#x20;.Example:&#x20;#&#x20;authselect&#x20;create-profile&#x20;custom-profile&#x20;-b&#x20;sssd&#x20;--symlink-meta','[{\"cis\": [\"5.3.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5161,'Ensure&#x20;authselect&#x20;includes&#x20;with-faillock','The&#x20;pam_faillock.so&#x20;module&#x20;maintains&#x20;a&#x20;list&#x20;of&#x20;failed&#x20;authentication&#x20;attempts&#x20;per&#x20;user&#x20;during&#x20;a&#x20;specified&#x20;interval&#x20;and&#x20;locks&#x20;the&#x20;account&#x20;in&#x20;case&#x20;there&#x20;were&#x20;more&#x20;than&#x20;deny&#x20;consecutive&#x20;failed&#x20;authentications.&#x20;It&#x20;stores&#x20;the&#x20;failure&#x20;records&#x20;into&#x20;per-user&#x20;files&#x20;in&#x20;the&#x20;tally&#x20;directory.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;include&#x20;the&#x20;with-faillock&#x20;option:&#x20;#&#x20;authselect&#x20;select&#x20;&lt;PROFILE&#x20;NAME&gt;&#x20;with-faillock&#x20;&#x20;&#x20;&#x20;Example:&#x20;#&#x20;authselect&#x20;select&#x20;custom/custom-profile&#x20;with-sudo&#x20;with-faillock&#x20;without-nullok','[{\"cis\": [\"5.3.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5162,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options.&#x20;try_first_pass&#x20;-&#x20;retrieve&#x20;the&#x20;password&#x20;from&#x20;a&#x20;previous&#x20;stacked&#x20;PAM&#x20;module.&#x20;If&#x20;not&#x20;available,&#x20;then&#x20;prompt&#x20;the&#x20;user&#x20;for&#x20;a&#x20;password.&#x20;retry=3&#x20;-&#x20;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure.&#x20;minlen=14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more&#x20;Either&#x20;of&#x20;the&#x20;following&#x20;can&#x20;be&#x20;used&#x20;to&#x20;enforce&#x20;complex&#x20;passwords:&#x20;minclass=4&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;four&#x20;classes&#x20;of&#x20;characters&#x20;for&#x20;the&#x20;new&#x20;password&#x20;OR&#x20;dcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit&#x20;ucredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character&#x20;ocredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character&#x20;lcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character&#x20;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minclass&#x20;=&#x20;4&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;-1&#x20;=&#x20;-1&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;system-auth&#x20;and&#x20;password-auth&#x20;files:&#x20;CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&#039;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&#039;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;for&#x20;FN&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;[[&#x20;-n&#x20;$CP&#x20;]]&#x20;&amp;&amp;&#x20;PTF=/etc/authselect/$CP/$FN&#x20;||&#x20;PTF=/etc/authselect/$FN&#x20;[[&#x20;-z&#x20;$&#40;grep&#x20;-E&#x20;&#039;^s*passwords+requisites+pam_pwquality.sos+.*enforce-for-roots*.*$&#039;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+requisites+pam_pwquality.sos+&#41;&#40;.*&#41;$/12&#x20;enforce-for-root/&#039;&#x20;$PTF&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&#039;^s*passwords+requisites+pam_pwquality.sos+.*s+retry=S+s*.*$&#039;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;/pwquality/s/retry=S+/retry=3/&#039;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+requisites+pam_pwquality.sos+&#41;&#40;.*&#41;$/12&#x20;retry=3/&#039;&#x20;$PTF&#x20;done&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5163,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;deny=&#x20;-&#x20;Number&#x20;of&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;unlock_time=&#x20;-&#x20;Time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;account&#x20;is&#x20;unlocked.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;and&#x20;unlock&#x20;time&#x20;to&#x20;follow&#x20;local&#x20;site&#x20;policy.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Set&#x20;password&#x20;lockouts&#x20;and&#x20;unlock&#x20;times&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;system-auth&#x20;and&#x20;password-auth&#x20;files.&#x20;This&#x20;script&#x20;will&#x20;update/add&#x20;the&#x20;deny=5&#x20;and&#x20;unlock_time=900&#x20;options.&#x20;This&#x20;script&#x20;should&#x20;be&#x20;modified&#x20;as&#x20;needed&#x20;to&#x20;follow&#x20;local&#x20;site&#x20;policy.CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&quot;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&quot;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;for&#x20;FN&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;[[&#x20;-n&#x20;$CP&#x20;]]&#x20;&amp;&amp;&#x20;PTF=/etc/authselect/$CP/$FN&#x20;||&#x20;PTF=/etc/authselect/$FN&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&quot;^s*auths+requireds+pam_faillock.sos+.*deny=S+s*.*$&quot;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&quot;/pam_faillock.so/s/deny=S+/deny=5/g&quot;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&quot;s/^^s*&#40;auths+requireds+pam_faillock.sos+&#41;&#40;.*[^{}]&#41;&#40;{.*}|&#41;$/12&#x20;deny=5&#x20;3/&quot;&#x20;$PTF&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&quot;^s*auths+requireds+pam_faillock.sos+.*unlock_time=S+s*.*$&quot;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&quot;/pam_faillock.so/s/unlock_time=S+/unlock_time=900/g&quot;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;auths+requireds+pam_faillock.sos+&#41;&#40;.*[^{}]&#41;&#40;{.*}|&#41;$/12&#x20;unlock_time=900&#x20;3/&quot;&#x20;$PTF&#x20;done&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5164,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&quot;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.&#x20;remember=&lt;5&gt;&#x20;-&#x20;Number&#x20;of&#x20;old&#x20;passwords&#x20;to&#x20;remember','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;remembered&#x20;password&#x20;history&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;pam_pwhistory.so&#x20;and&#x20;pam_unix.so&#x20;lines&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option:&#x20;CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&quot;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&quot;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;[[&#x20;-n&#x20;$CP&#x20;]]&#x20;&amp;&amp;&#x20;PTF=/etc/authselect/$CP/system-auth&#x20;||&#x20;PTF=/etc/authselect/system-auth&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&quot;^s*passwords+&#40;sufficients+pam_unix|requi&#40;red|site&#41;s+pam_pwhistory&#41;.sos+&#x20;&#40;[^#]+s+&#41;*remember=S+s*.*$&quot;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;passwords+&#40;requisite|sufficient&#41;s+&#40;pam_pwquality.so|pam_unix.so&#41;s+&#41;&#40;.*&#41;&#40;remember=S+s*&#41;&#40;.*&#41;$/14&#x20;remember=5&#x20;6/&quot;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;passwords+&#40;requisite|sufficient&#41;s+&#40;pam_pwquality.so|pam_unix.so&#41;s+&#41;&#40;.*&#41;$/14&#x20;remember=5/&quot;&#x20;$PTF&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5165,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;password&#x20;hashing&#x20;algorithm&#x20;to&#x20;sha512.&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;dd&#x20;or&#x20;modify&#x20;the&#x20;pam_unix.so&#x20;lines&#x20;in&#x20;the&#x20;password-auth&#x20;and&#x20;system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option:&#x20;CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&#039;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&#039;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;for&#x20;FN&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;[[&#x20;-z&#x20;$&#40;grep&#x20;-E&#x20;&#039;^s*passwords+sufficients+pam_unix.sos+.*sha512s*.*$&#039;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+sufficients+pam_unix.sos+&#41;&#40;.*&#41;$/12&#x20;sha512/&#039;&#x20;$PTF&#x20;done&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(5166,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5167,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5168,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5169,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5170,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;readonly&#x20;TMOUT=900&#x20;;&#x20;export&#x20;TMOUT&#x20;.&#x20;Note&#x20;that&#x20;setting&#x20;the&#x20;value&#x20;to&#x20;readonly&#x20;prevents&#x20;unwanted&#x20;modification&#x20;during&#x20;runtime.','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(5171,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.5.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5172,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.5.5\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5173,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo&#x20;,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su&#x20;,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5174,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5175,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5176,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5177,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5178,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;600&#x20;/etc/passwd-','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5179,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/shadow-','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5180,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5181,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5182,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5183,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5184,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5185,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5186,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5501,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5502,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5503,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5504,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5505,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5506,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5507,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(5508,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5509,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstabfile&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5510,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5511,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5512,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5513,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5514,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5515,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5516,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5517,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5518,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5519,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5520,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5521,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5522,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5523,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5524,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;chkconfig&#x20;autofs&#x20;off','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5525,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(5526,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;aide:&#x20;yum&#x20;install&#x20;aide&#x20;//&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5527,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;//&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5528,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;located&#x20;at&#x20;/boot/grub/grub.conf&#x20;and&#x20;linked&#x20;as&#x20;/boot/grub/menu.lst&#x20;and&#x20;/etc/grub.conf&#x20;.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.conf&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.conf','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5529,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-md5-crypt:&#x20;#&#x20;grub-md5-crypt&#x20;Password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Retype&#x20;Password:&#x20;&lt;password&gt;&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Copy&#x20;and&#x20;paste&#x20;the&#x20;&lt;encrypted-password&gt;&#x20;into&#x20;the&#x20;global&#x20;section&#x20;of&#x20;/boot/grub/grub.conf&#x20;:&#x20;password&#x20;--md5&#x20;&lt;encrypted-password&gt;','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5530,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/etc/sysconfig/init&#x20;and&#x20;set&#x20;SINGLE&#x20;to&#x20;&#039;&#x20;/sbin/sulogin&#039;:&#x20;&#x20;SINGLE=/sbin/sulogin','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5531,'Ensure&#x20;interactive&#x20;boot&#x20;is&#x20;not&#x20;enabled','Interactive&#x20;boot&#x20;allows&#x20;console&#x20;users&#x20;to&#x20;interactively&#x20;select&#x20;which&#x20;services&#x20;start&#x20;on&#x20;boot.&#x20;The&#x20;PROMPT&#x20;option&#x20;provides&#x20;console&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;interactively&#x20;boot&#x20;the&#x20;system&#x20;and&#x20;select&#x20;which&#x20;services&#x20;to&#x20;start&#x20;on&#x20;boot&#x20;.&#x20;','Turn&#x20;off&#x20;the&#x20;PROMPT&#x20;option&#x20;on&#x20;the&#x20;console&#x20;to&#x20;prevent&#x20;console&#x20;users&#x20;from&#x20;potentially&#x20;overriding&#x20;established&#x20;security&#x20;settings.&#x20;','','Edit&#x20;the&#x20;/etc/sysconfig/init&#x20;file&#x20;and&#x20;set&#x20;PROMPT&#x20;to&#x20;&#039;&#x20;no&#x20;&#039;:&#x20;PROMPT=no','[{\"cis\": [\"1.4.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(5532,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5533,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5534,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5535,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5536,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/boot/grub/grub.conf&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;on&#x20;all&#x20;kernel&#x20;lines','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5537,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5538,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.6.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5539,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;yum&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.6.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5540,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;yum&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.6.1.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5541,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.6\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5542,'Ensure&#x20;SELinux&#x20;is&#x20;installed','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;libselinux:&#x20;yum&#x20;install&#x20;libselinux','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5543,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5544,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5545,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5546,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5547,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5548,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5549,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Create&#x20;the&#x20;/etc/dconf/profile/gdm&#x20;file&#x20;with&#x20;the&#x20;following&#x20;contents:&#x20;&#x20;user-db:user&#x20;&#x20;&#x20;system-db:gdm&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;file-db:/usr/share/gdm/greeter-dconf-defaults&#x20;&#x20;&#x20;&#x20;&#x20;||&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;banner-message-enable&#x20;and&#x20;banner-message-text&#x20;options&#x20;in&#x20;/etc/dconf/db/gdm.d/01-banner-message&#x20;:&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;&#x20;&#x20;&#x20;||&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;system&#x20;databases:&#x20;dconf&#x20;update','[{\"cis\": [\"1.7.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(5550,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.&#x20;The&#x20;audit&#x20;and&#x20;remediation&#x20;here&#x20;only&#x20;cover&#x20;security&#x20;updates.&#x20;Non-security&#x20;updates&#x20;can&#x20;be&#x20;audited&#x20;with&#x20;and&#x20;comparing&#x20;against&#x20;site&#x20;policy:&#x20;#&#x20;yum&#x20;check-update','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(5551,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;chargen-dgram&#x20;and&#x20;chargen-stream:&#x20;#&#x20;chkconfig&#x20;chargen-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;chargen-stream&#x20;off','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5552,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;daytime-dgram&#x20;and&#x20;daytime-stream:&#x20;#&#x20;chkconfig&#x20;daytime-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;daytime-stream&#x20;off','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5553,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled','discardis&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;discard-dgram&#x20;and&#x20;discard-stream:&#x20;#&#x20;chkconfig&#x20;discard-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;discard-stream&#x20;off','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5554,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;echo-dgram&#x20;and&#x20;echo-stream:&#x20;#&#x20;chkconfig&#x20;echo-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;echo-stream&#x20;off','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5555,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled','time&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;time-dgram&#x20;and&#x20;time-stream:&#x20;#&#x20;chkconfig&#x20;time-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;time-stream&#x20;off','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5556,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;rexec&#x20;&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;rsh,&#x20;rlogin,&#x20;and&#x20;rexec:&#x20;#&#x20;chkconfig&#x20;rsh&#x20;off&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;rlogin&#x20;off&#x20;&#x20;#&#x20;chkconfig&#x20;rexec&#x20;off','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5557,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;talk:&#x20;#&#x20;chkconfig&#x20;talk&#x20;off','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5558,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;chkconfig&#x20;telnet&#x20;off','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5559,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;package&#x20;tftp-server&#x20;is&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;tftp:&#x20;#&#x20;chkconfig&#x20;tftp&#x20;off','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5560,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;chkconfig&#x20;rsyncd&#x20;off','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5561,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;xinetd:&#x20;#&#x20;chkconfig&#x20;xinetd&#x20;off','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5562,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;and&#x20;verify&#x20;either&#x20;ntp&#x20;or&#x20;chrony&#x20;is&#x20;installed:&#x20;#&#x20;rpm&#x20;-q&#x20;ntp&#x20;#&#x20;rpm&#x20;-q&#x20;chrony&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;verify&#x20;that&#x20;host&#x20;based&#x20;synchronization&#x20;is&#x20;in&#x20;use.','[{\"cis\": [\"2.2.2.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5563,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;and&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/ntpd&#x20;to&#x20;include&#x20;&#039;&#x20;-u&#x20;ntp:ntp&#x20;&#039;:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5564,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/chrony.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;chronyd&#039;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5565,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;yum&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5566,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;chkconfig&#x20;avahi-daemon&#x20;off','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5567,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups&#x20;:&#x20;#&#x20;chkconfig&#x20;cups&#x20;off','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5568,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;chkconfig&#x20;dhcpd&#x20;off','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5569,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;chkconfig&#x20;slapd&#x20;off','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5570,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs,&#x20;nfs-server&#x20;and&#x20;rpcbind:&#x20;#&#x20;chkconfig&#x20;nfs&#x20;off;&#x20;#&#x20;chkconfig&#x20;rpcbind&#x20;off','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5571,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;chkconfig&#x20;named&#x20;off','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5572,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;chkconfig&#x20;vsftpd&#x20;off','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5573,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;chkconfig&#x20;httpd&#x20;off','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5574,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;chkconfig&#x20;dovecot&#x20;off','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5575,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;chkconfig&#x20;smb&#x20;off','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5576,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;chkconfig&#x20;squid&#x20;off','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5577,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;chkconfig&#x20;snmpd&#x20;off','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5578,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;Restart&#x20;postfix:&#x20;#&#x20;service&#x20;postfix&#x20;restart','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(5579,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;chkconfig&#x20;ypserv&#x20;off','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5580,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;yum&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5581,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;rsh','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5582,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5583,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5584,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5585,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5586,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5587,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5588,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5589,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5590,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5591,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5592,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5593,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5594,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5595,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;and&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5596,'Ensure&#x20;IPv6&#x20;redirects&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;ICMP&#x20;redirects.&#x20;ICMP&#x20;redirects&#x20;tell&#x20;the&#x20;system&#x20;about&#x20;alternate&#x20;routes&#x20;for&#x20;sending&#x20;traffic.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;ICMP&#x20;redirects&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;||&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5597,'Ensure&#x20;IPv6&#x20;is&#x20;disabled','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/boot/grub/grub.conf&#x20;to&#x20;include&#x20;ipv6.disable=1&#x20;on&#x20;all&#x20;kernel&#x20;lines.','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5598,'Ensure&#x20;TCP&#x20;Wrappers&#x20;is&#x20;installed','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;tcp_wrappers:&#x20;yum&#x20;install&#x20;tcp_wrappers','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(5599,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;echo&#x20;&#039;ALL:&#x20;ALL&#039;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(5600,'Ensure&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;are&#x20;configured.','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;networking&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;and&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(5601,'Ensure&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;are&#x20;configured.','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;and&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5602,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.5.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5603,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.5.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5604,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5605,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.5.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5606,'Ensure&#x20;iptables&#x20;is&#x20;installed','iptables&#x20;allows&#x20;configuration&#x20;of&#x20;the&#x20;IPv4&#x20;tables&#x20;in&#x20;the&#x20;linux&#x20;kernel&#x20;and&#x20;the&#x20;rules&#x20;stored&#x20;within&#x20;them.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;iptables&#x20;.','iptables&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;:&#x20;yum&#x20;install&#x20;iptables','[{\"cis\": [\"3.6.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.1\"]}]'),(5607,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;and&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.6.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(5608,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.6.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(5609,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(5610,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(5611,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(5612,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd&#x20;:&#x20;#&#x20;chkconfig&#x20;auditd&#x20;on','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5613,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/boot/grub/grub.conf&#x20;to&#x20;include&#x20;audit=1&#x20;on&#x20;all&#x20;kernel&#x20;lines.&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5614,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5615,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5616,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5617,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;directory.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5618,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;/var/run/failock&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5619,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.3\"]}]'),(5620,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;500&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5621,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;500&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5622,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5623,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete','[{\"cis\": [\"4.1.14\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(5624,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5625,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5626,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod&#x20;,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5627,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;&#x20;&#x20;-e&#x20;2','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"3\", \"6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5628,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lackblogging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;rsyslog&#x20;on','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5629,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(5630,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5631,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;syslog-ng&#x20;:&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;syslog-ng&#x20;on','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5632,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5633,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5634,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;&#x20;#&#x20;yum&#x20;install&#x20;rsyslog&#x20;&#x20;&#x20;#&#x20;yum&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5635,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitivebdata&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;{}&#x20;+','[{\"cis\": [\"4.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5636,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;chkconfig&#x20;crond&#x20;on','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5637,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5638,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5639,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5640,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]');
INSERT INTO `tsca` VALUES (5641,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5642,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5643,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5644,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5645,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5646,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5647,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5648,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(5649,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5650,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5651,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5652,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(5653,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(5654,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.13\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5655,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;and&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\", \"5.8\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5656,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5657,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_cracklib.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_cracklib.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_cracklib.so&#x20;try_first_pass&#x20;retry=3&#x20;minlen=14&#x20;dcredit=-1&#x20;ucredit=-1&#x20;ocredit=-1&#x20;lcredit=-1','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"5.7\", \"16.12\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5658,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;remember=5&#x20;&#x20;&#x20;or&#x20;&#x20;&#x20;&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5659,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(5660,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5661,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5662,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5663,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5664,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5665,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5666,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;and&#x20;/etc/profile&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(5667,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo&#x20;,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su&#x20;,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(5668,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5669,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5670,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5671,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5672,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5673,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5674,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5675,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5676,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(5677,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5678,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5679,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(5680,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6000,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/cramfs.confand&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}, {\"cis_level\": [\"1\"]}]'),(6001,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}, {\"cis_level\": [\"2\"]}]'),(6002,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}, {\"cis_level\": [\"1\"]}]'),(6003,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12,&#x20;FAT16,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','If&#x20;utilizing&#x20;UEFI&#x20;the&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;required.&#x20;If&#x20;this&#x20;case,&#x20;ensure&#x20;that&#x20;the&#x20;FAT&#x20;filesystem&#x20;is&#x20;only&#x20;used&#x20;where&#x20;appropriate.&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;grep&#x20;-E&#x20;-i&#x20;&#039;svfats&#039;&#x20;/etc/fstab&#x20;And&#x20;review&#x20;that&#x20;any&#x20;output&#x20;is&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;&#x20;If&#x20;not&#x20;utilizing&#x20;UEFI:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/fat.conf&#x20;&#x20;&#x20;&#x20;install&#x20;fat&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;install&#x20;vfat&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;install&#x20;msdos&#x20;/bin/true&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;unload&#x20;the&#x20;msdos,&#x20;vfat,&#x20;and&#x20;fatmodules:&#x20;&#x20;#&#x20;rmmod&#x20;msdos&#x20;&#x20;&#x20;#&#x20;rmmod&#x20;vfat&#x20;&#x20;#&#x20;rmmod&#x20;fat&#x20;','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}, {\"cis_level\": [\"2\"]}]'),(6004,'Ensure&#x20;/tmp&#x20;is&#x20;configured.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Create&#x20;or&#x20;update&#x20;an&#x20;entry&#x20;for&#x20;/tmp&#x20;in&#x20;either&#x20;/etc/fstab&#x20;&#x20;OR&#x20;&#x20;&#x20;in&#x20;a&#x20;systemd&#x20;tmp.mount&#x20;file:&#x20;&#x20;If&#x20;/etc/fstab&#x20;is&#x20;used:&#x20;&#x20;Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;&#x20;&#x20;&#x20;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;&#x20;0&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;systemd&#x20;tmp.mount&#x20;file&#x20;is&#x20;used:&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;file&#x20;/etc/systemd/system/tmp.mount&#x20;if&#x20;it&#x20;doesn&#039;t&#x20;exist:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;[&#x20;!&#x20;-f&#x20;/etc/systemd/system/tmp.mount&#x20;]&#x20;&amp;&amp;&#x20;cp&#x20;-v&#x20;/usr/lib/systemd/system/tmp.mount&#x20;/etc/systemd/system/&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/systemd/system/tmp.mount:&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;What=tmpfs&#x20;&#x20;&#x20;&#x20;Where=/tmp&#x20;&#x20;&#x20;&#x20;Type=tmpfs&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;systemd&#x20;daemon:#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;tmp.mount:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mpunt&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;tmp.mount:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;--now&#x20;tmp.mount','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"9.4\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6005,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;OR&#x20;&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstabfile&#x20;and&#x20;add&#x20;noexecto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6006,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;&#x20;&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6007,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;&#x20;&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nosuid,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6008,'Ensure&#x20;/dev/shm&#x20;is&#x20;configured&#x20;.','/dev/shm&#x20;is&#x20;a&#x20;traditional&#x20;shared&#x20;memory&#x20;concept.&#x20;One&#x20;program&#x20;will&#x20;create&#x20;a&#x20;memory&#x20;portion,&#x20;which&#x20;other&#x20;processes&#x20;&#40;if&#x20;permitted&#41;&#x20;can&#x20;access.&#x20;Mounting&#x20;tmpfs&#x20;at&#x20;/dev/shm&#x20;is&#x20;handled&#x20;automatically&#x20;by&#x20;systemd.','Any&#x20;user&#x20;can&#x20;upload&#x20;and&#x20;execute&#x20;files&#x20;inside&#x20;the&#x20;/dev/shm&#x20;similar&#x20;to&#x20;the&#x20;/tmp&#x20;partition.&#x20;Configuring&#x20;/dev/shm&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/dev/shm&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Edit&#x20;/etc/fstab&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line:&#x20;tmpfs&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;/dev/shm&#x20;&#x20;&#x20;&#x20;tmpfs&#x20;&#x20;&#x20;defaults,noexec,nodev,nosuid,seclabel&#x20;&#x20;&#x20;0&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6009,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"2.6\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6010,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6011,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6012,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6013,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications&#x20;and&#x20;is&#x20;intended&#x20;for&#x20;temporary&#x20;files&#x20;that&#x20;are&#x20;preserved&#x20;across&#x20;reboots.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6014,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;un&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6015,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6016,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6017,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6018,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6019,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6020,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.18\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6021,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6022,'Disable&#x20;USB&#x20;Storage.','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/usb_storage.conf&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.24\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6023,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated.','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}, {\"cis_level\": [\"1\"]}]'),(6024,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo.&#x20;#&#x20;yum&#x20;install&#x20;sudo','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6025,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;configuring&#x20;sudo&#x20;to&#x20;run&#x20;other&#x20;commands&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty,&#x20;whether&#x20;I/O&#x20;logging&#x20;is&#x20;turned&#x20;on&#x20;or&#x20;not.','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6026,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&#039;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&#039;&#x20;&#x20;&#x20;Example:Defaults&#x20;&#x20;logfile=&quot;/var/log/sudo.log&quot;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6027,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;yum&#x20;install&#x20;aide&#x20;//&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6028,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;aidecheck.service&#x20;and&#x20;aidecheck.timer&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.service&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;[Unit]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Description=Aide&#x20;Check&#x20;&#x20;&#x20;&#x20;[Service]&#x20;&#x20;&#x20;&#x20;&#x20;Type=simpleExecStart=/usr/sbin/aide&#x20;--check&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Install]&#x20;&#x20;&#x20;&#x20;&#x20;WantedBy=multi-user.target&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;&#x20;/etc/systemd/system/aidecheck.timer&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;[Unit]&#x20;&#x20;&#x20;Description=Aide&#x20;check&#x20;every&#x20;day&#x20;at&#x20;5AM&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Timer]&#x20;&#x20;&#x20;&#x20;&#x20;OnCalendar=*-*-*&#x20;05:00:00&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Unit=aidecheck.service&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Install]&#x20;&#x20;&#x20;&#x20;&#x20;WantedBy=multi-user.target&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;aidecheck.service&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;aidecheck.timer&#x20;','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6029,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','For&#x20;newergrub2based&#x20;systems&#x20;&#40;centOS/RHEL&#x20;7.2&#x20;and&#x20;newer&#41;:&#x20;Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-setpassword:&#x20;#&#x20;grub2-setpassword&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;older&#x20;&#x20;grub2based&#x20;systems:&#x20;create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-mkpasswd-pbkdf2:&#x20;&#x20;&#x20;#&#x20;grub2-mkpasswd-pbkdf2&#x20;&#x20;&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;Your&#x20;PBKDF2&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/01_users&#x20;or&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;&#x20;cat&#x20;&lt;&lt;EOFset&#x20;superusers=&quot;&lt;username&gt;&quot;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;EOF&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6030,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;located&#x20;at&#x20;/boot/grub2/grub.cfg&#x20;and&#x20;linked&#x20;as&#x20;/etc/grub2.cfg&#x20;.&#x20;&#x20;On&#x20;newer&#x20;grub2&#x20;systems&#x20;the&#x20;encrypted&#x20;bootloader&#x20;password&#x20;is&#x20;contained&#x20;in&#x20;/boot/grub2/user.cfg','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/user.cfg&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/user.cfg','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6031,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/usr/lib/systemd/system/rescue.service&#x20;and&#x20;/usr/lib/systemd/system/emergency.service&#x20;and&#x20;set&#x20;ExecStart&#x20;to&#x20;use&#x20;/sbin/sulogin&#x20;or&#x20;/usr/sbin/sulogin:&#x20;ExecStart=-/bin/sh&#x20;-c&#x20;&quot;/sbin/sulogin;&#x20;/usr/bin/systemctl&#x20;--fail&#x20;--no-block&#x20;default&quot;&#x20;','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6032,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6033,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6034,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6035,'Ensure&#x20;prelink&#x20;is&#x20;disabled.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;prelink:&#x20;#&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.6.4\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6036,'Ensure&#x20;SELinux&#x20;is&#x20;installed.','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;libselinux:&#x20;#&#x20;yum&#x20;install&#x20;libselinux','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6037,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration.','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6038,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured.','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6039,'Ensure&#x20;the&#x20;SELinux&#x20;mode&#x20;is&#x20;enforcing&#x20;or&#x20;permissive.','SELinux&#x20;can&#x20;run&#x20;in&#x20;one&#x20;of&#x20;three&#x20;modes:&#x20;disabled,&#x20;permissive,&#x20;or&#x20;enforcing:&#x20;&#x20;Enforcing&#x20;-&#x20;Is&#x20;the&#x20;default,&#x20;and&#x20;recommended,&#x20;mode&#x20;of&#x20;operation;&#x20;in&#x20;enforcing&#x20;mode&#x20;SELinux&#x20;operates&#x20;normally,&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy&#x20;on&#x20;the&#x20;entire&#x20;system.&#x20;&#x20;Permissive&#x20;-&#x20;The&#x20;system&#x20;acts&#x20;as&#x20;if&#x20;SELinux&#x20;is&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy,&#x20;including&#x20;labeling&#x20;objects&#x20;and&#x20;emitting&#x20;access&#x20;denial&#x20;entries&#x20;in&#x20;the&#x20;logs,&#x20;but&#x20;it&#x20;does&#x20;not&#x20;actually&#x20;deny&#x20;any&#x20;operations.&#x20;While&#x20;not&#x20;recommended&#x20;for&#x20;production&#x20;systems,&#x20;permissive&#x20;mode&#x20;can&#x20;be&#x20;helpful&#x20;for&#x20;SELinux&#x20;policy&#x20;development.&#x20;&#x20;&#x20;Disabled&#x20;-Is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future','Running&#x20;SELinux&#x20;in&#x20;disabled&#x20;modeis&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;SELinux&#039;s&#x20;running&#x20;mode:&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Enforcing:&#x20;#&#x20;setenforce&#x20;1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Permissive:&#x20;#&#x20;setenforce&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/selinux/config&#x20;&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;For&#x20;Enforcing&#x20;mode:&#x20;SELINUX=enforcing&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;Permissive&#x20;mode:&#x20;&#x20;SELINUX=permissive','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6040,'Ensure&#x20;no&#x20;unconfined&#x20;services&#x20;exist.','Unconfined&#x20;processes&#x20;run&#x20;in&#x20;unconfined&#x20;domains','For&#x20;unconfined&#x20;processes,&#x20;SELinux&#x20;policy&#x20;rules&#x20;are&#x20;applied,&#x20;but&#x20;policy&#x20;rules&#x20;exist&#x20;that&#x20;allow&#x20;processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;almost&#x20;all&#x20;access.&#x20;Processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;fall&#x20;back&#x20;to&#x20;using&#x20;DAC&#x20;rules&#x20;exclusively.&#x20;If&#x20;an&#x20;unconfined&#x20;process&#x20;is&#x20;compromised,&#x20;SELinux&#x20;does&#x20;not&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;system&#x20;resources&#x20;and&#x20;data,&#x20;but&#x20;of&#x20;course,&#x20;DAC&#x20;rules&#x20;are&#x20;still&#x20;used.&#x20;SELinux&#x20;is&#x20;a&#x20;security&#x20;enhancement&#x20;on&#x20;top&#x20;of&#x20;DAC&#x20;rules&#x20;&ndash;&#x20;it&#x20;does&#x20;not&#x20;replace&#x20;them','','Investigate&#x20;any&#x20;unconfined&#x20;processes&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6041,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed.','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;yum&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.7.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6042,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed.','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;yum&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.7.1.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6043,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;v&#x20;&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}, {\"cis_level\": [\"1\"]}]'),(6044,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}, {\"cis_level\": [\"1\"]}]'),(6045,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}, {\"cis_level\": [\"1\"]}]'),(6046,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6047,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6048,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6049,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;install&#x20;all&#x20;available&#x20;packages&#x20;#&#x20;yum&#x20;update&#x20;&#x20;','[{\"cis\": [\"1.9\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}, {\"cis_level\": [\"1\"]}]'),(6050,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured.','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','If&#x20;a&#x20;graphical&#x20;login&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;a&#x20;graphical&#x20;login&#x20;is&#x20;required,&#x20;last&#x20;logged&#x20;in&#x20;user&#x20;display&#x20;should&#x20;be&#x20;disabled,&#x20;and&#x20;a&#x20;warning&#x20;banner&#x20;should&#x20;be&#x20;configured.&#x20;Displaying&#x20;the&#x20;last&#x20;logged&#x20;in&#x20;user&#x20;eliminates&#x20;half&#x20;of&#x20;the&#x20;Userid/Password&#x20;equation&#x20;that&#x20;an&#x20;unauthorized&#x20;person&#x20;would&#x20;need&#x20;to&#x20;log&#x20;on.&#x20;Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;gdm:&#x20;#&#x20;yum&#x20;remove&#x20;gdm&#x20;OR&#x20;If&#x20;GDM&#x20;is&#x20;required:&#x20;Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/dconf/profile/gdm&#x20;and&#x20;add&#x20;the&#x20;following:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;user-db:user&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;system-db:gdm&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;file-db:/usr/share/gdm/greeter-dconf-defaults&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/dconf/db/gdm.d/&#x20;&#x20;and&#x20;add&#x20;the&#x20;following:&#x20;&#40;This&#x20;is&#x20;typically&#x20;/etc/dconf/db/gdm.d/01-banner-message&#41;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;&lt;banner&#x20;message&gt;&#039;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Example&#x20;Banner&#x20;Text:&#x20;&#x20;&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#x20;&#039;Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/dconf/db/gdm.d/and&#x20;add&#x20;the&#x20;following:&#x20;&#40;This&#x20;is&#x20;typically&#x20;/etc/dconf/db/gdm.d/00-login-screen&#41;&#x20;&#x20;&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;Do&#x20;not&#x20;show&#x20;the&#x20;user&#x20;list&#x20;&#x20;&#x20;&#x20;&#x20;disable-user-list=true&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;system&#x20;databases:&#x20;&#x20;#&#x20;dconf&#x20;update','[{\"cis\": [\"1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}, {\"cis_level\": [\"1\"]}]'),(6051,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled.','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;If&#x20;an&#x20;xinetd&#x20;service&#x20;or&#x20;services&#x20;are&#x20;required,&#x20;ensure&#x20;that&#x20;any&#x20;xinetd&#x20;service&#x20;not&#x20;required&#x20;is&#x20;stopped&#x20;and&#x20;disabled','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;yum&#x20;remove&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6052,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','Run&#x20;One&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;chrony&#x20;or&#x20;NTP:&#x20;to&#x20;install&#x20;chrony&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;yum&#x20;install&#x20;chrony&#x20;OR&#x20;to&#x20;install&#x20;ntp:&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;yum&#x20;install&#x20;ntp','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6053,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;and&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include&#x20;&#039;-u&#x20;chrony&#039;:OPTIONS=&quot;-u&#x20;chrony&quot;','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6054,'Ensure&#x20;ntp&#x20;is&#x20;configured.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;and&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/ntpd&#x20;to&#x20;include&#x20;&#039;&#x20;-u&#x20;ntp:ntp&#x20;&#039;:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6055,'&#x20;Ensure&#x20;X11&#x20;Server&#x20;components&#x20;are&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;yum&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6056,'&#x20;Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop,&#x20;mask&#x20;and&#x20;remove&#x20;avahi-autoipd&#x20;and&#x20;avahi:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;avahi-daemon.service;&#x20;#&#x20;yum&#x20;remove&#x20;avahi-autoipd&#x20;avahi','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6057,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Disabling&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cups:&#x20;#&#x20;yum&#x20;remove&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6058,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;the&#x20;dhcp&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dhcpd:&#x20;#&#x20;yum&#x20;remove&#x20;dhcp','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6059,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;slapd:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-servers','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6060,'Ensure&#x20;nfs-utils&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;nfs-server&#x20;service&#x20;is&#x20;masked.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;require&#x20;network&#x20;shares,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;nfs-utils&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs-utils:&#x20;#&#x20;yum&#x20;remove&#x20;nfs-utils;&#x20;OR&#x20;if&#x20;the&#x20;nfs-package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;nfs-server&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6061,'Ensure&#x20;rpcbind&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rpcbind&#x20;services&#x20;are&#x20;masked.','The&#x20;rpcbind&#x20;utility&#x20;maps&#x20;RPC&#x20;services&#x20;to&#x20;the&#x20;ports&#x20;on&#x20;which&#x20;they&#x20;listen.&#x20;RPC&#x20;processes&#x20;notify&#x20;rpcbind&#x20;when&#x20;they&#x20;start,&#x20;registering&#x20;the&#x20;ports&#x20;they&#x20;are&#x20;listening&#x20;on&#x20;and&#x20;the&#x20;RPC&#x20;program&#x20;numbers&#x20;they&#x20;expect&#x20;to&#x20;serve.&#x20;The&#x20;client&#x20;system&#x20;then&#x20;contacts&#x20;rpcbind&#x20;on&#x20;the&#x20;server&#x20;with&#x20;a&#x20;particular&#x20;RPC&#x20;program&#x20;number.&#x20;The&#x20;rpcbind&#x20;service&#x20;redirects&#x20;the&#x20;client&#x20;to&#x20;the&#x20;proper&#x20;port&#x20;number&#x20;so&#x20;it&#x20;can&#x20;communicate&#x20;with&#x20;the&#x20;requested&#x20;service&#x20;Portmapper&#x20;is&#x20;an&#x20;RPC&#x20;service,&#x20;which&#x20;always&#x20;listens&#x20;on&#x20;tcp&#x20;and&#x20;udp&#x20;111,&#x20;and&#x20;is&#x20;used&#x20;to&#x20;map&#x20;other&#x20;RPC&#x20;services&#x20;&#40;such&#x20;as&#x20;nfs,&#x20;nlockmgr,&#x20;quotad,&#x20;mountd,&#x20;etc.&#41;&#x20;to&#x20;their&#x20;corresponding&#x20;port&#x20;number&#x20;on&#x20;the&#x20;server.&#x20;When&#x20;a&#x20;remote&#x20;host&#x20;makes&#x20;an&#x20;RPC&#x20;call&#x20;to&#x20;that&#x20;server,&#x20;it&#x20;first&#x20;consults&#x20;with&#x20;portmap&#x20;to&#x20;determine&#x20;where&#x20;the&#x20;RPC&#x20;server&#x20;is&#x20;listening','A&#x20;small&#x20;request&#x20;&#40;~82&#x20;bytes&#x20;via&#x20;UDP&#41;&#x20;sent&#x20;to&#x20;the&#x20;Portmapper&#x20;generates&#x20;a&#x20;large&#x20;response&#x20;&#40;7x&#x20;to&#x20;28x&#x20;amplification&#41;,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;suitable&#x20;tool&#x20;for&#x20;DDoS&#x20;attacks.&#x20;If&#x20;rpcbind&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;rpcbind&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs-utils:&#x20;#&#x20;yum&#x20;remove&#x20;nfs-utils;&#x20;OR&#x20;if&#x20;the&#x20;nfs-package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;nfs-server&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6062,'&#x20;Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed&#x20;.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;yum&#x20;remove&#x20;bind','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6063,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','FTP&#x20;&#40;File&#x20;Transfer&#x20;Protocol&#41;&#x20;is&#x20;a&#x20;traditional&#x20;and&#x20;widely&#x20;used&#x20;standard&#x20;tool&#x20;for&#x20;transferring&#x20;files&#x20;between&#x20;a&#x20;server&#x20;and&#x20;clients&#x20;over&#x20;a&#x20;network,&#x20;especially&#x20;where&#x20;no&#x20;authentication&#x20;is&#x20;necessary&#x20;&#40;permits&#x20;anonymous&#x20;users&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#41;','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;yum&#x20;remove&#x20;vsftpd','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6064,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;installed.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;yum&#x20;remove&#x20;httpd','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6065,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;installed.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;yum&#x20;remove&#x20;dovecot','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6066,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;package&#x20;can&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;yum&#x20;remove&#x20;samba','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6067,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;yum&#x20;remove&#x20;squid','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6068,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;#&#x20;yum&#x20;remove&#x20;net-snmp','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6069,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}, {\"cis_level\": [\"1\"]}]'),(6070,'Ensure&#x20;rsync&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;masked.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','Unless&#x20;required,&#x20;the&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;rsync&#x20;package:&#x20;#&#x20;yum&#x20;remove&#x20;rsync;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;the&#x20;rsyncd&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rsyncd','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}, {\"cis_level\": [\"1\"]}]'),(6071,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;ypserv&#x20;package&#x20;provides&#x20;the&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;.&#x20;This&#x20;service,&#x20;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;ypservpackage&#x20;be&#x20;removed,&#x20;and&#x20;if&#x20;required&#x20;a&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;yum&#x20;remove&#x20;ypserv','[{\"cis\": [\"2.2.18\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6072,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;yum&#x20;remove&#x20;telnet-server','[{\"cis\": [\"2.2.19\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"cis_level\": [\"1\"]}]'),(6073,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;yum&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6074,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;#&#x20;yum&#x20;remove&#x20;rsh','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6075,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;#&#x20;yum&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6076,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;yum&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6077,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6078,'Ensure&#x20;nonessential&#x20;services&#x20;are&#x20;removed&#x20;or&#x20;masked.','A&#x20;network&#x20;port&#x20;is&#x20;identified&#x20;by&#x20;its&#x20;number,&#x20;the&#x20;associated&#x20;IP&#x20;address,&#x20;and&#x20;the&#x20;type&#x20;of&#x20;the&#x20;communication&#x20;protocol&#x20;such&#x20;as&#x20;TCP&#x20;or&#x20;UDP.A&#x20;listening&#x20;port&#x20;is&#x20;a&#x20;network&#x20;port&#x20;on&#x20;which&#x20;an&#x20;application&#x20;or&#x20;process&#x20;listens&#x20;on,&#x20;acting&#x20;as&#x20;a&#x20;communication&#x20;endpoint.&#x20;Each&#x20;listening&#x20;port&#x20;can&#x20;be&#x20;open&#x20;or&#x20;closed&#x20;&#40;filtered&#41;&#x20;using&#x20;a&#x20;firewall.&#x20;In&#x20;general&#x20;terms,&#x20;an&#x20;open&#x20;port&#x20;is&#x20;a&#x20;network&#x20;port&#x20;that&#x20;accepts&#x20;incoming&#x20;packets&#x20;from&#x20;remote&#x20;locations','Services&#x20;listening&#x20;on&#x20;the&#x20;system&#x20;pose&#x20;a&#x20;potential&#x20;risk&#x20;as&#x20;an&#x20;attack&#x20;vector.&#x20;These&#x20;services&#x20;should&#x20;be&#x20;reviewed,&#x20;and&#x20;if&#x20;not&#x20;required,&#x20;the&#x20;service&#x20;should&#x20;be&#x20;stopped,&#x20;and&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service&#x20;should&#x20;be&#x20;removed.&#x20;If&#x20;required&#x20;packages&#x20;have&#x20;a&#x20;dependency,&#x20;the&#x20;service&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Review&#x20;the&#x20;output&#x20;of:&#x20;#&#x20;lsof&#x20;-i&#x20;-P&#x20;-n&#x20;|&#x20;grep&#x20;-v&#x20;&#039;&#40;ESTABLISHED&#41;&#039;;&#x20;to&#x20;ensure&#x20;that&#x20;all&#x20;services&#x20;listed&#x20;are&#x20;required&#x20;on&#x20;the&#x20;system.&#x20;If&#x20;a&#x20;listed&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;remove&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service.&#x20;If&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service&#x20;is&#x20;required,&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;service.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;package&#x20;containing&#x20;the&#x20;service:#&#x20;yum&#x20;remove&#x20;&lt;package_name&gt;&#x20;OR&#x20;if&#x20;required&#x20;packages&#x20;have&#x20;a&#x20;dependency:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;service:#&#x20;systemctl&#x20;--now&#x20;mask&#x20;&lt;service_name&gt;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6079,'Disable&#x20;IPv6.','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;disable&#x20;IPv6&#x20;through&#x20;the&#x20;GRUB2&#x20;config:&#x20;edit&#x20;/etc/default/gruband&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:#&#x20;grub2-mkconfig&#x20;&ndash;o&#x20;/boot/grub2/grub.cfg;&#x20;OR&#x20;to&#x20;disable&#x20;IPv6&#x20;through&#x20;sysctl&#x20;settings:&#x20;set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;#&#x20;net.ipv6.conf.all.disable_ipv6&#x20;=&#x20;1;&#x20;#&#x20;net.ipv6.conf.default.disable_ipv6&#x20;=&#x20;1;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.disable_ipv6=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.disable_ipv6=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6080,'Ensure&#x20;wireless&#x20;interfaces&#x20;are&#x20;disabled.','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;any&#x20;wireless&#x20;interfaces:&#x20;#&#x20;ip&#x20;link&#x20;set&#x20;&lt;interface&gt;&#x20;down','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6081,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&#039;^s*net.ipv4.ip_forwards*=s*1&#039;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&#039;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6082,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled.','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6083,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted.','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6084,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6085,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6086,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6087,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored.','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6088,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6089,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6090,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled.','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6091,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;and&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6092,'Ensure&#x20;DCCP&#x20;is&#x20;disabled.','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6093,'Ensure&#x20;SCTP&#x20;is&#x20;disabled.','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6094,'Ensure&#x20;FirewallD&#x20;or&#x20;nftables&#x20;or&#x20;iptables-services&#x20;is&#x20;installed.','firewalld&#x20;is&#x20;a&#x20;firewall&#x20;management&#x20;tool&#x20;for&#x20;Linux&#x20;operating&#x20;systems.&#x20;It&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;net&#x20;filter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;backend&#x20;or&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;nftables&#x20;utility.&#x20;FirewallD&#x20;replaces&#x20;iptables&#x20;as&#x20;the&#x20;default&#x20;firewall&#x20;management&#x20;tool.&#x20;Use&#x20;the&#x20;firewalld&#x20;utility&#x20;to&#x20;configure&#x20;a&#x20;firewall&#x20;for&#x20;less&#x20;complex&#x20;firewalls.&#x20;The&#x20;utility&#x20;is&#x20;easy&#x20;to&#x20;use&#x20;and&#x20;covers&#x20;the&#x20;typical&#x20;use&#x20;cases&#x20;scenario.&#x20;FirewallD&#x20;supports&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6&#x20;networks&#x20;and&#x20;can&#x20;administer&#x20;separate&#x20;firewall&#x20;zones&#x20;with&#x20;varying&#x20;degrees&#x20;of&#x20;trust&#x20;as&#x20;defined&#x20;in&#x20;zone&#x20;profiles.','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x20;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;firewalld:&#x20;#&#x20;yum&#x20;install&#x20;firewalld&#x20;iptables;&#x20;OR&#x20;to&#x20;&#x20;install&#x20;nftables:&#x20;#&#x20;yum&#x20;install&#x20;nftables;&#x20;OR&#x20;to&#x20;install&#x20;&#x20;iptables-services:&#x20;#&#x20;yum&#x20;install&#x20;iptables-services&#x20;iptables','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6095,'Ensure&#x20;iptables-services&#x20;and&#x20;FirewallD&#x20;are&#x20;not&#x20;installed&#x20;at&#x20;the&#x20;same&#x20;time.','The&#x20;iptables-services&#x20;package&#x20;contains&#x20;the&#x20;iptables.service&#x20;and&#x20;ip6tables.service.&#x20;These&#x20;services&#x20;allow&#x20;for&#x20;management&#x20;of&#x20;the&#x20;Host&#x20;Based&#x20;Firewall&#x20;provided&#x20;by&#x20;the&#x20;iptables&#x20;package.','iptables.service&#x20;and&#x20;ip6tables.service&#x20;are&#x20;still&#x20;supported&#x20;and&#x20;can&#x20;be&#x20;installed&#x20;with&#x20;the&#x20;iptables-services&#x20;package.&#x20;Running&#x20;both&#x20;firewalld&#x20;and&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-services&#x20;package&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-services&#x20;package&#x20;and&#x20;remove&#x20;the&#x20;iptables-services&#x20;package:&#x20;#&#x20;systemctl&#x20;stop&#x20;iptables;&#x20;#&#x20;systemctl&#x20;stop&#x20;ip6tables;&#x20;#&#x20;yum&#x20;remove&#x20;iptables-services.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;firewalld:&#x20;#&#x20;yum&#x20;remove&#x20;firewalld&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;firewalld','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6096,'Ensure&#x20;nftables&#x20;and&#x20;FirewallD&#x20;are&#x20;not&#x20;installed&#x20;at&#x20;the&#x20;same&#x20;time&#x20;or&#x20;ensure&#x20;one&#x20;of&#x20;them&#x20;is&#x20;stopped&#x20;and&#x20;masked.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.Note:&#x20;Support&#x20;for&#x20;using&#x20;nftables&#x20;as&#x20;the&#x20;back-end&#x20;for&#x20;firewalld&#x20;was&#x20;added&#x20;in&#x20;release&#x20;v0.6.0.&#x20;In&#x20;Fedora&#x20;19&#x20;Linux&#x20;derivatives,&#x20;firewalld&#x20;utilizes&#x20;iptables&#x20;as&#x20;its&#x20;back-end&#x20;by&#x20;default.','Running&#x20;both&#x20;firewalld&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:#&#x20;yum&#x20;remove&#x20;nftables;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;nftables:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;firewalld:&#x20;#&#x20;yum&#x20;remove&#x20;firewalld&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;firewalld','[{\"cis\": [\"3.5.1.3\", \"3.5.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6097,'Ensure&#x20;nftables&#x20;and&#x20;iptables-services&#x20;are&#x20;not&#x20;installed&#x20;at&#x20;the&#x20;same&#x20;time&#x20;or&#x20;ensure&#x20;one&#x20;of&#x20;them&#x20;is&#x20;stopped&#x20;and&#x20;masked.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.Note:&#x20;Support&#x20;for&#x20;using&#x20;nftables&#x20;as&#x20;the&#x20;back-end&#x20;for&#x20;firewalld&#x20;was&#x20;added&#x20;in&#x20;release&#x20;v0.6.0.&#x20;In&#x20;Fedora&#x20;19&#x20;Linux&#x20;derivatives,&#x20;firewalld&#x20;utilizes&#x20;iptables&#x20;as&#x20;its&#x20;back-end&#x20;by&#x20;default.','Running&#x20;both&#x20;nftables&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:#&#x20;yum&#x20;remove&#x20;nftables;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;nftables:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;iptables#&#x20;#&#x20;systemctl&#x20;stop&#x20;iptables;&#x20;#&#x20;systemctl&#x20;stop&#x20;ip6tables;&#x20;#&#x20;yum&#x20;remove&#x20;iptables-services','[{\"cis\": [\"3.5.2.3\", \"3.5.3.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6098,'Ensure&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running.','firewalld.serviceenables&#x20;the&#x20;enforcement&#x20;of&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld','Ensure&#x20;that&#x20;the&#x20;firewalld.service&#x20;is&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;enforce&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;unmask&#x20;firewalld;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;firewalld','[{\"cis\": [\"3.5.1.4\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6099,'Ensure&#x20;a&#x20;table&#x20;exists.','nTables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6100,'Ensure&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;createchain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;','[{\"cis\": [\"3.5.2.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6101,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;iif&#x20;lo&#x20;accept;&#x20;&#x20;&#x20;#&#x20;nft&#x20;create&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;saddr&#x20;127.0.0.0/8&#x20;counter&#x20;drop;&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;implement&#x20;the&#x20;IPv6&#x20;loopback&#x20;rules:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip6&#x20;saddr::1&#x20;counter&#x20;drop','[{\"cis\": [\"3.5.2.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6102,'Ensure&#x20;outbound&#x20;and&#x20;established&#x20;connections&#x20;are&#x20;configured.','Configure&#x20;the&#x20;firewall&#x20;rules&#x20;for&#x20;new&#x20;outbound&#x20;and&#x20;established&#x20;connections.','If&#x20;rules&#x20;are&#x20;not&#x20;in&#x20;place&#x20;for&#x20;new&#x20;outbound&#x20;and&#x20;established&#x20;connections,&#x20;all&#x20;packets&#x20;will&#x20;be&#x20;dropped&#x20;by&#x20;the&#x20;default&#x20;policy&#x20;preventing&#x20;network&#x20;usage.','','Configure&#x20;nftables&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;commands&#x20;will&#x20;implement&#x20;a&#x20;policy&#x20;to&#x20;allow&#x20;all&#x20;outbound&#x20;connections&#x20;and&#x20;all&#x20;established&#x20;connections:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;protocol&#x20;tcp&#x20;ct&#x20;state&#x20;established&#x20;accept;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;protocol&#x20;udp&#x20;ct&#x20;state&#x20;established&#x20;accept;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;protocol&#x20;icmp&#x20;ct&#x20;state&#x20;established&#x20;accept;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;output&#x20;ip&#x20;protocol&#x20;tcp&#x20;ct&#x20;state&#x20;new,related,established&#x20;accept;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;output&#x20;ip&#x20;protocol&#x20;udp&#x20;ct&#x20;state&#x20;new,related,established&#x20;accept;&#x20;&#x20;&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;output&#x20;ip&#x20;protocol&#x20;icmp&#x20;ct&#x20;state&#x20;new,related,established&#x20;accept','[{\"cis\": [\"3.5.2.8\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6103,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;traversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.5.2.9\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6104,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled.','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conffile&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.2.10\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6105,'Ensure&#x20;nftables&#x20;rules&#x20;are&#x20;permanent.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames.&#x20;The&#x20;nftables&#x20;service&#x20;reads&#x20;the&#x20;/etc/sysconfig/nftables.conffile&#x20;for&#x20;a&#x20;nftables&#x20;file&#x20;or&#x20;files&#x20;to&#x20;include&#x20;in&#x20;the&#x20;nftables&#x20;ruleset.&#x20;A&#x20;nftables&#x20;ruleset&#x20;containing&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;base&#x20;chains&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;be&#x20;filtered.','Changes&#x20;made&#x20;to&#x20;nftables&#x20;ruleset&#x20;only&#x20;affect&#x20;the&#x20;live&#x20;system,&#x20;you&#x20;will&#x20;also&#x20;need&#x20;to&#x20;configure&#x20;the&#x20;nftables&#x20;ruleset&#x20;to&#x20;apply&#x20;on&#x20;boot','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.2.11\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6106,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6107,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6108,'Ensure&#x20;iptables&#x20;is&#x20;enabled&#x20;and&#x20;running.','iptables.service&#x20;is&#x20;a&#x20;utility&#x20;for&#x20;configuring&#x20;and&#x20;maintaining&#x20;iptables.','iptables.service&#x20;willload&#x20;the&#x20;iptables&#x20;rules&#x20;saved&#x20;in&#x20;the&#x20;file&#x20;/etc/sysconfig/iptablesat&#x20;boot,&#x20;otherwise&#x20;the&#x20;iptables&#x20;rules&#x20;will&#x20;be&#x20;cleared&#x20;during&#x20;a&#x20;re-boot&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-PFORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.2.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6109,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-PFORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.3.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6110,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;tothe&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6111,'Ensure&#x20;IPv6&#x20;outbound&#x20;and&#x20;established&#x20;connections&#x20;are&#x20;configured.','Configure&#x20;the&#x20;firewall&#x20;rules&#x20;for&#x20;new&#x20;outbound,&#x20;and&#x20;established&#x20;IPv6&#x20;connections.','If&#x20;rules&#x20;are&#x20;not&#x20;in&#x20;place&#x20;for&#x20;new&#x20;outbound,&#x20;and&#x20;established&#x20;connections&#x20;all&#x20;packets&#x20;will&#x20;be&#x20;dropped&#x20;by&#x20;the&#x20;default&#x20;policy&#x20;preventing&#x20;network&#x20;usage','','Configure&#x20;iptables&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;commands&#x20;will&#x20;implement&#x20;a&#x20;policy&#x20;to&#x20;allow&#x20;all&#x20;outbound&#x20;connections&#x20;and&#x20;all&#x20;established&#x20;connections:#&#x20;ip6tables&#x20;-AOUTPUT&#x20;-p&#x20;tcp&#x20;-m&#x20;state&#x20;--state&#x20;NEW,ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-p&#x20;udp&#x20;-m&#x20;state&#x20;--state&#x20;NEW,ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-p&#x20;icmp&#x20;-m&#x20;state&#x20;--state&#x20;NEW,ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-p&#x20;tcp&#x20;-m&#x20;state&#x20;--state&#x20;ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-p&#x20;udp&#x20;-m&#x20;state&#x20;--state&#x20;ESTABLISHED&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-p&#x20;icmp&#x20;-m&#x20;state&#x20;--state&#x20;ESTABLISHED&#x20;-j&#x20;ACCEPT','[{\"cis\": [\"3.5.3.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6112,'Ensure&#x20;ip6tables&#x20;is&#x20;enabled&#x20;and&#x20;running.','ip6tables.service&#x20;is&#x20;a&#x20;utility&#x20;for&#x20;configuring&#x20;and&#x20;maintaining&#x20;ip6tables.','ip6tables.service&#x20;will&#x20;load&#x20;the&#x20;iptables&#x20;rules&#x20;saved&#x20;in&#x20;the&#x20;file&#x20;/etc/sysconfig/ip6tables&#x20;at&#x20;boot,&#x20;otherwise&#x20;the&#x20;ip6tables&#x20;rules&#x20;will&#x20;be&#x20;cleared&#x20;during&#x20;a&#x20;re-boot&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;ip6tables:&#x20;#&#x20;systemctl&#x20;--now&#x20;start&#x20;ip6tables','[{\"cis\": [\"3.5.3.3.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}, {\"cis_level\": [\"1\"]}]'),(6113,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;&#x20;#&#x20;yum&#x20;install&#x20;audit&#x20;audit-libs','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6114,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6115,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub2&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6116,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"cis_level\": [\"2\"]}]'),(6117,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.2\", \"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"cis_level\": [\"2\"]}]'),(6118,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"cis_level\": [\"2\"]}]'),(6119,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient.','The&#x20;backlog&#x20;limit&#x20;has&#x20;a&#x20;default&#x20;setting&#x20;of&#x20;64','During&#x20;boot&#x20;if&#x20;audit=1,&#x20;then&#x20;the&#x20;backlog&#x20;will&#x20;hold&#x20;64&#x20;records.&#x20;If&#x20;more&#x20;than&#x20;64&#x20;records&#x20;are&#x20;created&#x20;during&#x20;boot,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit_backlog_limit=&lt;BACKLOG&#x20;SIZE&gt;&#x20;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;&#x20;&#x20;Example:&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;audit_backlog_limit=8192&quot;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"cis_level\": [\"2\"]}]'),(6120,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/time-change.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/time-change.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6121,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/identity.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6122,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.5\", \"6.2\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6123,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/MAC-policy.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6124,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;/var/run/faillock/&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/logins.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillog/&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;IF&#x20;&#x20;&#x20;the&#x20;pam_faillock.so&#x20;module&#x20;is&#x20;used:&#x20;Also&#x20;include&#x20;the&#x20;line:&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;OR&#x20;IF&#x20;the&#x20;pam_tally2.so&#x20;module&#x20;is&#x20;used:&#x20;Also&#x20;include&#x20;the&#x20;line:&#x20;&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6125,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/logins.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;&#x20;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;&#x20;last&#x20;-f&#x20;/var/run/utmp&#x20;&#41;&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"cis_level\": [\"2\"]}]'),(6126,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown,&#x20;fchown,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr,&#x20;lsetxattr,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr,&#x20;lremovexattr,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/perm_mod.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/perm_mod.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6127,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/access.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/access.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6128,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/mount.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/mounts.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6129,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;ollowing&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;:&#x20;unlink&#x20;-remove&#x20;a&#x20;file&#x20;&#x20;&#x20;&#x20;&#x20;unlinkat&#x20;-&#x20;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#x20;and&#x20;renameat&#x20;-&#x20;rename&#x20;a&#x20;file&#x20;attribute.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/delete.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/delete.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"6.2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}, {\"cis_level\": [\"2\"]}]'),(6130,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d&#x20;directory&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file,&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d/&#x20;directory&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/scope.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines::&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6131,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;The&#x20;sudo&#x20;log&#x20;file&#x20;is&#x20;configured&#x20;in&#x20;/etc/sudoersor&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;sudo&#x20;log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/action.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions&#x20;.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.9\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6132,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules.&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/modules.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/directory&#x20;ending&#x20;in&#x20;.rules&#x20;&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/modules.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6133,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rulesand&#x20;add&#x20;the&#x20;following&#x20;line&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file:&#x20;&#x20;-e&#x20;2','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"2\"]}]'),(6134,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;is&#x20;a&#x20;recommended&#x20;replacement&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon.&#x20;rsyslog&#x20;provides&#x20;improvements&#x20;over&#x20;syslogd,&#x20;including:&#x20;&#x20;&#x20;-&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs&#x20;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats&#x20;&#x20;&#x20;&#x20;-&#x20;Encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;#&#x20;yum&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6135,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled&#x20;and&#x20;running.','rsyslogneeds&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;perform&#x20;logging','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lackblogging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6136,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6137,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;&#x20;systemctl&#x20;restart&#x20;rsyslog','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6138,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog&#x20;.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6139,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6140,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6141,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured.','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.&#x20;&#x20;Other/world&#x20;should&#x20;not&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;view&#x20;this&#x20;information.&#x20;Group&#x20;should&#x20;not&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;modify&#x20;this&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;&quot;{}&quot;&#x20;+&#x20;-o&#x20;-type&#x20;d&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;&quot;{}&quot;&#x20;+','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6142,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;systemctl&#x20;enable&#x20;crond;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6143,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6144,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6145,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily;&#x20;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6146,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6147,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6148,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d/directory&#x20;contains&#x20;system&#x20;cronjobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;:&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d;&#x20;&#x20;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;yum&#x20;remove&#x20;cronie','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6149,'Ensure&#x20;cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','If&#x20;cronis&#x20;installed&#x20;in&#x20;the&#x20;system,&#x20;configure&#x20;/etc/cron.allowto&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allowdoes&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.denyis&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.alloware&#x20;allowed&#x20;to&#x20;use&#x20;cron.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allowfile&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cronjobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6150,'Ensure&#x20;at&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','If&#x20;atis&#x20;installed&#x20;in&#x20;the&#x20;system,&#x20;configure&#x20;/etc/at.allowto&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/at.allowdoes&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.denyis&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/at.alloware&#x20;allowed&#x20;to&#x20;use&#x20;at.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;atjobs.&#x20;Using&#x20;the&#x20;at.allowfile&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;atjobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6151,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6152,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions,&#x20;ownership,&#x20;and&#x20;group&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;{}&#x20;;&#x20;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:ssh_keys&#x20;{}&#x20;;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6153,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;public&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;u-x,go-wx&#x20;{}&#x20;;&#x20;&#x20;&#x20;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6154,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;#&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;#&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;#&#x20;DenyUsers&#x20;&lt;userlist&gt;;&#x20;#&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6155,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}, {\"cis_level\": [\"1\"]}]'),(6156,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"pci_dss\": [\"9.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6157,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6158,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}, {\"cis_level\": [\"1\"]}]'),(6159,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}, {\"cis_level\": [\"1\"]}]'),(6160,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}, {\"cis_level\": [\"1\"]}]'),(6161,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}, {\"cis_level\": [\"1\"]}]'),(6162,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}, {\"cis_level\": [\"1\"]}]'),(6163,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.:&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&#039;Sweet32&#039;&#x20;attack;&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involvingLSB&#x20;values,&#x20;aka&#x20;the&#x20;&#039;Bar&#x20;Mitzvah&#039;&#x20;issue;&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session;&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors;&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;add/modify&#x20;the&#x20;Ciphersline&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphersExample:Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"12.3.8\"]}, {\"cis_level\": [\"1\"]}]'),(6164,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"12.3.8\"]}, {\"cis_level\": [\"1\"]}]'),(6165,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms.Example:&#039;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256&#039;','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"12.3.8\"]}, {\"cis_level\": [\"1\"]}]'),(6166,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}, {\"cis_level\": [\"1\"]}]'),(6167,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6168,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6169,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthenticationand&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6170,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"2\"]}]'),(6171,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartupsparameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;maxstartups&#x20;10:30:60','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6172,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;limited.','The&#x20;MaxSessionsparameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10','[{\"cis\": [\"5.2.22\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6173,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minclass&#x20;=&#x20;4&#x20;&#x20;&#x20;&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:password&#x20;requisite&#x20;pam_pwquality.so&#x20;try_first_pass&#x20;retry=3','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6174,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}, {\"cis_level\": [\"1\"]}]'),(6175,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;remember=5&#x20;&#x20;&#x20;or&#x20;&#x20;&#x20;&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6176,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6177,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;configured.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;1&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;1&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6178,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6179,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6180,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6181,'&#x20;Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;configured.','TMOUT&#x20;is&#x20;an&#x20;environmental&#x20;setting&#x20;that&#x20;determines&#x20;the&#x20;timeout&#x20;of&#x20;a&#x20;shell&#x20;in&#x20;seconds.','Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;the&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;that&#x20;has&#x20;been&#x20;left&#x20;unattended.&#x20;It&#x20;also&#x20;ends&#x20;the&#x20;inactive&#x20;session&#x20;and&#x20;releases&#x20;the&#x20;resources&#x20;associated&#x20;with&#x20;that&#x20;session.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;and&#x20;/etc/profile&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}, {\"cis_level\": [\"1\"]}]'),(6182,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;configured.','The&#x20;user&#x20;file-creation&#x20;mode&#x20;mask&#x20;&#40;umask&#41;&#x20;is&#x20;use&#x20;to&#x20;determine&#x20;the&#x20;file&#x20;permission&#x20;for&#x20;newly&#x20;created&#x20;directories&#x20;and&#x20;files.&#x20;In&#x20;Linux,&#x20;the&#x20;default&#x20;permissions&#x20;for&#x20;any&#x20;newly&#x20;created&#x20;directory&#x20;is&#x20;0777&#x20;&#40;rwxrwxrwx&#41;,&#x20;and&#x20;for&#x20;any&#x20;newly&#x20;created&#x20;file&#x20;it&#x20;is&#x20;0666&#x20;&#40;rw-rw-rw-&#41;.&#x20;The&#x20;umask&#x20;modifies&#x20;the&#x20;default&#x20;Linux&#x20;permissions&#x20;by&#x20;restricting&#x20;&#40;masking&#41;&#x20;these&#x20;permissions.&#x20;The&#x20;umask&#x20;is&#x20;not&#x20;simply&#x20;subtracted,&#x20;but&#x20;is&#x20;processed&#x20;bitwise.&#x20;Bits&#x20;set&#x20;in&#x20;the&#x20;umaskare&#x20;cleared&#x20;in&#x20;the&#x20;resulting&#x20;file&#x20;mode.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6183,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted..','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6184,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;&#x20;&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6185,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"cis_level\": [\"1\"]}]'),(6186,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6187,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6188,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6189,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6190,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6191,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6192,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords.','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;The&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;one-way&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;xin&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;single&#x20;x&#x20;in&#x20;the&#x20;password&#x20;field,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;these&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwdInvestigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6193,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}, {\"cis_level\": [\"1\"]}]'),(6194,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"cis_level\": [\"1\"]}]'),(6195,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty.','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;runa&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.18\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}, {\"cis_level\": [\"1\"]}]'),(6500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/cramfs.conf:&#x20;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(6501,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;limited','The&#x20;VFAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/vfat.conf:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;#&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(6502,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/squashfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(6503,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(6504,'Ensure&#x20;/tmp&#x20;is&#x20;configured','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;example:&#x20;&quot;tmpfs&#x20;&#x20;/tmp&#x20;&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;&#x20;0&#x20;0&quot;&#x20;&#x20;OR&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;#&#x20;systemctl&#x20;enable&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount:&#x20;&#x20;&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6505,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;OR&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6506,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6507,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6508,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6509,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6510,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6511,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6512,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6513,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6514,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6515,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6516,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6517,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6518,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6519,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6520,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs&#x20;:&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6521,'Disable&#x20;USB&#x20;Storage','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/usb-storage.conf&#x20;&#x20;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;&#x20;#&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6522,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(6523,'Ensure&#x20;sudo&#x20;is&#x20;installed','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo:&#x20;#&#x20;dnf&#x20;install&#x20;sudo','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6524,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo&#x20;which&#x20;would&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6525,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6526,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;aide:&#x20;#&#x20;dnf&#x20;install&#x20;aide&#x20;&#x20;||&#x20;&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6527,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;cp&#x20;./config/aidecheck.service&#x20;/etc/systemd/system/aidecheck.service&#x20;&#x20;#&#x20;cp&#x20;./config/aidecheck.timer&#x20;/etc/systemd/system/aidecheck.timer&#x20;&#x20;&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;#&#x20;systemctl&#x20;reenable&#x20;aidecheck.timer&#x20;#&#x20;systemctl&#x20;restart&#x20;aidecheck.timer&#x20;#&#x20;systemctl&#x20;daemon-reload.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;//&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6528,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;and&#x20;grubenv&#x20;stored&#x20;in&#x20;/boot/grub2/','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grubenv&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grubenv','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6529,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-setpassword:&#x20;#&#x20;grub2-setpassword&#x20;&#x20;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6530,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/usr/lib/systemd/system/rescue.service&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;line:&#x20;ExecStart=-/usr/lib/systemd/systemd-sulogin-shell&#x20;rescue&#x20;Edit&#x20;/usr/lib/systemd/system/emergency.service&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;line:&#x20;ExecStart=-/usr/lib/systemd/systemd-sulogin-shell&#x20;emergency','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6531,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0.&#x20;If&#x20;systemd-coredump&#x20;is&#x20;installed:&#x20;&#x20;edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;Storage=none&#x20;ProcessSizeMax=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;command:&#x20;#&#x20;systemctl&#x20;daemon-reload','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6532,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6533,'Ensure&#x20;SELinux&#x20;is&#x20;installed','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Control.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;SELinux&#x20;:&#x20;#&#x20;dnf&#x20;install&#x20;libselinux','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6534,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6535,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6536,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6537,'Ensure&#x20;no&#x20;unconfined&#x20;services&#x20;exist','Unconfined&#x20;processes&#x20;run&#x20;in&#x20;unconfined&#x20;domains','For&#x20;unconfined&#x20;processes,&#x20;SELinux&#x20;policy&#x20;rules&#x20;are&#x20;applied,&#x20;but&#x20;policy&#x20;rules&#x20;exist&#x20;that&#x20;allow&#x20;processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;almost&#x20;all&#x20;access.&#x20;Processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;fall&#x20;back&#x20;to&#x20;using&#x20;DAC&#x20;rules&#x20;exclusively.&#x20;If&#x20;an&#x20;unconfined&#x20;process&#x20;is&#x20;compromised,&#x20;SELinux&#x20;does&#x20;not&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;system&#x20;resources&#x20;and&#x20;data,&#x20;but&#x20;of&#x20;course,&#x20;DAC&#x20;rules&#x20;are&#x20;still&#x20;used.&#x20;SELinux&#x20;is&#x20;a&#x20;security&#x20;enhancement&#x20;on&#x20;top&#x20;of&#x20;DAC&#x20;rules&#x20;&ndash;&#x20;it&#x20;does&#x20;not&#x20;replace&#x20;them','','Investigate&#x20;any&#x20;unconfined&#x20;processes&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.&#x20;Notes:&#x20;Occasionally&#x20;certain&#x20;daemons&#x20;such&#x20;as&#x20;backup&#x20;or&#x20;centralized&#x20;management&#x20;software&#x20;may&#x20;require&#x20;running&#x20;unconfined.&#x20;Any&#x20;such&#x20;software&#x20;should&#x20;be&#x20;carefully&#x20;analyzed&#x20;and&#x20;documented&#x20;before&#x20;such&#x20;an&#x20;exception&#x20;is&#x20;made.','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6538,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;dnf&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6539,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;dnf&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6540,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;FUTURE&#x20;or&#x20;FIPS','The&#x20;system-wide&#x20;crypto-policies&#x20;followed&#x20;by&#x20;the&#x20;crypto&#x20;core&#x20;components&#x20;allow&#x20;consistently&#x20;deprecating&#x20;and&#x20;disabling&#x20;algorithms&#x20;system-wide.&#x20;The&#x20;individual&#x20;policy&#x20;levels&#x20;&#40;DEFAULT,&#x20;LEGACY,&#x20;FUTURE,&#x20;and&#x20;FIPS&#41;&#x20;are&#x20;included&#x20;in&#x20;the&#x20;crypto-policies&#40;7&#41;&#x20;package.','If&#x20;the&#x20;Legacy&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;selected,&#x20;it&#x20;includes&#x20;support&#x20;for&#x20;TLS&#x20;1.0,&#x20;TLS&#x20;1.1,&#x20;and&#x20;SSH2&#x20;protocols&#x20;or&#x20;later.&#x20;The&#x20;algorithms&#x20;DSA,&#x20;3DES,&#x20;and&#x20;RC4&#x20;are&#x20;allowed,&#x20;while&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;1023-bits.&#x20;These&#x20;legacy&#x20;protocols&#x20;and&#x20;algorithms&#x20;can&#x20;make&#x20;the&#x20;system&#x20;vulnerable&#x20;to&#x20;attacks,&#x20;including&#x20;those&#x20;listed&#x20;in&#x20;RFC&#x20;7457&#x20;FUTURE:&#x20;Is&#x20;a&#x20;conservative&#x20;security&#x20;level&#x20;that&#x20;is&#x20;believed&#x20;to&#x20;withstand&#x20;any&#x20;near-term&#x20;future&#x20;attacks.&#x20;This&#x20;level&#x20;does&#x20;not&#x20;allow&#x20;the&#x20;use&#x20;of&#x20;SHA-1&#x20;in&#x20;signature&#x20;algorithms.&#x20;The&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;3071&#x20;bits.&#x20;The&#x20;level&#x20;provides&#x20;at&#x20;least&#x20;128-bit&#x20;security&#x20;FIPS:&#x20;Conforms&#x20;to&#x20;the&#x20;FIPS&#x20;140-2&#x20;requirements.&#x20;This&#x20;policy&#x20;is&#x20;used&#x20;internally&#x20;by&#x20;the&#x20;fips-mode-setup&#40;8&#41;&#x20;tool&#x20;which&#x20;can&#x20;switch&#x20;the&#x20;system&#x20;into&#x20;the&#x20;FIPS&#x20;140-2&#x20;compliance&#x20;mode.&#x20;The&#x20;level&#x20;provides&#x20;at&#x20;least&#x20;112-bit&#x20;security','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;FUTURE&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;To&#x20;switch&#x20;the&#x20;system&#x20;to&#x20;FIPS&#x20;mode,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;fips-mode-setup&#x20;--enable','[{\"cis\": [\"1.11\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6541,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(6542,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(6543,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(6544,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6545,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6546,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6547,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add&#x20;the&#x20;following&#x20;in&#x20;3&#x20;lines:&#x20;&#40;1&#41;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;&#40;2&#41;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#40;3&#41;&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;','[{\"cis\": [\"1.8.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(6548,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;install&#x20;all&#x20;available&#x20;security&#x20;updates:&#x20;#&#x20;dnf&#x20;update&#x20;--security&#x20;.&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.&#x20;The&#x20;audit&#x20;and&#x20;remediation&#x20;here&#x20;only&#x20;cover&#x20;security&#x20;updates.&#x20;Non-security&#x20;updates&#x20;can&#x20;be&#x20;audited&#x20;with&#x20;and&#x20;comparing&#x20;against&#x20;site&#x20;policy:&#x20;#&#x20;dnf&#x20;check-update','[{\"cis\": [\"1.9\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(6549,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;not&#x20;legacy','The&#x20;system-wide&#x20;crypto-policies&#x20;followed&#x20;by&#x20;the&#x20;crypto&#x20;core&#x20;components&#x20;allow&#x20;consistently&#x20;deprecating&#x20;and&#x20;disabling&#x20;algorithms&#x20;system-wide.&#x20;The&#x20;individual&#x20;policy&#x20;levels&#x20;&#40;DEFAULT,&#x20;LEGACY,&#x20;FUTURE,&#x20;and&#x20;FIPS&#41;&#x20;are&#x20;included&#x20;in&#x20;the&#x20;crypto-policies&#40;7&#41;&#x20;package.','If&#x20;the&#x20;Legacy&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;selected,&#x20;it&#x20;includes&#x20;support&#x20;for&#x20;TLS&#x20;1.0,&#x20;TLS&#x20;1.1,&#x20;and&#x20;SSH2&#x20;protocols&#x20;or&#x20;later.&#x20;The&#x20;algorithms&#x20;DSA,&#x20;3DES,&#x20;and&#x20;RC4&#x20;are&#x20;allowed,&#x20;while&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;1023-bits.&#x20;These&#x20;legacy&#x20;protocols&#x20;and&#x20;algorithms&#x20;can&#x20;make&#x20;the&#x20;system&#x20;vulnerable&#x20;to&#x20;attacks,&#x20;including&#x20;those&#x20;listed&#x20;in&#x20;RFC&#x20;7457','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;&lt;CRYPTO&#x20;POLICY&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Example:&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;DEFAULT&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;make&#x20;the&#x20;updated&#x20;system-wide&#x20;crypto&#x20;policy&#x20;active&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;update-crypto-policies','[{\"cis\": [\"1.10\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6550,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;dnf&#x20;remove&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6551,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;install&#x20;chrony:&#x20;#&#x20;dnf&#x20;install&#x20;chrony&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;verify&#x20;that&#x20;host&#x20;based&#x20;synchronization&#x20;is&#x20;in&#x20;use.','[{\"cis\": [\"2.2.2.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6552,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;&#x20;&#x20;Configure&#x20;chrony&#x20;to&#x20;run&#x20;as&#x20;the&#x20;chrony&#x20;user','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6553,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;dnf&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6554,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rsyncd','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6555,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6556,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6557,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6558,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;smb','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6559,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;dovecot','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6560,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;httpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6561,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6562,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;named','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6563,'Ensure&#x20;NFS&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;NFS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;nfs','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6564,'Ensure&#x20;RPC&#x20;is&#x20;not&#x20;enabled','The&#x20;rpcbind&#x20;service&#x20;maps&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;services&#x20;to&#x20;the&#x20;ports&#x20;on&#x20;which&#x20;they&#x20;listen.&#x20;RPC&#x20;processes&#x20;notify&#x20;rpcbind&#x20;when&#x20;they&#x20;start,&#x20;registering&#x20;the&#x20;ports&#x20;they&#x20;are&#x20;listening&#x20;on&#x20;and&#x20;the&#x20;RPC&#x20;program&#x20;numbers&#x20;they&#x20;expect&#x20;to&#x20;serve.&#x20;The&#x20;client&#x20;system&#x20;then&#x20;contacts&#x20;rpcbind&#x20;on&#x20;the&#x20;server&#x20;with&#x20;a&#x20;particular&#x20;RPC&#x20;program&#x20;number.&#x20;The&#x20;rpcbind&#x20;service&#x20;redirects&#x20;the&#x20;client&#x20;to&#x20;the&#x20;proper&#x20;port&#x20;number&#x20;so&#x20;it&#x20;can&#x20;communicate&#x20;with&#x20;the&#x20;requested&#x20;service.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;require&#x20;rpc&#x20;based&#x20;services,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;rpcbind&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6565,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6566,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;dhcpd','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6567,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6568,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;ypserv','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6569,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.18\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(6570,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;dnf&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6571,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet&#x20;:&#x20;#&#x20;dnf&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6572,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;dnf&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6573,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.ip_forwards*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;&#x20;&#x20;&#x20;&amp;&amp;&#x20;&#x20;&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv6.conf.all.forwardings*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv6.conf.all.forwardings*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6574,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;.Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6575,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6576,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;and&#x20;net.ipv6.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0;&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;and&#x20;#&#x20;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6577,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;and&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6578,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;and&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6579,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.icmp_echo_ignore_broadcastss*=s*0&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;&quot;s/^s*&#40;net.ipv4.icmp_echo_ignore_broadcastss*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.icmp_echo_ignore_broadcasts=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6580,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.icmp_ignore_bogus_error_responsess*=s*0&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.icmp_ignore_bogus_error_responsess*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&quot;','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6581,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.conf.all.rp_filters*=s*0&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.net.ipv4.conf.all.rp_filters*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;.Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.default.rp_filter=1&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6582,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.tcp_syncookiess*=s*[02]*&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.tcp_syncookiess*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6583,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;do&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;and&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;and&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1;','[{\"cis\": [\"3.2.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6584,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6585,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6586,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6587,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;.Example:&#x20;vim&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6588,'Disable&#x20;IPv6','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;.Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"3.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.6\", \"CC5.2\"]}]'),(6589,'Ensure&#x20;a&#x20;Firewall&#x20;package&#x20;is&#x20;installed','A&#x20;Firewall&#x20;package&#x20;should&#x20;be&#x20;selected.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;nftables&#x20;or&#x20;iptables.','A&#x20;Firewall&#x20;package&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;a&#x20;Firewall&#x20;package.&#x20;For&#x20;firewalld:&#x20;dnf&#x20;install&#x20;firewalld&#x20;.For&#x20;nftables:&#x20;#&#x20;dnf&#x20;install&#x20;nftables.&#x20;For&#x20;iptables:&#x20;#&#x20;dnf&#x20;install&#x20;iptables','[{\"cis\": [\"3.4.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6590,'Ensure&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running','Ensure&#x20;that&#x20;the&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;protect&#x20;your&#x20;system','firewalld&#x20;&#40;Dynamic&#x20;Firewall&#x20;Manager&#41;&#x20;tool&#x20;provides&#x20;a&#x20;dynamically&#x20;managed&#x20;firewall.&#x20;The&#x20;tool&#x20;enables&#x20;network/firewall&#x20;zones&#x20;to&#x20;define&#x20;the&#x20;trust&#x20;level&#x20;of&#x20;network&#x20;connections&#x20;and/or&#x20;interfaces.&#x20;It&#x20;has&#x20;support&#x20;both&#x20;for&#x20;IPv4&#x20;and&#x20;IPv6&#x20;firewall&#x20;settings.&#x20;Also,&#x20;it&#x20;supports&#x20;Ethernet&#x20;bridges&#x20;and&#x20;allow&#x20;you&#x20;to&#x20;separate&#x20;between&#x20;runtime&#x20;and&#x20;permanent&#x20;configuration&#x20;options.&#x20;Finally,&#x20;it&#x20;supports&#x20;an&#x20;interface&#x20;for&#x20;services&#x20;or&#x20;applications&#x20;to&#x20;add&#x20;firewall&#x20;rules&#x20;directly','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;firewalld:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;firewalld','[{\"cis\": [\"3.4.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6591,'Ensure&#x20;nftables&#x20;is&#x20;not&#x20;enabled','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.&#x20;nftables&#x20;are&#x20;installed&#x20;as&#x20;a&#x20;dependency&#x20;with&#x20;firewalld.','Running&#x20;firewalld&#x20;and&#x20;nftables&#x20;concurrently&#x20;may&#x20;lead&#x20;to&#x20;conflict,&#x20;therefore&#x20;nftables&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;when&#x20;using&#x20;firewalld.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;and&#x20;stop&#x20;nftables:&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables','[{\"cis\": [\"3.4.2.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6592,'Ensure&#x20;iptables&#x20;is&#x20;not&#x20;enabled','IPtables&#x20;is&#x20;an&#x20;application&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;IPv4&#x20;and&#x20;IPv6&#x20;tables,&#x20;chains&#x20;and&#x20;rules&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall.&#x20;IPtables&#x20;is&#x20;installed&#x20;as&#x20;a&#x20;dependency&#x20;with&#x20;firewalld.','Running&#x20;firewalld&#x20;and&#x20;IPtables&#x20;concurrently&#x20;may&#x20;lead&#x20;to&#x20;conflict,&#x20;therefore&#x20;IPtables&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;when&#x20;using&#x20;firewalld.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;iptables:&#x20;systemctl&#x20;--now&#x20;mask&#x20;iptables','[{\"cis\": [\"3.4.2.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6593,'Ensure&#x20;iptables&#x20;are&#x20;flushed','nftables&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;iptables,&#x20;ip6tables,&#x20;ebtables&#x20;and&#x20;arptables','It&#x20;is&#x20;possible&#x20;to&#x20;mix&#x20;iptables&#x20;and&#x20;nftables.&#x20;However,&#x20;this&#x20;increases&#x20;complexity&#x20;and&#x20;also&#x20;the&#x20;chance&#x20;to&#x20;introduce&#x20;errors.&#x20;For&#x20;simplicity&#x20;flush&#x20;out&#x20;all&#x20;iptables&#x20;rules,&#x20;and&#x20;ensure&#x20;it&#x20;is&#x20;not&#x20;loaded.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;flush&#x20;iptables:&#x20;For&#x20;iptables:&#x20;#&#x20;iptables&#x20;-F&#x20;and&#x20;For&#x20;ip6tables:&#x20;#&#x20;ip6tables&#x20;-F','[{\"cis\": [\"3.4.3.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6594,'Ensure&#x20;a&#x20;table&#x20;exists','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;.Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.4.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6595,'Ensure&#x20;base&#x20;chains&#x20;exist','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.4.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6596,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept&#x20;,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;;&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;and&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.4.3.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6597,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;nftables','[{\"cis\": [\"3.4.3.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6598,'Configure&#x20;IPv4&#x20;iptables','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.4.4.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6599,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.4.4.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6600,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.4.4.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6601,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.4.4.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6602,'Ensure&#x20;wireless&#x20;interfaces&#x20;are&#x20;disabled','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.&#x20;CentOS&#x20;Linux&#x20;contains&#x20;a&#x20;wireless&#x20;tool&#x20;kit&#x20;to&#x20;allow&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;and&#x20;use&#x20;wireless&#x20;networks.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;any&#x20;wireless&#x20;interfaces:&#x20;#&#x20;nmcli&#x20;radio&#x20;all&#x20;off&#x20;.&#x20;Disable&#x20;any&#x20;wireless&#x20;interfaces&#x20;in&#x20;your&#x20;network&#x20;configuration.','[{\"cis\": [\"3.5\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.6\"]}]'),(6603,'Ensure&#x20;auditd&#x20;is&#x20;installed','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;#&#x20;dnf&#x20;install&#x20;audit&#x20;audit-libs','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6604,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6605,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub2&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX&#x20;:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6606,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient','The&#x20;backlog&#x20;limit&#x20;has&#x20;a&#x20;default&#x20;setting&#x20;of&#x20;64.','During&#x20;boot&#x20;if&#x20;audit=1,&#x20;then&#x20;the&#x20;backlog&#x20;will&#x20;hold&#x20;64&#x20;records.&#x20;If&#x20;more&#x20;than&#x20;64&#x20;records&#x20;are&#x20;created&#x20;during&#x20;boot,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit_backlog_limit=&lt;BACKLOG&#x20;SIZE&gt;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(6607,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(6608,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(6609,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(6610,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6611,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.9\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6612,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"4.9\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(6613,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6614,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6615,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6616,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6617,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6618,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6619,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6620,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(6621,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod&#x20;,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6622,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6623,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line:&#x20;&#x20;&#x20;-e&#x20;2&#x20;&#x20;&#x20;&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(6624,'Ensure&#x20;rsyslog&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;software&#x20;is&#x20;a&#x20;recommended&#x20;replacement&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;&#x20;&#x20;#&#x20;dnf&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6625,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6626,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(6627,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6628,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(6629,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6630,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Compress=yes','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6631,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitivebdata&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;{}&#x20;+','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(6632,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;crond','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6633,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6634,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6635,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6636,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6637,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6638,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6639,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6640,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6641,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;and&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6642,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;0600&#x20;{}&#x20;;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6643,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;public&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;0644&#x20;{}&#x20;;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6644,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;or&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6645,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6646,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6647,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Ignorerhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6648,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6649,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6650,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6651,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6652,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(6653,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6654,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6655,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6656,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6657,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;4','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6658,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;not&#x20;over-ridden','System-wide&#x20;Crypto&#x20;policy&#x20;can&#x20;be&#x20;over-ridden&#x20;or&#x20;opted&#x20;out&#x20;of&#x20;for&#x20;openSSH','Over-riding&#x20;or&#x20;opting&#x20;out&#x20;of&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;could&#x20;allow&#x20;for&#x20;the&#x20;use&#x20;of&#x20;less&#x20;secure&#x20;Ciphers,&#x20;MACs,&#x20;KexAlgoritms&#x20;and&#x20;GSSAPIKexAlgorithsm','','Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;CRYPTO_POLICYs*=.*&#41;$/#&#x20;1/&quot;&#x20;/etc/sysconfig/sshd;&#x20;#&#x20;systemctl&#x20;reload&#x20;sshd','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(6659,'Create&#x20;custom&#x20;authselect&#x20;profile','A&#x20;custom&#x20;profile&#x20;can&#x20;be&#x20;created&#x20;by&#x20;copying&#x20;and&#x20;customizing&#x20;one&#x20;of&#x20;the&#x20;default&#x20;profiles.&#x20;The&#x20;default&#x20;profiles&#x20;include:&#x20;sssd,&#x20;winbind,&#x20;or&#x20;the&#x20;nis.','A&#x20;custom&#x20;profile&#x20;is&#x20;required&#x20;to&#x20;customize&#x20;many&#x20;of&#x20;the&#x20;pam&#x20;options','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;custom&#x20;authselect&#x20;profile:&#x20;#&#x20;authselect&#x20;create-profile&#x20;&lt;custom-profile&#x20;name&gt;&#x20;-b&#x20;&lt;default&#x20;profile&#x20;to&#x20;copy&gt;&#x20;.Example:&#x20;#&#x20;authselect&#x20;create-profile&#x20;custom-profile&#x20;-b&#x20;sssd&#x20;--symlink-meta','[{\"cis\": [\"5.3.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6660,'Ensure&#x20;authselect&#x20;includes&#x20;with-faillock','The&#x20;pam_faillock.so&#x20;module&#x20;maintains&#x20;a&#x20;list&#x20;of&#x20;failed&#x20;authentication&#x20;attempts&#x20;per&#x20;user&#x20;during&#x20;a&#x20;specified&#x20;interval&#x20;and&#x20;locks&#x20;the&#x20;account&#x20;in&#x20;case&#x20;there&#x20;were&#x20;more&#x20;than&#x20;deny&#x20;consecutive&#x20;failed&#x20;authentications.&#x20;It&#x20;stores&#x20;the&#x20;failure&#x20;records&#x20;into&#x20;per-user&#x20;files&#x20;in&#x20;the&#x20;tally&#x20;directory.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;include&#x20;the&#x20;with-faillock&#x20;option:&#x20;#&#x20;authselect&#x20;select&#x20;&lt;PROFILE&#x20;NAME&gt;&#x20;with-faillock&#x20;&#x20;&#x20;&#x20;Example:&#x20;#&#x20;authselect&#x20;select&#x20;custom/custom-profile&#x20;with-sudo&#x20;with-faillock&#x20;without-nullok','[{\"cis\": [\"5.3.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6661,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options.&#x20;try_first_pass&#x20;-&#x20;retrieve&#x20;the&#x20;password&#x20;from&#x20;a&#x20;previous&#x20;stacked&#x20;PAM&#x20;module.&#x20;If&#x20;not&#x20;available,&#x20;then&#x20;prompt&#x20;the&#x20;user&#x20;for&#x20;a&#x20;password.&#x20;retry=3&#x20;-&#x20;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure.&#x20;minlen=14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more&#x20;Either&#x20;of&#x20;the&#x20;following&#x20;can&#x20;be&#x20;used&#x20;to&#x20;enforce&#x20;complex&#x20;passwords:&#x20;minclass=4&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;four&#x20;classes&#x20;of&#x20;characters&#x20;for&#x20;the&#x20;new&#x20;password&#x20;OR&#x20;dcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit&#x20;ucredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character&#x20;ocredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character&#x20;lcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character&#x20;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minclass&#x20;=&#x20;4&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;-1&#x20;=&#x20;-1&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;system-auth&#x20;and&#x20;password-auth&#x20;files:&#x20;CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&#039;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&#039;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;for&#x20;FN&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;[[&#x20;-n&#x20;$CP&#x20;]]&#x20;&amp;&amp;&#x20;PTF=/etc/authselect/$CP/$FN&#x20;||&#x20;PTF=/etc/authselect/$FN&#x20;[[&#x20;-z&#x20;$&#40;grep&#x20;-E&#x20;&#039;^s*passwords+requisites+pam_pwquality.sos+.*enforce-for-roots*.*$&#039;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+requisites+pam_pwquality.sos+&#41;&#40;.*&#41;$/12&#x20;enforce-for-root/&#039;&#x20;$PTF&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&#039;^s*passwords+requisites+pam_pwquality.sos+.*s+retry=S+s*.*$&#039;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;/pwquality/s/retry=S+/retry=3/&#039;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+requisites+pam_pwquality.sos+&#41;&#40;.*&#41;$/12&#x20;retry=3/&#039;&#x20;$PTF&#x20;done&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6662,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;deny=&#x20;-&#x20;Number&#x20;of&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;unlock_time=&#x20;-&#x20;Time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;account&#x20;is&#x20;unlocked.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;and&#x20;unlock&#x20;time&#x20;to&#x20;follow&#x20;local&#x20;site&#x20;policy.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Set&#x20;password&#x20;lockouts&#x20;and&#x20;unlock&#x20;times&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;system-auth&#x20;and&#x20;password-auth&#x20;files.&#x20;This&#x20;script&#x20;will&#x20;update/add&#x20;the&#x20;deny=5&#x20;and&#x20;unlock_time=900&#x20;options.&#x20;This&#x20;script&#x20;should&#x20;be&#x20;modified&#x20;as&#x20;needed&#x20;to&#x20;follow&#x20;local&#x20;site&#x20;policy.CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&quot;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&quot;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;for&#x20;FN&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;[[&#x20;-n&#x20;$CP&#x20;]]&#x20;&amp;&amp;&#x20;PTF=/etc/authselect/$CP/$FN&#x20;||&#x20;PTF=/etc/authselect/$FN&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&quot;^s*auths+requireds+pam_faillock.sos+.*deny=S+s*.*$&quot;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&quot;/pam_faillock.so/s/deny=S+/deny=5/g&quot;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&quot;s/^^s*&#40;auths+requireds+pam_faillock.sos+&#41;&#40;.*[^{}]&#41;&#40;{.*}|&#41;$/12&#x20;deny=5&#x20;3/&quot;&#x20;$PTF&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&quot;^s*auths+requireds+pam_faillock.sos+.*unlock_time=S+s*.*$&quot;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&quot;/pam_faillock.so/s/unlock_time=S+/unlock_time=900/g&quot;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;auths+requireds+pam_faillock.sos+&#41;&#40;.*[^{}]&#41;&#40;{.*}|&#41;$/12&#x20;unlock_time=900&#x20;3/&quot;&#x20;$PTF&#x20;done&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6663,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&quot;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.&#x20;remember=&lt;5&gt;&#x20;-&#x20;Number&#x20;of&#x20;old&#x20;passwords&#x20;to&#x20;remember','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;remembered&#x20;password&#x20;history&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;pam_pwhistory.so&#x20;and&#x20;pam_unix.so&#x20;lines&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option:&#x20;CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&quot;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&quot;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;[[&#x20;-n&#x20;$CP&#x20;]]&#x20;&amp;&amp;&#x20;PTF=/etc/authselect/$CP/system-auth&#x20;||&#x20;PTF=/etc/authselect/system-auth&#x20;[[&#x20;-n&#x20;$&#40;grep&#x20;-E&#x20;&quot;^s*passwords+&#40;sufficients+pam_unix|requi&#40;red|site&#41;s+pam_pwhistory&#41;.sos+&#x20;&#40;[^#]+s+&#41;*remember=S+s*.*$&quot;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;passwords+&#40;requisite|sufficient&#41;s+&#40;pam_pwquality.so|pam_unix.so&#41;s+&#41;&#40;.*&#41;&#40;remember=S+s*&#41;&#40;.*&#41;$/14&#x20;remember=5&#x20;6/&quot;&#x20;$PTF&#x20;||&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;passwords+&#40;requisite|sufficient&#41;s+&#40;pam_pwquality.so|pam_unix.so&#41;s+&#41;&#40;.*&#41;$/14&#x20;remember=5/&quot;&#x20;$PTF&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6664,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;password&#x20;hashing&#x20;algorithm&#x20;to&#x20;sha512.&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;dd&#x20;or&#x20;modify&#x20;the&#x20;pam_unix.so&#x20;lines&#x20;in&#x20;the&#x20;password-auth&#x20;and&#x20;system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option:&#x20;CP=$&#40;authselect&#x20;current&#x20;|&#x20;awk&#x20;&#039;NR&#x20;==&#x20;1&#x20;{print&#x20;$3}&#039;&#x20;|&#x20;grep&#x20;custom/&#41;&#x20;for&#x20;FN&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;[[&#x20;-z&#x20;$&#40;grep&#x20;-E&#x20;&#039;^s*passwords+sufficients+pam_unix.sos+.*sha512s*.*$&#039;&#x20;$PTF&#41;&#x20;]]&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+sufficients+pam_unix.sos+&#41;&#40;.*&#41;$/12&#x20;sha512/&#039;&#x20;$PTF&#x20;done&#x20;authselect&#x20;apply-changes','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(6665,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6666,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6667,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6668,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6669,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;readonly&#x20;TMOUT=900&#x20;;&#x20;export&#x20;TMOUT&#x20;.&#x20;Note&#x20;that&#x20;setting&#x20;the&#x20;value&#x20;to&#x20;readonly&#x20;prevents&#x20;unwanted&#x20;modification&#x20;during&#x20;runtime.','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(6670,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.5.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6671,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.5.5\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6672,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo&#x20;,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su&#x20;,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(6673,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6674,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6675,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6676,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6677,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;600&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6678,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6679,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6680,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6681,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(6682,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6683,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6684,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(6685,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(7000,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}]'),(7001,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7002,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7003,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7004,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}]'),(7005,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}]'),(7006,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#x20;&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.3\"]}]'),(7007,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}]'),(7008,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home.&#x20;Notes:&#x20;The&#x20;actions&#x20;in&#x20;this&#x20;recommendation&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','[{\"cis\": [\"1.1.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7009,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7010,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7011,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7012,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-md5-crypt&#x20;:&#x20;#&#x20;grub-md5-crypt.&#x20;The&#x20;result&#x20;is&#x20;an&#x20;&lt;encrypted-password&gt;.&#x20;Copy&#x20;and&#x20;paste&#x20;the&#x20;&lt;encrypted-password&gt;&#x20;into&#x20;the&#x20;global&#x20;section&#x20;of&#x20;/boot/grub/menu.lst:&#x20;password&#x20;--md5&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7013,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/security/limits.conf&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0.','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}]'),(7014,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.4\"]}]'),(7015,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;chargen&#x20;and&#x20;chargen-udp&#x20;:&#x20;#&#x20;chkconfig&#x20;chargen&#x20;off&#x20;#&#x20;chkconfig&#x20;chargen-udp&#x20;off','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7016,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;daytime&#x20;-&#x20;and&#x20;daytime-udp:&#x20;#&#x20;chkconfig&#x20;daytime-off&#x20;#&#x20;chkconfig&#x20;daytime-udp&#x20;off','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7017,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled','discard&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;discard&#x20;and&#x20;discard-udp:&#x20;#&#x20;chkconfig&#x20;discard&#x20;off&#x20;#&#x20;chkconfig&#x20;discard-udp&#x20;off','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7018,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;echo&#x20;and&#x20;echo-udp:&#x20;#&#x20;chkconfig&#x20;echo&#x20;off&#x20;#&#x20;chkconfig&#x20;echo-udp&#x20;off','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7019,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled','timeis&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;time&#x20;and&#x20;time-udp:&#x20;#&#x20;chkconfig&#x20;time&#x20;off&#x20;#&#x20;chkconfig&#x20;time-udp&#x20;off','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7020,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;rexec&#x20;&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;and&#x20;rexec&#x20;:&#x20;#&#x20;chkconfig&#x20;rexec&#x20;off&#x20;#&#x20;chkconfig&#x20;rlogin&#x20;off&#x20;#&#x20;chkconfig&#x20;rsh&#x20;off','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"3.4\", \"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7021,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;talk:&#x20;#&#x20;chkconfig&#x20;talk&#x20;off','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7022,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;chkconfig&#x20;telnet&#x20;off','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"3.4\", \"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7023,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;package&#x20;atftp&#x20;is&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;tftp:&#x20;#&#x20;chkconfig&#x20;tftp&#x20;off','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7024,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsyncd&#x20;:&#x20;#&#x20;chkconfig&#x20;rsyncd&#x20;off','[{\"cis\": [\"2.1.10\", \"2.2.17\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7025,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://tools.ietf.org/html/rfc958.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;limited&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;limited&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;&#x20;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;&#x20;&#x20;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;NTPD_OPTIONS&#x20;in&#x20;/etc/sysconfig/ntp&#x20;to&#x20;include&#x20;&#039;-u&#x20;ntp:ntp&#039;:&#x20;NTPD_OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7026,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;zypper&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7027,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon&#x20;:&#x20;#&#x20;chkconfig&#x20;avahi-daemon&#x20;off','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7028,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd&#x20;:&#x20;#&#x20;chkconfig&#x20;dhcpd&#x20;off','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7029,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind&#x20;:&#x20;#&#x20;chkconfig&#x20;nfs&#x20;off&#x20;#&#x20;chkconfig&#x20;rpcbind&#x20;off','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7030,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;chkconfig&#x20;named&#x20;off','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7031,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd&#x20;:&#x20;#&#x20;chkconfig&#x20;vsftpd&#x20;off&#x20;&#x20;Notes:&#x20;Additional&#x20;FTP&#x20;servers&#x20;also&#x20;exist&#x20;and&#x20;should&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7032,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;&#x20;Notes:&#x20;Several&#x20;httpd&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;apache,&#x20;apache2,&#x20;lighttpd,&#x20;and&#x20;nginx&#x20;are&#x20;example&#x20;services&#x20;that&#x20;provide&#x20;an&#x20;HTTP&#x20;server.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2&#x20;:&#x20;#&#x20;chkconfig&#x20;apache2&#x20;off','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7033,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','cyrus&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cyrus&#x20;:&#x20;#&#x20;chkconfig&#x20;cyrus&#x20;off&#x20;&#x20;&#x20;Notes:&#x20;Several&#x20;IMAP/POP3&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;dovecot&#x20;is&#x20;an&#x20;example&#x20;service&#x20;that&#x20;provides&#x20;an&#x20;IMAP/POP3&#x20;server.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7034,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb&#x20;:&#x20;#&#x20;chkconfig&#x20;smb&#x20;off','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7035,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid&#x20;:&#x20;#&#x20;chkconfig&#x20;squid&#x20;off','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7036,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;chkconfig&#x20;snmpd&#x20;off&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Additional&#x20;methods&#x20;of&#x20;disabling&#x20;a&#x20;service&#x20;exist.&#x20;Consult&#x20;your&#x20;distribution&#x20;documentation&#x20;for&#x20;appropriate&#x20;methods.','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7037,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv&#x20;:&#x20;#&#x20;chkconfig&#x20;ypserv&#x20;off','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7038,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind&#x20;:&#x20;#&#x20;zypper&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7039,'Ensure&#x20;IPv4&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7040,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7041,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7042,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7043,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7044,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7045,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7046,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7047,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7048,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7049,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7050,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.&#x20;INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7051,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7052,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7053,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv&#x20;,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7054,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.&#x20;&#x20;Rationale:&#x20;Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7055,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7056,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(7057,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;username&gt;.&#x20;&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(7500,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;or&#x20;the&#x20;systemd&#x20;tmp.mount&#x20;service&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}]'),(7501,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7502,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7503,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7504,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}]'),(7505,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}]'),(7506,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#x20;&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.3\"]}]'),(7507,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}]'),(7508,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home.&#x20;Notes:&#x20;The&#x20;actions&#x20;in&#x20;this&#x20;recommendation&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','[{\"cis\": [\"1.1.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7509,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm&#x20;&#x20;&#x20;&#x20;Notes:&#x20;/dev/shm&#x20;is&#x20;not&#x20;specified&#x20;in&#x20;/etc/fstab&#x20;despite&#x20;being&#x20;mounted&#x20;by&#x20;default.&#x20;The&#x20;following&#x20;line&#x20;will&#x20;implement&#x20;the&#x20;recommended&#x20;/dev/shm&#x20;mount&#x20;options&#x20;in&#x20;/etc/fstab:&#x20;tmpfs&#x20;&#x20;/dev/shm&#x20;&#x20;tmpfs&#x20;&#x20;defaults,nodev,nosuid,noexec&#x20;&#x20;0&#x20;0.&#x20;Notes:&#x20;/dev/shm&#x20;is&#x20;not&#x20;specified&#x20;in&#x20;/etc/fstab&#x20;despite&#x20;being&#x20;mounted&#x20;by&#x20;default.&#x20;The&#x20;following&#x20;line&#x20;will&#x20;implement&#x20;the&#x20;recommended&#x20;/dev/shm&#x20;mount&#x20;options&#x20;in&#x20;/etc/fstab:&#x20;tmpfs&#x20;&#x20;/dev/shm&#x20;&#x20;tmpfs&#x20;&#x20;defaults,nodev,nosuid,noexec&#x20;&#x20;0&#x20;0','[{\"cis\": [\"1.1.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7510,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm&#x20;&#x20;&#x20;&#x20;Notes:&#x20;/dev/shm&#x20;is&#x20;not&#x20;specified&#x20;in&#x20;/etc/fstab&#x20;despite&#x20;being&#x20;mounted&#x20;by&#x20;default.&#x20;The&#x20;following&#x20;line&#x20;will&#x20;implement&#x20;the&#x20;recommended&#x20;/dev/shm&#x20;mount&#x20;options&#x20;in&#x20;/etc/fstab:&#x20;tmpfs&#x20;&#x20;/dev/shm&#x20;&#x20;tmpfs&#x20;&#x20;defaults,nodev,nosuid,noexec&#x20;&#x20;0&#x20;0.&#x20;Notes:&#x20;/dev/shm&#x20;is&#x20;not&#x20;specified&#x20;in&#x20;/etc/fstab&#x20;despite&#x20;being&#x20;mounted&#x20;by&#x20;default.&#x20;The&#x20;following&#x20;line&#x20;will&#x20;implement&#x20;the&#x20;recommended&#x20;/dev/shm&#x20;mount&#x20;options&#x20;in&#x20;/etc/fstab:&#x20;tmpfs&#x20;&#x20;/dev/shm&#x20;&#x20;tmpfs&#x20;&#x20;defaults,nodev,nosuid,noexec&#x20;&#x20;0&#x20;0','[{\"cis\": [\"1.1.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7511,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm&#x20;&#x20;&#x20;&#x20;Notes:&#x20;/dev/shm&#x20;is&#x20;not&#x20;specified&#x20;in&#x20;/etc/fstab&#x20;despite&#x20;being&#x20;mounted&#x20;by&#x20;default.&#x20;The&#x20;following&#x20;line&#x20;will&#x20;implement&#x20;the&#x20;recommended&#x20;/dev/shm&#x20;mount&#x20;options&#x20;in&#x20;/etc/fstab:&#x20;tmpfs&#x20;&#x20;/dev/shm&#x20;&#x20;tmpfs&#x20;&#x20;defaults,nodev,nosuid,noexec&#x20;&#x20;0&#x20;0.&#x20;Notes:&#x20;/dev/shm&#x20;is&#x20;not&#x20;specified&#x20;in&#x20;/etc/fstab&#x20;despite&#x20;being&#x20;mounted&#x20;by&#x20;default.&#x20;The&#x20;following&#x20;line&#x20;will&#x20;implement&#x20;the&#x20;recommended&#x20;/dev/shm&#x20;mount&#x20;options&#x20;in&#x20;/etc/fstab:&#x20;tmpfs&#x20;&#x20;/dev/shm&#x20;&#x20;tmpfs&#x20;&#x20;defaults,nodev,nosuid,noexec&#x20;&#x20;0&#x20;0','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7512,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:fs.suid_dumpable&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}]'),(7513,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.4\"]}]'),(7514,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;chargen&#x20;and&#x20;chargen-udp&#x20;:&#x20;#&#x20;chkconfig&#x20;chargen&#x20;off&#x20;#&#x20;chkconfig&#x20;chargen-udp&#x20;off','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7515,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;daytime&#x20;and&#x20;daytime-udp:&#x20;#&#x20;chkconfig&#x20;daytime&#x20;off&#x20;#&#x20;chkconfig&#x20;daytime-udp&#x20;off','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7516,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled','discard&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;discard&#x20;and&#x20;discard-udp:&#x20;#&#x20;chkconfig&#x20;discard&#x20;off&#x20;#&#x20;chkconfig&#x20;discard-udp&#x20;off','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7517,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;echo&#x20;and&#x20;echo-udp:&#x20;#&#x20;chkconfig&#x20;echo&#x20;off&#x20;#&#x20;chkconfig&#x20;echo-udp&#x20;off','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7518,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled','timeis&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;time&#x20;and&#x20;time-udp:&#x20;#&#x20;chkconfig&#x20;time&#x20;off&#x20;#&#x20;chkconfig&#x20;time-udp&#x20;off','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7519,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;rsh,&#x20;rlogin,&#x20;rexec&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;and&#x20;rexec&#x20;:&#x20;#&#x20;chkconfig&#x20;rexec&#x20;off&#x20;#&#x20;chkconfig&#x20;rlogin&#x20;off&#x20;#&#x20;chkconfig&#x20;rsh&#x20;off','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"3.4\", \"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7520,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;talk:&#x20;#&#x20;chkconfig&#x20;talk&#x20;off','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7521,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;chkconfig&#x20;telnet&#x20;off','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"3.4\", \"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7522,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;package&#x20;atftp&#x20;is&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;tftp:&#x20;#&#x20;systemctl&#x20;disable&#x20;atftpd','[{\"cis\": [\"2.1.9\", \"2.2.17\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7523,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsyncd:&#x20;#&#x20;systemctl&#x20;disable&#x20;rsyncd','[{\"cis\": [\"2.1.10\", \"2.2.18\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7524,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;xinetd&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;xinetd','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7525,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://tools.ietf.org/html/rfc958.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;limited&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;&#x20;&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;limited&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;&#x20;&#x20;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;&#x20;&#x20;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;NTPD_OPTIONS&#x20;in&#x20;/etc/sysconfig/ntp&#x20;to&#x20;include&#x20;&#039;-u&#x20;ntp:ntp&#039;:&#x20;NTPD_OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7526,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;zypper&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7527,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7528,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;dhcpd','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7529,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;nfs&#x20;#&#x20;systemctl&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7530,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;named','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7531,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;vsftpd&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Additional&#x20;FTP&#x20;servers&#x20;also&#x20;exist&#x20;and&#x20;should&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7532,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;apache2&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Several&#x20;httpd&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;apache,&#x20;apache2,&#x20;lighttpd,&#x20;and&#x20;nginx&#x20;are&#x20;example&#x20;services&#x20;that&#x20;provide&#x20;an&#x20;HTTP&#x20;server.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.1\"]}]'),(7533,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;dovecot&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Several&#x20;IMAP/POP3&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;cyrus-imap&#x20;is&#x20;an&#x20;example&#x20;service&#x20;that&#x20;provides&#x20;an&#x20;IMAP/POP3&#x20;server.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7534,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;smb','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7535,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;squid&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Several&#x20;HTTP&#x20;proxy&#x20;servers&#x20;exist.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;be&#x20;checked.','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7536,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;snmpd&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Additional&#x20;methods&#x20;of&#x20;disabling&#x20;a&#x20;service&#x20;exist.&#x20;Consult&#x20;your&#x20;distribution&#x20;documentation&#x20;for&#x20;appropriate&#x20;methods.','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7537,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv&#x20;:&#x20;#&#x20;systemctl&#x20;disable&#x20;ypserv','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7538,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind&#x20;:&#x20;#&#x20;zypper&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7539,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7540,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7541,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7542,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7543,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7544,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7545,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7546,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1.','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7547,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7548,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7549,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7550,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.&#x20;INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7551,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(7552,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7553,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv&#x20;,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7554,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7555,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(7556,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(7557,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;username&gt;.&#x20;&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(8000,'Disable&#x20;Local-only&#x20;Graphical&#x20;Login&#x20;Environment','The&#x20;graphical&#x20;login&#x20;service&#x20;provides&#x20;the&#x20;capability&#x20;of&#x20;logging&#x20;into&#x20;the&#x20;system&#x20;using&#x20;an&#x20;X-&#x20;windows&#x20;type&#x20;interface&#x20;from&#x20;the&#x20;console.&#x20;If&#x20;graphical&#x20;login&#x20;access&#x20;for&#x20;the&#x20;console&#x20;is&#x20;required,&#x20;leave&#x20;the&#x20;service&#x20;in&#x20;local-only&#x20;mode.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/application/graphical-login/gdm:default','[{\"cis\": [\"2.1\"]}]'),(8001,'Configure&#x20;sendmail&#x20;Service&#x20;for&#x20;Local-Only&#x20;Mode','In&#x20;Solaris&#x20;11,&#x20;the&#x20;sendmail&#x20;service&#x20;is&#x20;set&#x20;to&#x20;local&#x20;only&#x20;mode&#x20;by&#x20;default.&#x20;This&#x20;means&#x20;that&#x20;users&#x20;on&#x20;remote&#x20;systems&#x20;cannot&#x20;connect&#x20;to&#x20;the&#x20;sendmail&#x20;service,&#x20;eliminating&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;remote&#x20;exploit&#x20;attack&#x20;against&#x20;some&#x20;future&#x20;sendmail&#x20;vulnerability.&#x20;Leaving&#x20;sendmail&#x20;in&#x20;local-only&#x20;mode&#x20;permits&#x20;mail&#x20;to&#x20;be&#x20;sent&#x20;out&#x20;from&#x20;the&#x20;local&#x20;system.&#x20;If&#x20;the&#x20;local&#x20;system&#x20;will&#x20;not&#x20;be&#x20;processing&#x20;or&#x20;sending&#x20;any&#x20;mail,&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled.&#x20;However,&#x20;if&#x20;sendmail&#x20;is&#x20;disabled&#x20;completely,&#x20;email&#x20;messages&#x20;sent&#x20;to&#x20;the&#x20;root&#x20;account&#x20;&#40;such&#x20;as&#x20;cron&#x20;job&#x20;output&#x20;or&#x20;audit&#x20;service&#x20;warnings&#41;&#x20;will&#x20;fail&#x20;to&#x20;be&#x20;delivered.&#x20;An&#x20;alternative&#x20;approach&#x20;is&#x20;to&#x20;disable&#x20;the&#x20;sendmail&#x20;service&#x20;and&#x20;create&#x20;a&#x20;cron&#x20;job&#x20;to&#x20;process&#x20;all&#x20;mail&#x20;that&#x20;is&#x20;queued&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;sending&#x20;it&#x20;to&#x20;a&#x20;relay&#x20;host&#x20;defined&#x20;in&#x20;the&#x20;sendmail.cf&#x20;file.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;sendmail&#x20;be&#x20;left&#x20;in&#x20;local-only&#x20;mode&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;requirement&#x20;to&#x20;completely&#x20;disable&#x20;it.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Run&#x20;the&#x20;following&#x20;to&#x20;set&#x20;sendmail&#x20;to&#x20;listen&#x20;only&#x20;local&#x20;interfaces:&#x20;#&#x20;svccfg&#x20;-v&#x20;-s&#x20;svc:/network/smtp:sendmail&#x20;setprop&#x20;config/local_only=false&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;refresh&#x20;sendmail&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;sendmail','[{\"cis\": [\"2.2\"]}]'),(8002,'Disable&#x20;RPC&#x20;Encryption&#x20;Key','The&#x20;keyserv&#x20;service&#x20;is&#x20;only&#x20;required&#x20;for&#x20;sites&#x20;that&#x20;are&#x20;using&#x20;the&#x20;Secure&#x20;RPC&#x20;mechanism.&#x20;The&#x20;most&#x20;common&#x20;use&#x20;for&#x20;Secure&#x20;RPC&#x20;on&#x20;Solaris&#x20;machines&#x20;is&#x20;&quot;secure&#x20;NFS&quot;,&#x20;which&#x20;uses&#x20;the&#x20;Secure&#x20;RPC&#x20;mechanism&#x20;to&#x20;provide&#x20;higher&#x20;levels&#x20;of&#x20;security&#x20;than&#x20;the&#x20;standard&#x20;NFS&#x20;protocols.&#x20;&#40;&quot;Secure&#x20;NFS&quot;&#x20;is&#x20;unrelated&#x20;to&#x20;Kerberos&#x20;authentication&#x20;as&#x20;a&#x20;mechanism&#x20;for&#x20;providing&#x20;higher&#x20;levels&#x20;of&#x20;NFS&#x20;security.&#x20;&quot;Kerberized&quot;&#x20;NFS&#x20;does&#x20;not&#x20;require&#x20;the&#x20;keyserv&#x20;service&#x20;to&#x20;be&#x20;running.&#41;','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/keyserv','[{\"cis\": [\"2.3\"]}]'),(8003,'Disable&#x20;NIS&#x20;Server&#x20;Services','The&#x20;NIS&#x20;server&#x20;software&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default&#x20;and&#x20;is&#x20;only&#x20;required&#x20;on&#x20;systems&#x20;that&#x20;are&#x20;acting&#x20;as&#x20;an&#x20;NIS&#x20;server&#x20;for&#x20;the&#x20;local&#x20;site.&#x20;Typically&#x20;there&#x20;are&#x20;only&#x20;a&#x20;small&#x20;number&#x20;of&#x20;NIS&#x20;servers&#x20;on&#x20;any&#x20;given&#x20;network.&#x20;These&#x20;services&#x20;are&#x20;disabled&#x20;by&#x20;default&#x20;unless&#x20;the&#x20;system&#x20;has&#x20;been&#x20;previously&#x20;configured&#x20;to&#x20;act&#x20;as&#x20;a&#x20;NIS&#x20;server.','As&#x20;RPC-based&#x20;services&#x20;such&#x20;as&#x20;NIS&#x20;may&#x20;use&#x20;non-secure&#x20;authentication&#x20;and&#x20;share&#x20;sensitive&#x20;network&#x20;object&#x20;information&#x20;with&#x20;systems&#x20;and&#x20;applications&#x20;using&#x20;RPC-based&#x20;services,&#x20;this&#x20;service&#x20;should&#x20;be&#x20;disabled.&#x20;Users&#x20;are&#x20;encouraged&#x20;to&#x20;use&#x20;LDAP&#x20;as&#x20;a&#x20;name&#x20;service&#x20;in&#x20;place&#x20;of&#x20;NIS.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/server&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/domain','[{\"cis\": [\"2.4\"]}]'),(8004,'Disable&#x20;NIS&#x20;Client&#x20;Services','If&#x20;the&#x20;local&#x20;site&#x20;is&#x20;not&#x20;using&#x20;the&#x20;NIS&#x20;naming&#x20;service&#x20;to&#x20;distribute&#x20;system&#x20;and&#x20;user&#x20;configuration&#x20;information,&#x20;this&#x20;service&#x20;may&#x20;be&#x20;disabled.&#x20;This&#x20;service&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;unless&#x20;the&#x20;NIS&#x20;service&#x20;has&#x20;been&#x20;installed&#x20;and&#x20;configured&#x20;on&#x20;the&#x20;system.','As&#x20;RPC-based&#x20;services&#x20;such&#x20;as&#x20;NIS&#x20;may&#x20;use&#x20;non-secure&#x20;authentication&#x20;and&#x20;share&#x20;sensitive&#x20;network&#x20;object&#x20;information&#x20;with&#x20;systems&#x20;and&#x20;applications&#x20;using&#x20;RPC-based&#x20;service,&#x20;NIS&#x20;client&#x20;daemons&#x20;should&#x20;be&#x20;disabled.&#x20;Users&#x20;are&#x20;encouraged&#x20;to&#x20;use&#x20;LDAP&#x20;as&#x20;a&#x20;name&#x20;service&#x20;in&#x20;place&#x20;of&#x20;NIS.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/client&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/domain','[{\"cis\": [\"2.5\"]}]'),(8005,'Disable&#x20;Kerberos&#x20;TGT&#x20;Expiration&#x20;Warning','The&#x20;Kerberos&#x20;TGT&#x20;warning&#x20;service&#x20;is&#x20;used&#x20;to&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;Kerberos&#x20;tickets&#x20;are&#x20;about&#x20;expire&#x20;or&#x20;to&#x20;renew&#x20;those&#x20;tickets&#x20;before&#x20;they&#x20;expire.&#x20;This&#x20;service&#x20;is&#x20;not&#x20;used&#x20;if&#x20;Kerberos&#x20;has&#x20;not&#x20;been&#x20;configured.&#x20;This&#x20;service&#x20;is&#x20;configured&#x20;to&#x20;be&#x20;&quot;local&#x20;only&quot;&#x20;by&#x20;default.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/security/ktkt_warn','[{\"cis\": [\"2.6\"]}]'),(8006,'Disable&#x20;Generic&#x20;Security&#x20;Services&#x20;&#40;GSS&#41;','The&#x20;GSS&#x20;API&#x20;is&#x20;a&#x20;security&#x20;abstraction&#x20;layer&#x20;that&#x20;is&#x20;designed&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;developers&#x20;to&#x20;integrate&#x20;with&#x20;different&#x20;authentication&#x20;schemes.&#x20;It&#x20;is&#x20;most&#x20;commonly&#x20;used&#x20;in&#x20;applications&#x20;for&#x20;sites&#x20;that&#x20;use&#x20;Kerberos&#x20;for&#x20;network&#x20;authentication,&#x20;though&#x20;it&#x20;can&#x20;also&#x20;allow&#x20;applications&#x20;to&#x20;interoperate&#x20;with&#x20;other&#x20;authentication&#x20;schemes.','GSS&#x20;does&#x20;not&#x20;expose&#x20;anything&#x20;external&#x20;to&#x20;the&#x20;system&#x20;as&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;TLI&#x20;&#40;protocol&#x20;=&#x20;ticotsord&#41;&#x20;by&#x20;default.&#x20;This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/gss','[{\"cis\": [\"2.7\"]}]'),(8007,'Disable&#x20;Removable&#x20;Volume&#x20;Manager','The&#x20;HAL-aware&#x20;removable&#x20;volume&#x20;manager&#x20;in&#x20;the&#x20;Solaris&#x20;11&#x20;OS&#x20;automatically&#x20;mounts&#x20;external&#x20;devices&#x20;for&#x20;users&#x20;whenever&#x20;the&#x20;device&#x20;is&#x20;attached&#x20;to&#x20;the&#x20;system.&#x20;These&#x20;devices&#x20;include&#x20;CD-R,&#x20;CD-RW,&#x20;floppies,&#x20;DVD,&#x20;USB&#x20;and&#x20;1394&#x20;mass&#x20;storage&#x20;devices.&#x20;See&#x20;the&#x20;rmvolmgr&#40;1M&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;details.','Allowing&#x20;users&#x20;to&#x20;mount&#x20;and&#x20;access&#x20;data&#x20;from&#x20;removable&#x20;media&#x20;devices&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;malicious&#x20;programs&#x20;and&#x20;data&#x20;to&#x20;be&#x20;imported&#x20;onto&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;introduces&#x20;the&#x20;risk&#x20;that&#x20;sensitive&#x20;data&#x20;may&#x20;be&#x20;transferred&#x20;off&#x20;the&#x20;system&#x20;without&#x20;a&#x20;log&#x20;record.&#x20;By&#x20;adding&#x20;rmvolmgr&#x20;to&#x20;the&#x20;.xinitrc&#x20;file,&#x20;user-isolated&#x20;instances&#x20;of&#x20;rmvolmgr&#x20;can&#x20;be&#x20;run&#x20;via&#x20;a&#x20;session&#x20;startup&#x20;script.&#x20;In&#x20;such&#x20;cases,&#x20;the&#x20;rmvolmgr&#x20;instance&#x20;will&#x20;not&#x20;allow&#x20;management&#x20;of&#x20;volumes&#x20;that&#x20;belong&#x20;to&#x20;other&#x20;than&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;startup&#x20;script.&#x20;When&#x20;a&#x20;user&#x20;logs&#x20;onto&#x20;the&#x20;workstation&#x20;console&#x20;&#40;/dev/console&#41;,&#x20;any&#x20;instance&#x20;of&#x20;user-initiated&#x20;rmvolmgr&#x20;will&#x20;only&#x20;own&#x20;locally&#x20;connected&#x20;devices,&#x20;such&#x20;as&#x20;CD-ROMs&#x20;or&#x20;flash&#x20;memory&#x20;hardware,&#x20;locally&#x20;connected&#x20;to&#x20;USB&#x20;or&#x20;FireWire&#x20;ports.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/system/filesystem/rmvolmgr&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/smserver','[{\"cis\": [\"2.8\"]}]'),(8008,'Disable&#x20;automount&#x20;Service','The&#x20;automount&#x20;daemon&#x20;is&#x20;normally&#x20;used&#x20;to&#x20;automatically&#x20;mount&#x20;NFS&#x20;file&#x20;systems&#x20;from&#x20;remote&#x20;file&#x20;servers&#x20;when&#x20;needed.&#x20;However,&#x20;the&#x20;automount&#x20;daemon&#x20;can&#x20;also&#x20;be&#x20;configured&#x20;to&#x20;mount&#x20;local&#x20;&#40;loopback&#41;&#x20;file&#x20;systems&#x20;as&#x20;well,&#x20;which&#x20;may&#x20;include&#x20;local&#x20;user&#x20;home&#x20;directories,&#x20;depending&#x20;on&#x20;the&#x20;system&#x20;configuration.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/system/filesystem/autofs','[{\"cis\": [\"2.9\"]}]'),(8009,'Disable&#x20;Apache&#x20;Service','The&#x20;Apache&#x20;service&#x20;provides&#x20;an&#x20;instance&#x20;of&#x20;the&#x20;Apache&#x20;web&#x20;server.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/http:apache22','[{\"cis\": [\"2.10\"]}]'),(8010,'Disable&#x20;Local-only&#x20;RPC&#x20;Port&#x20;Mapping&#x20;Service','Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;is&#x20;used&#x20;by&#x20;many&#x20;services&#x20;within&#x20;the&#x20;Solaris&#x20;11&#x20;operating&#x20;system.&#x20;Some&#x20;of&#x20;these&#x20;services&#x20;allow&#x20;external&#x20;connections&#x20;to&#x20;use&#x20;the&#x20;service&#x20;&#40;e.g.&#x20;NFS,&#x20;NIS&#41;.&#x20;By&#x20;default,&#x20;the&#x20;Solaris&#x20;11&#x20;OS&#x20;configures&#x20;this&#x20;service&#x20;to&#x20;be&#x20;local&#x20;only.','RPC-based&#x20;services&#x20;typically&#x20;have&#x20;weak&#x20;or&#x20;non-existent&#x20;authentication&#x20;and&#x20;yet&#x20;may&#x20;share&#x20;very&#x20;sensitive&#x20;information,&#x20;which&#x20;is&#x20;vulnerable&#x20;to&#x20;network&#x20;traffic&#x20;sniffers.&#x20;Unless&#x20;one&#x20;of&#x20;these&#x20;services&#x20;is&#x20;required&#x20;on&#x20;this&#x20;host,&#x20;RPC-based&#x20;tools&#x20;should&#x20;be&#x20;fully&#x20;disabled.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/bind.&#x20;If&#x20;the&#x20;goal&#x20;is&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;this&#x20;service,&#x20;but&#x20;not&#x20;disable&#x20;it&#x20;completely,&#x20;consider&#x20;using&#x20;a&#x20;host-based&#x20;firewall&#x20;such&#x20;as&#x20;ipfilter&#40;5&#41;&#x20;to&#x20;control&#x20;what&#x20;hosts&#x20;are&#x20;allowed&#x20;to&#x20;access&#x20;this&#x20;service.&#x20;Alternatively,&#x20;TCP&#x20;Wrappers&#x20;support,&#x20;which&#x20;controls&#x20;host&#x20;access&#x20;and&#x20;connection&#x20;auditing,&#x20;can&#x20;be&#x20;enabled.&#x20;TCP&#x20;Wrappers&#x20;is&#x20;discussed&#x20;in&#x20;the&#x20;next&#x20;section.','[{\"cis\": [\"2.11\"]}]'),(8011,'Configure&#x20;TCP&#x20;Wrappers','TCP&#x20;Wrappers&#x20;is&#x20;a&#x20;host-based&#x20;access&#x20;control&#x20;system&#x20;that&#x20;allows&#x20;administrators&#x20;to&#x20;control&#x20;who&#x20;has&#x20;access&#x20;to&#x20;various&#x20;network&#x20;services&#x20;based&#x20;on&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;remote&#x20;end&#x20;of&#x20;the&#x20;connection.&#x20;TCP&#x20;Wrappers&#x20;also&#x20;provide&#x20;logging&#x20;information&#x20;via&#x20;syslog&#x20;about&#x20;both&#x20;successful&#x20;and&#x20;unsuccessful&#x20;connections.','TCP&#x20;Wrappers&#x20;provides&#x20;granular&#x20;control&#x20;over&#x20;what&#x20;services&#x20;can&#x20;be&#x20;accessed&#x20;over&#x20;the&#x20;network.&#x20;Its&#x20;logs&#x20;show&#x20;attempted&#x20;access&#x20;to&#x20;services&#x20;from&#x20;non-authorized&#x20;systems,&#x20;which&#x20;can&#x20;help&#x20;identify&#x20;unauthorized&#x20;access&#x20;attempts.','','To&#x20;enable&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;1.&#x20;Create&#x20;and&#x20;customize&#x20;your&#x20;policy&#x20;in&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;&#x20;/etc/hosts.allow.&#x20;Where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#40;for&#x20;example,&#x20;the&#x20;Class&#x20;C&#x20;address&#x20;block&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;can&#x20;represent&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.&#x20;2&#41;&#x20;Create&#x20;a&#x20;default&#x20;deny&#x20;policy&#x20;in&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;/etc/hosts.deny.&#x20;3&#41;&#x20;Enable&#x20;TCP&#x20;Wrappers&#x20;for&#x20;all&#x20;services&#x20;started&#x20;by&#x20;inetd:&#x20;#&#x20;inetadm&#x20;-M&#x20;tcp_wrappers=TRUE&#x20;-&#x20;To&#x20;protect&#x20;only&#x20;specific&#x20;inetd&#x20;services,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;inetadm&#x20;-m&#x20;[FMRI]&#x20;tcp_wrappers=TRUE.&#x20;To&#x20;enable&#x20;TCP&#x20;Wrappers&#x20;for&#x20;the&#x20;RPC&#x20;port&#x20;mapping&#x20;service,&#x20;use&#x20;the&#x20;commands:&#x20;#&#x20;svccfg&#x20;-s&#x20;rpc/bind&#x20;setprop&#x20;config/enable_tcpwrappers=true&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;refresh&#x20;rpc/bind.&#x20;The&#x20;versions&#x20;of&#x20;SSH&#x20;and&#x20;sendmail&#x20;that&#x20;ship&#x20;with&#x20;Solaris&#x20;11&#x20;will&#x20;automatically&#x20;use&#x20;TCP&#x20;Wrappers&#x20;to&#x20;filter&#x20;access&#x20;if&#x20;a&#x20;hosts.allow&#x20;or&#x20;hosts.deny&#x20;file&#x20;exists.&#x20;To&#x20;protect&#x20;UDP&#x20;and&#x20;RPC-based&#x20;services&#x20;that&#x20;are&#x20;spawned&#x20;from&#x20;inetd,&#x20;consider&#x20;implementing&#x20;a&#x20;host-based&#x20;firewall&#x20;such&#x20;as&#x20;Solaris&#x20;IP&#x20;Filter.&#x20;See&#x20;ipfilter&#40;5&#41;&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"2.12\"]}]'),(8012,'Disable&#x20;Telnet&#x20;Service','The&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol&#x20;and&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;shell&#x20;access.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;protocol&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Disable&#x20;telnet&#x20;server&#x20;if&#x20;enabled:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/telnet','[{\"cis\": [\"2.13\"]}]'),(8013,'Restrict&#x20;Core&#x20;Dumps&#x20;to&#x20;Protected&#x20;Directory','The&#x20;action&#x20;described&#x20;in&#x20;this&#x20;section&#x20;creates&#x20;a&#x20;protected&#x20;directory&#x20;to&#x20;store&#x20;core&#x20;dumps&#x20;and&#x20;also&#x20;causes&#x20;the&#x20;system&#x20;to&#x20;create&#x20;a&#x20;log&#x20;entry&#x20;whenever&#x20;a&#x20;regular&#x20;process&#x20;dumps&#x20;core.','Core&#x20;dumps,&#x20;particularly&#x20;those&#x20;from&#x20;set-UID&#x20;and&#x20;set-GID&#x20;processes,&#x20;may&#x20;contain&#x20;sensitive&#x20;data.','','To&#x20;implement&#x20;the&#x20;recommendation,&#x20;run&#x20;the&#x20;commands:&#x20;#&#x20;chmod&#x20;700&#x20;/var/cores&#x20;&#x20;&#x20;&#x20;#&#x20;coreadm&#x20;-g&#x20;/var/cores/core_%n_%f_%u_%g_%t_%p&#x20;-e&#x20;log&#x20;-e&#x20;global&#x20;-e&#x20;global-setid&#x20;-d&#x20;process&#x20;-d&#x20;proc-setid&#x20;&#x20;&#x20;&#x20;If&#x20;the&#x20;local&#x20;site&#x20;chooses,&#x20;dumping&#x20;of&#x20;core&#x20;files&#x20;can&#x20;be&#x20;completely&#x20;disabled&#x20;with&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;coreadm&#x20;-d&#x20;global&#x20;-d&#x20;global-setid&#x20;-d&#x20;process&#x20;-d&#x20;proc-setid','[{\"cis\": [\"3.1\"]}]'),(8014,'Enable&#x20;Stack&#x20;Protection','Buffer&#x20;overflow&#x20;exploits&#x20;have&#x20;been&#x20;the&#x20;basis&#x20;for&#x20;many&#x20;highly&#x20;publicized&#x20;compromises&#x20;and&#x20;defacements&#x20;of&#x20;large&#x20;numbers&#x20;of&#x20;Internet&#x20;connected&#x20;systems.&#x20;Many&#x20;of&#x20;the&#x20;automated&#x20;tools&#x20;in&#x20;use&#x20;by&#x20;system&#x20;attackers&#x20;exploit&#x20;well-known&#x20;buffer&#x20;overflow&#x20;problems&#x20;in&#x20;vendor-&#x20;supplied&#x20;and&#x20;third&#x20;party&#x20;software.','Enabling&#x20;stack&#x20;protection&#x20;prevents&#x20;certain&#x20;classes&#x20;of&#x20;buffer&#x20;overflow&#x20;attacks&#x20;and&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;enhancement.&#x20;However,&#x20;this&#x20;does&#x20;not&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;that&#x20;do&#x20;not&#x20;execute&#x20;code&#x20;on&#x20;the&#x20;stack&#x20;&#40;such&#x20;as&#x20;return-to-libc&#x20;exploits&#41;.&#x20;While&#x20;most&#x20;of&#x20;the&#x20;Solaris&#x20;OS&#x20;is&#x20;already&#x20;configured&#x20;to&#x20;employ&#x20;a&#x20;non-executable&#x20;stack,&#x20;this&#x20;setting&#x20;is&#x20;still&#x20;recommended&#x20;to&#x20;provide&#x20;a&#x20;more&#x20;comprehensive&#x20;solution&#x20;for&#x20;both&#x20;Solaris&#x20;and&#x20;other&#x20;software&#x20;that&#x20;may&#x20;be&#x20;installed.','','To&#x20;enable&#x20;stack&#x20;protection&#x20;and&#x20;block&#x20;stack-smashing&#x20;attacks,&#x20;run&#x20;the&#x20;following&#x20;to&#x20;edit&#x20;the&#x20;/etc/system&#x20;file:&#x20;#&#x20;if&#x20;[&#x20;!&#x20;&quot;`grep&#x20;noexec_user_stack=&#x20;/etc/system`&quot;&#x20;];&#x20;then&#x20;cat&#x20;&lt;&lt;END_CFG&#x20;&gt;&gt;/etc/system&#x20;set&#x20;noexec_user_stack=1&#x20;set&#x20;noexec_user_stack_log=1&#x20;END_CFG&#x20;fi','[{\"cis\": [\"3.2\"]}]'),(8015,'Enable&#x20;Strong&#x20;TCP&#x20;Sequence&#x20;Number&#x20;Generation','The&#x20;variable&#x20;TCP_STRONG_ISS&#x20;defines&#x20;the&#x20;mechanism&#x20;used&#x20;for&#x20;TCP&#x20;initial&#x20;sequence&#x20;number&#x20;generation.&#x20;If&#x20;an&#x20;attacker&#x20;can&#x20;predict&#x20;the&#x20;next&#x20;sequence&#x20;number,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;inject&#x20;fraudulent&#x20;packets&#x20;into&#x20;the&#x20;data&#x20;stream&#x20;to&#x20;hijack&#x20;the&#x20;session.','The&#x20;RFC&#x20;1948&#x20;method&#x20;is&#x20;widely&#x20;accepted&#x20;as&#x20;the&#x20;strongest&#x20;mechanism&#x20;for&#x20;TCP&#x20;packet&#x20;generation.&#x20;This&#x20;makes&#x20;remote&#x20;session&#x20;hijacking&#x20;attacks&#x20;more&#x20;difficult,&#x20;as&#x20;well&#x20;as&#x20;any&#x20;other&#x20;network-based&#x20;attack&#x20;that&#x20;relies&#x20;on&#x20;predicting&#x20;TCP&#x20;sequence&#x20;number&#x20;information.&#x20;It&#x20;is&#x20;theoretically&#x20;possible&#x20;that&#x20;there&#x20;may&#x20;be&#x20;a&#x20;small&#x20;performance&#x20;hit&#x20;in&#x20;connection&#x20;setup&#x20;time&#x20;when&#x20;this&#x20;setting&#x20;is&#x20;used,&#x20;but&#x20;there&#x20;are&#x20;no&#x20;publicly&#x20;available&#x20;benchmarks&#x20;that&#x20;establish&#x20;this.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;TCP_STRONG_ISS&#x20;parameter&#x20;to&#x20;use&#x20;RFC&#x20;1948&#x20;sequence&#x20;number&#x20;generation&#x20;in&#x20;the&#x20;/etc/default/inetinit&#x20;file:&#x20;#&#x20;cd&#x20;/etc/default&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/TCP_STRONG_ISS=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;TCP_STRONG_ISS=2&quot;&#x20;};&#x20;{&#x20;print&#x20;}&#039;&#x20;inetinit&#x20;&gt;&#x20;inetinit.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;inetinit.CIS&#x20;inetinit&#x20;&#x20;&#x20;&#x20;&#x20;To&#x20;set&#x20;the&#x20;TCP_STRONG_ISS&#x20;parameter&#x20;on&#x20;a&#x20;running&#x20;system,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_strong_iss=2&#x20;tcp','[{\"cis\": [\"3.3\"]}]'),(8016,'Create&#x20;CIS&#x20;Audit&#x20;Class','To&#x20;group&#x20;a&#x20;set&#x20;of&#x20;related&#x20;audit&#x20;events,&#x20;the&#x20;Solaris&#x20;Audit&#x20;service&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;sites&#x20;to&#x20;define&#x20;their&#x20;own&#x20;audit&#x20;classes&#x20;that&#x20;contain&#x20;just&#x20;those&#x20;events&#x20;that&#x20;the&#x20;site&#x20;wants&#x20;to&#x20;audit.','To&#x20;simplify&#x20;administration,&#x20;a&#x20;CIS&#x20;specific&#x20;audit&#x20;class&#x20;should&#x20;be&#x20;created.','','To&#x20;create&#x20;the&#x20;CIS&#x20;audit&#x20;class,&#x20;edit&#x20;the&#x20;/etc/security/audit_class&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;entry&#x20;before&#x20;the&#x20;last&#x20;line&#x20;of&#x20;the&#x20;file:&#x20;0x0100000000000000:cis:CIS&#x20;Solaris&#x20;Benchmark','[{\"cis\": [\"4.1\"]}]'),(8017,'Enable&#x20;Auditing&#x20;of&#x20;Incoming&#x20;Network&#x20;Connections','The&#x20;Solaris&#x20;Audit&#x20;service&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;incoming&#x20;network&#x20;connections&#x20;to&#x20;any&#x20;listening&#x20;service&#x20;running&#x20;on&#x20;the&#x20;system.','This&#x20;recommendation&#x20;will&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;that&#x20;contains&#x20;information&#x20;related&#x20;to&#x20;incoming&#x20;network&#x20;connections.&#x20;While&#x20;this&#x20;functionality&#x20;can&#x20;be&#x20;enabled&#x20;using&#x20;service-&#x20;specific&#x20;mechanisms,&#x20;using&#x20;the&#x20;Solaris&#x20;Audit&#x20;service&#x20;provides&#x20;a&#x20;more&#x20;centralized&#x20;and&#x20;complete&#x20;window&#x20;into&#x20;incoming&#x20;network&#x20;activity.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;edit&#x20;the&#x20;/etc/security/audit_event&#x20;file&#x20;and&#x20;add&#x20;the&#x20;cis&#x20;audit&#x20;class&#x20;to&#x20;the&#x20;following&#x20;audit&#x20;events:&#x20;AUE_ACCEPT&#x20;&#x20;&#x20;&#x20;AUE_CONNECT&#x20;&#x20;&#x20;&#x20;AUE_SOCKACCEPT&#x20;&#x20;&#x20;&#x20;AUE_SOCKCONNECT&#x20;&#x20;&#x20;&#x20;AUE_inetd_connect','[{\"cis\": [\"4.2\"]}]'),(8018,'Enable&#x20;Auditing&#x20;of&#x20;File&#x20;Metadata&#x20;Modification&#x20;Events','The&#x20;Solaris&#x20;Audit&#x20;service&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;file&#x20;metadata&#x20;modification&#x20;events&#x20;for&#x20;every&#x20;process&#x20;running&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;will&#x20;allow&#x20;the&#x20;auditing&#x20;service&#x20;to&#x20;determine&#x20;when&#x20;file&#x20;ownership,&#x20;permissions&#x20;and&#x20;related&#x20;information&#x20;is&#x20;changed.','This&#x20;recommendation&#x20;will&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;that&#x20;contains&#x20;information&#x20;related&#x20;to&#x20;changes&#x20;of&#x20;file&#x20;metadata.&#x20;The&#x20;Solaris&#x20;Audit&#x20;service&#x20;is&#x20;used&#x20;to&#x20;provide&#x20;a&#x20;more&#x20;centralized&#x20;and&#x20;complete&#x20;window&#x20;into&#x20;activities&#x20;such&#x20;as&#x20;these.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;edit&#x20;the&#x20;/etc/security/audit_event&#x20;file&#x20;and&#x20;add&#x20;the&#x20;cis&#x20;audit&#x20;class&#x20;to&#x20;the&#x20;following&#x20;audit&#x20;events:&#x20;AUE_CHMOD&#x20;&#x20;&#x20;&#x20;AUE_CHOWN&#x20;&#x20;&#x20;&#x20;AUE_FCHOWN&#x20;&#x20;&#x20;&#x20;AUE_FCHMOD&#x20;&#x20;&#x20;&#x20;AUE_LCHOWN&#x20;&#x20;&#x20;&#x20;AUE_ACLSET&#x20;&#x20;&#x20;&#x20;AUE_FACLSET','[{\"cis\": [\"4.3\"]}]'),(8019,'Enable&#x20;Auditing&#x20;of&#x20;Process&#x20;and&#x20;Privilege&#x20;Events','The&#x20;Solaris&#x20;Audit&#x20;service&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;the&#x20;use&#x20;of&#x20;privileges&#x20;by&#x20;processes&#x20;running&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;will&#x20;capture&#x20;events&#x20;such&#x20;as&#x20;the&#x20;setting&#x20;of&#x20;UID&#x20;and&#x20;GID&#x20;values,&#x20;setting&#x20;of&#x20;privileges,&#x20;as&#x20;well&#x20;as&#x20;the&#x20;use&#x20;of&#x20;functionality&#x20;such&#x20;as&#x20;chroot&#40;2&#41;.','This&#x20;recommendation&#x20;will&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;that&#x20;contains&#x20;information&#x20;related&#x20;to&#x20;the&#x20;use&#x20;of&#x20;privileges&#x20;by&#x20;processes&#x20;running&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;Solaris&#x20;Audit&#x20;service&#x20;is&#x20;used&#x20;to&#x20;provide&#x20;a&#x20;more&#x20;centralized&#x20;and&#x20;complete&#x20;window&#x20;into&#x20;activities&#x20;such&#x20;as&#x20;these.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;edit&#x20;the&#x20;/etc/security/audit_event&#x20;file&#x20;and&#x20;add&#x20;the&#x20;cis&#x20;audit&#x20;class&#x20;to&#x20;the&#x20;following&#x20;audit&#x20;events:&#x20;AUE_CHROOT&#x20;&#x20;&#x20;&#x20;AUE_SETREUID&#x20;&#x20;&#x20;&#x20;AUE_SETREGID&#x20;&#x20;&#x20;&#x20;AUE_FCHROOT&#x20;&#x20;&#x20;&#x20;AUE_PFEXEC&#x20;&#x20;&#x20;&#x20;AUE_SETUID&#x20;&#x20;&#x20;&#x20;AUE_NICE&#x20;&#x20;&#x20;&#x20;AUE_SETGID&#x20;&#x20;&#x20;&#x20;AUE_PRIOCNTLSYS&#x20;&#x20;&#x20;&#x20;AUE_SETEGID&#x20;&#x20;&#x20;&#x20;AUE_SETEUID&#x20;&#x20;&#x20;&#x20;AUE_SETPPRIV&#x20;&#x20;&#x20;&#x20;AUE_SETSID&#x20;&#x20;&#x20;&#x20;AUE_SETPGID','[{\"cis\": [\"4.4\"]}]'),(8020,'Configure&#x20;Solaris&#x20;Auditing','Solaris&#x20;auditing&#x20;service&#x20;keeps&#x20;a&#x20;record&#x20;of&#x20;how&#x20;a&#x20;system&#x20;is&#x20;being&#x20;used.&#x20;Solaris&#x20;auditing&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;different&#x20;classes&#x20;of&#x20;events&#x20;based&#x20;upon&#x20;site&#x20;policy.&#x20;This&#x20;recommendation&#x20;will&#x20;set&#x20;and&#x20;verify&#x20;a&#x20;consensus-developed&#x20;auditing&#x20;policy.&#x20;That&#x20;said,&#x20;all&#x20;organizations&#x20;are&#x20;encouraged&#x20;to&#x20;tailor&#x20;this&#x20;policy&#x20;based&#x20;upon&#x20;their&#x20;specific&#x20;needs.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;the&#x20;Solaris&#x20;auditing&#x20;service&#x20;including&#x20;how&#x20;to&#x20;filter&#x20;and&#x20;view&#x20;events,&#x20;see&#x20;the&#x20;Oracle&#x20;Solaris&#x20;product&#x20;documentation.&#x20;The&#x20;&quot;cis&quot;&#x20;class&#x20;is&#x20;a&#x20;&quot;custom&#x20;class&quot;&#x20;that&#x20;CIS&#x20;recommends&#x20;creating&#x20;that&#x20;includes&#x20;specifically&#x20;those&#x20;events&#x20;that&#x20;are&#x20;of&#x20;interest&#x20;&#40;defined&#x20;in&#x20;the&#x20;sections&#x20;above&#41;.&#x20;In&#x20;addition&#x20;to&#x20;those&#x20;events,&#x20;this&#x20;recommendation&#x20;also&#x20;includes&#x20;auditing&#x20;of&#x20;login&#x20;and&#x20;logout&#x20;&#40;lo&#41;&#x20;events,&#x20;administrative&#x20;&#40;ad&#41;&#x20;events,&#x20;file&#x20;transfer&#x20;&#40;ft&#41;&#x20;events,&#x20;and&#x20;command&#x20;execution&#x20;&#40;ex&#41;&#x20;events.&#x20;This&#x20;recommendation&#x20;also&#x20;configures&#x20;the&#x20;Solaris&#x20;auditing&#x20;service&#x20;to&#x20;capture&#x20;and&#x20;report&#x20;command&#x20;line&#x20;arguments&#x20;&#40;for&#x20;command&#x20;execution&#x20;events&#41;&#x20;and&#x20;the&#x20;zone&#x20;name&#x20;in&#x20;which&#x20;a&#x20;command&#x20;was&#x20;executed&#x20;&#40;for&#x20;global&#x20;and&#x20;non-global&#x20;zones&#41;.&#x20;Further,&#x20;this&#x20;recommendation&#x20;sets&#x20;a&#x20;disk&#x20;utilization&#x20;threshold&#x20;of&#x20;1%.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x20;crossed&#x20;&#40;for&#x20;the&#x20;volume&#x20;that&#x20;includes&#x20;/var/audit&#41;,&#x20;then&#x20;a&#x20;warning&#x20;e-mail&#x20;will&#x20;be&#x20;sent&#x20;to&#x20;advise&#x20;the&#x20;system&#x20;administrators&#x20;that&#x20;audit&#x20;events&#x20;may&#x20;be&#x20;lost&#x20;if&#x20;the&#x20;disk&#x20;becomes&#x20;full.&#x20;Finally,&#x20;this&#x20;recommendation&#x20;will&#x20;also&#x20;ensure&#x20;that&#x20;new&#x20;audit&#x20;trails&#x20;are&#x20;created&#x20;at&#x20;the&#x20;start&#x20;of&#x20;each&#x20;new&#x20;day&#x20;&#40;to&#x20;help&#x20;keep&#x20;the&#x20;size&#x20;of&#x20;the&#x20;files&#x20;small&#x20;to&#x20;facilitate&#x20;analysis&#41;.','The&#x20;consensus&#x20;settings&#x20;described&#x20;in&#x20;this&#x20;section&#x20;are&#x20;an&#x20;effort&#x20;to&#x20;log&#x20;interesting&#x20;system&#x20;events&#x20;without&#x20;consuming&#x20;excessive&#x20;amounts&#x20;of&#x20;resources&#x20;logging&#x20;significant&#x20;but&#x20;usually&#x20;uninteresting&#x20;system&#x20;calls.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;auditconfig&#x20;-conf&#x20;&#x20;&#x20;&#x20;#&#x20;auditconfig&#x20;-setflags&#x20;lo,ad,ft,ex,cis&#x20;&#x20;&#x20;&#x20;#&#x20;auditconfig&#x20;-setnaflags&#x20;lo&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;auditconfig&#x20;-setpolicy&#x20;cnt,argv,zonename&#x20;&#x20;&#x20;&#x20;#&#x20;auditconfig&#x20;-setplugin&#x20;audit_binfile&#x20;active&#x20;p_minfree=1&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;audit&#x20;-s&#x20;&#x20;&#x20;&#x20;#&#x20;rolemod&#x20;-K&#x20;audit_flags=lo,ad,ft,ex,cis:no&#x20;root&#x20;&#x20;&#x20;&#x20;#&#x20;EDITOR=ed&#x20;crontab&#x20;-e&#x20;root&#x20;&lt;&lt;&#x20;END_CRON&#x20;$&#x20;a&#x20;0&#x20;*&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/audit&#x20;-n&#x20;.&#x20;&#x20;w&#x20;q&#x20;END_CRON&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/var/audit&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;750&#x20;/var/audit','[{\"cis\": [\"4.5\"]}]'),(8021,'Default&#x20;Service&#x20;File&#x20;Creation&#x20;Mask','The&#x20;default&#x20;system&#x20;file&#x20;creation&#x20;mask&#x20;applies&#x20;to&#x20;processes&#x20;that&#x20;are&#x20;started&#x20;by&#x20;init&#x20;-&#x20;including&#x20;most&#x20;system&#x20;services.&#x20;To&#x20;ensure&#x20;that&#x20;files&#x20;are&#x20;not&#x20;created&#x20;with&#x20;write&#x20;access&#x20;to&#x20;anyone&#x20;other&#x20;than&#x20;their&#x20;owner,&#x20;the&#x20;default&#x20;file&#x20;creation&#x20;mask&#x20;should&#x20;be&#x20;set&#x20;to&#x20;022.&#x20;Some&#x20;sites&#x20;with&#x20;more&#x20;stringent&#x20;security&#x20;requirements&#x20;may&#x20;prefer&#x20;to&#x20;set&#x20;this&#x20;value&#x20;to&#x20;077&#x20;to&#x20;eliminate&#x20;all&#x20;permissions&#x20;for&#x20;group&#x20;and&#x20;world.&#x20;Note&#x20;that&#x20;changing&#x20;this&#x20;value&#x20;from&#x20;the&#x20;Solaris&#x20;default&#x20;of&#x20;022&#x20;may&#x20;negatively&#x20;impact&#x20;services&#x20;that&#x20;may&#x20;not&#x20;be&#x20;able&#x20;to&#x20;operate&#x20;with&#x20;a&#x20;stricter&#x20;setting.','The&#x20;default&#x20;file&#x20;creation&#x20;mask&#x20;should&#x20;be&#x20;set&#x20;to&#x20;022&#x20;to&#x20;avoid&#x20;unnecessarily&#x20;giving&#x20;files&#x20;write&#x20;access&#x20;to&#x20;group&#x20;or&#x20;world.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;&#x20;#&#x20;svccfg&#x20;-s&#x20;svc:/system/environment:init&#x20;setprop&#x20;umask/umask&#x20;=&#x20;astring:&#x20;&quot;022&quot;','[{\"cis\": [\"5.1\"]}]'),(8022,'Disable&#x20;&quot;nobody&quot;&#x20;Access&#x20;for&#x20;RPC&#x20;Encryption&#x20;Key&#x20;Storage&#x20;Service','This&#x20;action&#x20;listed&#x20;prevents&#x20;keyserv&#x20;from&#x20;using&#x20;default&#x20;keys&#x20;for&#x20;the&#x20;nobody&#x20;user,&#x20;effectively&#x20;stopping&#x20;the&#x20;nobody&#x20;user&#x20;from&#x20;accessing&#x20;information&#x20;via&#x20;Secure&#x20;RPC.','If&#x20;login&#x20;by&#x20;the&#x20;user&#x20;nobody&#x20;is&#x20;allowed&#x20;for&#x20;secure&#x20;RPC,&#x20;there&#x20;is&#x20;an&#x20;increased&#x20;risk&#x20;of&#x20;system&#x20;compromise.&#x20;If&#x20;keyserv&#x20;holds&#x20;a&#x20;private&#x20;key&#x20;for&#x20;the&#x20;nobody&#x20;user,&#x20;it&#x20;will&#x20;be&#x20;used&#x20;by&#x20;key_encryptsession&#x20;to&#x20;compute&#x20;a&#x20;magic&#x20;phrase&#x20;which&#x20;can&#x20;be&#x20;easily&#x20;recovered&#x20;by&#x20;a&#x20;malicious&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;#&#x20;awk&#x20;&#039;/ENABLE_NOBODY_KEYS=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;ENABLE_NOBODY_KEYS=NO&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;keyserv&#x20;&gt;&#x20;keyserv.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;keyserv.CIS&#x20;keyserv','[{\"cis\": [\"6.2\"]}]'),(8023,'Disable&#x20;X11&#x20;Forwarding&#x20;for&#x20;SSH','The&#x20;&#039;X11&#x20;Forwarding&#039;&#x20;parameter&#x20;defined&#x20;within&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;specifies&#x20;whether&#x20;or&#x20;not&#x20;X11&#x20;Forwarding&#x20;via&#x20;SSH&#x20;is&#x20;enabled&#x20;on&#x20;the&#x20;server:&#x20;The&#x20;Secure&#x20;Shell&#x20;service&#x20;provides&#x20;an&#x20;encrypted&#x20;&#039;tunnel&#039;&#x20;for&#x20;the&#x20;data&#x20;traffic&#x20;passing&#x20;through&#x20;it.&#x20;While&#x20;commonly&#x20;used&#x20;to&#x20;substitute&#x20;for&#x20;clear-text,&#x20;CLI-based&#x20;remote&#x20;connections&#x20;such&#x20;as&#x20;telnet,&#x20;Secure&#x20;Shell&#x20;can&#x20;be&#x20;used&#x20;to&#x20;forward&#x20;an&#x20;&#039;X&#x20;Window&#039;&#x20;session&#x20;through&#x20;the&#x20;encrypted&#x20;tunnel,&#x20;allowing&#x20;the&#x20;remote&#x20;user&#x20;to&#x20;have&#x20;a&#x20;GUI&#x20;interface.','As&#x20;enabling&#x20;X11Forwarding&#x20;on&#x20;the&#x20;host&#x20;can&#x20;permit&#x20;a&#x20;malicious&#x20;user&#x20;to&#x20;secretly&#x20;open&#x20;another&#x20;X11&#x20;connection&#x20;to&#x20;another&#x20;remote&#x20;client&#x20;during&#x20;the&#x20;session&#x20;and&#x20;perform&#x20;unobtrusive&#x20;activities&#x20;such&#x20;as&#x20;keystroke&#x20;monitoring,&#x20;if&#x20;the&#x20;X11&#x20;services&#x20;are&#x20;not&#x20;required&#x20;for&#x20;the&#x20;system&#039;s&#x20;intended&#x20;function,&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;or&#x20;restricted&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;user&#039;s&#x20;needs.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;awk&#x20;&#039;/^X11Forwarding&#x20;/&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/ssh/sshd_config&#x20;&gt;&#x20;/etc/ssh/sshd_config.CIS&#x20;#&#x20;mv&#x20;/etc/ssh/sshd_config.CIS&#x20;/etc/ssh/sshd_config&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.3\"]}]'),(8024,'Limit&#x20;Consecutive&#x20;Login&#x20;Attempts&#x20;for&#x20;SSH','The&#x20;&#039;MaxAuthTries&#039;&#x20;parameter&#x20;in&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;By&#x20;restricting&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;authentication&#x20;attempts&#x20;before&#x20;the&#x20;server&#x20;terminates&#x20;the&#x20;connection,&#x20;malicious&#x20;users&#x20;are&#x20;blocked&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;host&#x20;by&#x20;using&#x20;repetitive&#x20;brute-force&#x20;login&#x20;exploits.','By&#x20;setting&#x20;the&#x20;authentication&#x20;login&#x20;limit&#x20;to&#x20;a&#x20;low&#x20;value&#x20;this&#x20;will&#x20;disconnect&#x20;the&#x20;attacker&#x20;and&#x20;force&#x20;a&#x20;reconnect,&#x20;which&#x20;severely&#x20;limits&#x20;the&#x20;speed&#x20;of&#x20;such&#x20;brute&#x20;force&#x20;attacks.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;awk&#x20;&#039;/^MaxAuthTries/&#x20;{&#x20;$2&#x20;=&#x20;&quot;3&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/ssh/sshd_config&#x20;&gt;&#x20;/etc/ssh/sshd_config.CIS&#x20;#&#x20;mv&#x20;/etc/ssh/sshd_config.CIS&#x20;/etc/ssh/sshd_config&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.4\"]}]'),(8025,'Disable&#x20;Rhost-based&#x20;Authentication&#x20;for&#x20;SSH','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;existing&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files,&#x20;which&#x20;may&#x20;apply&#x20;to&#x20;application&#x20;rather&#x20;than&#x20;user&#x20;logins,&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;SSH.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;awk&#x20;&#039;/^IgnoreRhosts/&#x20;{&#x20;$2&#x20;=&#x20;&quot;yes&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/ssh/sshd_config&#x20;&gt;&#x20;/etc/ssh/sshd_config.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;/etc/ssh/sshd_config.CIS&#x20;/etc/ssh/sshd_config&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh&#x20;&#x20;&#x20;&#x20;This&#x20;action&#x20;will&#x20;only&#x20;set&#x20;the&#x20;IgnoreRhosts&#x20;line&#x20;if&#x20;it&#x20;already&#x20;exists&#x20;in&#x20;the&#x20;file&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;set&#x20;to&#x20;the&#x20;proper&#x20;value.&#x20;If&#x20;the&#x20;IgnoreRhosts&#x20;line&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;the&#x20;file,&#x20;the&#x20;default&#x20;setting&#x20;of&#x20;Yes&#x20;is&#x20;automatically&#x20;used,&#x20;so&#x20;no&#x20;additional&#x20;changes&#x20;are&#x20;needed.','[{\"cis\": [\"6.5\"]}]'),(8026,'Disable&#x20;root&#x20;login&#x20;for&#x20;SSH','The&#x20;PermitRootLogin&#x20;value&#x20;&#40;in&#x20;/etc/ssh/sshd_config&#41;&#x20;allows&#x20;for&#x20;direct&#x20;root&#x20;login&#x20;by&#x20;a&#x20;remote&#x20;user/application&#x20;to&#x20;resources&#x20;on&#x20;the&#x20;local&#x20;host.','By&#x20;default,&#x20;it&#x20;is&#x20;not&#x20;possible&#x20;for&#x20;the&#x20;root&#x20;account&#x20;to&#x20;log&#x20;directly&#x20;into&#x20;the&#x20;system&#x20;console&#x20;because&#x20;the&#x20;account&#x20;is&#x20;configured&#x20;as&#x20;a&#x20;role.&#x20;This&#x20;setting&#x20;therefore&#x20;does&#x20;not&#x20;significantly&#x20;alter&#x20;the&#x20;security&#x20;posture&#x20;of&#x20;the&#x20;system&#x20;unless&#x20;the&#x20;root&#x20;account&#x20;is&#x20;changed&#x20;from&#x20;this&#x20;default&#x20;and&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;normal&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;awk&#x20;&#039;/^PermitRootLogin/&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/ssh/sshd_config&#x20;&gt;&#x20;/etc/ssh/sshd_config.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;/etc/ssh/sshd_config.CIS&#x20;/etc/ssh/sshd_config&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.6\"]}]'),(8027,'Blocking&#x20;Authentication&#x20;Using&#x20;Empty/Null&#x20;Passwords&#x20;for&#x20;SSH','The&#x20;PermitEmptyPasswords&#x20;value&#x20;allows&#x20;for&#x20;direct&#x20;login&#x20;through&#x20;SSH&#x20;without&#x20;a&#x20;password&#x20;by&#x20;a&#x20;remote&#x20;user/application&#x20;to&#x20;resources&#x20;on&#x20;the&#x20;local&#x20;host&#x20;in&#x20;the&#x20;same&#x20;way&#x20;a&#x20;standard&#x20;remote&#x20;login&#x20;would.','Permitting&#x20;login&#x20;without&#x20;a&#x20;password&#x20;is&#x20;inherently&#x20;risky.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;awk&#x20;&#039;/^PermitEmptyPasswords/&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/ssh/sshd_config&#x20;&gt;&#x20;/etc/ssh/sshd_config.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;/etc/ssh/sshd_config.CIS&#x20;/etc/ssh/sshd_config&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.7\"]}]'),(8028,'Disable&#x20;Host-based&#x20;Authentication&#x20;for&#x20;Login-based&#x20;Services','The&#x20;.rhosts&#x20;files&#x20;are&#x20;used&#x20;for&#x20;automatic&#x20;login&#x20;to&#x20;remote&#x20;hosts&#x20;and&#x20;contain&#x20;username&#x20;and&#x20;hostname&#x20;combinations.&#x20;The&#x20;.rhosts&#x20;files&#x20;are&#x20;unencrypted&#x20;&#40;usually&#x20;group-&#x20;or&#x20;world-&#x20;readable&#41;&#x20;and&#x20;present&#x20;a&#x20;serious&#x20;risk&#x20;in&#x20;that&#x20;a&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;the&#x20;information&#x20;within&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;a&#x20;remote&#x20;host&#x20;with&#x20;the&#x20;privileges&#x20;of&#x20;the&#x20;original&#x20;application&#x20;or&#x20;user.','The&#x20;use&#x20;of&#x20;.rhosts&#x20;authentication&#x20;is&#x20;an&#x20;old&#x20;and&#x20;insecure&#x20;protocol&#x20;and&#x20;can&#x20;be&#x20;replaced&#x20;with&#x20;public-key&#x20;authentication&#x20;using&#x20;Secure&#x20;Shell.&#x20;As&#x20;automatic&#x20;authentication&#x20;settings&#x20;in&#x20;the&#x20;.rhosts&#x20;files&#x20;can&#x20;provide&#x20;a&#x20;malicious&#x20;user&#x20;with&#x20;sensitive&#x20;system&#x20;credentials,&#x20;the&#x20;use&#x20;of&#x20;.rhosts&#x20;files&#x20;should&#x20;be&#x20;disabled.&#x20;It&#x20;should&#x20;be&#x20;noted&#x20;that&#x20;by&#x20;default&#x20;the&#x20;Solaris&#x20;services&#x20;that&#x20;use&#x20;this&#x20;file,&#x20;including&#x20;rsh&#x20;and&#x20;rlogin,&#x20;are&#x20;disabled&#x20;by&#x20;default.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc&#x20;&#x20;&#x20;&#x20;#&#x20;cp&#x20;pam.conf&#x20;pam.conf.pre-CIS&#x20;&#x20;&#x20;&#x20;#&#x20;sed&#x20;-e&#x20;&#039;s/^.*pam_rhosts_auth/#&amp;/&#039;&#x20;&lt;&#x20;/etc/pam.conf&#x20;&gt;&#x20;pam.conf.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;pam.conf.CIS&#x20;pam.conf','[{\"cis\": [\"6.8\"]}]'),(8029,'Set&#x20;Delay&#x20;between&#x20;Failed&#x20;Login&#x20;Attempts&#x20;to&#x20;4','The&#x20;SLEEPTIME&#x20;variable&#x20;in&#x20;the&#x20;/etc/default/login&#x20;file&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;seconds&#x20;to&#x20;wait&#x20;before&#x20;printing&#x20;the&#x20;&quot;login&#x20;incorrect&quot;&#x20;message&#x20;when&#x20;a&#x20;bad&#x20;password&#x20;is&#x20;provided.','As&#x20;an&#x20;immediate&#x20;return&#x20;of&#x20;an&#x20;error&#x20;message,&#x20;coupled&#x20;with&#x20;the&#x20;capability&#x20;to&#x20;try&#x20;again&#x20;may&#x20;facilitate&#x20;automatic&#x20;and&#x20;rapid-fire&#x20;brute-force&#x20;password&#x20;attacks&#x20;by&#x20;a&#x20;malicious&#x20;user,&#x20;this&#x20;delay&#x20;time&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;#&#x20;awk&#x20;&#039;/SLEEPTIME=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;SLEEPTIME=4&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;login&#x20;&gt;&#x20;login.CIS&#x20;#&#x20;mv&#x20;login.CIS&#x20;login','[{\"cis\": [\"6.10\"]}]'),(8030,'Remove&#x20;Autologin&#x20;Capabilities&#x20;from&#x20;the&#x20;GNOME&#x20;desktop','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;used&#x20;for&#x20;login&#x20;session&#x20;management.&#x20;See&#x20;the&#x20;manual&#x20;page&#x20;gdm&#40;1&#41;&#x20;for&#x20;more&#x20;information.&#x20;By&#x20;default,&#x20;GNOME&#x20;automatic&#x20;login&#x20;is&#x20;defined&#x20;in&#x20;pam.conf&#40;4&#41;&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;access&#x20;the&#x20;system&#x20;without&#x20;a&#x20;password.','As&#x20;automatic&#x20;logins&#x20;are&#x20;a&#x20;known&#x20;security&#x20;risk&#x20;for&#x20;other&#x20;than&#x20;&quot;kiosk&quot;&#x20;types&#x20;of&#x20;systems,&#x20;GNOME&#x20;automatic&#x20;login&#x20;should&#x20;be&#x20;disabled&#x20;in&#x20;pam.conf&#40;4&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/^gdm-autologin/&#x20;{&#x20;$1=&quot;&#x20;&#x20;&#x20;#gdm-autologin&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/pam.conf&#x20;&gt;&#x20;/etc/pam.conf.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;pam.conf.CIS&#x20;pam.conf','[{\"cis\": [\"6.11\"]}]'),(8031,'Set&#x20;Default&#x20;Screen&#x20;Lock&#x20;for&#x20;GNOME&#x20;Users','The&#x20;timeout&#x20;parameter&#x20;dictates&#x20;the&#x20;invocation&#x20;of&#x20;a&#x20;password-protected&#x20;screen&#x20;saver&#x20;after&#x20;a&#x20;specified&#x20;time&#x20;of&#x20;keyboard&#x20;and&#x20;mouse&#x20;inactivity,&#x20;specific&#x20;to&#x20;the&#x20;xscreensaver&#x20;application&#x20;used&#x20;in&#x20;the&#x20;GNOME&#x20;windowing&#x20;environment.','As&#x20;a&#x20;screensaver&#x20;timeout&#x20;provides&#x20;protection&#x20;for&#x20;a&#x20;desktop&#x20;that&#x20;has&#x20;not&#x20;been&#x20;locked&#x20;by&#x20;the&#x20;user&#x20;upon&#x20;his/her&#x20;departure,&#x20;to&#x20;help&#x20;prevent&#x20;session&#x20;hijacking,&#x20;this&#x20;value&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/usr/share/X11/app-defaults&#x20;&#x20;&#x20;&#x20;#&#x20;cp&#x20;XScreenSaver&#x20;XScreenSaver.orig&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/^*timeout:/&#x20;{&#x20;$2&#x20;=&#x20;&quot;0:10:00&quot;&#x20;}&#x20;/^*lockTimeout:/&#x20;{&#x20;$2&#x20;=&#x20;&quot;0:00:00&quot;&#x20;}&#x20;/^*lock:/&#x20;{&#x20;$2&#x20;=&#x20;&quot;True&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;xScreenSaver&#x20;&gt;&#x20;xScreenSaver.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;xScreenSaver.CIS&#x20;xScreenSaver','[{\"cis\": [\"6.12\"]}]'),(8032,'Restrict&#x20;at/cron&#x20;to&#x20;Authorized&#x20;Users','The&#x20;cron.allow&#x20;and&#x20;at.allow&#x20;files&#x20;contain&#x20;a&#x20;list&#x20;of&#x20;users&#x20;who&#x20;are&#x20;allowed&#x20;to&#x20;run&#x20;the&#x20;crontab&#x20;and&#x20;at&#x20;commands&#x20;to&#x20;submit&#x20;jobs&#x20;to&#x20;be&#x20;run&#x20;at&#x20;scheduled&#x20;intervals.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;needs&#x20;the&#x20;ability&#x20;to&#x20;schedule&#x20;jobs.&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.&#x20;Much&#x20;more&#x20;effective&#x20;access&#x20;controls&#x20;for&#x20;the&#x20;cron&#x20;system&#x20;can&#x20;be&#x20;obtained&#x20;by&#x20;using&#x20;Role-Based&#x20;Access&#x20;Controls&#x20;&#40;RBAC&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/cron.d&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;cron.deny&#x20;cron.deny.cis&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;at.deny&#x20;at.deny.cis&#x20;&#x20;&#x20;&#x20;#&#x20;echo&#x20;root&#x20;&gt;&#x20;cron.allow&#x20;&#x20;&#x20;&#x20;#&#x20;cp&#x20;/dev/null&#x20;at.allow&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;cron.allow&#x20;at.allow&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;400&#x20;cron.allow&#x20;at.allow','[{\"cis\": [\"6.13\"]}]'),(8033,'Restrict&#x20;root&#x20;Login&#x20;to&#x20;System&#x20;Console','Privileged&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;root&#x20;must&#x20;be&#x20;accountable&#x20;to&#x20;a&#x20;particular&#x20;user.','Use&#x20;an&#x20;authorized&#x20;mechanism&#x20;such&#x20;as&#x20;RBAC&#x20;and&#x20;the&#x20;su&#x20;command&#x20;to&#x20;provide&#x20;administrative&#x20;access&#x20;to&#x20;unprivileged&#x20;accounts.&#x20;These&#x20;mechanisms&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;problems.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;#&#x20;awk&#x20;&#039;/CONSOLE=/&#x20;{&#x20;print&#x20;&quot;CONSOLE=/dev/console&quot;;&#x20;next&#x20;};&#x20;{&#x20;print&#x20;}&#039;&#x20;login&#x20;&gt;&#x20;login.CIS&#x20;#&#x20;mv&#x20;login.CIS&#x20;login','[{\"cis\": [\"6.14\"]}]'),(8034,'Set&#x20;Retry&#x20;Limit&#x20;for&#x20;Account&#x20;Lockout','The&#x20;RETRIES&#x20;parameter&#x20;is&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;a&#x20;user&#x20;is&#x20;allowed&#x20;before&#x20;being&#x20;disconnected&#x20;from&#x20;the&#x20;system&#x20;and&#x20;forced&#x20;to&#x20;reconnect.&#x20;When&#x20;LOCK_AFTER_RETRIES&#x20;is&#x20;set&#x20;in&#x20;/etc/security/policy.conf,&#x20;then&#x20;the&#x20;user&#039;s&#x20;account&#x20;is&#x20;locked&#x20;after&#x20;this&#x20;many&#x20;failed&#x20;retries&#x20;&#40;the&#x20;account&#x20;can&#x20;only&#x20;be&#x20;unlocked&#x20;by&#x20;the&#x20;administrator&#x20;using&#x20;the&#x20;command:&#x20;passwd&#x20;-u&#x20;&lt;username&gt;&#41;.&#x20;The&#x20;account&#x20;lockout&#x20;threshold&#x20;&#40;RETRIES&#x20;parameter&#41;&#x20;restricts&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;allowed&#x20;before&#x20;requiring&#x20;the&#x20;offending&#x20;account&#x20;be&#x20;locked.&#x20;The&#x20;lockout&#x20;requirement&#x20;will&#x20;help&#x20;block&#x20;malicious&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;host&#x20;via&#x20;automated,&#x20;repetitive&#x20;brute-force&#x20;login&#x20;exploits--trying&#x20;different&#x20;passwords&#x20;until&#x20;one&#x20;fits&#x20;a&#x20;user&#x20;name.','Setting&#x20;the&#x20;failed&#x20;login&#x20;limit&#x20;to&#x20;an&#x20;appropriate&#x20;value&#x20;locks&#x20;the&#x20;user&#x20;account,&#x20;which&#x20;will&#x20;severely&#x20;limit&#x20;the&#x20;speed&#x20;of&#x20;such&#x20;attacks,&#x20;making&#x20;it&#x20;much&#x20;more&#x20;likely&#x20;that&#x20;the&#x20;attacker&#039;s&#x20;pattern&#x20;will&#x20;be&#x20;noticed&#x20;and&#x20;the&#x20;offending&#x20;source&#x20;address&#x20;and/or&#x20;port&#x20;blocked,&#x20;so&#x20;this&#x20;should&#x20;be&#x20;set&#x20;according&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/RETRIES=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;RETRIES=3&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;login&#x20;&gt;login.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;login.CIS&#x20;login&#x20;&#x20;&#x20;&#x20;#&#x20;cd&#x20;/etc/security&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/LOCK_AFTER_RETRIES=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;LOCK_AFTER_RETRIES=YES&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;policy.conf&#x20;&gt;&#x20;policy.conf.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;policy.conf.CIS&#x20;policy.conf&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/system/name-service/cache&#x20;&#x20;&#x20;&#x20;&#x20;Be&#x20;careful&#x20;when&#x20;enabling&#x20;these&#x20;settings&#x20;as&#x20;they&#x20;can&#x20;create&#x20;a&#x20;denial-of-service&#x20;situation&#x20;for&#x20;legitimate&#x20;users&#x20;and&#x20;applications.&#x20;Account&#x20;lockout&#x20;can&#x20;be&#x20;disabled&#x20;for&#x20;specific&#x20;users&#x20;via&#x20;the&#x20;usermod&#x20;command.&#x20;For&#x20;example,&#x20;the&#x20;following&#x20;command&#x20;disables&#x20;account&#x20;lock&#x20;specifically&#x20;for&#x20;the&#x20;oracle&#x20;account:&#x20;#&#x20;usermod&#x20;-K&#x20;lock_after_retries=no&#x20;oracle','[{\"cis\": [\"6.15\"]}]'),(8035,'Secure&#x20;the&#x20;GRUB&#x20;Menu&#x20;&#40;Intel&#41;','GRUB&#x20;is&#x20;a&#x20;boot&#x20;loader&#x20;for&#x20;x64&#x20;based&#x20;systems&#x20;that&#x20;permits&#x20;loading&#x20;an&#x20;OS&#x20;image&#x20;from&#x20;any&#x20;location.&#x20;Oracle&#x20;x64&#x20;systems&#x20;support&#x20;the&#x20;use&#x20;of&#x20;a&#x20;GRUB&#x20;Menu&#x20;password&#x20;for&#x20;the&#x20;console.','The&#x20;flexibility&#x20;that&#x20;GRUB&#x20;provides&#x20;creates&#x20;a&#x20;security&#x20;risk&#x20;if&#x20;its&#x20;configuration&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x20;The&#x20;failsafe&#x20;menu&#x20;entry&#x20;needs&#x20;to&#x20;be&#x20;secured&#x20;in&#x20;the&#x20;same&#x20;environments&#x20;that&#x20;require&#x20;securing&#x20;the&#x20;systems&#x20;firmware&#x20;to&#x20;avoid&#x20;unauthorized&#x20;removable&#x20;media&#x20;boots.&#x20;Setting&#x20;the&#x20;GRUB&#x20;Menu&#x20;password&#x20;helps&#x20;prevent&#x20;attackers&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;system&#x20;console&#x20;from&#x20;booting&#x20;off&#x20;some&#x20;external&#x20;device&#x20;&#40;such&#x20;as&#x20;a&#x20;CD-&#x20;ROM&#x20;or&#x20;floppy&#41;&#x20;and&#x20;subverting&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;actions&#x20;described&#x20;in&#x20;this&#x20;section&#x20;will&#x20;ensure&#x20;you&#x20;cannot&#x20;get&#x20;to&#x20;failsafe&#x20;or&#x20;any&#x20;of&#x20;the&#x20;GRUB&#x20;command&#x20;line&#x20;options&#x20;without&#x20;first&#x20;entering&#x20;the&#x20;password.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;/boot/grub/bin/grub&#x20;&#x20;&#x20;&#x20;grub&gt;&#x20;md5crypt&#x20;&#x20;&#x20;&#x20;Password:&#x20;[enter&#x20;desired&#x20;boot&#x20;loader&#x20;password]&#x20;&#x20;&#x20;&#x20;Encrypted:&#x20;[enter&#x20;md5&#x20;password&#x20;string]&#x20;&#x20;&#x20;&#x20;grub&gt;&#x20;[enter&#x20;control-C&#x20;&#40;^C&#41;]&#x20;&#x20;&#x20;&#x20;The&#x20;actual&#x20;menu.lst&#x20;file&#x20;for&#x20;Solaris&#x20;11&#x20;x64&#x20;is&#x20;the&#x20;/rpool/boot/grub/menu.lst.&#x20;First,&#x20;ensure&#x20;the&#x20;menu.lst&#x20;file&#x20;can&#x20;only&#x20;be&#x20;read&#x20;by&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;chmod&#x20;600&#x20;/rpool/boot/grub/menu.lst&#x20;&#x20;&#x20;&#x20;Next,&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;menu.lst&#x20;file&#x20;above&#x20;the&#x20;entries&#x20;added&#x20;by&#x20;bootadm:&#x20;password&#x20;--md5&#x20;[enter&#x20;md5&#x20;password&#x20;string&#x20;generated&#x20;above]&#x20;&#x20;&#x20;&#x20;Finally,&#x20;add&#x20;the&#x20;keyword&#x20;lock&#x20;to&#x20;the&#x20;Solaris&#x20;failsafe&#x20;boot&#x20;entry&#x20;as&#x20;in&#x20;the&#x20;following&#x20;example&#x20;&#40;as&#x20;well&#x20;as&#x20;to&#x20;any&#x20;other&#x20;entries&#x20;that&#x20;you&#x20;want&#x20;to&#x20;protect&#41;:&#x20;title&#x20;Solaris&#x20;failsafe&#x20;&#x20;&#x20;&#x20;lock','[{\"cis\": [\"6.17\"]}]'),(8036,'Set&#x20;Password&#x20;Expiration&#x20;Parameters&#x20;on&#x20;Active&#x20;Accounts','The&#x20;characteristics&#x20;of&#x20;an&#x20;operating&#x20;system&#x20;that&#x20;make&#x20;&#039;user&#x20;identification&#039;&#x20;via&#x20;password&#x20;a&#x20;secure&#x20;and&#x20;workable&#x20;solution&#x20;is&#x20;the&#x20;combination&#x20;of&#x20;settings&#x20;chosen.&#x20;By&#x20;requiring&#x20;that&#x20;a&#x20;series&#x20;of&#x20;password-choices&#x20;be&#x20;security-centric,&#x20;it&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;malicious&#x20;user&#x20;breaking&#x20;the&#x20;password&#x20;through&#x20;dictionary/brute&#x20;force&#x20;attacks&#x20;or&#x20;fortuitous&#x20;guessing&#x20;based&#x20;upon&#x20;&#039;social&#x20;engineering.&#039;&#x20;A&#x20;basic&#x20;password&#x20;security&#x20;strategy&#x20;is&#x20;requiring&#x20;a&#x20;new&#x20;password&#x20;to&#x20;be&#x20;chosen&#x20;every&#x20;45-90&#x20;days,&#x20;so&#x20;that&#x20;repeated&#x20;attempts&#x20;to&#x20;gain&#x20;entry&#x20;by&#x20;brute-force&#x20;tactics&#x20;will&#x20;fail&#x20;when&#x20;a&#x20;new&#x20;password&#x20;is&#x20;chosen,&#x20;which&#x20;requires&#x20;starting&#x20;over&#x20;again&#x20;to&#x20;break&#x20;the&#x20;new&#x20;password.','The&#x20;commands&#x20;for&#x20;this&#x20;item&#x20;set&#x20;all&#x20;active&#x20;accounts&#x20;&#40;except&#x20;the&#x20;root&#x20;account&#41;&#x20;to&#x20;force&#x20;password&#x20;changes&#x20;every&#x20;91&#x20;days&#x20;&#40;13&#x20;weeks&#41;,&#x20;and&#x20;then&#x20;prevent&#x20;password&#x20;changes&#x20;for&#x20;seven&#x20;days&#x20;&#40;one&#x20;week&#41;,&#x20;thereafter.&#x20;Users&#x20;will&#x20;begin&#x20;receiving&#x20;warnings&#x20;28&#x20;days&#x20;&#40;4&#x20;weeks&#41;&#x20;before&#x20;their&#x20;password&#x20;expires.&#x20;Sites&#x20;also&#x20;have&#x20;the&#x20;option&#x20;of&#x20;expiring&#x20;idle&#x20;accounts&#x20;after&#x20;a&#x20;certain&#x20;number&#x20;of&#x20;days&#x20;&#40;see&#x20;the&#x20;on-line&#x20;manual&#x20;page&#x20;for&#x20;the&#x20;usermod&#x20;command,&#x20;particularly&#x20;the&#x20;-f&#x20;option&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;logins&#x20;-ox&#x20;|&#x20;awk&#x20;-F:&#x20;&#039;&#40;$1&#x20;==&#x20;&quot;root&quot;&#x20;||&#x20;$8&#x20;==&#x20;&quot;LK&quot;&#x20;||&#x20;$8&#x20;==&#x20;&quot;NL&quot;&#41;&#x20;&#x20;{&#x20;next&#x20;}&#x20;;&#x20;&#x20;{&#x20;$cmd&#x20;=&#x20;&quot;passwd&quot;&#x20;}&#x20;;&#x20;&#40;$11&#x20;91&#41;&#x20;{&#x20;$cmd&#x20;=&#x20;$cmd&#x20;&quot;&#x20;-x&#x20;91&quot;&#x20;}&#x20;&#x20;&#40;$10&#x20;&lt;&#x20;7&#41;&#x20;{&#x20;$cmd&#x20;=&#x20;$cmd&#x20;&quot;&#x20;-n&#x20;7&quot;&#x20;}&#x20;&#x20;&#40;$12&#x20;&lt;&#x20;28&#41;&#x20;{&#x20;$cmd&#x20;=&#x20;$cmd&#x20;&quot;&#x20;-w&#x20;28&quot;&#x20;}&#x20;&#x20;&#40;$cmd&#x20;!=&#x20;&quot;passwd&quot;&#41;&#x20;{&#x20;print&#x20;$cmd&#x20;&quot;&#x20;&quot;&#x20;$1&#x20;}&#039;&#x20;&#x20;&gt;&#x20;/etc/CISupd_accounts&#x20;&#x20;&#x20;&#x20;#&#x20;/sbin/sh&#x20;/etc/CISupd_accounts&#x20;&#x20;&#x20;&#x20;#&#x20;rm&#x20;-f&#x20;/etc/CISupd_accounts&#x20;&#x20;&#x20;&#x20;#&#x20;cd&#x20;/etc/default&#x20;&#x20;&#x20;&#x20;#&#x20;grep&#x20;-v&#x20;WEEKS&#x20;passwd&#x20;&gt;&#x20;passwd.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;cat&#x20;&lt;&lt;EODefaults&#x20;&gt;&gt;&#x20;passwd.CIS&#x20;MAXWEEKS=13&#x20;MINWEEKS=1&#x20;WARNWEEKS=4&#x20;EODefaults&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;passwd.CIS&#x20;passwd','[{\"cis\": [\"7.1\"]}]'),(8037,'Set&#x20;Strong&#x20;Password&#x20;Creation&#x20;Policies','The&#x20;variables&#x20;in&#x20;the&#x20;/etc/default/passwd&#x20;file&#x20;indicate&#x20;various&#x20;strategies&#x20;for&#x20;creating&#x20;differences&#x20;required&#x20;between&#x20;an&#x20;old&#x20;and&#x20;a&#x20;new&#x20;password.&#x20;As&#x20;requiring&#x20;users&#x20;to&#x20;select&#x20;a&#x20;specific&#x20;numbers&#x20;of&#x20;differences&#x20;between&#x20;the&#x20;characters&#x20;in&#x20;the&#x20;existing&#x20;password&#x20;and&#x20;the&#x20;new&#x20;one&#x20;can&#x20;strengthen&#x20;the&#x20;password&#x20;by&#x20;increasing&#x20;the&#x20;symbol-set&#x20;space,&#x20;to&#x20;further&#x20;increase&#x20;the&#x20;difficulty&#x20;of&#x20;breaking&#x20;any&#x20;password&#x20;by&#x20;brute-force&#x20;attacks,&#x20;these&#x20;values&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','Administrators&#x20;may&#x20;wish&#x20;to&#x20;add&#x20;site-specific&#x20;dictionaries&#x20;to&#x20;the&#x20;DICTIONLIST&#x20;parameter.&#x20;Warning:&#x20;Sites&#x20;often&#x20;have&#x20;differing&#x20;opinions&#x20;on&#x20;the&#x20;optimal&#x20;value&#x20;of&#x20;the&#x20;HISTORY&#x20;parameter&#x20;&#40;how&#x20;many&#x20;previous&#x20;passwords&#x20;to&#x20;remember&#x20;per&#x20;user&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;re-&#x20;use&#41;.&#x20;The&#x20;values&#x20;specified&#x20;here&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;NSA/DISA&#x20;requirements.&#x20;If&#x20;this&#x20;is&#x20;too&#x20;restrictive&#x20;for&#x20;your&#x20;site,&#x20;you&#x20;may&#x20;wish&#x20;to&#x20;set&#x20;a&#x20;HISTORY&#x20;value&#x20;of&#x20;4&#x20;and&#x20;a&#x20;MAXREPEATS&#x20;of&#x20;2.&#x20;Consult&#x20;your&#x20;local&#x20;security&#x20;rules&#x20;for&#x20;guidance.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/PASSLENGTH=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;PASSLENGTH=8&quot;&#x20;};&#x20;/NAMECHECK=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;NAMECHECK=YES&quot;&#x20;};&#x20;/HISTORY=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;HISTORY=10&quot;&#x20;};&#x20;/MINDIFF=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;MINDIFF=3&quot;&#x20;};&#x20;/MINALPHA=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;MINALPHA=2&quot;&#x20;};&#x20;/MINUPPER=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;MINUPPER=1&quot;&#x20;};&#x20;/MINLOWER=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;MINLOWER=1&quot;&#x20;};&#x20;/MINNONALPHA=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;MINNONALPHA=1&quot;&#x20;};&#x20;/MAXREPEATS=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;MAXREPEATS=0&quot;&#x20;};&#x20;/WHITESPACE=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;WHITESPACE=YES&quot;&#x20;};&#x20;/DICTIONDBDIR=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;DICTIONDBDIR=/var/passwd&quot;&#x20;};&#x20;/DICTIONLIST=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;DICTIONLIST=/usr/share/lib/dict/words&quot;&#x20;};&#x20;{&#x20;print&#x20;}&#039;&#x20;passwd&#x20;&gt;&#x20;passwd.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;passwd.CIS&#x20;passwd','[{\"cis\": [\"7.2\"]}]'),(8038,'Set&#x20;Default&#x20;umask&#x20;for&#x20;users','The&#x20;default&#x20;umask&#40;1&#41;&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#40;1&#41;&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;.profile,&#x20;.cshrc,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;allow&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;&#039;/#UMASK=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;UMASK=027&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;login&#x20;&gt;&#x20;login.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;login.CIS&#x20;login','[{\"cis\": [\"7.3\"]}]'),(8039,'Set&#x20;Default&#x20;File&#x20;Creation&#x20;Mask&#x20;for&#x20;FTP&#x20;Users','If&#x20;FTP&#x20;is&#x20;permitted,&#x20;set&#x20;a&#x20;strong,&#x20;default&#x20;file&#x20;creation&#x20;mask&#x20;to&#x20;apply&#x20;to&#x20;files&#x20;created&#x20;by&#x20;the&#x20;FTP&#x20;server.','Many&#x20;users&#x20;assume&#x20;that&#x20;the&#x20;FTP&#x20;server&#x20;will&#x20;use&#x20;their&#x20;system&#x20;file&#x20;creation&#x20;mask;&#x20;generally&#x20;it&#x20;does&#x20;not.&#x20;This&#x20;setting&#x20;ensures&#x20;that&#x20;files&#x20;transmitted&#x20;over&#x20;FTP&#x20;use&#x20;a&#x20;strong&#x20;file&#x20;creation&#x20;mask.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc&#x20;&#x20;&#x20;&#x20;#&#x20;if&#x20;[&#x20;&quot;`grep&#x20;&#039;^Umask&#039;&#x20;proftpd.conf`&quot;&#x20;];&#x20;then&#x20;awk&#x20;&#039;/^Umask/&#x20;{&#x20;$2&#x20;=&#x20;&quot;027&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;proftpd.conf&#x20;&gt;&#x20;proftpd.conf.CIS&#x20;mv&#x20;proftpd.conf.CIS&#x20;proftpd.conf&#x20;else&#x20;echo&#x20;&quot;Umask&#x20;027&quot;&#x20;&gt;&gt;&#x20;proftpd.conf&#x20;fi','[{\"cis\": [\"7.4\"]}]'),(8040,'Set&#x20;&quot;mesg&#x20;n&quot;&#x20;as&#x20;Default&#x20;for&#x20;All&#x20;Users','The&#x20;&quot;mesg&#x20;n&quot;&#x20;command&#x20;blocks&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;write&#x20;or&#x20;talk&#x20;commands&#x20;to&#x20;contact&#x20;users&#x20;at&#x20;their&#x20;terminals,&#x20;but&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;slightly&#x20;strengthening&#x20;permissions&#x20;on&#x20;the&#x20;user&#039;s&#x20;tty&#x20;device.','Since&#x20;write&#x20;and&#x20;talk&#x20;are&#x20;no&#x20;longer&#x20;widely&#x20;used&#x20;at&#x20;most&#x20;sites,&#x20;the&#x20;incremental&#x20;security&#x20;increase&#x20;is&#x20;worth&#x20;the&#x20;loss&#x20;of&#x20;functionality.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc&#x20;&#x20;&#x20;&#x20;#&#x20;for&#x20;file&#x20;in&#x20;profile&#x20;.login&#x20;;&#x20;do&#x20;if&#x20;[&#x20;&quot;`grep&#x20;mesg&#x20;$file`&quot;&#x20;];&#x20;then&#x20;awk&#x20;&#039;$1&#x20;==&#x20;&quot;mesg&quot;&#x20;{&#x20;$2&#x20;=&#x20;&quot;n&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;$file&#x20;&gt;&#x20;$file.CIS&#x20;mv&#x20;$file.CIS&#x20;$file&#x20;else&#x20;echo&#x20;mesg&#x20;n&#x20;&gt;&gt;&#x20;$file&#x20;fi&#x20;done','[{\"cis\": [\"7.5\"]}]'),(8041,'Create&#x20;Warnings&#x20;for&#x20;Standard&#x20;Login&#x20;Services','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;prior&#x20;to&#x20;the&#x20;login&#x20;prompt&#x20;on&#x20;the&#x20;system&#039;s&#x20;console&#x20;and&#x20;serial&#x20;devices&#x20;and&#x20;also&#x20;prior&#x20;to&#x20;logins&#x20;via&#x20;telnet&#x20;and&#x20;Secure&#x20;Shell.&#x20;The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;generally&#x20;displayed&#x20;after&#x20;all&#x20;successful&#x20;logins,&#x20;regardless&#x20;from&#x20;where&#x20;the&#x20;user&#x20;is&#x20;logging&#x20;in.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;As&#x20;implementing&#x20;a&#x20;logon&#x20;banner&#x20;to&#x20;deter&#x20;inappropriate&#x20;use&#x20;and&#x20;can&#x20;provide&#x20;a&#x20;foundation&#x20;for&#x20;legal&#x20;action&#x20;against&#x20;abuse,&#x20;this&#x20;warning&#x20;content&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate.&#x20;Consult&#x20;with&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;counsel&#x20;for&#x20;the&#x20;appropriate&#x20;wording&#x20;as&#x20;the&#x20;examples&#x20;below&#x20;are&#x20;for&#x20;demonstration&#x20;purposes&#x20;only.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;users&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/motd&#x20;&#x20;&#x20;&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;users&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"8.1\"]}]'),(8042,'Enable&#x20;a&#x20;Warning&#x20;Banner&#x20;for&#x20;the&#x20;SSH&#x20;Service','The&#x20;contents&#x20;of&#x20;the&#x20;Banner&#x20;string&#x20;in&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;allowed,&#x20;requiring&#x20;that&#x20;the&#x20;user&#x20;read&#x20;the&#x20;legal&#x20;caution.','','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;awk&#x20;&#039;/^#Banner/&#x20;{&#x20;$1&#x20;=&#x20;&quot;Banner&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;/etc/ssh/sshd_config&#x20;&gt;&#x20;/etc/ssh/sshd_config.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;/etc/ssh/sshd_config.CIS&#x20;/etc/ssh/sshd_config&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"8.2\"]}]'),(8043,'Enable&#x20;a&#x20;Warning&#x20;Banner&#x20;for&#x20;the&#x20;GNOME&#x20;Service','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;used&#x20;for&#x20;login&#x20;session&#x20;management.&#x20;See&#x20;the&#x20;manual&#x20;page&#x20;gdm&#40;1&#41;&#x20;for&#x20;more&#x20;information&#x20;on&#x20;configuration&#x20;of&#x20;the&#x20;settings,&#x20;which&#x20;can&#x20;be&#x20;user-&#x20;or&#x20;group&#x20;specific.','The&#x20;remediation&#x20;action&#x20;for&#x20;this&#x20;item&#x20;sets&#x20;a&#x20;pre-login&#x20;warning&#x20;message&#x20;for&#x20;GDM&#x20;users.&#x20;Additional&#x20;methods&#x20;can&#x20;be&#x20;employed&#x20;to&#x20;display&#x20;a&#x20;similar&#x20;message&#x20;to&#x20;a&#x20;user&#x20;post-&#x20;authentication.&#x20;For&#x20;more&#x20;information,&#x20;see&#x20;the&#x20;Oracle&#x20;Solaris&#x20;11&#x20;Security&#x20;Guidelines&#x20;document.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Edit&#x20;the&#x20;/etc/gdm/Init/Default&#x20;file&#x20;to&#x20;add&#x20;the&#x20;following&#x20;content&#x20;before&#x20;the&#x20;last&#x20;line&#x20;of&#x20;the&#x20;file.&#x20;&#x20;/usr/bin/zenity&#x20;--text-info&#x20;--width=800&#x20;--height=300&#x20;--title=&quot;Security&#x20;Message&quot;&#x20;--filename=/etc/issue','[{\"cis\": [\"8.3\"]}]'),(8044,'Enable&#x20;a&#x20;Warning&#x20;Banner&#x20;for&#x20;the&#x20;FTP&#x20;service','The&#x20;action&#x20;for&#x20;this&#x20;item&#x20;sets&#x20;a&#x20;warning&#x20;message&#x20;for&#x20;FTP&#x20;users&#x20;before&#x20;they&#x20;log&#x20;in.','Warning&#x20;Banners&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;access&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;using&#x20;the&#x20;system.&#x20;The&#x20;text&#x20;below&#x20;is&#x20;a&#x20;generic&#x20;sample&#x20;only,&#x20;so&#x20;consult&#x20;with&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;counsel&#x20;for&#x20;the&#x20;appropriate&#x20;wording.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;echo&#x20;&quot;DisplayConnect&#x20;/etc/issue&quot;&#x20;&gt;&gt;&#x20;/etc/proftpd.conf&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;ftp','[{\"cis\": [\"8.4\"]}]'),(8045,'Check&#x20;that&#x20;the&#x20;Banner&#x20;Setting&#x20;for&#x20;telnet&#x20;is&#x20;Null','The&#x20;BANNER&#x20;variable&#x20;in&#x20;the&#x20;file&#x20;/etc/default/telnetd&#x20;can&#x20;be&#x20;used&#x20;to&#x20;display&#x20;text&#x20;before&#x20;the&#x20;telnet&#x20;login&#x20;prompt.&#x20;Traditionally,&#x20;it&#x20;has&#x20;been&#x20;used&#x20;to&#x20;display&#x20;the&#x20;OS&#x20;level&#x20;of&#x20;the&#x20;target&#x20;system.','The&#x20;warning&#x20;banner&#x20;provides&#x20;information&#x20;that&#x20;can&#x20;be&#x20;used&#x20;in&#x20;reconnaissance&#x20;for&#x20;an&#x20;attack.&#x20;By&#x20;default,&#x20;this&#x20;file&#x20;is&#x20;distributed&#x20;with&#x20;the&#x20;BANNER&#x20;variable&#x20;set&#x20;to&#x20;null.&#x20;It&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;create&#x20;a&#x20;separate&#x20;warning&#x20;banner&#x20;for&#x20;telnet&#x20;if&#x20;a&#x20;warning&#x20;is&#x20;set&#x20;in&#x20;the&#x20;/etc/issue&#x20;file.&#x20;As&#x20;telnet&#x20;is&#x20;an&#x20;insecure&#x20;protocol,&#x20;it&#x20;is&#x20;strongly&#x20;recommend&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;and&#x20;all&#x20;remote&#x20;administrative/user&#x20;connections&#x20;take&#x20;place&#x20;by&#x20;Secure&#x20;Shell.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;#&#x20;awk&#x20;&#039;/^BANNER=/&#x20;{&#x20;$1&#x20;=&#x20;&quot;BANNER=&quot;&#x20;};&#x20;{&#x20;print&#x20;}&#039;&#x20;telnetd&#x20;&gt;&#x20;telnetd.CIS&#x20;&#x20;&#x20;&#x20;#&#x20;mv&#x20;telnetd.CIS&#x20;telnetd','[{\"cis\": [\"8.5\"]}]'),(8046,'Verify&#x20;System&#x20;Account&#x20;Default&#x20;Passwords','There&#x20;are&#x20;a&#x20;number&#x20;of&#x20;accounts&#x20;provided&#x20;with&#x20;the&#x20;Solaris&#x20;OS&#x20;that&#x20;are&#x20;used&#x20;to&#x20;manage&#x20;applications&#x20;and&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;provide&#x20;an&#x20;interactive&#x20;shell.&#x20;These&#x20;accounts&#x20;are&#x20;delivered&#x20;either&#x20;in&#x20;a&#x20;locked&#x20;or&#x20;non-login&#x20;state.&#x20;Oracle&#x20;does&#x20;not&#x20;support&#x20;nor&#x20;recommend&#x20;changing&#x20;the&#x20;passwords&#x20;associated&#x20;with&#x20;these&#x20;accounts.','System&#x20;accounts,&#x20;such&#x20;as&#x20;bin,&#x20;lpd,&#x20;and&#x20;sys&#x20;have&#x20;special&#x20;purposes&#x20;and&#x20;privileges.&#x20;By&#x20;default,&#x20;these&#x20;accounts&#x20;are&#x20;configured&#x20;as&#x20;either&#x20;locked&#x20;or&#x20;non-login.&#x20;This&#x20;status&#x20;should&#x20;be&#x20;verified&#x20;to&#x20;ensure&#x20;that&#x20;these&#x20;accounts&#x20;have&#x20;not&#x20;accidentally&#x20;or&#x20;intentionally&#x20;been&#x20;enabled.','','To&#x20;lock&#x20;a&#x20;single&#x20;account,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;passwd&#x20;-d&#x20;[username]&#x20;&#x20;&#x20;&#x20;#&#x20;passwd&#x20;-l&#x20;[username]&#x20;&#x20;&#x20;&#x20;To&#x20;configure&#x20;a&#x20;single&#x20;account&#x20;to&#x20;be&#x20;non-login,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;passwd&#x20;-d&#x20;[username]&#x20;&#x20;&#x20;&#x20;#&#x20;passwd&#x20;-N&#x20;[username]','[{\"cis\": [\"9.3\"]}]'),(8047,'Ensure&#x20;Password&#x20;Fields&#x20;are&#x20;Not&#x20;Empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password&#x20;at&#x20;all&#x20;&#40;assuming&#x20;that&#x20;the&#x20;value&#x20;PASSREQ=NO&#x20;is&#x20;set&#x20;in&#x20;/etc/default/login&#41;.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords,&#x20;be&#x20;configured&#x20;as&#x20;&quot;Non-login,&quot;&#x20;or&#x20;be&#x20;locked.','','Use&#x20;the&#x20;passwd&#x20;-l&#x20;command&#x20;to&#x20;lock&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;execute&#x20;commands&#x20;.&#x20;Use&#x20;the&#x20;passwd&#x20;-N&#x20;command&#x20;to&#x20;set&#x20;accounts&#x20;to&#x20;be&#x20;non-logini.','[{\"cis\": [\"9.4\"]}]'),(8048,'Verify&#x20;No&#x20;UID&#x20;0&#x20;Accounts&#x20;Exist&#x20;Other&#x20;than&#x20;root','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;rights&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;role&#x20;and&#x20;be&#x20;made&#x20;accessible&#x20;from&#x20;the&#x20;system&#x20;console&#x20;only.&#x20;Administrative&#x20;access&#x20;granted&#x20;to&#x20;an&#x20;unprivileged&#x20;account&#x20;should&#x20;use&#x20;an&#x20;approved&#x20;mechanism&#x20;such&#x20;as&#x20;RBAC.','','Disable&#x20;or&#x20;delete&#x20;any&#x20;other&#x20;0&#x20;UID&#x20;entries&#x20;that&#x20;are&#x20;displayed;&#x20;there&#x20;should&#x20;be&#x20;only&#x20;one&#x20;root&#x20;account.&#x20;Finer&#x20;granularity&#x20;access&#x20;control&#x20;for&#x20;administrative&#x20;access&#x20;can&#x20;be&#x20;obtained&#x20;by&#x20;using&#x20;the&#x20;Solaris&#x20;Role-Based&#x20;Access&#x20;Control&#x20;&#40;RBAC&#41;&#x20;mechanism.&#x20;RBAC&#x20;configurations&#x20;should&#x20;be&#x20;monitored&#x20;via&#x20;user_attr&#40;4&#41;&#x20;to&#x20;make&#x20;sure&#x20;that&#x20;privileges&#x20;are&#x20;managed&#x20;appropriately.','[{\"cis\": [\"9.5\"]}]'),(8049,'Ensure&#x20;root&#x20;PATH&#x20;Integrity','The&#x20;root&#x20;user&#x20;can&#x20;execute&#x20;any&#x20;command&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;executing&#x20;programs&#x20;if&#x20;the&#x20;PATH&#x20;is&#x20;not&#x20;set&#x20;correctly.','Including&#x20;the&#x20;current&#x20;working&#x20;directory&#x20;&#40;.&#41;&#x20;or&#x20;any&#x20;other&#x20;writable&#x20;directory&#x20;in&#x20;root&#039;s&#x20;executable&#x20;path&#x20;makes&#x20;it&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;can&#x20;gain&#x20;superuser&#x20;access&#x20;by&#x20;forcing&#x20;an&#x20;administrator&#x20;operating&#x20;as&#x20;root&#x20;to&#x20;execute&#x20;a&#x20;malcode,&#x20;such&#x20;as&#x20;a&#x20;Trojan&#x20;horse&#x20;program.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.','[{\"cis\": [\"9.6\"]}]'),(8050,'Check&#x20;That&#x20;Users&#x20;Are&#x20;Assigned&#x20;Home&#x20;Directories','passwd&#40;4&#41;&#x20;defines&#x20;a&#x20;home&#x20;directory&#x20;that&#x20;each&#x20;user&#x20;is&#x20;placed&#x20;in&#x20;upon&#x20;login.&#x20;If&#x20;there&#x20;is&#x20;no&#x20;defined&#x20;home&#x20;directory,&#x20;a&#x20;user&#x20;will&#x20;be&#x20;placed&#x20;in&#x20;/&#x20;and&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;write&#x20;any&#x20;files&#x20;or&#x20;have&#x20;local&#x20;environment&#x20;variables&#x20;set.','All&#x20;users&#x20;must&#x20;be&#x20;assigned&#x20;a&#x20;home&#x20;directory&#x20;in&#x20;passwd&#40;4&#41;.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;if&#x20;there&#x20;exists&#x20;any&#x20;users&#x20;who&#x20;are&#x20;in&#x20;passwd&#40;4&#41;&#x20;but&#x20;do&#x20;not&#x20;have&#x20;a&#x20;home&#x20;directory,&#x20;and&#x20;work&#x20;with&#x20;those&#x20;users&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.','[{\"cis\": [\"9.12\"]}]'),(8500,'Verify&#x20;all&#x20;Apple&#x20;provided&#x20;software&#x20;is&#x20;current','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following:&#x20;softwareupdate&#x20;-l&#x20;&#x20;2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename','[{\"cis\": [\"1.1\"]}]'),(8501,'Enable&#x20;Auto&#x20;Update','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-int&#x20;1','[{\"cis\": [\"1.2\"]}]'),(8502,'Enable&#x20;app&#x20;update&#x20;installs','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-bool&#x20;TRUE&#x20;&#x20;&#x20;&#x20;The&#x20;remediation&#x20;requires&#x20;a&#x20;log&#x20;out&#x20;and&#x20;log&#x20;in&#x20;to&#x20;show&#x20;in&#x20;the&#x20;GUI.&#x20;Please&#x20;note&#x20;that.','[{\"cis\": [\"1.3\"]}]'),(8503,'Enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;update&#x20;installs','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper,&#x20;with&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.4\"]}]'),(8504,'Enable&#x20;OS&#x20;X&#x20;update&#x20;installs','Ensure&#x20;that&#x20;OS&#x20;X&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;OS&#x20;X&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdateRestartRequired&#x20;-bool&#x20;TRUE','[{\"cis\": [\"1.5\"]}]'),(8505,'Enable&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;Apple&#039;s&#x20;automatic&#x20;time&#x20;update&#x20;solution&#x20;will&#x20;enable&#x20;an&#x20;NTP&#x20;server&#x20;that&#x20;is&#x20;not&#x20;controlled&#x20;by&#x20;the&#x20;Application&#x20;Firewall.&#x20;Turning&#x20;on&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;&#x20;allows&#x20;other&#x20;computers&#x20;to&#x20;connect&#x20;to&#x20;set&#x20;their&#x20;time&#x20;and&#x20;allows&#x20;for&#x20;exploit&#x20;attempts&#x20;against&#x20;ntpd.&#x20;It&#x20;also&#x20;allows&#x20;for&#x20;more&#x20;accurate&#x20;network&#x20;detection&#x20;and&#x20;OS&#x20;fingerprinting.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;&#x20;&#x20;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on','[{\"cis\": [\"2.2.1\"]}]'),(8506,'Restrict&#x20;NTP&#x20;server&#x20;to&#x20;loopback&#x20;interface','The&#x20;Apple&#x20;System&#x20;Preference&#x20;setting&#x20;to&#x20;&quot;Set&#x20;date&#x20;and&#x20;time&#x20;automatically&quot;&#x20;enables&#x20;both&#x20;an&#x20;NTP&#x20;client&#x20;that&#x20;can&#x20;synchronize&#x20;the&#x20;time&#x20;from&#x20;known&#x20;time&#x20;server&#40;s&#41;&#x20;and&#x20;an&#x20;open&#x20;listening&#x20;NTP&#x20;server&#x20;that&#x20;can&#x20;be&#x20;used&#x20;by&#x20;any&#x20;other&#x20;computer&#x20;that&#x20;can&#x20;connect&#x20;to&#x20;port&#x20;123&#x20;on&#x20;the&#x20;time&#x20;syncing&#x20;computer.&#x20;This&#x20;open&#x20;listening&#x20;service&#x20;can&#x20;allow&#x20;for&#x20;both&#x20;exploits&#x20;of&#x20;future&#x20;NTP&#x20;vulnerabilities&#x20;and&#x20;allow&#x20;for&#x20;open&#x20;ports&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;fingerprinting&#x20;to&#x20;target&#x20;exploits.&#x20;Access&#x20;to&#x20;this&#x20;port&#x20;should&#x20;be&#x20;restricted.&#x20;&#x20;Editing&#x20;the&#x20;/etc/ntp-restrict.conf&#x20;file&#x20;by&#x20;adding&#x20;a&#x20;control&#x20;on&#x20;the&#x20;loopback&#x20;interface&#x20;limits&#x20;external&#x20;access.','Mobile&#x20;workstations&#x20;on&#x20;untrusted&#x20;networks&#x20;should&#x20;not&#x20;have&#x20;open&#x20;listening&#x20;services&#x20;available&#x20;to&#x20;other&#x20;nodes&#x20;on&#x20;the&#x20;network.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;&#x20;sudo&#x20;vim&#x20;/etc/ntp-restrict.conf&#x20;&#x20;2.&#x20;Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;file:&#x20;restrict&#x20;lo&#x20;interface&#x20;ignore&#x20;wildcard&#x20;interface&#x20;listen&#x20;lo','[{\"cis\": [\"2.2.3\"]}]'),(8507,'Disable&#x20;Remote&#x20;Apple&#x20;Events','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}]'),(8508,'Disable&#x20;Printer&#x20;Sharing','By&#x20;enabling&#x20;Printer&#x20;sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Sharing&#x20;3.&#x20;Uncheck&#x20;Printer&#x20;Sharing','[{\"cis\": [\"2.4.4\"]}]'),(8509,'Disable&#x20;Remote&#x20;Login','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;OSX&#x20;clients,&#x20;not&#x20;servers.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}]'),(8510,'Disable&#x20;File&#x20;Sharing','Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;a&#x20;combination&#x20;of&#x20;SMB&#x20;&#40;Windows&#x20;sharing&#41;&#x20;and&#x20;AFP&#x20;&#40;Mac&#x20;sharing&#41;','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;AFP&#x20;from&#x20;the&#x20;command&#x20;line:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.AppleFileServer.plist&#x20;&#x20;-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;SMB&#x20;sharing&#x20;from&#x20;the&#x20;CLI:&#x20;&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.smbd.plist','[{\"cis\": [\"2.4.8\"]}]'),(8511,'Disable&#x20;&quot;Wake&#x20;for&#x20;network&#x20;access&quot;','This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&#039;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0&#x20;&#x20;&#x20;Note:&#x20;The&#x20;-c&#x20;flag&#x20;means&#x20;&quot;wall&#x20;power.&quot;&#x20;Different&#x20;settings&#x20;must&#x20;be&#x20;used&#x20;for&#x20;other&#x20;power&#x20;sources.','[{\"cis\": [\"2.5.1\"]}]'),(8512,'Enable&#x20;FileVault','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.6.1\"]}]'),(8513,'Enable&#x20;Gatekeeper','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;white-listing&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;spctl&#x20;--master-enable','[{\"cis\": [\"2.6.2\"]}]'),(8514,'Enable&#x20;Firewall','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-&#x20;int&#x20;&lt;value&gt;&#x20;&#x20;&#x20;&#x20;Where&#x20;&lt;value&gt;&#x20;is:&#x20;-&#x20;1&#x20;=&#x20;on&#x20;for&#x20;specific&#x20;services&#x20;-&#x20;2&#x20;=&#x20;on&#x20;for&#x20;essential&#x20;services','[{\"cis\": [\"2.6.3\"]}]'),(8515,'Enable&#x20;Firewall&#x20;Stealth&#x20;Mode','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.6.4\"]}]'),(8516,'Enable&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;in&#x20;terminal.app','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Terminal&#x20;2.&#x20;Select&#x20;Terminal&#x20;3.&#x20;Select&#x20;Secure&#x20;Keyboard&#x20;Entry','[{\"cis\": [\"2.10\"]}]'),(8517,'Java&#x20;6&#x20;is&#x20;not&#x20;the&#x20;default&#x20;Java&#x20;runtime','Apple&#x20;had&#x20;made&#x20;Java&#x20;part&#x20;of&#x20;the&#x20;core&#x20;Operating&#x20;System&#x20;for&#x20;OS&#x20;X.&#x20;Apple&#x20;is&#x20;no&#x20;longer&#x20;providing&#x20;Java&#x20;updates&#x20;for&#x20;OS&#x20;X&#x20;and&#x20;updated&#x20;JREs&#x20;and&#x20;JDK&#x20;are&#x20;made&#x20;available&#x20;by&#x20;Oracle.&#x20;&#x20;The&#x20;latest&#x20;version&#x20;of&#x20;Java&#x20;6&#x20;made&#x20;available&#x20;by&#x20;Apple&#x20;has&#x20;many&#x20;unpatched&#x20;vulnerabilities&#x20;and&#x20;should&#x20;not&#x20;be&#x20;the&#x20;default&#x20;runtime&#x20;for&#x20;Java&#x20;applets&#x20;that&#x20;request&#x20;one&#x20;from&#x20;the&#x20;Operating&#x20;System','Java&#x20;is&#x20;one&#x20;of&#x20;the&#x20;most&#x20;exploited&#x20;environments&#x20;and&#x20;is&#x20;no&#x20;longer&#x20;maintained&#x20;by&#x20;Apple,&#x20;old&#x20;versions&#x20;may&#x20;still&#x20;be&#x20;installed&#x20;and&#x20;should&#x20;be&#x20;removed&#x20;from&#x20;the&#x20;computer&#x20;or&#x20;not&#x20;be&#x20;in&#x20;the&#x20;default&#x20;path.','','Java&#x20;6&#x20;can&#x20;be&#x20;removed&#x20;completely&#x20;or,&#x20;if&#x20;necessary&#x20;Java&#x20;applications&#x20;will&#x20;only&#x20;work&#x20;with&#x20;Java&#x20;6,&#x20;a&#x20;custom&#x20;path&#x20;can&#x20;be&#x20;used.','[{\"cis\": [\"2.11\"]}]'),(8518,'Enable&#x20;security&#x20;auditing','OSX&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.2\"]}]'),(8519,'Configure&#x20;Security&#x20;Auditing&#x20;Flags','Auditing&#x20;is&#x20;the&#x20;capture&#x20;and&#x20;maintenance&#x20;of&#x20;information&#x20;about&#x20;security-related&#x20;events.','Maintaining&#x20;an&#x20;audit&#x20;trail&#x20;of&#x20;system&#x20;activity&#x20;logs&#x20;can&#x20;help&#x20;identify&#x20;configuration&#x20;errors,&#x20;troubleshoot&#x20;service&#x20;disruptions,&#x20;and&#x20;analyze&#x20;compromises&#x20;or&#x20;attacks&#x20;that&#x20;have&#x20;occurred,&#x20;have&#x20;begun,&#x20;or&#x20;are&#x20;about&#x20;to&#x20;begin.&#x20;Audit&#x20;logs&#x20;are&#x20;necessary&#x20;to&#x20;provide&#x20;a&#x20;trail&#x20;of&#x20;evidence&#x20;in&#x20;case&#x20;the&#x20;system&#x20;or&#x20;network&#x20;is&#x20;compromised.','','1.&#x20;Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;edit&#x20;the&#x20;/etc/security/audit_control&#x20;file&#x20;2.&#x20;Find&#x20;the&#x20;line&#x20;beginning&#x20;with&#x20;&quot;flags&quot;&#x20;3.&#x20;Add&#x20;the&#x20;following&#x20;flags:&#x20;lo,&#x20;ad,&#x20;fd,&#x20;fm,&#x20;-all.&#x20;&#x20;4.&#x20;Save&#x20;the&#x20;file.','[{\"cis\": [\"3.3\"]}]'),(8520,'Disable&#x20;Bonjour&#x20;advertising&#x20;service','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;Mac&#x20;OS&#x20;X&#x20;&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;stop&#x20;the&#x20;computer&#x20;from&#x20;sending&#x20;out&#x20;service&#x20;discovery&#x20;messages&#x20;when&#x20;looking&#x20;for&#x20;services&#x20;on&#x20;an&#x20;internal&#x20;subnet,&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;looking&#x20;for&#x20;a&#x20;printer&#x20;or&#x20;server&#x20;and&#x20;using&#x20;service&#x20;discovery.&#x20;To&#x20;block&#x20;all&#x20;Bonjour&#x20;traffic&#x20;except&#x20;to&#x20;approved&#x20;devices&#x20;the&#x20;pf&#x20;or&#x20;other&#x20;firewall&#x20;would&#x20;be&#x20;needed.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements','[{\"cis\": [\"4.1\"]}]'),(8521,'Ensure&#x20;http&#x20;server&#x20;is&#x20;not&#x20;running','Mac&#x20;OS&#x20;X&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;Web&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;&#x20;&#x20;&#x20;Stop&#x20;the&#x20;Web&#x20;Server:&#x20;sudo&#x20;apachectl&#x20;stop&#x20;&#x20;&#x20;&#x20;Ensure&#x20;that&#x20;the&#x20;web&#x20;server&#x20;will&#x20;not&#x20;auto-start&#x20;at&#x20;boot:&#x20;sudo&#x20;defaults&#x20;write&#x20;/System/Library/LaunchDaemons/org.apache.httpd&#x20;Disabled&#x20;-bool&#x20;true','[{\"cis\": [\"4.4\"]}]'),(8522,'Ensure&#x20;ftp&#x20;server&#x20;is&#x20;not&#x20;running','Mac&#x20;OS&#x20;X&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;ftp&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Ftp&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Running&#x20;an&#x20;Ftp&#x20;server&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;The&#x20;Ftp&#x20;server&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;Ftp&#x20;servers&#x20;meet&#x20;a&#x20;specialized&#x20;need&#x20;to&#x20;distribute&#x20;files&#x20;without&#x20;strong&#x20;authentication&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;servers.&#x20;Cloud&#x20;services&#x20;or&#x20;other&#x20;distribution&#x20;methods&#x20;should&#x20;be&#x20;considered','Ftp&#x20;servers&#x20;should&#x20;not&#x20;be&#x20;run&#x20;on&#x20;an&#x20;end&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;servers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot.&#x20;Stop&#x20;the&#x20;ftp&#x20;Server:&#x20;sudo&#x20;-s&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/ftp.plist','[{\"cis\": [\"4.5\"]}]'),(8523,'Ensure&#x20;nfs&#x20;server&#x20;is&#x20;not&#x20;running','Mac&#x20;OS&#x20;X&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop,&#x20;dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Stop&#x20;the&#x20;NFS&#x20;Server:&#x20;sudo&#x20;nfsd&#x20;disable&#x20;&#x20;&#x20;&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing:&#x20;rm&#x20;/etc/export','[{\"cis\": [\"4.6\"]}]'),(8524,'Do&#x20;not&#x20;enable&#x20;the&#x20;&quot;root&quot;&#x20;account','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;In&#x20;the&#x20;UNIX/Linux&#x20;world,&#x20;the&#x20;system&#x20;administrator&#x20;commonly&#x20;uses&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;Mac&#x20;OS&#x20;X&#x20;client&#x20;computer.&#x20;It&#x20;is&#x20;enabled&#x20;on&#x20;Mac&#x20;OS&#x20;X&#x20;Server.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Open&#x20;System&#x20;Preferences,&#x20;Uses&#x20;&amp;&#x20;Groups.&#x20;&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;&#x20;In&#x20;the&#x20;Network&#x20;Account&#x20;Server&#x20;section,&#x20;click&#x20;Join&#x20;or&#x20;Edit.&#x20;&#x20;Click&#x20;Open&#x20;Directory&#x20;Utility.&#x20;&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;&#x20;Select&#x20;the&#x20;Edit&#x20;menu&#x20;&gt;&#x20;Disable&#x20;Root&#x20;User.','[{\"cis\": [\"5.7\"]}]'),(8525,'Disable&#x20;automatic&#x20;login','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen,&#x20;instead&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.8\"]}]'),(8526,'Require&#x20;a&#x20;password&#x20;to&#x20;wake&#x20;the&#x20;computer&#x20;from&#x20;sleep&#x20;or&#x20;screen&#x20;saver','Sleep&#x20;and&#x20;screensaver&#x20;modes&#x20;are&#x20;low&#x20;power&#x20;modes&#x20;that&#x20;reduces&#x20;electrical&#x20;consumption&#x20;while&#x20;the&#x20;system&#x20;is&#x20;not&#x20;in&#x20;use.','Prompting&#x20;for&#x20;a&#x20;password&#x20;when&#x20;waking&#x20;from&#x20;sleep&#x20;or&#x20;screensaver&#x20;mode&#x20;mitigates&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system&#x20;in&#x20;the&#x20;user&#039;s&#x20;absence.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;The&#x20;current&#x20;user&#x20;will&#x20;need&#x20;to&#x20;log&#x20;off&#x20;and&#x20;on&#x20;for&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;defaults&#x20;write&#x20;com.apple.screensaver&#x20;askForPassword&#x20;-int&#x20;1&#x20;&#x20;2.&#x20;&#x20;The&#x20;current&#x20;user&#x20;will&#x20;need&#x20;to&#x20;log&#x20;off&#x20;and&#x20;on&#x20;for&#x20;changes&#x20;to&#x20;take&#x20;effect.','[{\"cis\": [\"5.9\"]}]'),(8527,'Disable&#x20;ability&#x20;to&#x20;login&#x20;to&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session','OSX&#x20;has&#x20;a&#x20;privilege&#x20;that&#x20;can&#x20;be&#x20;granted&#x20;to&#x20;any&#x20;user&#x20;that&#x20;will&#x20;allow&#x20;that&#x20;user&#x20;to&#x20;unlock&#x20;active&#x20;user&#039;s&#x20;sessions.','Disabling&#x20;the&#x20;admins&#x20;and/or&#x20;user&#039;s&#x20;ability&#x20;to&#x20;log&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;potentially&#x20;sensitive&#x20;and/or&#x20;personal&#x20;information.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;&#x20;sudo&#x20;vi&#x20;/etc/pam.d/screensaver&#x20;2.&#x20;Locate&#x20;&#x20;&#x20;&quot;account&#x20;&#x20;&#x20;&#x20;required&#x20;&#x20;&#x20;&#x20;&#x20;pam_group.so&#x20;no_warn&#x20;group=admin,wheel&#x20;fail_safe&quot;&#x20;3.&#x20;Remove&#x20;&quot;admin,&quot;&#x20;4.&#x20;Save','[{\"cis\": [\"5.11\"]}]'),(8528,'System&#x20;Integrity&#x20;Protection&#x20;status','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;new&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;OS&#x20;X&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;&#x20;&#x20;&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.18\"]}]'),(8529,'Disable&#x20;guest&#x20;account&#x20;login','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes,&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system&#x20;and&#x20;all&#x20;created&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;NO','[{\"cis\": [\"6.1.3\"]}]'),(8530,'Remove&#x20;Guest&#x20;home&#x20;folder','The&#x20;guest&#x20;account&#x20;login&#x20;should&#x20;have&#x20;been&#x20;disabled,&#x20;so&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folders&#x20;continued&#x20;existence&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;rm&#x20;-R&#x20;/Users/Guest&#x20;&#x20;2.&#x20;Make&#x20;sure&#x20;there&#x20;is&#x20;no&#x20;output','[{\"cis\": [\"6.1.5\"]}]'),(8531,'Turn&#x20;on&#x20;filename&#x20;extensions','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Select&#x20;Finder&#x20;2.&#x20;Select&#x20;Preferences&#x20;3.&#x20;Check&#x20;Show&#x20;all&#x20;filename&#x20;extensions&#x20;&#x20;&#x20;&#x20;Alternatively,&#x20;use&#x20;the&#x20;following&#x20;command:&#x20;defaults&#x20;write&#x20;NSGlobalDomain&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}]'),(8532,'Disable&#x20;the&#x20;automatic&#x20;run&#x20;of&#x20;safe&#x20;files&#x20;in&#x20;Safari','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Safari&#x20;2.&#x20;Select&#x20;Safari&#x20;from&#x20;the&#x20;menu&#x20;bar&#x20;3.&#x20;Select&#x20;Preferences&#x20;4.&#x20;Select&#x20;General&#x20;5.&#x20;Uncheck&#x20;Open&#x20;&quot;safe&quot;&#x20;files&#x20;after&#x20;downloading&#x20;&#x20;&#x20;&#x20;Alternatively&#x20;run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-boolean&#x20;no','[{\"cis\": [\"6.3\"]}]'),(9000,'Verify&#x20;all&#x20;Apple&#x20;provided&#x20;software&#x20;is&#x20;current','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following:&#x20;softwareupdate&#x20;-l&#x20;&#x20;2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename','[{\"cis\": [\"1.1\"]}]'),(9001,'Enable&#x20;Auto&#x20;Update','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-int&#x20;1','[{\"cis\": [\"1.2\"]}]'),(9002,'Enable&#x20;app&#x20;update&#x20;installs','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-bool&#x20;TRUE&#x20;&#x20;&#x20;&#x20;The&#x20;remediation&#x20;requires&#x20;a&#x20;log&#x20;out&#x20;and&#x20;log&#x20;in&#x20;to&#x20;show&#x20;in&#x20;the&#x20;GUI.&#x20;Please&#x20;note&#x20;that.','[{\"cis\": [\"1.3\"]}]'),(9003,'Enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;update&#x20;installs','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper,&#x20;with&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.4\"]}]'),(9004,'Enable&#x20;macOS&#x20;update&#x20;installs','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdateRestartRequired&#x20;-bool&#x20;TRUE','[{\"cis\": [\"1.5\"]}]'),(9005,'Enable&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;&#x20;Note:&#x20;If&#x20;your&#x20;organization&#x20;has&#x20;internal&#x20;time&#x20;servers,&#x20;enter&#x20;them&#x20;here.&#x20;Enterprise&#x20;mobile&#x20;devices&#x20;may&#x20;need&#x20;to&#x20;use&#x20;a&#x20;mix&#x20;of&#x20;internal&#x20;and&#x20;external&#x20;time&#x20;servers.&#x20;If&#x20;multiple&#x20;servers&#x20;are&#x20;required&#x20;use&#x20;the&#x20;Date&#x20;&amp;&#x20;Time&#x20;System&#x20;Preference&#x20;with&#x20;each&#x20;server&#x20;separated&#x20;by&#x20;a&#x20;space.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;&#x20;&#x20;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on','[{\"cis\": [\"2.2.1\"]}]'),(9006,'Disable&#x20;Remote&#x20;Apple&#x20;Events','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}]'),(9007,'Disable&#x20;Printer&#x20;Sharing','By&#x20;enabling&#x20;Printer&#x20;sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Sharing&#x20;3.&#x20;Uncheck&#x20;Printer&#x20;Sharing','[{\"cis\": [\"2.4.4\"]}]'),(9008,'Disable&#x20;Remote&#x20;Login','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}]'),(9009,'Disable&#x20;File&#x20;Sharing','Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;a&#x20;combination&#x20;of&#x20;SMB&#x20;&#40;Windows&#x20;sharing&#41;&#x20;and&#x20;AFP&#x20;&#40;Mac&#x20;sharing&#41;','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;AFP&#x20;from&#x20;the&#x20;command&#x20;line:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.AppleFileServer.plist&#x20;&#x20;-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;SMB&#x20;sharing&#x20;from&#x20;the&#x20;CLI:&#x20;&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.smbd.plist','[{\"cis\": [\"2.4.8\"]}]'),(9010,'Disable&#x20;&quot;Wake&#x20;for&#x20;network&#x20;access&quot;','This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&#039;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;unmanaged&#x20;network&#x20;where&#x20;untrusted&#x20;devices&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0&#x20;&#x20;&#x20;Note:&#x20;The&#x20;-c&#x20;flag&#x20;means&#x20;&quot;wall&#x20;power.&quot;&#x20;Different&#x20;settings&#x20;must&#x20;be&#x20;used&#x20;for&#x20;other&#x20;power&#x20;sources.','[{\"cis\": [\"2.5.1\"]}]'),(9011,'Enable&#x20;FileVault','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.6.1.1\"]}]'),(9012,'Enable&#x20;Gatekeeper','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;white-listing&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;spctl&#x20;--master-enable','[{\"cis\": [\"2.6.2\"]}]'),(9013,'Enable&#x20;Firewall','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-&#x20;int&#x20;&lt;value&gt;&#x20;&#x20;&#x20;&#x20;Where&#x20;&lt;value&gt;&#x20;is:&#x20;-&#x20;1&#x20;=&#x20;on&#x20;for&#x20;specific&#x20;services&#x20;-&#x20;2&#x20;=&#x20;on&#x20;for&#x20;essential&#x20;services','[{\"cis\": [\"2.6.3\"]}]'),(9014,'Enable&#x20;Firewall&#x20;Stealth&#x20;Mode','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.6.4\"]}]'),(9015,'Enable&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;in&#x20;terminal.app','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Terminal&#x20;2.&#x20;Select&#x20;Terminal&#x20;3.&#x20;Select&#x20;Secure&#x20;Keyboard&#x20;Entry','[{\"cis\": [\"2.10\"]}]'),(9016,'Java&#x20;6&#x20;is&#x20;not&#x20;the&#x20;default&#x20;Java&#x20;runtime','Apple&#x20;had&#x20;made&#x20;Java&#x20;part&#x20;of&#x20;the&#x20;core&#x20;Operating&#x20;System&#x20;for&#x20;macOS.&#x20;Apple&#x20;is&#x20;no&#x20;longer&#x20;providing&#x20;Java&#x20;updates&#x20;for&#x20;macOS&#x20;and&#x20;updated&#x20;JREs&#x20;and&#x20;JDK&#x20;are&#x20;made&#x20;available&#x20;by&#x20;Oracle.&#x20;&#x20;The&#x20;latest&#x20;version&#x20;of&#x20;Java&#x20;6&#x20;made&#x20;available&#x20;by&#x20;Apple&#x20;has&#x20;many&#x20;unpatched&#x20;vulnerabilities&#x20;and&#x20;should&#x20;not&#x20;be&#x20;the&#x20;default&#x20;runtime&#x20;for&#x20;Java&#x20;applets&#x20;that&#x20;request&#x20;one&#x20;from&#x20;the&#x20;Operating&#x20;System','Java&#x20;has&#x20;been&#x20;one&#x20;of&#x20;the&#x20;most&#x20;exploited&#x20;environments&#x20;and&#x20;Java&#x20;6,&#x20;which&#x20;was&#x20;provided&#x20;as&#x20;an&#x20;OS&#x20;component&#x20;by&#x20;Apple,&#x20;is&#x20;no&#x20;longer&#x20;maintained&#x20;by&#x20;Apple&#x20;or&#x20;Oracle.&#x20;The&#x20;old&#x20;versions&#x20;provided&#x20;by&#x20;Apple&#x20;are&#x20;both&#x20;unsupported&#x20;and&#x20;missing&#x20;the&#x20;more&#x20;modern&#x20;security&#x20;controls&#x20;that&#x20;have&#x20;limited&#x20;current&#x20;exploits.&#x20;The&#x20;EOL&#x20;version&#x20;may&#x20;still&#x20;be&#x20;installed&#x20;and&#x20;should&#x20;be&#x20;removed&#x20;from&#x20;the&#x20;computer&#x20;or&#x20;not&#x20;be&#x20;in&#x20;the&#x20;default&#x20;path.','','Java&#x20;6&#x20;can&#x20;be&#x20;removed&#x20;completely&#x20;or,&#x20;if&#x20;required&#x20;Java&#x20;applications&#x20;will&#x20;only&#x20;work&#x20;with&#x20;Java&#x20;6,&#x20;a&#x20;custom&#x20;path&#x20;can&#x20;be&#x20;used.&#x20;Apple&#x20;is&#x20;likely&#x20;to&#x20;finally&#x20;pull&#x20;the&#x20;plug&#x20;on&#x20;Java&#x20;6&#x20;in&#x20;upcoming&#x20;macOS&#x20;versions&#x20;so&#x20;any&#x20;applications&#x20;that&#x20;still&#x20;require&#x20;Java&#x20;6&#x20;will&#x20;likely&#x20;soon&#x20;be&#x20;unavailable.','[{\"cis\": [\"2.11\"]}]'),(9017,'Enable&#x20;security&#x20;auditing','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.1\"]}]'),(9018,'Configure&#x20;Security&#x20;Auditing&#x20;Flags','Auditing&#x20;is&#x20;the&#x20;capture&#x20;and&#x20;maintenance&#x20;of&#x20;information&#x20;about&#x20;security-related&#x20;events.','Maintaining&#x20;an&#x20;audit&#x20;trail&#x20;of&#x20;system&#x20;activity&#x20;logs&#x20;can&#x20;help&#x20;identify&#x20;configuration&#x20;errors,&#x20;troubleshoot&#x20;service&#x20;disruptions,&#x20;and&#x20;analyze&#x20;compromises&#x20;or&#x20;attacks&#x20;that&#x20;have&#x20;occurred,&#x20;have&#x20;begun,&#x20;or&#x20;are&#x20;about&#x20;to&#x20;begin.&#x20;Audit&#x20;logs&#x20;are&#x20;necessary&#x20;to&#x20;provide&#x20;a&#x20;trail&#x20;of&#x20;evidence&#x20;in&#x20;case&#x20;the&#x20;system&#x20;or&#x20;network&#x20;is&#x20;compromised.','','1.&#x20;Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;edit&#x20;the&#x20;/etc/security/audit_control&#x20;file&#x20;2.&#x20;Find&#x20;the&#x20;line&#x20;beginning&#x20;with&#x20;&quot;flags&quot;&#x20;3.&#x20;Add&#x20;the&#x20;following&#x20;flags:&#x20;lo,&#x20;ad,&#x20;fd,&#x20;fm,&#x20;-all.&#x20;&#x20;4.&#x20;Save&#x20;the&#x20;file.','[{\"cis\": [\"3.2\"]}]'),(9019,'Disable&#x20;Bonjour&#x20;advertising&#x20;service','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements','[{\"cis\": [\"4.1\"]}]'),(9020,'Ensure&#x20;http&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Stop&#x20;the&#x20;Web&#x20;Server&#x20;sudo&#x20;apachectl&#x20;stop&#x20;&#x20;&#x20;&#x20;Ensure&#x20;that&#x20;the&#x20;web&#x20;server&#x20;will&#x20;not&#x20;auto-start&#x20;at&#x20;boot&#x20;sudo&#x20;defaults&#x20;write&#x20;/System/Library/LaunchDaemons/org.apache.httpd&#x20;Disabled&#x20;-&#x20;bool&#x20;true','[{\"cis\": [\"4.4\"]}]'),(9021,'Ensure&#x20;FTP&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;FTP&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;FTP&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Running&#x20;an&#x20;FTP&#x20;server&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;The&#x20;FTP&#x20;server&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;FTP&#x20;servers&#x20;meet&#x20;a&#x20;specialized&#x20;need&#x20;to&#x20;distribute&#x20;files&#x20;without&#x20;strong&#x20;authentication&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;servers.&#x20;Cloud&#x20;services&#x20;or&#x20;other&#x20;distribution&#x20;methods&#x20;should&#x20;be&#x20;considered','FTP&#x20;servers&#x20;should&#x20;not&#x20;be&#x20;run&#x20;on&#x20;an&#x20;end&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;servers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Stop&#x20;the&#x20;ftp&#x20;Server&#x20;sudo&#x20;-s&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/ftp.plist','[{\"cis\": [\"4.5\"]}]'),(9022,'Ensure&#x20;nfs&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop,&#x20;dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Stop&#x20;the&#x20;NFS&#x20;Server&#x20;sudo&#x20;nfsd&#x20;disable&#x20;&#x20;&#x20;&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing&#x20;rm&#x20;/etc/export','[{\"cis\": [\"4.6\"]}]'),(9023,'Do&#x20;not&#x20;enable&#x20;the&#x20;&quot;root&quot;&#x20;account','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;Linux&#x20;distros&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;uses&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Open&#x20;System&#x20;Preferences,&#x20;Uses&#x20;&amp;&#x20;Groups.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;In&#x20;the&#x20;Network&#x20;Account&#x20;Server&#x20;section,&#x20;click&#x20;Join&#x20;or&#x20;Edit.&#x20;Click&#x20;Open&#x20;Directory&#x20;Utility.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;Select&#x20;the&#x20;Edit&#x20;menu&#x20;&gt;&#x20;Disable&#x20;Root&#x20;User.','[{\"cis\": [\"5.8\"]}]'),(9024,'Disable&#x20;automatic&#x20;login','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen,&#x20;instead&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.9\"]}]'),(9025,'System&#x20;Integrity&#x20;Protection&#x20;status','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;macOS&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;&#x20;&#x20;&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.20\"]}]'),(9026,'Disable&#x20;guest&#x20;account&#x20;login','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes,&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system&#x20;and&#x20;all&#x20;created&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;NO','[{\"cis\": [\"6.1.3\"]}]'),(9027,'Remove&#x20;Guest&#x20;home&#x20;folder','The&#x20;guest&#x20;account&#x20;login&#x20;should&#x20;have&#x20;been&#x20;disabled,&#x20;so&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folders&#x20;continued&#x20;existence&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;rm&#x20;-R&#x20;/Users/Guest&#x20;&#x20;2.&#x20;Make&#x20;sure&#x20;there&#x20;is&#x20;no&#x20;output','[{\"cis\": [\"6.1.5\"]}]'),(9028,'Turn&#x20;on&#x20;filename&#x20;extensions','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Select&#x20;Finder&#x20;2.&#x20;Select&#x20;Preferences&#x20;3.&#x20;Check&#x20;Show&#x20;all&#x20;filename&#x20;extensions&#x20;&#x20;&#x20;&#x20;Alternatively,&#x20;use&#x20;the&#x20;following&#x20;command:&#x20;defaults&#x20;write&#x20;NSGlobalDomain&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}]'),(9029,'Disable&#x20;the&#x20;automatic&#x20;run&#x20;of&#x20;safe&#x20;files&#x20;in&#x20;Safari','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Safari&#x20;2.&#x20;Select&#x20;Safari&#x20;from&#x20;the&#x20;menu&#x20;bar&#x20;3.&#x20;Select&#x20;Preferences&#x20;4.&#x20;Select&#x20;General&#x20;5.&#x20;Uncheck&#x20;Open&#x20;&quot;safe&quot;&#x20;files&#x20;after&#x20;downloading&#x20;&#x20;&#x20;&#x20;Alternatively&#x20;run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-boolean&#x20;no','[{\"cis\": [\"6.3\"]}]'),(9500,'Verify&#x20;all&#x20;Apple&#x20;provided&#x20;software&#x20;is&#x20;current','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following:&#x20;softwareupdate&#x20;-l&#x20;&#x20;&#x20;&#x20;2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename','[{\"cis\": [\"1.1\"]}]'),(9501,'Enable&#x20;Auto&#x20;Update','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-int&#x20;1','[{\"cis\": [\"1.2\"]}]'),(9502,'Enable&#x20;app&#x20;update&#x20;installs','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-bool&#x20;TRUE&#x20;&#x20;&#x20;&#x20;The&#x20;remediation&#x20;requires&#x20;a&#x20;log&#x20;out&#x20;and&#x20;log&#x20;in&#x20;to&#x20;show&#x20;in&#x20;the&#x20;GUI.&#x20;Please&#x20;note&#x20;that.','[{\"cis\": [\"1.3\"]}]'),(9503,'Enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;update&#x20;installs','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper,&#x20;with&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.4\"]}]'),(9504,'Enable&#x20;macOS&#x20;update&#x20;installs','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdateRestartRequired&#x20;-bool&#x20;TRUE','[{\"cis\": [\"1.5\"]}]'),(9505,'Enable&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;&#x20;&#x20;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on','[{\"cis\": [\"2.2.1\"]}]'),(9506,'Disable&#x20;Remote&#x20;Apple&#x20;Events','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}]'),(9507,'Disable&#x20;Printer&#x20;Sharing','By&#x20;enabling&#x20;Printer&#x20;sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Sharing&#x20;3.&#x20;Uncheck&#x20;Printer&#x20;Sharing','[{\"cis\": [\"2.4.4\"]}]'),(9508,'Disable&#x20;Remote&#x20;Login','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}]'),(9509,'Disable&#x20;File&#x20;Sharing','Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;a&#x20;combination&#x20;of&#x20;SMB&#x20;&#40;Windows&#x20;sharing&#41;&#x20;and&#x20;AFP&#x20;&#40;Mac&#x20;sharing&#41;','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;AFP&#x20;from&#x20;the&#x20;command&#x20;line:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.AppleFileServer.plist&#x20;&#x20;-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;SMB&#x20;sharing&#x20;from&#x20;the&#x20;CLI:&#x20;&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.smbd.plist','[{\"cis\": [\"2.4.8\"]}]'),(9510,'Disable&#x20;&quot;Wake&#x20;for&#x20;network&#x20;access&quot;','This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&#039;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;unmanaged&#x20;network&#x20;where&#x20;untrusted&#x20;devices&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0','[{\"cis\": [\"2.5.1\"]}]'),(9511,'Enable&#x20;FileVault','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.6.1.1\"]}]'),(9512,'Enable&#x20;Gatekeeper','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;white-listing&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;spctl&#x20;--master-enable','[{\"cis\": [\"2.6.2\"]}]'),(9513,'Enable&#x20;Firewall','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-&#x20;int&#x20;&lt;value&gt;&#x20;&#x20;&#x20;&#x20;Where&#x20;&lt;value&gt;&#x20;is:&#x20;-&#x20;1&#x20;=&#x20;on&#x20;for&#x20;specific&#x20;services&#x20;-&#x20;2&#x20;=&#x20;on&#x20;for&#x20;essential&#x20;services&#x20;','[{\"cis\": [\"2.6.3\"]}]'),(9514,'Enable&#x20;Firewall&#x20;Stealth&#x20;Mode','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.6.4\"]}]'),(9515,'Enable&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;in&#x20;terminal.app','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Terminal&#x20;2.&#x20;Select&#x20;Terminal&#x20;3.&#x20;Select&#x20;Secure&#x20;Keyboard&#x20;Entry','[{\"cis\": [\"2.10\"]}]'),(9516,'Java&#x20;6&#x20;is&#x20;not&#x20;the&#x20;default&#x20;Java&#x20;runtime','Apple&#x20;had&#x20;made&#x20;Java&#x20;part&#x20;of&#x20;the&#x20;core&#x20;Operating&#x20;System&#x20;for&#x20;macOS.&#x20;Apple&#x20;is&#x20;no&#x20;longer&#x20;providing&#x20;Java&#x20;updates&#x20;for&#x20;macOS&#x20;and&#x20;updated&#x20;JREs&#x20;and&#x20;JDK&#x20;are&#x20;made&#x20;available&#x20;by&#x20;Oracle.&#x20;&#x20;The&#x20;latest&#x20;version&#x20;of&#x20;Java&#x20;6&#x20;made&#x20;available&#x20;by&#x20;Apple&#x20;has&#x20;many&#x20;unpatched&#x20;vulnerabilities&#x20;and&#x20;should&#x20;not&#x20;be&#x20;the&#x20;default&#x20;runtime&#x20;for&#x20;Java&#x20;applets&#x20;that&#x20;request&#x20;one&#x20;from&#x20;the&#x20;Operating&#x20;System','Java&#x20;has&#x20;been&#x20;one&#x20;of&#x20;the&#x20;most&#x20;exploited&#x20;environments&#x20;and&#x20;Java&#x20;6,&#x20;which&#x20;was&#x20;provided&#x20;as&#x20;an&#x20;OS&#x20;component&#x20;by&#x20;Apple,&#x20;is&#x20;no&#x20;longer&#x20;maintained&#x20;by&#x20;Apple&#x20;or&#x20;Oracle.&#x20;The&#x20;old&#x20;versions&#x20;provided&#x20;by&#x20;Apple&#x20;are&#x20;both&#x20;unsupported&#x20;and&#x20;missing&#x20;the&#x20;more&#x20;modern&#x20;security&#x20;controls&#x20;that&#x20;have&#x20;limited&#x20;current&#x20;exploits.&#x20;The&#x20;EOL&#x20;version&#x20;may&#x20;still&#x20;be&#x20;installed&#x20;and&#x20;should&#x20;be&#x20;removed&#x20;from&#x20;the&#x20;computer&#x20;or&#x20;not&#x20;be&#x20;in&#x20;the&#x20;default&#x20;path.','','Java&#x20;6&#x20;can&#x20;be&#x20;removed&#x20;completely&#x20;or,&#x20;if&#x20;required&#x20;Java&#x20;applications&#x20;will&#x20;only&#x20;work&#x20;with&#x20;Java&#x20;6,&#x20;a&#x20;custom&#x20;path&#x20;can&#x20;be&#x20;used.&#x20;Apple&#x20;is&#x20;likely&#x20;to&#x20;finally&#x20;pull&#x20;the&#x20;plug&#x20;on&#x20;Java&#x20;6&#x20;in&#x20;upcoming&#x20;macOS&#x20;versions&#x20;so&#x20;any&#x20;applications&#x20;that&#x20;still&#x20;require&#x20;Java&#x20;6&#x20;will&#x20;likely&#x20;soon&#x20;be&#x20;unavailable.','[{\"cis\": [\"2.11\"]}]'),(9517,'Ensure&#x20;EFI&#x20;version&#x20;is&#x20;valid&#x20;and&#x20;being&#x20;regularly&#x20;checked','In&#x20;order&#x20;to&#x20;mitigate&#x20;firmware&#x20;attacks&#x20;Apple&#x20;has&#x20;created&#x20;a&#x20;automated&#x20;Firmware&#x20;check&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;EFI&#x20;version&#x20;running&#x20;is&#x20;a&#x20;known&#x20;good&#x20;version&#x20;from&#x20;Apple.&#x20;There&#x20;is&#x20;also&#x20;an&#x20;automated&#x20;process&#x20;to&#x20;check&#x20;it&#x20;every&#x20;seven&#x20;days.','If&#x20;the&#x20;Firmware&#x20;of&#x20;a&#x20;computer&#x20;has&#x20;been&#x20;compromised&#x20;the&#x20;Operating&#x20;System&#x20;that&#x20;the&#x20;Firmware&#x20;loads&#x20;cannot&#x20;be&#x20;trusted&#x20;either.','','If&#x20;EFI&#x20;does&#x20;not&#x20;pass&#x20;the&#x20;integrity&#x20;check&#x20;you&#x20;may&#x20;send&#x20;a&#x20;report&#x20;to&#x20;Apple.&#x20;Backing&#x20;up&#x20;files&#x20;and&#x20;clean&#x20;installing&#x20;a&#x20;known&#x20;good&#x20;Operating&#x20;System&#x20;and&#x20;Firmware&#x20;is&#x20;recommended.','[{\"cis\": [\"2.13\"]}]'),(9518,'Enable&#x20;security&#x20;auditing','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.1\"]}]'),(9519,'Configure&#x20;Security&#x20;Auditing&#x20;Flags','Auditing&#x20;is&#x20;the&#x20;capture&#x20;and&#x20;maintenance&#x20;of&#x20;information&#x20;about&#x20;security-related&#x20;events.','Maintaining&#x20;an&#x20;audit&#x20;trail&#x20;of&#x20;system&#x20;activity&#x20;logs&#x20;can&#x20;help&#x20;identify&#x20;configuration&#x20;errors,&#x20;troubleshoot&#x20;service&#x20;disruptions,&#x20;and&#x20;analyze&#x20;compromises&#x20;or&#x20;attacks&#x20;that&#x20;have&#x20;occurred,&#x20;have&#x20;begun,&#x20;or&#x20;are&#x20;about&#x20;to&#x20;begin.&#x20;Audit&#x20;logs&#x20;are&#x20;necessary&#x20;to&#x20;provide&#x20;a&#x20;trail&#x20;of&#x20;evidence&#x20;in&#x20;case&#x20;the&#x20;system&#x20;or&#x20;network&#x20;is&#x20;compromised.','','1.&#x20;Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;edit&#x20;the&#x20;/etc/security/audit_control&#x20;file&#x20;&#x20;2.&#x20;Find&#x20;the&#x20;line&#x20;beginning&#x20;with&#x20;&quot;flags&quot;&#x20;&#x20;3.&#x20;Add&#x20;the&#x20;following&#x20;flags:&#x20;lo,&#x20;ad,&#x20;fd,&#x20;fm,&#x20;-all.&#x20;&#x20;4.&#x20;Save&#x20;the&#x20;file.','[{\"cis\": [\"3.2\"]}]'),(9520,'Disable&#x20;Bonjour&#x20;advertising&#x20;service','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements','[{\"cis\": [\"4.1\"]}]'),(9521,'Ensure&#x20;http&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;Web&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;Web&#x20;Server:&#x20;sudo&#x20;apachectl&#x20;stop&#x20;&#x20;&#x20;&#x20;Ensure&#x20;that&#x20;the&#x20;web&#x20;server&#x20;will&#x20;not&#x20;auto-start&#x20;at&#x20;boot&#x20;sudo:&#x20;defaults&#x20;write&#x20;/System/Library/LaunchDaemons/org.apache.httpd&#x20;Disabled&#x20;-&#x20;bool&#x20;true','[{\"cis\": [\"4.4\"]}]'),(9522,'Ensure&#x20;nfs&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop,&#x20;dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;NFS&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;NFS&#x20;Server:&#x20;sudo&#x20;nfsd&#x20;disable&#x20;&#x20;&#x20;&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing:&#x20;rm&#x20;/etc/export','[{\"cis\": [\"4.5\"]}]'),(9523,'Do&#x20;not&#x20;enable&#x20;the&#x20;&quot;root&quot;&#x20;account','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;Linux&#x20;distros&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;uses&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Open&#x20;System&#x20;Preferences,&#x20;Uses&#x20;&amp;&#x20;Groups.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;In&#x20;the&#x20;Network&#x20;Account&#x20;Server&#x20;section,&#x20;click&#x20;Join&#x20;or&#x20;Edit.&#x20;Click&#x20;Open&#x20;Directory&#x20;Utility.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;Select&#x20;the&#x20;Edit&#x20;menu&#x20;&gt;&#x20;Disable&#x20;Root&#x20;User.','[{\"cis\": [\"5.11\"]}]'),(9524,'Disable&#x20;automatic&#x20;login','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen,&#x20;instead&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.12\"]}]'),(9525,'System&#x20;Integrity&#x20;Protection&#x20;status','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;macOS&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;&#x20;&#x20;&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.23\"]}]'),(9526,'Disable&#x20;guest&#x20;account&#x20;login','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes,&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system&#x20;and&#x20;all&#x20;created&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;NO','[{\"cis\": [\"6.1.3\"]}]'),(9527,'Remove&#x20;Guest&#x20;home&#x20;folder','The&#x20;guest&#x20;account&#x20;login&#x20;should&#x20;have&#x20;been&#x20;disabled,&#x20;so&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folders&#x20;continued&#x20;existence&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;rm&#x20;-R&#x20;/Users/Guest&#x20;&#x20;2.&#x20;Make&#x20;sure&#x20;there&#x20;is&#x20;no&#x20;output','[{\"cis\": [\"6.1.5\"]}]'),(9528,'Turn&#x20;on&#x20;filename&#x20;extensions','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Select&#x20;Finder&#x20;2.&#x20;Select&#x20;Preferences&#x20;3.&#x20;Check&#x20;Show&#x20;all&#x20;filename&#x20;extensions&#x20;&#x20;&#x20;&#x20;Alternatively,&#x20;use&#x20;the&#x20;following&#x20;command:&#x20;defaults&#x20;write&#x20;NSGlobalDomain&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}]'),(9529,'Disable&#x20;the&#x20;automatic&#x20;run&#x20;of&#x20;safe&#x20;files&#x20;in&#x20;Safari','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Safari&#x20;2.&#x20;Select&#x20;Safari&#x20;from&#x20;the&#x20;menu&#x20;bar&#x20;3.&#x20;Select&#x20;Preferences&#x20;4.&#x20;Select&#x20;General&#x20;5.&#x20;Uncheck&#x20;Open&#x20;&quot;safe&quot;&#x20;files&#x20;after&#x20;downloading&#x20;&#x20;&#x20;&#x20;Alternatively&#x20;run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-boolean&#x20;no','[{\"cis\": [\"6.3\"]}]'),(10000,'Ensure&#x20;the&#x20;WebDAV&#x20;Modules&#x20;Are&#x20;Disabled','The&#x20;Apache&#x20;mod_dav&#x20;and&#x20;mod_dav_fs&#x20;modules&#x20;support&#x20;WebDAV&#x20;&#40;Web-based&#x20;Distributed&#x20;Authoring&#x20;and&#x20;Versioning&#41;&#x20;functionality&#x20;for&#x20;Apache.&#x20;WebDAV&#x20;is&#x20;an&#x20;extension&#x20;to&#x20;the&#x20;HTTP&#x20;protocol&#x20;which&#x20;allows&#x20;clients&#x20;to&#x20;create,&#x20;move,&#x20;and&#x20;delete&#x20;files&#x20;and&#x20;resources&#x20;on&#x20;the&#x20;web&#x20;server.','Disabling&#x20;WebDAV&#x20;modules&#x20;will&#x20;improve&#x20;the&#x20;security&#x20;posture&#x20;of&#x20;the&#x20;web&#x20;server&#x20;by&#x20;reducing&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;paths&#x20;exposed&#x20;to&#x20;the&#x20;network&#x20;and&#x20;reducing&#x20;potential&#x20;for&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;via&#x20;misconfigured&#x20;WebDAV&#x20;access&#x20;controls.','','Perform&#x20;either&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;WebDAV&#x20;module:&#x20;1.&#x20;For&#x20;source&#x20;builds&#x20;with&#x20;static&#x20;modules&#x20;run&#x20;the&#x20;Apache&#x20;./configure&#x20;script&#x20;without&#x20;including&#x20;the&#x20;mod_dav,&#x20;and&#x20;mod_dav_fs&#x20;in&#x20;the&#x20;--enable-modules=configure&#x20;script&#x20;options.&#x20;$&#x20;cd&#x20;$DOWNLOAD_HTTPD&#x20;$&#x20;./configure&#x20;2.&#x20;For&#x20;dynamically&#x20;loaded&#x20;modules&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;the&#x20;LoadModule&#x20;directive&#x20;for&#x20;mod_dav,&#x20;and&#x20;mod_dav_fs&#x20;modules&#x20;from&#x20;the&#x20;httpd.conf&#x20;file.&#x20;##LoadModule&#x20;dav_module&#x20;modules/mod_dav.so&#x20;##LoadModule&#x20;dav_fs_module&#x20;modules/mod_dav_fs.so','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(10001,'Ensure&#x20;the&#x20;Status&#x20;Module&#x20;Is&#x20;Disabled','The&#x20;Apache&#x20;mod_status&#x20;module&#x20;provides&#x20;current&#x20;server&#x20;performance&#x20;statistics.','When&#x20;mod_status&#x20;is&#x20;loaded&#x20;into&#x20;the&#x20;server,&#x20;its&#x20;handler&#x20;capability&#x20;is&#x20;available&#x20;in&#x20;all&#x20;configuration&#x20;files,&#x20;including&#x20;per-directory&#x20;files&#x20;&#40;e.g.,&#x20;.htaccess&#41;.&#x20;The&#x20;mod_status&#x20;module&#x20;may&#x20;provide&#x20;an&#x20;adversary&#x20;with&#x20;information&#x20;that&#x20;can&#x20;be&#x20;used&#x20;to&#x20;refine&#x20;exploits&#x20;that&#x20;depend&#x20;on&#x20;measuring&#x20;server&#x20;load.','','Perform&#x20;either&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;mod_status&#x20;module:&#x20;1&#41;&#x20;For&#x20;source&#x20;builds&#x20;with&#x20;static&#x20;modules,&#x20;run&#x20;the&#x20;Apache&#x20;./configure&#x20;script&#x20;with&#x20;the&#x20;--disable-status&#x20;configure&#x20;script&#x20;options.&#x20;2&#41;&#x20;For&#x20;dynamically&#x20;loaded&#x20;modules,&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;the&#x20;LoadModule&#x20;directive&#x20;for&#x20;the&#x20;mod_status&#x20;module&#x20;from&#x20;the&#x20;httpd.conf&#x20;file.&#x20;##LoadModule&#x20;status_module&#x20;modules/mod_status.so','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(10002,'Ensure&#x20;the&#x20;Autoindex&#x20;Module&#x20;Is&#x20;Disabled','The&#x20;Apache&#x20;mod_autoindex&#x20;module&#x20;automatically&#x20;generates&#x20;a&#x20;web&#x20;page&#x20;listing&#x20;the&#x20;contents&#x20;of&#x20;directories&#x20;on&#x20;the&#x20;server,&#x20;typically&#x20;used&#x20;so&#x20;an&#x20;index.html&#x20;does&#x20;not&#x20;have&#x20;to&#x20;be&#x20;generated.','Automated&#x20;directory&#x20;listings&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;because&#x20;they&#x20;will&#x20;reveal&#x20;information&#x20;helpful&#x20;to&#x20;an&#x20;attacker&#x20;such&#x20;as&#x20;naming&#x20;conventions&#x20;and&#x20;directory&#x20;paths.&#x20;They&#x20;may&#x20;also&#x20;reveal&#x20;files&#x20;that&#x20;were&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;revealed.','','Perform&#x20;either&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;mod_autoindex&#x20;module:&#x20;1.&#x20;For&#x20;source&#x20;builds&#x20;with&#x20;static&#x20;modules,&#x20;run&#x20;the&#x20;Apache&#x20;./configure&#x20;script&#x20;with&#x20;the&#x20;--disable-autoindex&#x20;configure&#x20;script&#x20;options.&#x20;$&#x20;cd&#x20;$DOWNLOAD_HTTPD&#x20;$&#x20;./configure&#x20;-disable-autoindex.&#x20;2.&#x20;For&#x20;dynamically&#x20;loaded&#x20;modules,&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;the&#x20;LoadModule&#x20;directive&#x20;for&#x20;mod_autoindex&#x20;from&#x20;the&#x20;httpd.conf&#x20;file.&#x20;##&#x20;LoadModule&#x20;autoindex_module&#x20;modules/mod_autoindex.so','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"18\", \"5.1\"]}]'),(10003,'Ensure&#x20;the&#x20;Proxy&#x20;Modules&#x20;Are&#x20;Disabled','The&#x20;Apache&#x20;proxy&#x20;modules&#x20;allow&#x20;the&#x20;server&#x20;to&#x20;act&#x20;as&#x20;a&#x20;proxy&#x20;&#40;either&#x20;forward&#x20;or&#x20;reverse&#x20;proxy&#41;&#x20;of&#x20;HTTP&#x20;and&#x20;other&#x20;protocols&#x20;with&#x20;additional&#x20;proxy&#x20;modules&#x20;loaded.&#x20;If&#x20;the&#x20;Apache&#x20;installation&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;proxy&#x20;requests&#x20;to&#x20;or&#x20;from&#x20;another&#x20;network&#x20;then&#x20;the&#x20;proxy&#x20;module&#x20;should&#x20;not&#x20;be&#x20;loaded.','Proxy&#x20;servers&#x20;can&#x20;act&#x20;as&#x20;an&#x20;important&#x20;security&#x20;control&#x20;when&#x20;properly&#x20;configured,&#x20;however&#x20;a&#x20;secure&#x20;proxy&#x20;server&#x20;is&#x20;not&#x20;within&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;benchmark.&#x20;A&#x20;web&#x20;server&#x20;should&#x20;be&#x20;primarily&#x20;a&#x20;web&#x20;server&#x20;or&#x20;a&#x20;proxy&#x20;server&#x20;but&#x20;not&#x20;both,&#x20;for&#x20;the&#x20;same&#x20;reasons&#x20;that&#x20;other&#x20;multi-use&#x20;servers&#x20;are&#x20;not&#x20;recommended.&#x20;Scanning&#x20;for&#x20;web&#x20;servers&#x20;that&#x20;will&#x20;also&#x20;proxy&#x20;requests&#x20;is&#x20;a&#x20;very&#x20;common&#x20;attack,&#x20;as&#x20;proxy&#x20;servers&#x20;are&#x20;useful&#x20;for&#x20;anonymizing&#x20;attacks&#x20;on&#x20;other&#x20;servers,&#x20;or&#x20;possibly&#x20;proxying&#x20;requests&#x20;into&#x20;an&#x20;otherwise&#x20;protected&#x20;network.','','Perform&#x20;either&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;proxy&#x20;module:&#x20;1.&#x20;For&#x20;source&#x20;builds&#x20;with&#x20;static&#x20;modules,&#x20;run&#x20;the&#x20;Apache&#x20;./configure&#x20;script&#x20;without&#x20;including&#x20;the&#x20;mod_proxy&#x20;in&#x20;the&#x20;--enable-modules=configure&#x20;script&#x20;options.&#x20;$&#x20;cd&#x20;$DOWNLOAD_HTTPD&#x20;$&#x20;./configure&#x20;2.&#x20;For&#x20;dynamically&#x20;loaded&#x20;modules,&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;the&#x20;LoadModule&#x20;directive&#x20;for&#x20;mod_proxy&#x20;module&#x20;and&#x20;all&#x20;other&#x20;proxy&#x20;modules&#x20;from&#x20;the&#x20;httpd.conf&#x20;file.&#x20;##LoadModule&#x20;proxy_module&#x20;modules/mod_proxy.so&#x20;##LoadModule&#x20;proxy_connect_module&#x20;modules/mod_proxy_connect.so&#x20;##LoadModule&#x20;proxy_ftp_module&#x20;modules/mod_proxy_ftp.so&#x20;##LoadModule&#x20;proxy_http_module&#x20;modules/mod_proxy_http.so&#x20;##LoadModule&#x20;proxy_fcgi_module&#x20;modules/mod_proxy_fcgi.so&#x20;##LoadModule&#x20;proxy_scgi_module&#x20;modules/mod_proxy_scgi.so&#x20;##LoadModule&#x20;proxy_ajp_module&#x20;modules/mod_proxy_ajp.so&#x20;##LoadModule&#x20;proxy_balancer_module&#x20;modules/mod_proxy_balancer.so&#x20;##LoadModule&#x20;proxy_express_module&#x20;modules/mod_proxy_express.so&#x20;##LoadModule&#x20;proxy_wstunnel_module&#x20;modules/mod_proxy_wstunnel.so&#x20;##LoadModule&#x20;proxy_fdpass_module&#x20;modules/mod_proxy_fdpass.so','[{\"cis\": [\"2.6\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(10004,'Ensure&#x20;the&#x20;User&#x20;Directories&#x20;Module&#x20;Is&#x20;Disabled','The&#x20;UserDir&#x20;directive&#x20;must&#x20;be&#x20;disabled&#x20;so&#x20;that&#x20;user&#x20;home&#x20;directories&#x20;are&#x20;not&#x20;accessed&#x20;via&#x20;the&#x20;web&#x20;site&#x20;with&#x20;a&#x20;tilde&#x20;&#40;~&#41;&#x20;preceding&#x20;the&#x20;username.&#x20;The&#x20;directive&#x20;also&#x20;sets&#x20;the&#x20;path&#x20;name&#x20;of&#x20;the&#x20;directory&#x20;that&#x20;will&#x20;be&#x20;accessed.','The&#x20;user&#x20;directories&#x20;should&#x20;not&#x20;be&#x20;globally&#x20;enabled&#x20;since&#x20;that&#x20;allows&#x20;anonymous&#x20;access&#x20;to&#x20;anything&#x20;users&#x20;may&#x20;want&#x20;to&#x20;share&#x20;with&#x20;other&#x20;users&#x20;on&#x20;the&#x20;network.&#x20;Also&#x20;consider&#x20;that&#x20;every&#x20;time&#x20;a&#x20;new&#x20;account&#x20;is&#x20;created&#x20;on&#x20;the&#x20;system,&#x20;there&#x20;is&#x20;potentially&#x20;new&#x20;content&#x20;available&#x20;via&#x20;the&#x20;web&#x20;site.','','Perform&#x20;either&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;user&#x20;directories&#x20;module:&#x20;1.&#x20;For&#x20;source&#x20;builds&#x20;with&#x20;static&#x20;modules,&#x20;run&#x20;the&#x20;Apache&#x20;./configure&#x20;script&#x20;with&#x20;the&#x20;--disable-userdir&#x20;configure&#x20;script&#x20;options.&#x20;$&#x20;cd&#x20;$DOWNLOAD_HTTPD&#x20;$&#x20;./configure&#x20;--disable-userdir&#x20;2.&#x20;For&#x20;dynamically&#x20;loaded&#x20;modules,&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;the&#x20;LoadModule&#x20;directive&#x20;for&#x20;mod_userdir&#x20;module&#x20;from&#x20;the&#x20;httpd.conf&#x20;file.&#x20;##LoadModule&#x20;userdir_module&#x20;modules/mod_userdir.so','[{\"cis\": [\"2.7\"]}, {\"cis_csc\": [\"18\", \"5.1\"]}]'),(10005,'Ensure&#x20;the&#x20;Info&#x20;Module&#x20;Is&#x20;Disabled','The&#x20;Apache&#x20;mod_info&#x20;module&#x20;provides&#x20;information&#x20;on&#x20;the&#x20;server&#x20;configuration&#x20;via&#x20;access&#x20;to&#x20;a&#x20;/server-info&#x20;URL&#x20;location.','While&#x20;having&#x20;server&#x20;configuration&#x20;information&#x20;available&#x20;as&#x20;a&#x20;web&#x20;page&#x20;may&#x20;be&#x20;convenient&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;module&#x20;NOT&#x20;be&#x20;enabled.&#x20;Once&#x20;mod_info&#x20;is&#x20;loaded&#x20;into&#x20;the&#x20;server,&#x20;its&#x20;handler&#x20;capability&#x20;is&#x20;available&#x20;in&#x20;per-directory&#x20;.htaccess&#x20;files&#x20;and&#x20;can&#x20;leak&#x20;sensitive&#x20;information&#x20;from&#x20;the&#x20;configuration&#x20;directives&#x20;of&#x20;other&#x20;Apache&#x20;modules&#x20;such&#x20;as&#x20;system&#x20;paths,&#x20;usernames/passwords,&#x20;database&#x20;names,&#x20;etc.','','Perform&#x20;either&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;mod_info&#x20;module:&#x20;1.&#x20;For&#x20;source&#x20;builds&#x20;with&#x20;static&#x20;modules,&#x20;run&#x20;the&#x20;Apache&#x20;./configure&#x20;script&#x20;without&#x20;including&#x20;the&#x20;mod_info&#x20;in&#x20;the&#x20;--enable-modules=configure&#x20;script&#x20;options.&#x20;$&#x20;cd&#x20;$DOWNLOAD_HTTPD&#x20;$&#x20;./configure&#x20;2.&#x20;For&#x20;dynamically&#x20;loaded&#x20;modules,&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;the&#x20;LoadModule&#x20;directive&#x20;for&#x20;the&#x20;mod_info&#x20;module&#x20;from&#x20;the&#x20;httpd.conf&#x20;file.&#x20;##LoadModule&#x20;info_module&#x20;modules/mod_info.so','[{\"cis\": [\"2.8\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(10006,'Ensure&#x20;the&#x20;Apache&#x20;User&#x20;Account&#x20;Has&#x20;an&#x20;Invalid&#x20;Shell','The&#x20;apache&#x20;account&#x20;must&#x20;not&#x20;be&#x20;used&#x20;as&#x20;a&#x20;regular&#x20;login&#x20;account,&#x20;so&#x20;it&#x20;should&#x20;be&#x20;assigned&#x20;an&#x20;invalid&#x20;or&#x20;nologin&#x20;shell&#x20;to&#x20;ensure&#x20;it&#x20;cannot&#x20;be&#x20;used&#x20;to&#x20;login.','Service&#x20;accounts&#x20;such&#x20;as&#x20;the&#x20;apache&#x20;account&#x20;are&#x20;a&#x20;risk&#x20;if&#x20;they&#x20;can&#x20;be&#x20;used&#x20;to&#x20;get&#x20;a&#x20;login&#x20;shell&#x20;to&#x20;the&#x20;system.','','Change&#x20;the&#x20;apache&#x20;account&#x20;to&#x20;use&#x20;the&#x20;nologin&#x20;shell&#x20;or&#x20;an&#x20;invalid&#x20;shell&#x20;such&#x20;as&#x20;/dev/null:&#x20;#&#x20;chsh&#x20;-s&#x20;/sbin/nologin&#x20;apache','[{\"cis\": [\"3.2\"]}, {\"cis_csc\": [\"16\", \"4.3\"]}]'),(10007,'Ensure&#x20;the&#x20;Apache&#x20;User&#x20;Account&#x20;Is&#x20;Locked','The&#x20;user&#x20;account&#x20;under&#x20;which&#x20;Apache&#x20;runs&#x20;should&#x20;not&#x20;have&#x20;a&#x20;valid&#x20;password,&#x20;but&#x20;should&#x20;be&#x20;locked.','As&#x20;a&#x20;defense-in-depth&#x20;measure&#x20;the&#x20;Apache&#x20;user&#x20;account&#x20;should&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;logins,&#x20;and&#x20;to&#x20;prevent&#x20;a&#x20;user&#x20;from&#x20;suing&#x20;to&#x20;apache&#x20;using&#x20;the&#x20;password.&#x20;In&#x20;general,&#x20;there&#x20;should&#x20;not&#x20;be&#x20;a&#x20;need&#x20;for&#x20;anyone&#x20;to&#x20;have&#x20;to&#x20;su&#x20;as&#x20;apache,&#x20;and&#x20;when&#x20;there&#x20;is&#x20;a&#x20;need,&#x20;then&#x20;sudo&#x20;should&#x20;be&#x20;used&#x20;instead,&#x20;which&#x20;would&#x20;not&#x20;require&#x20;the&#x20;apache&#x20;account&#x20;password.','','Use&#x20;the&#x20;passwd&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;apache&#x20;account:&#x20;#&#x20;passwd&#x20;-l&#x20;apache','[{\"cis\": [\"3.3\"]}, {\"cis_csc\": [\"16\", \"16.8\"]}]'),(10008,'Ensure&#x20;OverRide&#x20;Is&#x20;Disabled&#x20;for&#x20;All&#x20;Directories','The&#x20;Apache&#x20;AllowOverride&#x20;directive&#x20;and&#x20;the&#x20;new&#x20;AllowOverrideList&#x20;directive&#x20;allow&#x20;for&#x20;.htaccess&#x20;files&#x20;to&#x20;be&#x20;used&#x20;to&#x20;override&#x20;much&#x20;of&#x20;the&#x20;configuration,&#x20;including&#x20;authentication,&#x20;handling&#x20;of&#x20;document&#x20;types,&#x20;auto&#x20;generated&#x20;indexes,&#x20;access&#x20;control,&#x20;and&#x20;options.&#x20;When&#x20;the&#x20;server&#x20;finds&#x20;an&#x20;.htaccess&#x20;file&#x20;&#40;as&#x20;specified&#x20;by&#x20;AccessFileName&#41;&#x20;it&#x20;needs&#x20;to&#x20;know&#x20;which&#x20;directives&#x20;declared&#x20;in&#x20;that&#x20;file&#x20;can&#x20;override&#x20;earlier&#x20;access&#x20;information.&#x20;When&#x20;this&#x20;directive&#x20;is&#x20;set&#x20;to&#x20;None,&#x20;then&#x20;.htaccess&#x20;files&#x20;are&#x20;completely&#x20;ignored.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;server&#x20;will&#x20;not&#x20;even&#x20;attempt&#x20;to&#x20;read&#x20;.htaccess&#x20;files&#x20;in&#x20;the&#x20;filesystem.&#x20;When&#x20;this&#x20;directive&#x20;is&#x20;set&#x20;to&#x20;All,&#x20;then&#x20;any&#x20;directive&#x20;which&#x20;has&#x20;the&#x20;.htaccess&#x20;context&#x20;is&#x20;allowed&#x20;in&#x20;.htaccess&#x20;files.','.htaccess&#x20;files&#x20;decentralizes&#x20;access&#x20;control&#x20;and&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;server&#x20;configuration&#x20;being&#x20;changed&#x20;inappropriately.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Search&#x20;the&#x20;Apache&#x20;configuration&#x20;files&#x20;&#40;httpd.conf&#x20;and&#x20;any&#x20;included&#x20;configuration&#x20;files&#41;&#x20;to&#x20;find&#x20;AllowOverride&#x20;directives.&#x20;2.&#x20;Set&#x20;the&#x20;value&#x20;for&#x20;all&#x20;AllowOverride&#x20;directives&#x20;to&#x20;None.&#x20;3.&#x20;Remove&#x20;any&#x20;AllowOverrideList&#x20;directives&#x20;found.','[{\"cis\": [\"4.4\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(10009,'Ensure&#x20;Options&#x20;for&#x20;Other&#x20;Directories&#x20;Are&#x20;Minimized','The&#x20;Apache&#x20;Options&#x20;directive&#x20;allows&#x20;for&#x20;specific&#x20;configuration&#x20;of&#x20;options,&#x20;including&#x20;execution&#x20;of&#x20;CGI,&#x20;following&#x20;symbolic&#x20;links,&#x20;server&#x20;side&#x20;includes,&#x20;and&#x20;content&#x20;negotiation.','Likewise,&#x20;the&#x20;options&#x20;for&#x20;other&#x20;directories&#x20;and&#x20;hosts&#x20;needs&#x20;to&#x20;be&#x20;restricted&#x20;to&#x20;the&#x20;minimal&#x20;options&#x20;required.&#x20;A&#x20;setting&#x20;of&#x20;None&#x20;is&#x20;recommended,&#x20;however&#x20;it&#x20;is&#x20;recognized&#x20;that&#x20;other&#x20;options&#x20;may&#x20;be&#x20;needed&#x20;in&#x20;some&#x20;cases:&#x20;Multiviews,&#x20;FollowSymbolicLinks&#x20;&amp;&#x20;SymLinksIfOwnerMatch,&#x20;ExecCGI,&#x20;Includes&#x20;&amp;&#x20;IncludesNOEXEC,&#x20;&amp;&#x20;Indexes.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Search&#x20;the&#x20;Apache&#x20;configuration&#x20;files&#x20;&#40;httpd.conf&#x20;and&#x20;any&#x20;included&#x20;configuration&#x20;files&#41;&#x20;to&#x20;find&#x20;all&#x20;&lt;Directory&gt;&#x20;elements.&#x20;2.&#x20;Add&#x20;or&#x20;modify&#x20;any&#x20;existing&#x20;Options&#x20;directive&#x20;to&#x20;NOT&#x20;have&#x20;a&#x20;value&#x20;of&#x20;Includes.&#x20;Other&#x20;options&#x20;may&#x20;be&#x20;set&#x20;if&#x20;necessary&#x20;and&#x20;appropriate&#x20;as&#x20;described&#x20;above.','[{\"cis\": [\"5.3\"]}, {\"cis_csc\": [\"18\", \"5.1\"]}]'),(10010,'Ensure&#x20;Default&#x20;HTML&#x20;Content&#x20;Is&#x20;Removed','Apache&#x20;installations&#x20;have&#x20;default&#x20;content&#x20;that&#x20;is&#x20;not&#x20;needed&#x20;or&#x20;appropriate&#x20;for&#x20;production&#x20;use.&#x20;The&#x20;primary&#x20;function&#x20;for&#x20;the&#x20;sample&#x20;content&#x20;is&#x20;to&#x20;provide&#x20;a&#x20;default&#x20;web&#x20;site,&#x20;provide&#x20;user&#x20;manuals,&#x20;or&#x20;demonstrate&#x20;special&#x20;features&#x20;of&#x20;the&#x20;web&#x20;server.&#x20;All&#x20;content&#x20;that&#x20;is&#x20;not&#x20;needed&#x20;should&#x20;be&#x20;removed.','Historically,&#x20;sample&#x20;content&#x20;and&#x20;features&#x20;have&#x20;been&#x20;remotely&#x20;exploited&#x20;and&#x20;can&#x20;provide&#x20;different&#x20;levels&#x20;of&#x20;access&#x20;to&#x20;the&#x20;server.&#x20;Usually&#x20;these&#x20;routines&#x20;are&#x20;not&#x20;written&#x20;for&#x20;production&#x20;use&#x20;and&#x20;consequently&#x20;little&#x20;thought&#x20;was&#x20;given&#x20;to&#x20;security&#x20;in&#x20;their&#x20;development.','','Review&#x20;all&#x20;pre-installed&#x20;content&#x20;and&#x20;remove&#x20;content&#x20;which&#x20;is&#x20;not&#x20;required.&#x20;In&#x20;particular&#x20;look&#x20;for&#x20;the&#x20;unnecessary&#x20;content&#x20;which&#x20;may&#x20;be&#x20;found&#x20;in&#x20;the&#x20;document&#x20;root&#x20;directory,&#x20;a&#x20;configuration&#x20;directory&#x20;such&#x20;as&#x20;conf/extra&#x20;directory,&#x20;or&#x20;as&#x20;a&#x20;Unix/Linux&#x20;package.&#x20;1.&#x20;Remove&#x20;the&#x20;default&#x20;index.html&#x20;or&#x20;welcome&#x20;page&#x20;if&#x20;it&#x20;is&#x20;a&#x20;separate&#x20;package.&#x20;If&#x20;it&#x20;is&#x20;part&#x20;of&#x20;main&#x20;Apache&#x20;httpd&#x20;package&#x20;such&#x20;as&#x20;it&#x20;is&#x20;on&#x20;Red&#x20;Hat&#x20;Linux,&#x20;then&#x20;comment&#x20;out&#x20;the&#x20;configuration&#x20;as&#x20;shown&#x20;below.&#x20;Removing&#x20;a&#x20;file&#x20;such&#x20;as&#x20;the&#x20;welcome.conf,&#x20;is&#x20;not&#x20;recommended&#x20;as&#x20;it&#x20;may&#x20;get&#x20;replaced&#x20;if&#x20;the&#x20;package&#x20;is&#x20;updated.&#x20;2.&#x20;Remove&#x20;the&#x20;Apache&#x20;user&#x20;manual&#x20;content&#x20;or&#x20;comment&#x20;out&#x20;configurations&#x20;referencing&#x20;the&#x20;manual.&#x20;#&#x20;yum&#x20;erase&#x20;httpd-manual&#x20;3.&#x20;Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;Server&#x20;Information&#x20;handler&#x20;configuration.&#x20;4.&#x20;Remove&#x20;or&#x20;comment&#x20;out&#x20;any&#x20;other&#x20;handler&#x20;configuration&#x20;such&#x20;as&#x20;perl-status.','[{\"cis\": [\"5.4\"]}, {\"cis_csc\": [\"18.9\", \"5.1\"]}]'),(10011,'Ensure&#x20;the&#x20;Default&#x20;CGI&#x20;Content&#x20;printenv&#x20;Script&#x20;Is&#x20;Removed','Most&#x20;Web&#x20;Servers,&#x20;including&#x20;Apache&#x20;installations&#x20;have&#x20;default&#x20;CGI&#x20;content&#x20;which&#x20;is&#x20;not&#x20;needed&#x20;or&#x20;appropriate&#x20;for&#x20;production&#x20;use.&#x20;The&#x20;primary&#x20;function&#x20;for&#x20;these&#x20;sample&#x20;programs&#x20;is&#x20;to&#x20;demonstrate&#x20;the&#x20;capabilities&#x20;of&#x20;the&#x20;web&#x20;server.&#x20;One&#x20;common&#x20;default&#x20;CGI&#x20;content&#x20;for&#x20;Apache&#x20;installations&#x20;is&#x20;the&#x20;script&#x20;printenv.&#x20;This&#x20;script&#x20;will&#x20;print&#x20;back&#x20;to&#x20;the&#x20;requester&#x20;all&#x20;of&#x20;the&#x20;CGI&#x20;environment&#x20;variables&#x20;which&#x20;includes&#x20;many&#x20;server&#x20;configuration&#x20;details&#x20;and&#x20;system&#x20;paths.','CGI&#x20;programs&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;bugs&#x20;and&#x20;problems&#x20;associated&#x20;with&#x20;improperly&#x20;accepting&#x20;user-input.&#x20;Since&#x20;these&#x20;programs&#x20;are&#x20;often&#x20;targets&#x20;of&#x20;attackers,&#x20;we&#x20;need&#x20;to&#x20;make&#x20;sure&#x20;that&#x20;there&#x20;are&#x20;no&#x20;unnecessary&#x20;CGI&#x20;programs&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;used&#x20;for&#x20;malicious&#x20;purposes.&#x20;Usually&#x20;these&#x20;programs&#x20;are&#x20;not&#x20;written&#x20;for&#x20;production&#x20;use&#x20;and&#x20;consequently&#x20;little&#x20;thought&#x20;was&#x20;given&#x20;to&#x20;security&#x20;in&#x20;their&#x20;development.&#x20;The&#x20;printenv&#x20;script&#x20;in&#x20;particular&#x20;will&#x20;disclose&#x20;inappropriate&#x20;information&#x20;about&#x20;the&#x20;web&#x20;server&#x20;including&#x20;directory&#x20;paths&#x20;and&#x20;detailed&#x20;version&#x20;and&#x20;configuration&#x20;information.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Locate&#x20;cgi-bin&#x20;files&#x20;and&#x20;directories&#x20;enabled&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;via&#x20;Script,&#x20;ScriptAlias,&#x20;ScriptAliasMatch,&#x20;or&#x20;ScriptInterpreterSource&#x20;directives.&#x20;2.&#x20;Remove&#x20;the&#x20;printenvdefault&#x20;CGI&#x20;in&#x20;cgi-bin&#x20;directory&#x20;if&#x20;it&#x20;is&#x20;installed.&#x20;#&#x20;rm&#x20;$APACHE_PREFIX/cgi-bin/printenv','[{\"cis\": [\"5.5\"]}, {\"cis_csc\": [\"18\", \"4.7\"]}]'),(10012,'Ensure&#x20;the&#x20;Default&#x20;CGI&#x20;Content&#x20;test-cgi&#x20;Script&#x20;Is&#x20;Removed','Most&#x20;Web&#x20;Servers,&#x20;including&#x20;Apache&#x20;installations&#x20;have&#x20;default&#x20;CGI&#x20;content&#x20;which&#x20;is&#x20;not&#x20;needed&#x20;or&#x20;appropriate&#x20;for&#x20;production&#x20;use.&#x20;The&#x20;primary&#x20;function&#x20;for&#x20;these&#x20;sample&#x20;programs&#x20;is&#x20;to&#x20;demonstrate&#x20;the&#x20;capabilities&#x20;of&#x20;the&#x20;web&#x20;server.&#x20;A&#x20;common&#x20;default&#x20;CGI&#x20;content&#x20;for&#x20;Apache&#x20;installations&#x20;is&#x20;the&#x20;script&#x20;test-cgi.&#x20;This&#x20;script&#x20;will&#x20;print&#x20;back&#x20;to&#x20;the&#x20;requester&#x20;CGI&#x20;environment&#x20;variables&#x20;which&#x20;includes&#x20;many&#x20;server&#x20;configuration&#x20;details.','CGI&#x20;programs&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;bugs&#x20;and&#x20;problems&#x20;associated&#x20;with&#x20;improperly&#x20;accepting&#x20;user-input.&#x20;Since&#x20;these&#x20;programs&#x20;are&#x20;often&#x20;targets&#x20;of&#x20;attackers,&#x20;we&#x20;need&#x20;to&#x20;make&#x20;sure&#x20;that&#x20;there&#x20;are&#x20;no&#x20;unnecessary&#x20;CGI&#x20;programs&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;used&#x20;for&#x20;malicious&#x20;purposes.&#x20;Usually&#x20;these&#x20;programs&#x20;are&#x20;not&#x20;written&#x20;for&#x20;production&#x20;use&#x20;and&#x20;consequently&#x20;little&#x20;thought&#x20;was&#x20;given&#x20;to&#x20;security&#x20;in&#x20;their&#x20;development.&#x20;The&#x20;test-cgi&#x20;script&#x20;in&#x20;particular&#x20;will&#x20;disclose&#x20;inappropriate&#x20;information&#x20;about&#x20;the&#x20;web&#x20;server&#x20;including&#x20;directory&#x20;paths&#x20;and&#x20;detailed&#x20;version&#x20;and&#x20;configuration&#x20;information.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Locate&#x20;cgi-bin&#x20;files&#x20;and&#x20;directories&#x20;enabled&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;via&#x20;Script,&#x20;ScriptAlias,&#x20;ScriptAliasMatch,&#x20;or&#x20;ScriptInterpreterSource&#x20;directives.&#x20;2.&#x20;Remove&#x20;the&#x20;test-cgi&#x20;default&#x20;CGI&#x20;in&#x20;cgi-bin&#x20;directory&#x20;if&#x20;it&#x20;is&#x20;installed.&#x20;#&#x20;rm&#x20;$APACHE_PREFIX/cgi-bin/test-cgi','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"18.9\", \"4.7\"]}]'),(10013,'Ensure&#x20;the&#x20;HTTP&#x20;TRACE&#x20;Method&#x20;Is&#x20;Disabled','Use&#x20;the&#x20;Apache&#x20;TraceEnable&#x20;directive&#x20;to&#x20;disable&#x20;the&#x20;HTTP&#x20;TRACE&#x20;request&#x20;method.','The&#x20;HTTP&#x20;1.1&#x20;protocol&#x20;requires&#x20;support&#x20;for&#x20;the&#x20;TRACE&#x20;request&#x20;method&#x20;which&#x20;reflects&#x20;the&#x20;request&#x20;back&#x20;as&#x20;a&#x20;response&#x20;and&#x20;was&#x20;intended&#x20;for&#x20;diagnostics&#x20;purposes.&#x20;The&#x20;TRACE&#x20;method&#x20;is&#x20;not&#x20;needed&#x20;and&#x20;is&#x20;easily&#x20;subjected&#x20;to&#x20;abuse&#x20;and&#x20;should&#x20;be&#x20;disabled.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Locate&#x20;the&#x20;main&#x20;Apache&#x20;configuration&#x20;file&#x20;such&#x20;as&#x20;httpd.conf.&#x20;2.&#x20;Add&#x20;a&#x20;TraceEnable&#x20;directive&#x20;to&#x20;the&#x20;server&#x20;level&#x20;configuration&#x20;with&#x20;a&#x20;value&#x20;of&#x20;off.&#x20;Server&#x20;level&#x20;configuration&#x20;is&#x20;the&#x20;top-level&#x20;configuration,&#x20;not&#x20;nested&#x20;within&#x20;any&#x20;other&#x20;directives&#x20;like&#x20;&lt;Directory&gt;&#x20;or&#x20;&lt;Location&gt;.','[{\"cis\": [\"5.8\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(10014,'Ensure&#x20;the&#x20;IP&#x20;Addresses&#x20;for&#x20;Listening&#x20;for&#x20;Requests&#x20;Are&#x20;Specified','The&#x20;Apache&#x20;Listen&#x20;directive&#x20;specifies&#x20;the&#x20;IP&#x20;addresses&#x20;and&#x20;port&#x20;numbers&#x20;the&#x20;Apache&#x20;web&#x20;server&#x20;will&#x20;listen&#x20;for&#x20;requests.&#x20;Rather&#x20;than&#x20;be&#x20;unrestricted&#x20;to&#x20;listen&#x20;on&#x20;all&#x20;IP&#x20;addresses&#x20;available&#x20;to&#x20;the&#x20;system,&#x20;the&#x20;specific&#x20;IP&#x20;address&#x20;or&#x20;addresses&#x20;intended&#x20;should&#x20;be&#x20;explicitly&#x20;specified.&#x20;Specifically,&#x20;a&#x20;Listen&#x20;directive&#x20;with&#x20;no&#x20;IP&#x20;address&#x20;specified,&#x20;or&#x20;with&#x20;an&#x20;IP&#x20;address&#x20;of&#x20;zeros&#x20;should&#x20;not&#x20;be&#x20;used.','Having&#x20;multiple&#x20;interfaces&#x20;on&#x20;web&#x20;servers&#x20;is&#x20;fairly&#x20;common,&#x20;and&#x20;without&#x20;explicit&#x20;Listen&#x20;directives,&#x20;the&#x20;web&#x20;server&#x20;is&#x20;likely&#x20;to&#x20;be&#x20;listening&#x20;on&#x20;an&#x20;inappropriate&#x20;IP&#x20;address&#x20;/&#x20;interface&#x20;that&#x20;was&#x20;not&#x20;intended&#x20;for&#x20;the&#x20;web&#x20;server.&#x20;Single&#x20;homed&#x20;system&#x20;with&#x20;a&#x20;single&#x20;IP&#x20;addressed&#x20;are&#x20;also&#x20;required&#x20;to&#x20;have&#x20;an&#x20;explicit&#x20;IP&#x20;address&#x20;in&#x20;the&#x20;Listen&#x20;directive,&#x20;in&#x20;case&#x20;additional&#x20;interfaces&#x20;are&#x20;added&#x20;to&#x20;the&#x20;system&#x20;at&#x20;a&#x20;later&#x20;date.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Find&#x20;any&#x20;Listen&#x20;directives&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;file&#x20;with&#x20;no&#x20;IP&#x20;address&#x20;specified,&#x20;or&#x20;with&#x20;an&#x20;IP&#x20;address&#x20;of&#x20;all&#x20;zeros&#x20;similar&#x20;to&#x20;the&#x20;examples&#x20;below.&#x20;Keep&#x20;in&#x20;mind&#x20;there&#x20;may&#x20;be&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6&#x20;addresses&#x20;on&#x20;the&#x20;system.&#x20;2.&#x20;Modify&#x20;the&#x20;Listen&#x20;directives&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;file&#x20;to&#x20;have&#x20;explicit&#x20;IP&#x20;addresses&#x20;according&#x20;to&#x20;the&#x20;intended&#x20;usage.&#x20;Multiple&#x20;Listen&#x20;directives&#x20;may&#x20;be&#x20;specified&#x20;for&#x20;each&#x20;IP&#x20;address&#x20;&amp;&#x20;Port.','[{\"cis\": [\"5.13\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(10015,'Ensure&#x20;Browser&#x20;Framing&#x20;Is&#x20;Restricted','The&#x20;Header&#x20;directive&#x20;allows&#x20;server&#x20;HTTP&#x20;response&#x20;headers&#x20;to&#x20;be&#x20;added,&#x20;replaced&#x20;or&#x20;merged.&#x20;We&#x20;will&#x20;use&#x20;the&#x20;directive&#x20;to&#x20;add&#x20;a&#x20;server&#x20;HTTP&#x20;response&#x20;header&#x20;to&#x20;tell&#x20;browsers&#x20;to&#x20;restrict&#x20;all&#x20;of&#x20;the&#x20;web&#x20;pages&#x20;from&#x20;being&#x20;framed&#x20;by&#x20;other&#x20;web&#x20;sites.','Using&#x20;iframes&#x20;and&#x20;regular&#x20;web&#x20;frames&#x20;to&#x20;embed&#x20;malicious&#x20;content&#x20;along&#x20;with&#x20;expected&#x20;web&#x20;content&#x20;has&#x20;been&#x20;a&#x20;favored&#x20;attack&#x20;vector&#x20;for&#x20;attacking&#x20;web&#x20;clients&#x20;for&#x20;a&#x20;long&#x20;time.&#x20;This&#x20;can&#x20;happen&#x20;when&#x20;the&#x20;attacker&#x20;lures&#x20;the&#x20;victim&#x20;to&#x20;a&#x20;malicious&#x20;web&#x20;site,&#x20;which&#x20;using&#x20;frames&#x20;to&#x20;include&#x20;the&#x20;expected&#x20;content&#x20;from&#x20;the&#x20;legitimate&#x20;site.&#x20;The&#x20;attack&#x20;can&#x20;also&#x20;be&#x20;performed&#x20;via&#x20;XSS&#x20;&#40;either&#x20;reflected,&#x20;DOM&#x20;or&#x20;stored&#x20;XSS&#41;&#x20;to&#x20;add&#x20;the&#x20;malicious&#x20;content&#x20;to&#x20;the&#x20;legitimate&#x20;web&#x20;site.&#x20;To&#x20;combat&#x20;this&#x20;vector,&#x20;an&#x20;HTTP&#x20;Response&#x20;header,&#x20;X-Frame-Options,&#x20;has&#x20;been&#x20;introduced&#x20;that&#x20;allows&#x20;a&#x20;server&#x20;to&#x20;specify&#x20;whether&#x20;a&#x20;web&#x20;page&#x20;may&#x20;be&#x20;loaded&#x20;in&#x20;any&#x20;frame&#x20;&#40;DENY&#41;&#x20;or&#x20;those&#x20;frames&#x20;that&#x20;share&#x20;the&#x20;pages&#x20;origin&#x20;&#40;SAMEORIGIN&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;Header&#x20;directive&#x20;for&#x20;the&#x20;X-Frames-Options&#x20;header&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;the&#x20;condition&#x20;always,&#x20;an&#x20;action&#x20;of&#x20;append&#x20;and&#x20;a&#x20;value&#x20;of&#x20;SAMEORIGIN&#x20;or&#x20;DENY,&#x20;as&#x20;shown&#x20;below.&#x20;Header&#x20;always&#x20;append&#x20;X-Frame-Options&#x20;SAMEORIGIN','[{\"cis\": [\"5.14\"]}, {\"cis_csc\": [\"18\", \"5.1\"]}]'),(10016,'Ensure&#x20;Insecure&#x20;SSL&#x20;Renegotiation&#x20;Is&#x20;Not&#x20;Enabled','A&#x20;man-in-the-middle&#x20;renegotiation&#x20;attack&#x20;was&#x20;discovered&#x20;in&#x20;SSLv3&#x20;and&#x20;TLSv1&#x20;in&#x20;November,&#x20;2009&#x20;&#40;CVE-2009-3555&#41;.&#x20;First,&#x20;a&#x20;work&#x20;around&#x20;and&#x20;then&#x20;a&#x20;fix&#x20;was&#x20;approved&#x20;as&#x20;an&#x20;Internet&#x20;Standard&#x20;as&#x20;RFC&#x20;574,&#x20;Feb&#x20;2010.&#x20;The&#x20;work&#x20;around,&#x20;which&#x20;removes&#x20;the&#x20;renegotiation,&#x20;is&#x20;available&#x20;from&#x20;OpenSSL&#x20;as&#x20;of&#x20;version&#x20;0.9.8l&#x20;and&#x20;newer&#x20;versions.&#x20;For&#x20;details:&#x20;https://www.openssl.org/news/secadv_20091111.txt&#x20;The&#x20;SSLInsecureRenegotiation&#x20;directive&#x20;was&#x20;added&#x20;in&#x20;Apache&#x20;2.2.15,&#x20;for&#x20;web&#x20;servers&#x20;linked&#x20;with&#x20;OpenSSL&#x20;version&#x20;0.9.8m&#x20;or&#x20;later,&#x20;to&#x20;provide&#x20;backward&#x20;compatibility&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;older,&#x20;unpatched&#x20;SSL&#x20;implementations.','Enabling&#x20;the&#x20;SSLInsecureRenegotiation&#x20;directive&#x20;leaves&#x20;the&#x20;server&#x20;vulnerable&#x20;to&#x20;man-in-&#x20;the-middle&#x20;renegotiation&#x20;attack.&#x20;Therefore,&#x20;the&#x20;SSLInsecureRenegotiation&#x20;directive&#x20;should&#x20;not&#x20;be&#x20;enabled.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Search&#x20;the&#x20;Apache&#x20;configuration&#x20;files&#x20;for&#x20;the&#x20;SSLInsecureRenegotiation&#x20;directive.&#x20;If&#x20;the&#x20;directive&#x20;is&#x20;present&#x20;modify&#x20;the&#x20;value&#x20;to&#x20;be&#x20;off.&#x20;If&#x20;the&#x20;directive&#x20;is&#x20;not&#x20;present&#x20;then&#x20;no&#x20;action&#x20;is&#x20;required.&#x20;SSLInsecureRenegotiation&#x20;off','[{\"cis\": [\"7.6\"]}, {\"cis_csc\": [\"14.2\", \"14.4\"]}]'),(10017,'Ensure&#x20;SSL&#x20;Compression&#x20;is&#x20;Not&#x20;Enabled','The&#x20;SSLCompression&#x20;directive&#x20;controls&#x20;whether&#x20;SSL&#x20;compression&#x20;is&#x20;used&#x20;by&#x20;Apache&#x20;when&#x20;serving&#x20;content&#x20;over&#x20;HTTPS.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SSLCompression&#x20;directive&#x20;be&#x20;set&#x20;to&#x20;off.','If&#x20;SSL&#x20;compression&#x20;is&#x20;enabled,&#x20;HTTPS&#x20;communication&#x20;between&#x20;the&#x20;client&#x20;and&#x20;the&#x20;server&#x20;may&#x20;be&#x20;at&#x20;increased&#x20;risk&#x20;to&#x20;the&#x20;CRIME&#x20;attack.&#x20;The&#x20;CRIME&#x20;attack&#x20;increases&#x20;a&#x20;malicious&#x20;actor&#039;s&#x20;ability&#x20;to&#x20;derive&#x20;the&#x20;value&#x20;of&#x20;a&#x20;session&#x20;cookie,&#x20;which&#x20;commonly&#x20;contains&#x20;an&#x20;authenticator.&#x20;If&#x20;the&#x20;authenticator&#x20;in&#x20;a&#x20;session&#x20;cookie&#x20;is&#x20;derived,&#x20;it&#x20;can&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;the&#x20;account&#x20;associated&#x20;with&#x20;the&#x20;authenticator.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Search&#x20;the&#x20;Apache&#x20;configuration&#x20;files&#x20;for&#x20;the&#x20;SSLCompression&#x20;directive.&#x20;2.&#x20;If&#x20;the&#x20;directive&#x20;is&#x20;present,&#x20;set&#x20;it&#x20;to&#x20;off.','[{\"cis\": [\"7.7\"]}, {\"cis_csc\": [\"14.2\", \"14.4\"]}]'),(10018,'Ensure&#x20;ServerTokens&#x20;is&#x20;Set&#x20;to&#x20;&#039;Prod&#039;&#x20;or&#x20;&#039;ProductOnly&#039;','Configure&#x20;the&#x20;Apache&#x20;ServerTokens&#x20;directive&#x20;to&#x20;provide&#x20;minimal&#x20;information.&#x20;By&#x20;setting&#x20;the&#x20;value&#x20;to&#x20;Prod&#x20;or&#x20;ProductOnly.&#x20;The&#x20;only&#x20;version&#x20;information&#x20;given&#x20;in&#x20;the&#x20;server&#x20;HTTP&#x20;response&#x20;header&#x20;will&#x20;be&#x20;Apache&#x20;rather&#x20;than&#x20;details&#x20;on&#x20;modules&#x20;and&#x20;versions&#x20;installed.','Information&#x20;is&#x20;power&#x20;and&#x20;identifying&#x20;web&#x20;server&#x20;details&#x20;greatly&#x20;increases&#x20;the&#x20;efficiency&#x20;of&#x20;any&#x20;attack,&#x20;as&#x20;security&#x20;vulnerabilities&#x20;are&#x20;extremely&#x20;dependent&#x20;upon&#x20;specific&#x20;software&#x20;versions&#x20;and&#x20;configurations.&#x20;Excessive&#x20;probing&#x20;and&#x20;requests&#x20;may&#x20;cause&#x20;too&#x20;much&#x20;&#039;noise&#039;&#x20;being&#x20;generated&#x20;and&#x20;may&#x20;tip&#x20;off&#x20;an&#x20;administrator.&#x20;If&#x20;an&#x20;attacker&#x20;can&#x20;accurately&#x20;target&#x20;their&#x20;exploits,&#x20;the&#x20;chances&#x20;of&#x20;successful&#x20;compromise&#x20;prior&#x20;to&#x20;detection&#x20;increase&#x20;dramatically.&#x20;Script&#x20;Kiddies&#x20;are&#x20;constantly&#x20;scanning&#x20;the&#x20;Internet&#x20;and&#x20;documenting&#x20;the&#x20;version&#x20;information&#x20;openly&#x20;provided&#x20;by&#x20;web&#x20;servers.&#x20;The&#x20;purpose&#x20;of&#x20;this&#x20;scanning&#x20;is&#x20;to&#x20;accumulate&#x20;a&#x20;database&#x20;of&#x20;software&#x20;installed&#x20;on&#x20;those&#x20;hosts,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;when&#x20;new&#x20;vulnerabilities&#x20;are&#x20;released.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;ServerTokens&#x20;directive&#x20;as&#x20;shown&#x20;below&#x20;to&#x20;have&#x20;the&#x20;value&#x20;of&#x20;Prod&#x20;or&#x20;ProductOnly:&#x20;ServerTokens&#x20;Prod','[{\"cis\": [\"8.1\"]}, {\"cis_csc\": [\"18.9\", \"14.7\"]}]'),(10019,'Ensure&#x20;ServerSignature&#x20;Is&#x20;Not&#x20;Enabled','Disable&#x20;the&#x20;server&#x20;signatures&#x20;which&#x20;generates&#x20;a&#x20;signature&#x20;line&#x20;as&#x20;a&#x20;trailing&#x20;footer&#x20;at&#x20;the&#x20;bottom&#x20;of&#x20;server&#x20;generated&#x20;documents&#x20;such&#x20;as&#x20;error&#x20;pages.','Server&#x20;signatures&#x20;are&#x20;helpful&#x20;when&#x20;the&#x20;server&#x20;is&#x20;acting&#x20;as&#x20;a&#x20;proxy,&#x20;since&#x20;it&#x20;helps&#x20;the&#x20;user&#x20;distinguish&#x20;errors&#x20;from&#x20;the&#x20;proxy&#x20;rather&#x20;than&#x20;the&#x20;destination&#x20;server,&#x20;however&#x20;in&#x20;this&#x20;context&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;additional&#x20;information.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;ServerSignature&#x20;directive&#x20;to&#x20;have&#x20;the&#x20;value&#x20;of&#x20;Off:&#x20;ServerSignature&#x20;Off','[{\"cis\": [\"8.2\"]}, {\"cis_csc\": [\"18\", \"13.2\"]}]'),(10020,'Ensure&#x20;the&#x20;TimeOut&#x20;Is&#x20;Set&#x20;to&#x20;10&#x20;or&#x20;Less','Denial&#x20;of&#x20;Service&#x20;&#40;DoS&#41;&#x20;is&#x20;an&#x20;attack&#x20;technique&#x20;with&#x20;the&#x20;intent&#x20;of&#x20;preventing&#x20;a&#x20;web&#x20;site&#x20;from&#x20;serving&#x20;normal&#x20;user&#x20;activity.&#x20;DoS&#x20;attacks,&#x20;which&#x20;are&#x20;normally&#x20;applied&#x20;to&#x20;the&#x20;network&#x20;layer,&#x20;are&#x20;also&#x20;possible&#x20;at&#x20;the&#x20;application&#x20;layer.&#x20;These&#x20;malicious&#x20;attacks&#x20;can&#x20;succeed&#x20;by&#x20;starving&#x20;a&#x20;system&#x20;of&#x20;critical&#x20;resources,&#x20;vulnerability&#x20;exploit,&#x20;or&#x20;abuse&#x20;of&#x20;functionality.&#x20;Although&#x20;there&#x20;is&#x20;no&#x20;100%&#x20;solution&#x20;for&#x20;preventing&#x20;DoS&#x20;attacks,&#x20;the&#x20;following&#x20;recommendation&#x20;uses&#x20;the&#x20;Timeout&#x20;directive&#x20;to&#x20;mitigate&#x20;some&#x20;of&#x20;the&#x20;risk,&#x20;by&#x20;requiring&#x20;more&#x20;effort&#x20;for&#x20;a&#x20;successful&#x20;DoS&#x20;attack.&#x20;Of&#x20;course,&#x20;DoS&#x20;attacks&#x20;can&#x20;happen&#x20;in&#x20;rather&#x20;unintentional&#x20;ways&#x20;as&#x20;well&#x20;as&#x20;intentional&#x20;and&#x20;these&#x20;directives&#x20;will&#x20;help&#x20;in&#x20;many&#x20;of&#x20;those&#x20;situations&#x20;as&#x20;well.','One&#x20;common&#x20;technique&#x20;for&#x20;DoS&#x20;is&#x20;to&#x20;initiate&#x20;many&#x20;connections&#x20;to&#x20;the&#x20;server.&#x20;By&#x20;decreasing&#x20;the&#x20;timeout&#x20;for&#x20;old&#x20;connections&#x20;and&#x20;we&#x20;allow&#x20;the&#x20;server&#x20;to&#x20;free&#x20;up&#x20;resources&#x20;more&#x20;quickly&#x20;and&#x20;be&#x20;more&#x20;responsive.&#x20;By&#x20;making&#x20;the&#x20;server&#x20;more&#x20;efficient,&#x20;it&#x20;will&#x20;be&#x20;more&#x20;resilient&#x20;to&#x20;DoS&#x20;conditions.&#x20;The&#x20;Timeout&#x20;directive&#x20;affects&#x20;several&#x20;timeout&#x20;values&#x20;for&#x20;Apache,&#x20;so&#x20;review&#x20;the&#x20;Apache&#x20;document&#x20;carefully.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;Timeout&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;10&#x20;seconds&#x20;or&#x20;shorter.&#x20;Timeout&#x20;10','[{\"cis\": [\"9.1\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10021,'Ensure&#x20;KeepAlive&#x20;Is&#x20;Enabled','The&#x20;KeepAlive&#x20;directive&#x20;controls&#x20;whether&#x20;Apache&#x20;will&#x20;reuse&#x20;the&#x20;same&#x20;TCP&#x20;connection&#x20;per&#x20;client&#x20;to&#x20;process&#x20;subsequent&#x20;HTTP&#x20;requests&#x20;from&#x20;that&#x20;client.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;KeepAlive&#x20;directive&#x20;be&#x20;set&#x20;to&#x20;On.','Allowing&#x20;per-client&#x20;reuse&#x20;of&#x20;TCP&#x20;sockets&#x20;reduces&#x20;the&#x20;amount&#x20;of&#x20;system&#x20;and&#x20;network&#x20;resources&#x20;required&#x20;to&#x20;serve&#x20;requests.&#x20;This&#x20;efficiency&#x20;gain&#x20;may&#x20;improve&#x20;a&#x20;server&#x20;resiliency&#x20;to&#x20;DoS&#x20;attacks.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;KeepAlive&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;On,&#x20;so&#x20;that&#x20;KeepAlive&#x20;connections&#x20;are&#x20;enabled.&#x20;KeepAlive&#x20;On','[{\"cis\": [\"9.2\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10022,'Ensure&#x20;MaxKeepAliveRequests&#x20;is&#x20;Set&#x20;to&#x20;a&#x20;Value&#x20;of&#x20;100&#x20;or&#x20;Greater','The&#x20;MaxKeepAliveRequests&#x20;directive&#x20;limits&#x20;the&#x20;number&#x20;of&#x20;requests&#x20;allowed&#x20;per&#x20;connection&#x20;when&#x20;KeepAlive&#x20;is&#x20;on.&#x20;If&#x20;it&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;unlimited&#x20;requests&#x20;will&#x20;be&#x20;allowed.','The&#x20;MaxKeepAliveRequests&#x20;directive&#x20;is&#x20;important&#x20;to&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;Denial&#x20;of&#x20;Service&#x20;&#40;DoS&#41;&#x20;attack&#x20;technique&#x20;by&#x20;reducing&#x20;the&#x20;overhead&#x20;imposed&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;KeepAlive&#x20;directive&#x20;must&#x20;be&#x20;enabled&#x20;before&#x20;it&#x20;is&#x20;effective.&#x20;Enabling&#x20;KeepAlives&#x20;allows&#x20;for&#x20;multiple&#x20;HTTP&#x20;requests&#x20;to&#x20;be&#x20;sent&#x20;while&#x20;keeping&#x20;the&#x20;same&#x20;TCP&#x20;connection&#x20;alive.&#x20;This&#x20;reduces&#x20;the&#x20;overhead&#x20;of&#x20;having&#x20;to&#x20;setup&#x20;and&#x20;tear&#x20;down&#x20;TCP&#x20;connections&#x20;for&#x20;each&#x20;request.&#x20;By&#x20;making&#x20;the&#x20;server&#x20;more&#x20;efficient,&#x20;it&#x20;will&#x20;be&#x20;more&#x20;resilient&#x20;to&#x20;DoS&#x20;conditions.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;MaxKeepAliveRequests&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;100&#x20;or&#x20;more.&#x20;MaxKeepAliveRequests&#x20;100','[{\"cis\": [\"9.3\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10023,'Ensure&#x20;KeepAliveTimeout&#x20;is&#x20;Set&#x20;to&#x20;a&#x20;Value&#x20;of&#x20;15&#x20;or&#x20;Less','The&#x20;KeepAliveTimeout&#x20;directive&#x20;specifies&#x20;the&#x20;number&#x20;of&#x20;seconds&#x20;Apache&#x20;will&#x20;wait&#x20;for&#x20;a&#x20;subsequent&#x20;request&#x20;before&#x20;closing&#x20;a&#x20;connection&#x20;that&#x20;is&#x20;being&#x20;kept&#x20;alive.','The&#x20;KeepAliveTimeout&#x20;directive&#x20;is&#x20;used&#x20;mitigate&#x20;some&#x20;of&#x20;the&#x20;risk,&#x20;by&#x20;requiring&#x20;more&#x20;effort&#x20;for&#x20;a&#x20;successful&#x20;DoS&#x20;attack.&#x20;By&#x20;enabling&#x20;KeepAlive&#x20;and&#x20;keeping&#x20;the&#x20;timeout&#x20;relatively&#x20;low&#x20;for&#x20;old&#x20;connections&#x20;and&#x20;we&#x20;allow&#x20;the&#x20;server&#x20;to&#x20;free&#x20;up&#x20;resources&#x20;more&#x20;quickly&#x20;and&#x20;be&#x20;more&#x20;responsive.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;KeepAliveTimeout&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;15&#x20;or&#x20;less.&#x20;KeepAliveTimeout&#x20;15','[{\"cis\": [\"9.4\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10024,'Ensure&#x20;the&#x20;Timeout&#x20;Limits&#x20;for&#x20;Request&#x20;Headers&#x20;is&#x20;Set&#x20;to&#x20;40&#x20;or&#x20;Less','The&#x20;RequestReadTimeout&#x20;directive&#x20;allows&#x20;configuration&#x20;of&#x20;timeout&#x20;limits&#x20;for&#x20;client&#x20;requests.&#x20;The&#x20;header&#x20;portion&#x20;of&#x20;the&#x20;directive&#x20;provides&#x20;for&#x20;an&#x20;initial&#x20;timeout&#x20;value,&#x20;a&#x20;maximum&#x20;timeout&#x20;and&#x20;a&#x20;minimum&#x20;rate.&#x20;The&#x20;minimum&#x20;rate&#x20;specifies&#x20;that&#x20;after&#x20;the&#x20;initial&#x20;timeout,&#x20;the&#x20;server&#x20;will&#x20;wait&#x20;an&#x20;additional&#x20;1&#x20;second&#x20;for&#x20;each&#x20;N&#x20;bytes&#x20;received.&#x20;The&#x20;recommended&#x20;setting&#x20;is&#x20;to&#x20;have&#x20;a&#x20;maximum&#x20;timeout&#x20;of&#x20;40&#x20;seconds&#x20;or&#x20;less.&#x20;Keep&#x20;in&#x20;mind&#x20;that&#x20;for&#x20;SSL/TLS&#x20;virtual&#x20;hosts&#x20;the&#x20;time&#x20;for&#x20;the&#x20;TLS&#x20;handshake&#x20;must&#x20;fit&#x20;within&#x20;the&#x20;timeout.','Setting&#x20;a&#x20;request&#x20;header&#x20;timeout&#x20;is&#x20;vital&#x20;for&#x20;mitigating&#x20;Denial&#x20;of&#x20;Service&#x20;attacks&#x20;based&#x20;on&#x20;slow&#x20;requests.&#x20;The&#x20;slow&#x20;request&#x20;attacks&#x20;are&#x20;particularly&#x20;lethal&#x20;and&#x20;relative&#x20;easy&#x20;to&#x20;perform,&#x20;because&#x20;they&#x20;require&#x20;very&#x20;little&#x20;bandwidth&#x20;and&#x20;can&#x20;easily&#x20;be&#x20;done&#x20;through&#x20;anonymous&#x20;proxies.&#x20;Starting&#x20;in&#x20;June&#x20;2009&#x20;with&#x20;the&#x20;Slow&#x20;Loris&#x20;DoS&#x20;attack,&#x20;which&#x20;used&#x20;a&#x20;slow&#x20;GET&#x20;request&#x20;as&#x20;published&#x20;by&#x20;Robert&#x20;Hansen&#x20;&#40;RSnake&#41;&#x20;on&#x20;his&#x20;blog&#x20;http://ha.ckers.org/slowloris/.&#x20;Later&#x20;in&#x20;November&#x20;2010&#x20;at&#x20;the&#x20;OWASP&#x20;App&#x20;Sec&#x20;DC&#x20;conference&#x20;Wong&#x20;Onn&#x20;Chee&#x20;demonstrated&#x20;a&#x20;slow&#x20;POST&#x20;request&#x20;attack&#x20;which&#x20;was&#x20;even&#x20;more&#x20;effective.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Load&#x20;the&#x20;mod_requesttimeout&#x20;module&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;with&#x20;the&#x20;following&#x20;configuration.&#x20;LoadModule&#x20;reqtimeout_module&#x20;modules/mod_reqtimeout.so&#x20;2.&#x20;Add&#x20;a&#x20;RequestReadTimeout&#x20;directive&#x20;similar&#x20;to&#x20;the&#x20;one&#x20;below&#x20;with&#x20;the&#x20;maximum&#x20;request&#x20;header&#x20;timeout&#x20;value&#x20;of&#x20;40&#x20;seconds&#x20;or&#x20;less.&#x20;RequestReadTimeout&#x20;header=20-40,MinRate=500&#x20;body=20,MinRate=500','[{\"cis\": [\"9.5\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10025,'Ensure&#x20;Timeout&#x20;Limits&#x20;for&#x20;the&#x20;Request&#x20;Body&#x20;is&#x20;Set&#x20;to&#x20;20&#x20;or&#x20;Less','The&#x20;RequestReadTimeout&#x20;directive&#x20;also&#x20;allows&#x20;setting&#x20;timeout&#x20;values&#x20;for&#x20;the&#x20;body&#x20;portion&#x20;of&#x20;a&#x20;request.&#x20;The&#x20;directive&#x20;provides&#x20;for&#x20;an&#x20;initial&#x20;timeout&#x20;value,&#x20;and&#x20;a&#x20;maximum&#x20;timeout&#x20;and&#x20;minimum&#x20;rate.&#x20;The&#x20;minimum&#x20;rate&#x20;specifies&#x20;that&#x20;after&#x20;the&#x20;initial&#x20;timeout,&#x20;the&#x20;server&#x20;will&#x20;wait&#x20;an&#x20;additional&#x20;1&#x20;second&#x20;for&#x20;each&#x20;N&#x20;bytes&#x20;are&#x20;received.&#x20;The&#x20;recommended&#x20;setting&#x20;is&#x20;to&#x20;have&#x20;a&#x20;maximum&#x20;timeout&#x20;of&#x20;20&#x20;seconds&#x20;or&#x20;less.&#x20;The&#x20;default&#x20;value&#x20;is&#x20;body=20,MinRate=500.','It&#x20;is&#x20;not&#x20;sufficient&#x20;to&#x20;timeout&#x20;only&#x20;on&#x20;the&#x20;header&#x20;portion&#x20;of&#x20;the&#x20;request,&#x20;as&#x20;the&#x20;server&#x20;will&#x20;still&#x20;be&#x20;vulnerable&#x20;to&#x20;attacks&#x20;like&#x20;the&#x20;OWASP&#x20;Slow&#x20;POST&#x20;attack,&#x20;which&#x20;provide&#x20;the&#x20;body&#x20;of&#x20;the&#x20;request&#x20;very&#x20;slowly.&#x20;Therefore,&#x20;the&#x20;body&#x20;portion&#x20;of&#x20;the&#x20;request&#x20;must&#x20;have&#x20;a&#x20;timeout&#x20;as&#x20;well.&#x20;A&#x20;timeout&#x20;of&#x20;20&#x20;seconds&#x20;or&#x20;less&#x20;is&#x20;recommended.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;1.&#x20;Load&#x20;the&#x20;mod_requesttimeout&#x20;module&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;with&#x20;the&#x20;following&#x20;configuration.&#x20;LoadModule&#x20;reqtimeout_module&#x20;modules/mod_reqtimeout.so&#x20;2.&#x20;Add&#x20;a&#x20;RequestReadTimeout&#x20;directive&#x20;similar&#x20;to&#x20;the&#x20;one&#x20;below&#x20;with&#x20;the&#x20;maximum&#x20;request&#x20;body&#x20;timeout&#x20;value&#x20;of&#x20;20&#x20;seconds&#x20;or&#x20;less.&#x20;RequestReadTimeout&#x20;header=20-40,MinRate=500&#x20;body=20,MinRate=500','[{\"cis\": [\"9.6\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10026,'Ensure&#x20;the&#x20;LimitRequestLine&#x20;directive&#x20;is&#x20;Set&#x20;to&#x20;512&#x20;or&#x20;less','Buffer&#x20;Overflow&#x20;attacks&#x20;attempt&#x20;to&#x20;exploit&#x20;an&#x20;application&#x20;by&#x20;providing&#x20;more&#x20;data&#x20;than&#x20;the&#x20;application&#x20;buffer&#x20;can&#x20;contain.&#x20;If&#x20;the&#x20;application&#x20;allows&#x20;copying&#x20;data&#x20;to&#x20;the&#x20;buffer&#x20;to&#x20;overflow&#x20;the&#x20;boundaries&#x20;of&#x20;the&#x20;buffer,&#x20;then&#x20;the&#x20;application&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;buffer&#x20;overflow.&#x20;The&#x20;results&#x20;of&#x20;Buffer&#x20;overflow&#x20;vulnerabilities&#x20;vary,&#x20;and&#x20;may&#x20;result&#x20;in&#x20;the&#x20;application&#x20;crashing,&#x20;or&#x20;may&#x20;allow&#x20;the&#x20;attacker&#x20;to&#x20;execute&#x20;instructions&#x20;provided&#x20;in&#x20;the&#x20;data.&#x20;The&#x20;Apache&#x20;LimitRequest*&#x20;directives&#x20;allow&#x20;the&#x20;Apache&#x20;web&#x20;server&#x20;to&#x20;limit&#x20;the&#x20;sizes&#x20;of&#x20;requests&#x20;and&#x20;request&#x20;fields&#x20;and&#x20;can&#x20;be&#x20;used&#x20;to&#x20;help&#x20;protect&#x20;programs&#x20;and&#x20;applications&#x20;processing&#x20;those&#x20;requests.&#x20;Specifically,&#x20;the&#x20;LimitRequestLine&#x20;directive&#x20;limits&#x20;the&#x20;allowed&#x20;size&#x20;of&#x20;a&#x20;client&#039;s&#x20;HTTP&#x20;request-line,&#x20;which&#x20;consists&#x20;of&#x20;the&#x20;HTTP&#x20;method,&#x20;URI,&#x20;and&#x20;protocol&#x20;version.','The&#x20;limiting&#x20;of&#x20;the&#x20;size&#x20;of&#x20;the&#x20;request&#x20;line&#x20;is&#x20;helpful&#x20;so&#x20;that&#x20;the&#x20;web&#x20;server&#x20;can&#x20;prevent&#x20;an&#x20;unexpectedly&#x20;long&#x20;or&#x20;large&#x20;request&#x20;from&#x20;being&#x20;passed&#x20;to&#x20;a&#x20;potentially&#x20;vulnerable&#x20;CGI&#x20;program,&#x20;module&#x20;or&#x20;application&#x20;that&#x20;would&#x20;have&#x20;attempted&#x20;to&#x20;process&#x20;the&#x20;request.&#x20;Of&#x20;course,&#x20;the&#x20;underlying&#x20;dependency&#x20;is&#x20;that&#x20;we&#x20;need&#x20;to&#x20;set&#x20;the&#x20;limits&#x20;high&#x20;enough&#x20;to&#x20;not&#x20;interfere&#x20;with&#x20;any&#x20;one&#x20;application&#x20;on&#x20;the&#x20;server,&#x20;while&#x20;setting&#x20;them&#x20;low&#x20;enough&#x20;to&#x20;be&#x20;of&#x20;value&#x20;in&#x20;protecting&#x20;the&#x20;applications.&#x20;Since&#x20;the&#x20;configuration&#x20;directive&#x20;is&#x20;available&#x20;only&#x20;at&#x20;the&#x20;server&#x20;configuration&#x20;level,&#x20;it&#x20;is&#x20;not&#x20;possible&#x20;to&#x20;tune&#x20;the&#x20;value&#x20;for&#x20;different&#x20;portions&#x20;of&#x20;the&#x20;same&#x20;web&#x20;server.&#x20;Please&#x20;read&#x20;the&#x20;Apache&#x20;documentation&#x20;carefully,&#x20;as&#x20;these&#x20;requests&#x20;may&#x20;interfere&#x20;with&#x20;the&#x20;expected&#x20;functionality&#x20;of&#x20;some&#x20;web&#x20;applications.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;LimitRequestline&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;512&#x20;or&#x20;shorter.&#x20;LimitRequestline&#x20;512','[{\"cis\": [\"10.1\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10027,'Ensure&#x20;the&#x20;LimitRequestFields&#x20;Directive&#x20;is&#x20;Set&#x20;to&#x20;100&#x20;or&#x20;Less','The&#x20;LimitRequestFields&#x20;directive&#x20;limits&#x20;the&#x20;number&#x20;of&#x20;fields&#x20;allowed&#x20;in&#x20;an&#x20;HTTP&#x20;request.','The&#x20;limiting&#x20;of&#x20;the&#x20;number&#x20;of&#x20;fields&#x20;is&#x20;helpful&#x20;so&#x20;that&#x20;the&#x20;web&#x20;server&#x20;can&#x20;prevent&#x20;an&#x20;unexpectedly&#x20;high&#x20;number&#x20;of&#x20;fields&#x20;from&#x20;being&#x20;passed&#x20;to&#x20;a&#x20;potentially&#x20;vulnerable&#x20;CGI&#x20;program,&#x20;module&#x20;or&#x20;application&#x20;that&#x20;would&#x20;have&#x20;attempted&#x20;to&#x20;process&#x20;the&#x20;request.&#x20;Of&#x20;course,&#x20;the&#x20;underlying&#x20;dependency&#x20;is&#x20;that&#x20;we&#x20;need&#x20;to&#x20;set&#x20;the&#x20;limits&#x20;high&#x20;enough&#x20;to&#x20;not&#x20;interfere&#x20;with&#x20;any&#x20;one&#x20;application&#x20;on&#x20;the&#x20;server,&#x20;while&#x20;setting&#x20;them&#x20;low&#x20;enough&#x20;to&#x20;be&#x20;of&#x20;value&#x20;in&#x20;protecting&#x20;the&#x20;applications.&#x20;Since&#x20;the&#x20;configuration&#x20;directives&#x20;are&#x20;available&#x20;only&#x20;at&#x20;the&#x20;server&#x20;configuration&#x20;level,&#x20;it&#x20;is&#x20;not&#x20;possible&#x20;to&#x20;tune&#x20;the&#x20;value&#x20;for&#x20;different&#x20;portions&#x20;of&#x20;the&#x20;same&#x20;web&#x20;server.&#x20;Please&#x20;read&#x20;the&#x20;Apache&#x20;documentation&#x20;carefully,&#x20;as&#x20;these&#x20;requests&#x20;may&#x20;interfere&#x20;with&#x20;the&#x20;expected&#x20;functionality&#x20;of&#x20;some&#x20;web&#x20;applications.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;LimitRequestFields&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;100&#x20;or&#x20;less.&#x20;If&#x20;the&#x20;directive&#x20;is&#x20;not&#x20;present&#x20;the&#x20;default&#x20;depends&#x20;on&#x20;a&#x20;compile&#x20;time&#x20;configuration,&#x20;but&#x20;defaults&#x20;to&#x20;a&#x20;value&#x20;of&#x20;100.&#x20;LimitRequestFields&#x20;100','[{\"cis\": [\"10.2\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10028,'Ensure&#x20;the&#x20;LimitRequestFieldsize&#x20;Directive&#x20;is&#x20;Set&#x20;to&#x20;1024&#x20;or&#x20;Less','The&#x20;LimitRequestFieldSize&#x20;limits&#x20;the&#x20;number&#x20;of&#x20;bytes&#x20;that&#x20;will&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;HTTP&#x20;request&#x20;header.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;LimitRequestFieldSize&#x20;directive&#x20;be&#x20;set&#x20;to&#x20;1024&#x20;or&#x20;less.','By&#x20;limiting&#x20;of&#x20;the&#x20;size&#x20;of&#x20;request&#x20;headers&#x20;is&#x20;helpful&#x20;so&#x20;that&#x20;the&#x20;web&#x20;server&#x20;can&#x20;prevent&#x20;an&#x20;unexpectedly&#x20;long&#x20;or&#x20;large&#x20;value&#x20;from&#x20;being&#x20;passed&#x20;to&#x20;exploit&#x20;a&#x20;potentially&#x20;vulnerable&#x20;program.&#x20;Of&#x20;course,&#x20;the&#x20;underlying&#x20;dependency&#x20;is&#x20;that&#x20;we&#x20;need&#x20;to&#x20;set&#x20;the&#x20;limits&#x20;high&#x20;enough&#x20;to&#x20;not&#x20;interfere&#x20;with&#x20;any&#x20;one&#x20;application&#x20;on&#x20;the&#x20;server,&#x20;while&#x20;setting&#x20;them&#x20;low&#x20;enough&#x20;to&#x20;be&#x20;of&#x20;value&#x20;in&#x20;protecting&#x20;the&#x20;applications.&#x20;Since&#x20;the&#x20;configuration&#x20;directives&#x20;are&#x20;available&#x20;only&#x20;at&#x20;the&#x20;server&#x20;configuration&#x20;level,&#x20;it&#x20;is&#x20;not&#x20;possible&#x20;to&#x20;tune&#x20;the&#x20;value&#x20;for&#x20;different&#x20;portions&#x20;of&#x20;the&#x20;same&#x20;web&#x20;server.&#x20;Please&#x20;read&#x20;the&#x20;Apache&#x20;documentation&#x20;carefully,&#x20;as&#x20;these&#x20;requests&#x20;may&#x20;interfere&#x20;with&#x20;the&#x20;expected&#x20;functionality&#x20;of&#x20;some&#x20;web&#x20;applications.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;LimitRequestFieldsize&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;1024&#x20;or&#x20;less.&#x20;LimitRequestFieldsize&#x20;1024','[{\"cis\": [\"10.3\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10029,'Ensure&#x20;the&#x20;LimitRequestBody&#x20;Directive&#x20;is&#x20;Set&#x20;to&#x20;102400&#x20;or&#x20;Less','The&#x20;LimitRequestBody&#x20;directive&#x20;limits&#x20;the&#x20;number&#x20;of&#x20;bytes&#x20;that&#x20;are&#x20;allowed&#x20;in&#x20;a&#x20;request&#x20;body.&#x20;Size&#x20;of&#x20;requests&#x20;may&#x20;vary&#x20;greatly;&#x20;for&#x20;example,&#x20;during&#x20;a&#x20;file&#x20;upload&#x20;the&#x20;size&#x20;of&#x20;the&#x20;file&#x20;must&#x20;fit&#x20;within&#x20;this&#x20;limit.','The&#x20;limiting&#x20;of&#x20;the&#x20;size&#x20;of&#x20;the&#x20;request&#x20;body&#x20;is&#x20;helpful&#x20;so&#x20;that&#x20;the&#x20;web&#x20;server&#x20;can&#x20;prevent&#x20;an&#x20;unexpectedly&#x20;long&#x20;or&#x20;large&#x20;request&#x20;from&#x20;being&#x20;passed&#x20;to&#x20;a&#x20;potentially&#x20;vulnerable&#x20;program.&#x20;Of&#x20;course,&#x20;the&#x20;underlying&#x20;dependency&#x20;is&#x20;that&#x20;we&#x20;need&#x20;to&#x20;set&#x20;the&#x20;limits&#x20;high&#x20;enough&#x20;to&#x20;not&#x20;interfere&#x20;with&#x20;any&#x20;one&#x20;application&#x20;on&#x20;the&#x20;server,&#x20;while&#x20;setting&#x20;them&#x20;low&#x20;enough&#x20;to&#x20;be&#x20;of&#x20;value&#x20;in&#x20;protecting&#x20;the&#x20;applications.&#x20;The&#x20;LimitRequestBody&#x20;may&#x20;be&#x20;configured&#x20;on&#x20;a&#x20;per&#x20;directory,&#x20;or&#x20;per&#x20;location&#x20;context.&#x20;Please&#x20;read&#x20;the&#x20;Apache&#x20;documentation&#x20;carefully,&#x20;as&#x20;these&#x20;requests&#x20;may&#x20;interfere&#x20;with&#x20;the&#x20;expected&#x20;functionality&#x20;of&#x20;some&#x20;web&#x20;applications.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Add&#x20;or&#x20;modify&#x20;the&#x20;LimitRequestBody&#x20;directive&#x20;in&#x20;the&#x20;Apache&#x20;configuration&#x20;to&#x20;have&#x20;a&#x20;value&#x20;of&#x20;102400&#x20;&#40;100K&#41;&#x20;or&#x20;less.&#x20;Please&#x20;read&#x20;the&#x20;Apache&#x20;documentation&#x20;so&#x20;that&#x20;it&#x20;is&#x20;understood&#x20;that&#x20;this&#x20;directive&#x20;will&#x20;limit&#x20;the&#x20;size&#x20;of&#x20;file&#x20;up-loads&#x20;to&#x20;the&#x20;web&#x20;server.&#x20;LimitRequestBody&#x20;102400','[{\"cis\": [\"10.4\"]}, {\"cis_csc\": [\"9\", \"5.1\"]}]'),(10500,'Disable&#x20;MySQL&#x20;Command&#x20;History','On&#x20;Linux/UNIX,&#x20;the&#x20;MySQL&#x20;client&#x20;logs&#x20;statements&#x20;executed&#x20;interactively&#x20;to&#x20;a&#x20;history&#x20;file.&#x20;By&#x20;default,&#x20;this&#x20;file&#x20;is&#x20;named&#x20;.mysql_history&#x20;in&#x20;the&#x20;user&#039;s&#x20;home&#x20;directory.&#x20;Most&#x20;interactive&#x20;commands&#x20;run&#x20;in&#x20;the&#x20;MySQL&#x20;client&#x20;application&#x20;are&#x20;saved&#x20;to&#x20;a&#x20;history&#x20;file.&#x20;The&#x20;MySQL&#x20;command&#x20;history&#x20;should&#x20;be&#x20;disabled.','Disabling&#x20;the&#x20;MySQL&#x20;command&#x20;history&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;exposing&#x20;sensitive&#x20;information,&#x20;such&#x20;as&#x20;passwords&#x20;and&#x20;encryption&#x20;keys.','','Perform&#x20;the&#x20;following&#x20;steps:&#x20;1.&#x20;Remove&#x20;.mysql_history&#x20;if&#x20;it&#x20;exists.&#x20;And&#x20;2.&#x20;Set&#x20;the&#x20;MYSQL_HISTFILE&#x20;environment&#x20;variable&#x20;to&#x20;/dev/null.&#x20;This&#x20;will&#x20;need&#x20;to&#x20;be&#x20;placed&#x20;in&#x20;the&#x20;shell&#039;s&#x20;startup&#x20;script.&#x20;Or&#x20;Create&#x20;$HOME/.mysql_history&#x20;as&#x20;a&#x20;symbolic&#x20;to&#x20;/dev/null.','[{\"cis\": [\"1.3\"]}]'),(10501,'Disable&#x20;Interactive&#x20;Login','When&#x20;created,&#x20;the&#x20;MySQL&#x20;user&#x20;may&#x20;have&#x20;interactive&#x20;access&#x20;to&#x20;the&#x20;operating&#x20;system,&#x20;which&#x20;means&#x20;that&#x20;the&#x20;MySQL&#x20;user&#x20;could&#x20;login&#x20;to&#x20;the&#x20;host&#x20;as&#x20;any&#x20;other&#x20;user&#x20;would.','Preventing&#x20;the&#x20;MySQL&#x20;user&#x20;from&#x20;logging&#x20;in&#x20;interactively&#x20;may&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;a&#x20;compromised&#x20;MySQL&#x20;account.&#x20;There&#x20;is&#x20;also&#x20;more&#x20;accountability&#x20;as&#x20;accessing&#x20;the&#x20;operating&#x20;system&#x20;where&#x20;the&#x20;MySQL&#x20;server&#x20;lies&#x20;will&#x20;require&#x20;the&#x20;user&#039;s&#x20;own&#x20;account.&#x20;Interactive&#x20;access&#x20;by&#x20;the&#x20;MySQL&#x20;user&#x20;is&#x20;unnecessary&#x20;and&#x20;should&#x20;be&#x20;disabled.','','Execute&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;in&#x20;a&#x20;terminal:&#x20;&#039;usermod&#x20;-s&#x20;/bin/false&#x20;mysql&#039;&#x20;or&#x20;&#039;usermod&#x20;-s&#x20;/sbin/nologin&#x20;mysql&#039;','[{\"cis\": [\"1.5\"]}]'),(10502,'Verify&#x20;That&#x20;&#039;MYSQL_PWD&#039;&#x20;Is&#x20;Not&#x20;Set&#x20;In&#x20;Users&#039;&#x20;Profiles','MySQL&#x20;can&#x20;read&#x20;a&#x20;default&#x20;database&#x20;password&#x20;from&#x20;an&#x20;environment&#x20;variable&#x20;called&#x20;MYSQL_PWD.','The&#x20;use&#x20;of&#x20;the&#x20;MYSQL_PWD&#x20;environment&#x20;variable&#x20;implies&#x20;the&#x20;clear&#x20;text&#x20;storage&#x20;of&#x20;MySQL&#x20;credentials.&#x20;Avoiding&#x20;this&#x20;may&#x20;increase&#x20;assurance&#x20;that&#x20;the&#x20;confidentiality&#x20;of&#x20;MySQL&#x20;credentials&#x20;is&#x20;preserved.','','Check&#x20;which&#x20;users&#x20;and/or&#x20;scripts&#x20;are&#x20;setting&#x20;MYSQL_PWD&#x20;and&#x20;change&#x20;them&#x20;to&#x20;use&#x20;a&#x20;more&#x20;secure&#x20;method.','[{\"cis\": [\"1.6\"]}]'),(10503,'Ensure&#x20;&#039;allow-suspicious-udfs&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;FALSE&#039;','This&#x20;option&#x20;prevents&#x20;attaching&#x20;arbitrary&#x20;shared&#x20;library&#x20;functions&#x20;as&#x20;user-defined&#x20;functions&#x20;by&#x20;checking&#x20;for&#x20;at&#x20;least&#x20;one&#x20;corresponding&#x20;method&#x20;named&#x20;_init,&#x20;_deinit,&#x20;_reset,&#x20;_clear,&#x20;or&#x20;_add.','Preventing&#x20;shared&#x20;libraries&#x20;that&#x20;do&#x20;not&#x20;contain&#x20;user-defined&#x20;functions&#x20;from&#x20;loading&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.','','Remove&#x20;&#039;--allow-suspicious-udfs&#039;&#x20;from&#x20;the&#x20;&#039;mysqld&#039;&#x20;start&#x20;up&#x20;command&#x20;line.&#x20;Or&#x20;Remove&#x20;&#039;allow-suspicious-udfs&#039;&#x20;from&#x20;the&#x20;MySQL&#x20;option&#x20;file.','[{\"cis\": [\"4.3\"]}]'),(10504,'Ensure&#x20;&#039;local_infile&#039;&#x20;is&#x20;Disabled','The&#x20;&#039;local_infile&#039;&#x20;parameter&#x20;dictates&#x20;whether&#x20;files&#x20;located&#x20;on&#x20;the&#x20;MySQL&#x20;client&#039;s&#x20;computer&#x20;can&#x20;be&#x20;loaded&#x20;or&#x20;selected&#x20;via&#x20;&#039;LOAD&#x20;DATA&#x20;INFILE&#039;&#x20;or&#x20;&#039;SELECT&#x20;local_file&#039;.','Disabling&#x20;&#039;local_infile&#039;&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;ability&#x20;to&#x20;read&#x20;sensitive&#x20;files&#x20;off&#x20;the&#x20;affected&#x20;server&#x20;via&#x20;a&#x20;SQL&#x20;injection&#x20;vulnerability.','','Add&#x20;a&#x20;line&#x20;local-infile=0&#x20;in&#x20;the&#x20;[mysqld]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;and&#x20;restart&#x20;the&#x20;MySQL&#x20;service.','[{\"cis\": [\"4.4\"]}]'),(10505,'Ensure&#x20;&#039;mysqld&#039;&#x20;Is&#x20;Not&#x20;Started&#x20;with&#x20;&#039;--skip-grant-tables&#039;','This&#x20;option&#x20;causes&#x20;mysqld&#x20;to&#x20;start&#x20;without&#x20;using&#x20;the&#x20;privilege&#x20;system.','If&#x20;this&#x20;option&#x20;is&#x20;used,&#x20;all&#x20;clients&#x20;of&#x20;the&#x20;affected&#x20;server&#x20;will&#x20;have&#x20;unrestricted&#x20;access&#x20;to&#x20;all&#x20;databases.','','Open&#x20;the&#x20;MySQL&#x20;configuration&#x20;&#40;e.g.&#x20;my.cnf&#41;&#x20;file&#x20;and&#x20;set:&#x20;skip-grant-tables&#x20;=&#x20;FALSE','[{\"cis\": [\"4.5\"]}]'),(10506,'Ensure&#x20;&#039;--skip-symbolic-links&#039;&#x20;Is&#x20;Enabled','The&#x20;symbolic-links&#x20;and&#x20;skip-symbolic-links&#x20;options&#x20;for&#x20;MySQL&#x20;determine&#x20;whether&#x20;symbolic&#x20;link&#x20;support&#x20;is&#x20;available.&#x20;&#x20;When&#x20;use&#x20;of&#x20;symbolic&#x20;links&#x20;are&#x20;enabled,&#x20;they&#x20;have&#x20;different&#x20;effects&#x20;depending&#x20;on&#x20;the&#x20;host&#x20;platform.&#x20;&#x20;When&#x20;symbolic&#x20;links&#x20;are&#x20;disabled,&#x20;then&#x20;symbolic&#x20;links&#x20;stored&#x20;in&#x20;files&#x20;or&#x20;entries&#x20;in&#x20;tables&#x20;are&#x20;not&#x20;used&#x20;by&#x20;the&#x20;database.&#x20;','Prevents&#x20;sym&#x20;links&#x20;being&#x20;used&#x20;for&#x20;data&#x20;base&#x20;files.&#x20;This&#x20;is&#x20;especially&#x20;important&#x20;when&#x20;MySQL&#x20;is&#x20;executing&#x20;as&#x20;root&#x20;as&#x20;arbitrary&#x20;files&#x20;may&#x20;be&#x20;overwritten.&#x20;The&#x20;symbolic-links&#x20;option&#x20;might&#x20;allow&#x20;someone&#x20;to&#x20;direct&#x20;actions&#x20;by&#x20;to&#x20;MySQL&#x20;server&#x20;to&#x20;other&#x20;files&#x20;and/or&#x20;directories.','','Open&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;locate&#x20;&#039;skip_symbolic_links&#039;&#x20;and&#x20;set&#x20;it&#x20;to&#x20;YES.&#x20;If&#x20;the&#x20;option&#x20;does&#x20;not&#x20;exist,&#x20;create&#x20;it&#x20;in&#x20;the&#x20;&#039;mysqld&#039;&#x20;section.','[{\"cis\": [\"4.6\"]}]'),(10507,'Ensure&#x20;&#039;secure_file_priv&#039;&#x20;is&#x20;not&#x20;empty','The&#x20;secure_file_priv&#x20;option&#x20;restricts&#x20;to&#x20;paths&#x20;used&#x20;by&#x20;LOAD&#x20;DATA&#x20;INFILE&#x20;or&#x20;SELECT&#x20;local_file.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;option&#x20;be&#x20;set&#x20;to&#x20;a&#x20;file&#x20;system&#x20;location&#x20;that&#x20;contains&#x20;only&#x20;resources&#x20;expected&#x20;to&#x20;be&#x20;loaded&#x20;by&#x20;MySQL.','Setting&#x20;secure_file_priv&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;ability&#x20;to&#x20;read&#x20;sensitive&#x20;files&#x20;off&#x20;the&#x20;affected&#x20;server&#x20;via&#x20;a&#x20;SQL&#x20;injection&#x20;vulnerability.&#x20;','','Add&#x20;the&#x20;line&#x20;secure_file_priv=&lt;path_to_load_directory&gt;&#x20;to&#x20;the&#x20;[mysqld]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;and&#x20;restart&#x20;the&#x20;MySQL&#x20;service.','[{\"cis\": [\"4.8\"]}]'),(10508,'Ensure&#x20;&#039;sql_mode&#039;&#x20;Contains&#x20;&#039;STRICT_ALL_TABLES&#039;','When&#x20;data&#x20;changing&#x20;statements&#x20;are&#x20;made&#x20;&#40;i.e.&#x20;INSERT,&#x20;UPDATE&#41;,&#x20;MySQL&#x20;can&#x20;handle&#x20;invalid&#x20;or&#x20;missing&#x20;values&#x20;differently&#x20;depending&#x20;on&#x20;whether&#x20;strict&#x20;SQL&#x20;mode&#x20;is&#x20;enabled.&#x20;When&#x20;strict&#x20;SQL&#x20;mode&#x20;is&#x20;enabled,&#x20;data&#x20;may&#x20;not&#x20;be&#x20;truncated&#x20;or&#x20;otherwise&#x20;&#039;adjusted&#039;&#x20;to&#x20;make&#x20;the&#x20;data&#x20;changing&#x20;statement&#x20;work.','Without&#x20;strict&#x20;mode&#x20;the&#x20;server&#x20;tries&#x20;to&#x20;do&#x20;proceed&#x20;with&#x20;the&#x20;action&#x20;when&#x20;an&#x20;error&#x20;might&#x20;have&#x20;been&#x20;a&#x20;more&#x20;secure&#x20;choice.&#x20;For&#x20;example,&#x20;by&#x20;default&#x20;MySQL&#x20;will&#x20;truncate&#x20;data&#x20;if&#x20;it&#x20;does&#x20;not&#x20;fit&#x20;in&#x20;a&#x20;field,&#x20;which&#x20;can&#x20;lead&#x20;to&#x20;unknown&#x20;behavior,&#x20;or&#x20;be&#x20;leveraged&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;circumvent&#x20;data&#x20;validation.&#x20;','','Add&#x20;STRICT_ALL_TABLES&#x20;to&#x20;the&#x20;sql_mode&#x20;in&#x20;the&#x20;server&#039;s&#x20;configuration&#x20;file.','[{\"cis\": [\"4.9\"]}]'),(10509,'Ensure&#x20;&#039;log_error&#039;&#x20;is&#x20;not&#x20;empty','The&#x20;error&#x20;log&#x20;contains&#x20;information&#x20;about&#x20;events&#x20;such&#x20;as&#x20;mysqld&#x20;starting&#x20;and&#x20;stopping,&#x20;when&#x20;a&#x20;table&#x20;needs&#x20;to&#x20;be&#x20;checked&#x20;or&#x20;repaired,&#x20;and,&#x20;depending&#x20;on&#x20;the&#x20;host&#x20;operating&#x20;system,&#x20;stack&#x20;traces&#x20;when&#x20;mysqld&#x20;fails','Enabling&#x20;error&#x20;logging&#x20;may&#x20;increase&#x20;the&#x20;ability&#x20;to&#x20;detect&#x20;malicious&#x20;attempts&#x20;against&#x20;MySQL,&#x20;and&#x20;other&#x20;critical&#x20;messages,&#x20;such&#x20;as&#x20;if&#x20;the&#x20;error&#x20;log&#x20;is&#x20;not&#x20;enabled&#x20;then&#x20;connection&#x20;error&#x20;might&#x20;go&#x20;unnoticed.','','Set&#x20;the&#x20;log-error&#x20;option&#x20;to&#x20;the&#x20;path&#x20;for&#x20;the&#x20;error&#x20;log&#x20;in&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#x20;or&#x20;my.ini&#41;.','[{\"cis\": [\"6.1\"]}]'),(10510,'Ensure&#x20;Log&#x20;Files&#x20;are&#x20;not&#x20;Stored&#x20;on&#x20;a&#x20;non-system&#x20;partition','MySQL&#x20;log&#x20;files&#x20;can&#x20;be&#x20;set&#x20;in&#x20;the&#x20;MySQL&#x20;configuration&#x20;to&#x20;exist&#x20;anywhere&#x20;on&#x20;the&#x20;filesystem.&#x20;&#x20;It&#x20;is&#x20;common&#x20;practice&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;filesystem&#x20;is&#x20;left&#x20;uncluttered&#x20;by&#x20;application&#x20;logs.&#x20;&#x20;System&#x20;filesystems&#x20;include&#x20;the&#x20;root,&#x20;/var,&#x20;or&#x20;/usr.','Moving&#x20;the&#x20;MySQL&#x20;logs&#x20;off&#x20;the&#x20;system&#x20;partition&#x20;will&#x20;reduce&#x20;the&#x20;probability&#x20;of&#x20;denial&#x20;of&#x20;service&#x20;via&#x20;the&#x20;exhaustion&#x20;of&#x20;available&#x20;disk&#x20;space&#x20;to&#x20;the&#x20;operating&#x20;system.','','In&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;locate&#x20;the&#x20;log-bin&#x20;entry&#x20;and&#x20;set&#x20;it&#x20;to&#x20;a&#x20;file&#x20;not&#x20;on&#x20;root&#x20;&#40;&#039;/&#039;&#41;,&#x20;/var,&#x20;or&#x20;/usr.','[{\"cis\": [\"6.2\"]}]'),(10511,'Ensure&#x20;&#039;log_warning&#039;&#x20;is&#x20;set&#x20;to&#x20;2','The&#x20;log_warnings&#x20;system&#x20;variable,&#x20;enabled&#x20;by&#x20;default,&#x20;provides&#x20;additional&#x20;information&#x20;to&#x20;the&#x20;MySQL&#x20;log.&#x20;&#x20;A&#x20;value&#x20;of&#x20;1&#x20;enables&#x20;logging&#x20;of&#x20;warning&#x20;messages,&#x20;and&#x20;higher&#x20;integer&#x20;values&#x20;tend&#x20;to&#x20;enable&#x20;more&#x20;logging.','This&#x20;might&#x20;help&#x20;to&#x20;detect&#x20;malicious&#x20;behavior&#x20;by&#x20;logging&#x20;communication&#x20;errors&#x20;and&#x20;aborted&#x20;connections.','','Ensure&#x20;a&#x20;line&#x20;containing&#x20;log-warnings&#x20;=&#x20;2&#x20;is&#x20;found&#x20;in&#x20;the&#x20;mysqld&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;.','[{\"cis\": [\"6.3\"]}]'),(10512,'Ensure&#x20;&#039;log_raw&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;','The&#x20;log-raw&#x20;MySQL&#x20;option&#x20;determines&#x20;whether&#x20;passwords&#x20;are&#x20;rewritten&#x20;by&#x20;the&#x20;server&#x20;so&#x20;as&#x20;not&#x20;to&#x20;appear&#x20;in&#x20;log&#x20;files&#x20;as&#x20;plain&#x20;text.&#x20;&#x20;If&#x20;log-raw&#x20;is&#x20;enabled,&#x20;then&#x20;passwords&#x20;are&#x20;written&#x20;to&#x20;the&#x20;various&#x20;log&#x20;files&#x20;&#40;general&#x20;query&#x20;log,&#x20;slow&#x20;query&#x20;log,&#x20;and&#x20;binary&#x20;log&#41;&#x20;in&#x20;plain&#x20;text.&#x20;','With&#x20;raw&#x20;logging&#x20;of&#x20;passwords&#x20;enabled&#x20;someone&#x20;with&#x20;access&#x20;to&#x20;the&#x20;log&#x20;files&#x20;might&#x20;see&#x20;plain&#x20;text&#x20;passwords.','','IN&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;locate&#x20;and&#x20;set&#x20;the&#x20;value&#x20;of&#x20;this&#x20;option:&#x20;log-raw&#x20;=&#x20;OFF','[{\"cis\": [\"6.4\"]}]');
INSERT INTO `tsca` VALUES (10513,'Ensure&#x20;&#039;old_passwords&#039;&#x20;Is&#x20;Not&#x20;Set&#x20;to&#x20;&#039;1&#039;&#x20;or&#x20;&#039;ON&#039;','This&#x20;variable&#x20;controls&#x20;the&#x20;password&#x20;hashing&#x20;method&#x20;used&#x20;by&#x20;the&#x20;PASSWORD&#40;&#41;&#x20;function&#x20;and&#x20;for&#x20;the&#x20;IDENTIFIED&#x20;BY&#x20;clause&#x20;of&#x20;the&#x20;CREATE&#x20;USER&#x20;and&#x20;GRANT&#x20;statements.&#x20;&#x20;Before&#x20;5.6.6,&#x20;the&#x20;value&#x20;can&#x20;be&#x20;0&#x20;&#40;or&#x20;OFF&#41;,&#x20;or&#x20;1&#x20;&#40;or&#x20;ON&#41;.&#x20;As&#x20;of&#x20;5.6.6,&#x20;the&#x20;following&#x20;value&#x20;can&#x20;be&#x20;one&#x20;of&#x20;the&#x20;following:&#x20;0&#x20;-&#x20;authenticate&#x20;with&#x20;the&#x20;mysql_native_password&#x20;plugin;&#x20;1&#x20;-&#x20;authenticate&#x20;with&#x20;the&#x20;mysql_old_password&#x20;plugin;&#x20;2&#x20;-&#x20;authenticate&#x20;with&#x20;the&#x20;sha256_password&#x20;plugin','The&#x20;mysql_old_password&#x20;plugin&#x20;leverages&#x20;an&#x20;algorithm&#x20;that&#x20;can&#x20;be&#x20;quickly&#x20;brute&#x20;forced&#x20;using&#x20;an&#x20;offline&#x20;dictionary&#x20;attack.&#x20;See&#x20;CVE-2003-1480&#x20;for&#x20;additional&#x20;details.','','Configure&#x20;mysql&#x20;to&#x20;leverage&#x20;the&#x20;mysql_native_password&#x20;or&#x20;sha256_password&#x20;plugin.','[{\"cis\": [\"7.1\"]}]'),(10514,'Ensure&#x20;&#039;secure_auth&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;','This&#x20;option&#x20;dictates&#x20;whether&#x20;the&#x20;server&#x20;will&#x20;deny&#x20;connections&#x20;by&#x20;clients&#x20;that&#x20;attempt&#x20;to&#x20;use&#x20;accounts&#x20;that&#x20;have&#x20;their&#x20;password&#x20;stored&#x20;in&#x20;the&#x20;mysql_old_password&#x20;format.','Enabling&#x20;this&#x20;option&#x20;will&#x20;prevent&#x20;all&#x20;use&#x20;of&#x20;passwords&#x20;employing&#x20;the&#x20;old&#x20;format&#x20;&#40;and&#x20;hence&#x20;insecure&#x20;communication&#x20;over&#x20;the&#x20;network&#41;.','','Add&#x20;a&#x20;line&#x20;secure_auth=ON&#x20;to&#x20;the&#x20;[mysqld]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;option&#x20;file.','[{\"cis\": [\"7.2\"]}]'),(10515,'Ensure&#x20;Passwords&#x20;Are&#x20;Not&#x20;Stored&#x20;in&#x20;the&#x20;Global&#x20;Configuration','The&#x20;[client]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;allows&#x20;setting&#x20;a&#x20;user&#x20;and&#x20;password&#x20;to&#x20;be&#x20;used.&#x20;Verify&#x20;the&#x20;password&#x20;option&#x20;is&#x20;not&#x20;used&#x20;in&#x20;the&#x20;global&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;.','The&#x20;use&#x20;of&#x20;the&#x20;password&#x20;parameter&#x20;may&#x20;negatively&#x20;impact&#x20;the&#x20;confidentiality&#x20;of&#x20;the&#x20;user&#039;s&#x20;password.','','Use&#x20;the&#x20;mysql_config_editor&#x20;to&#x20;store&#x20;authentication&#x20;credentials&#x20;in&#x20;.mylogin.cnf&#x20;in&#x20;encrypted&#x20;form.&#x20;If&#x20;not&#x20;possible,&#x20;use&#x20;the&#x20;user-specific&#x20;options&#x20;file,&#x20;.my.cnf.,&#x20;and&#x20;restricting&#x20;file&#x20;access&#x20;permissions&#x20;to&#x20;the&#x20;user&#x20;identity.&#x20;','[{\"cis\": [\"7.3\"]}]'),(10516,'Ensure&#x20;&#039;sql_mode&#039;&#x20;Contains&#x20;&#039;NO_AUTO_CREATE_USER&#039;','NO_AUTO_CREATE_USER&#x20;is&#x20;an&#x20;option&#x20;for&#x20;sql_mode&#x20;that&#x20;prevents&#x20;a&#x20;GRANT&#x20;statement&#x20;from&#x20;automatically&#x20;creating&#x20;a&#x20;user&#x20;when&#x20;authentication&#x20;information&#x20;is&#x20;not&#x20;provided.','Blank&#x20;passwords&#x20;negate&#x20;the&#x20;benefits&#x20;provided&#x20;by&#x20;authentication&#x20;mechanisms.&#x20;Without&#x20;this&#x20;setting&#x20;an&#x20;administrative&#x20;user&#x20;might&#x20;accidentally&#x20;create&#x20;a&#x20;user&#x20;without&#x20;a&#x20;password.','','In&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;find&#x20;the&#x20;sql_mode&#x20;setting&#x20;in&#x20;the&#x20;[mysqld]&#x20;area,&#x20;and&#x20;add&#x20;the&#x20;NO_AUTO_CREATE_USER&#x20;to&#x20;the&#x20;sql_mode&#x20;setting.','[{\"cis\": [\"7.4\"]}]'),(10517,'Ensure&#x20;Password&#x20;Policy&#x20;is&#x20;in&#x20;Place','Password&#x20;complexity&#x20;includes&#x20;password&#x20;characteristics&#x20;such&#x20;as&#x20;length,&#x20;case,&#x20;length,&#x20;and&#x20;character&#x20;sets.','Complex&#x20;passwords&#x20;help&#x20;mitigate&#x20;dictionary,&#x20;brute&#x20;forcing,&#x20;and&#x20;other&#x20;password&#x20;attacks.&#x20;This&#x20;recommendation&#x20;prevents&#x20;users&#x20;from&#x20;choosing&#x20;weak&#x20;passwords&#x20;which&#x20;can&#x20;easily&#x20;be&#x20;guessed.','','Add&#x20;to&#x20;the&#x20;global&#x20;configuration:&#x20;plugin-load=validate_password.so&#x20;validate-password=FORCE_PLUS_PERMANENT&#x20;validate_password_length=14&#x20;validate_password_mixed_case_count=1&#x20;validate_password_number_count=1&#x20;validate_password_special_char_count=1&#x20;validate_password_policy=MEDIUM.&#x20;And&#x20;change&#x20;passwords&#x20;for&#x20;users&#x20;which&#x20;have&#x20;passwords&#x20;which&#x20;are&#x20;identical&#x20;to&#x20;their&#x20;username.&#x20;Restarting&#x20;the&#x20;server&#x20;is&#x20;required.','[{\"cis\": [\"7.6\"]}]'),(10518,'Ensure&#x20;&#039;master_info_repository&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;TABLE&#039;','The&#x20;master_info_repository&#x20;setting&#x20;determines&#x20;to&#x20;where&#x20;a&#x20;slave&#x20;logs&#x20;master&#x20;status&#x20;and&#x20;connection&#x20;information.&#x20;&#x20;The&#x20;options&#x20;are&#x20;FILE&#x20;or&#x20;TABLE.&#x20;Note&#x20;also&#x20;that&#x20;this&#x20;setting&#x20;is&#x20;associated&#x20;with&#x20;the&#x20;sync_master_info&#x20;setting&#x20;as&#x20;well.','The&#x20;password&#x20;which&#x20;the&#x20;client&#x20;uses&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;master&#x20;info&#x20;repository,&#x20;which&#x20;by&#x20;default&#x20;is&#x20;a&#x20;plaintext&#x20;file.&#x20;The&#x20;TABLE&#x20;master&#x20;info&#x20;repository&#x20;is&#x20;a&#x20;bit&#x20;safer,&#x20;but&#x20;with&#x20;filesystem&#x20;access&#x20;it&#039;s&#x20;still&#x20;possible&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;password&#x20;the&#x20;slave&#x20;is&#x20;using.','','Open&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;;&#x20;locate&#x20;master_info_repository;&#x20;set&#x20;the&#x20;master_info_repository&#x20;value&#x20;to&#x20;TABLE.&#x20;Add&#x20;the&#x20;option&#x20;if&#x20;it&#x20;does&#x20;not&#x20;exist.','[{\"cis\": [\"9.2\"]}]'),(11000,'Disable&#x20;MySQL&#x20;Command&#x20;History','On&#x20;Linux/UNIX,&#x20;the&#x20;MySQL&#x20;client&#x20;logs&#x20;statements&#x20;executed&#x20;interactively&#x20;to&#x20;a&#x20;history&#x20;file.&#x20;By&#x20;default,&#x20;this&#x20;file&#x20;is&#x20;named&#x20;.mysql_history&#x20;in&#x20;the&#x20;user&#039;s&#x20;home&#x20;directory.&#x20;Most&#x20;interactive&#x20;commands&#x20;run&#x20;in&#x20;the&#x20;MySQL&#x20;client&#x20;application&#x20;are&#x20;saved&#x20;to&#x20;a&#x20;history&#x20;file.&#x20;The&#x20;MySQL&#x20;command&#x20;history&#x20;should&#x20;be&#x20;disabled.','Disabling&#x20;the&#x20;MySQL&#x20;command&#x20;history&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;exposing&#x20;sensitive&#x20;information,&#x20;such&#x20;as&#x20;passwords&#x20;and&#x20;encryption&#x20;keys.','','Perform&#x20;the&#x20;following&#x20;steps:&#x20;1.&#x20;Remove&#x20;.mysql_history&#x20;if&#x20;it&#x20;exists.&#x20;And&#x20;2.&#x20;Set&#x20;the&#x20;MYSQL_HISTFILE&#x20;environment&#x20;variable&#x20;to&#x20;/dev/null.&#x20;This&#x20;will&#x20;need&#x20;to&#x20;be&#x20;placed&#x20;in&#x20;the&#x20;shell&#039;s&#x20;startup&#x20;script.&#x20;Or&#x20;Create&#x20;$HOME/.mysql_history&#x20;as&#x20;a&#x20;symbolic&#x20;to&#x20;/dev/null.','[{\"cis\": [\"1.3\"]}]'),(11001,'Disable&#x20;Interactive&#x20;Login','When&#x20;created,&#x20;the&#x20;MySQL&#x20;user&#x20;may&#x20;have&#x20;interactive&#x20;access&#x20;to&#x20;the&#x20;operating&#x20;system,&#x20;which&#x20;means&#x20;that&#x20;the&#x20;MySQL&#x20;user&#x20;could&#x20;login&#x20;to&#x20;the&#x20;host&#x20;as&#x20;any&#x20;other&#x20;user&#x20;would.','Preventing&#x20;the&#x20;MySQL&#x20;user&#x20;from&#x20;logging&#x20;in&#x20;interactively&#x20;may&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;a&#x20;compromised&#x20;MySQL&#x20;account.&#x20;There&#x20;is&#x20;also&#x20;more&#x20;accountability&#x20;as&#x20;accessing&#x20;the&#x20;operating&#x20;system&#x20;where&#x20;the&#x20;MySQL&#x20;server&#x20;lies&#x20;will&#x20;require&#x20;the&#x20;user&#039;s&#x20;own&#x20;account.&#x20;Interactive&#x20;access&#x20;by&#x20;the&#x20;MySQL&#x20;user&#x20;is&#x20;unnecessary&#x20;and&#x20;should&#x20;be&#x20;disabled.','','Execute&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;in&#x20;a&#x20;terminal:&#x20;&#039;usermod&#x20;-s&#x20;/bin/false&#x20;mysql&#039;&#x20;or&#x20;&#039;usermod&#x20;-s&#x20;/sbin/nologin&#x20;mysql&#039;','[{\"cis\": [\"1.5\"]}]'),(11002,'Verify&#x20;That&#x20;&#039;MYSQL_PWD&#039;&#x20;Is&#x20;Not&#x20;Set&#x20;In&#x20;Users&#039;&#x20;Profiles','MySQL&#x20;can&#x20;read&#x20;a&#x20;default&#x20;database&#x20;password&#x20;from&#x20;an&#x20;environment&#x20;variable&#x20;called&#x20;MYSQL_PWD.','The&#x20;use&#x20;of&#x20;the&#x20;MYSQL_PWD&#x20;environment&#x20;variable&#x20;implies&#x20;the&#x20;clear&#x20;text&#x20;storage&#x20;of&#x20;MySQL&#x20;credentials.&#x20;Avoiding&#x20;this&#x20;may&#x20;increase&#x20;assurance&#x20;that&#x20;the&#x20;confidentiality&#x20;of&#x20;MySQL&#x20;credentials&#x20;is&#x20;preserved.','','Check&#x20;which&#x20;users&#x20;and/or&#x20;scripts&#x20;are&#x20;setting&#x20;MYSQL_PWD&#x20;and&#x20;change&#x20;them&#x20;to&#x20;use&#x20;a&#x20;more&#x20;secure&#x20;method.','[{\"cis\": [\"1.6\"]}]'),(11003,'Ensure&#x20;&#039;allow-suspicious-udfs&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;FALSE&#039;','This&#x20;option&#x20;prevents&#x20;attaching&#x20;arbitrary&#x20;shared&#x20;library&#x20;functions&#x20;as&#x20;user-defined&#x20;functions&#x20;by&#x20;checking&#x20;for&#x20;at&#x20;least&#x20;one&#x20;corresponding&#x20;method&#x20;named&#x20;_init,&#x20;_deinit,&#x20;_reset,&#x20;_clear,&#x20;or&#x20;_add.','Preventing&#x20;shared&#x20;libraries&#x20;that&#x20;do&#x20;not&#x20;contain&#x20;user-defined&#x20;functions&#x20;from&#x20;loading&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.','','Remove&#x20;&#039;--allow-suspicious-udfs&#039;&#x20;from&#x20;the&#x20;&#039;mysqld&#039;&#x20;start&#x20;up&#x20;command&#x20;line.&#x20;Or&#x20;Remove&#x20;&#039;allow-suspicious-udfs&#039;&#x20;from&#x20;the&#x20;MySQL&#x20;option&#x20;file.','[{\"cis\": [\"4.3\"]}]'),(11004,'Ensure&#x20;&#039;local_infile&#039;&#x20;is&#x20;Disabled','The&#x20;&#039;local_infile&#039;&#x20;parameter&#x20;dictates&#x20;whether&#x20;files&#x20;located&#x20;on&#x20;the&#x20;MySQL&#x20;client&#039;s&#x20;computer&#x20;can&#x20;be&#x20;loaded&#x20;or&#x20;selected&#x20;via&#x20;&#039;LOAD&#x20;DATA&#x20;INFILE&#039;&#x20;or&#x20;&#039;SELECT&#x20;local_file&#039;.','Disabling&#x20;&#039;local_infile&#039;&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;ability&#x20;to&#x20;read&#x20;sensitive&#x20;files&#x20;off&#x20;the&#x20;affected&#x20;server&#x20;via&#x20;a&#x20;SQL&#x20;injection&#x20;vulnerability.','','Add&#x20;a&#x20;line&#x20;local-infile=0&#x20;in&#x20;the&#x20;[mysqld]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;and&#x20;restart&#x20;the&#x20;MySQL&#x20;service.','[{\"cis\": [\"4.4\"]}]'),(11005,'Ensure&#x20;&#039;mysqld&#039;&#x20;Is&#x20;Not&#x20;Started&#x20;with&#x20;&#039;--skip-grant-tables&#039;','This&#x20;option&#x20;causes&#x20;mysqld&#x20;to&#x20;start&#x20;without&#x20;using&#x20;the&#x20;privilege&#x20;system.','If&#x20;this&#x20;option&#x20;is&#x20;used,&#x20;all&#x20;clients&#x20;of&#x20;the&#x20;affected&#x20;server&#x20;will&#x20;have&#x20;unrestricted&#x20;access&#x20;to&#x20;all&#x20;databases.','','Open&#x20;the&#x20;MySQL&#x20;configuration&#x20;&#40;e.g.&#x20;my.cnf&#41;&#x20;file&#x20;and&#x20;set:&#x20;skip-grant-tables&#x20;=&#x20;FALSE','[{\"cis\": [\"4.5\"]}]'),(11006,'Ensure&#x20;&#039;--skip-symbolic-links&#039;&#x20;Is&#x20;Enabled','The&#x20;symbolic-links&#x20;and&#x20;skip-symbolic-links&#x20;options&#x20;for&#x20;MySQL&#x20;determine&#x20;whether&#x20;symbolic&#x20;link&#x20;support&#x20;is&#x20;available.&#x20;&#x20;When&#x20;use&#x20;of&#x20;symbolic&#x20;links&#x20;are&#x20;enabled,&#x20;they&#x20;have&#x20;different&#x20;effects&#x20;depending&#x20;on&#x20;the&#x20;host&#x20;platform.&#x20;&#x20;When&#x20;symbolic&#x20;links&#x20;are&#x20;disabled,&#x20;then&#x20;symbolic&#x20;links&#x20;stored&#x20;in&#x20;files&#x20;or&#x20;entries&#x20;in&#x20;tables&#x20;are&#x20;not&#x20;used&#x20;by&#x20;the&#x20;database.&#x20;','Prevents&#x20;sym&#x20;links&#x20;being&#x20;used&#x20;for&#x20;data&#x20;base&#x20;files.&#x20;This&#x20;is&#x20;especially&#x20;important&#x20;when&#x20;MySQL&#x20;is&#x20;executing&#x20;as&#x20;root&#x20;as&#x20;arbitrary&#x20;files&#x20;may&#x20;be&#x20;overwritten.&#x20;The&#x20;symbolic-links&#x20;option&#x20;might&#x20;allow&#x20;someone&#x20;to&#x20;direct&#x20;actions&#x20;by&#x20;to&#x20;MySQL&#x20;server&#x20;to&#x20;other&#x20;files&#x20;and/or&#x20;directories.','','Open&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;locate&#x20;&#039;skip_symbolic_links&#039;&#x20;and&#x20;set&#x20;it&#x20;to&#x20;YES.&#x20;If&#x20;the&#x20;option&#x20;does&#x20;not&#x20;exist,&#x20;create&#x20;it&#x20;in&#x20;the&#x20;&#039;mysqld&#039;&#x20;section.','[{\"cis\": [\"4.6\"]}]'),(11007,'Ensure&#x20;&#039;secure_file_priv&#039;&#x20;is&#x20;not&#x20;empty','The&#x20;secure_file_priv&#x20;option&#x20;restricts&#x20;to&#x20;paths&#x20;used&#x20;by&#x20;LOAD&#x20;DATA&#x20;INFILE&#x20;or&#x20;SELECT&#x20;local_file.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;option&#x20;be&#x20;set&#x20;to&#x20;a&#x20;file&#x20;system&#x20;location&#x20;that&#x20;contains&#x20;only&#x20;resources&#x20;expected&#x20;to&#x20;be&#x20;loaded&#x20;by&#x20;MySQL.','Setting&#x20;secure_file_priv&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;ability&#x20;to&#x20;read&#x20;sensitive&#x20;files&#x20;off&#x20;the&#x20;affected&#x20;server&#x20;via&#x20;a&#x20;SQL&#x20;injection&#x20;vulnerability.&#x20;','','Add&#x20;the&#x20;line&#x20;secure_file_priv=&lt;path_to_load_directory&gt;&#x20;to&#x20;the&#x20;[mysqld]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;and&#x20;restart&#x20;the&#x20;MySQL&#x20;service.','[{\"cis\": [\"4.8\"]}]'),(11008,'Ensure&#x20;&#039;sql_mode&#039;&#x20;Contains&#x20;&#039;STRICT_ALL_TABLES&#039;','When&#x20;data&#x20;changing&#x20;statements&#x20;are&#x20;made&#x20;&#40;i.e.&#x20;INSERT,&#x20;UPDATE&#41;,&#x20;MySQL&#x20;can&#x20;handle&#x20;invalid&#x20;or&#x20;missing&#x20;values&#x20;differently&#x20;depending&#x20;on&#x20;whether&#x20;strict&#x20;SQL&#x20;mode&#x20;is&#x20;enabled.&#x20;When&#x20;strict&#x20;SQL&#x20;mode&#x20;is&#x20;enabled,&#x20;data&#x20;may&#x20;not&#x20;be&#x20;truncated&#x20;or&#x20;otherwise&#x20;&#039;adjusted&#039;&#x20;to&#x20;make&#x20;the&#x20;data&#x20;changing&#x20;statement&#x20;work.','Without&#x20;strict&#x20;mode&#x20;the&#x20;server&#x20;tries&#x20;to&#x20;do&#x20;proceed&#x20;with&#x20;the&#x20;action&#x20;when&#x20;an&#x20;error&#x20;might&#x20;have&#x20;been&#x20;a&#x20;more&#x20;secure&#x20;choice.&#x20;For&#x20;example,&#x20;by&#x20;default&#x20;MySQL&#x20;will&#x20;truncate&#x20;data&#x20;if&#x20;it&#x20;does&#x20;not&#x20;fit&#x20;in&#x20;a&#x20;field,&#x20;which&#x20;can&#x20;lead&#x20;to&#x20;unknown&#x20;behavior,&#x20;or&#x20;be&#x20;leveraged&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;circumvent&#x20;data&#x20;validation.&#x20;','','Add&#x20;STRICT_ALL_TABLES&#x20;to&#x20;the&#x20;sql_mode&#x20;in&#x20;the&#x20;server&#039;s&#x20;configuration&#x20;file.','[{\"cis\": [\"4.9\"]}]'),(11009,'Ensure&#x20;&#039;log_error&#039;&#x20;is&#x20;not&#x20;empty','The&#x20;error&#x20;log&#x20;contains&#x20;information&#x20;about&#x20;events&#x20;such&#x20;as&#x20;mysqld&#x20;starting&#x20;and&#x20;stopping,&#x20;when&#x20;a&#x20;table&#x20;needs&#x20;to&#x20;be&#x20;checked&#x20;or&#x20;repaired,&#x20;and,&#x20;depending&#x20;on&#x20;the&#x20;host&#x20;operating&#x20;system,&#x20;stack&#x20;traces&#x20;when&#x20;mysqld&#x20;fails','Enabling&#x20;error&#x20;logging&#x20;may&#x20;increase&#x20;the&#x20;ability&#x20;to&#x20;detect&#x20;malicious&#x20;attempts&#x20;against&#x20;MySQL,&#x20;and&#x20;other&#x20;critical&#x20;messages,&#x20;such&#x20;as&#x20;if&#x20;the&#x20;error&#x20;log&#x20;is&#x20;not&#x20;enabled&#x20;then&#x20;connection&#x20;error&#x20;might&#x20;go&#x20;unnoticed.','','Set&#x20;the&#x20;log-error&#x20;option&#x20;to&#x20;the&#x20;path&#x20;for&#x20;the&#x20;error&#x20;log&#x20;in&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#x20;or&#x20;my.ini&#41;.','[{\"cis\": [\"6.1\"]}]'),(11010,'Ensure&#x20;Log&#x20;Files&#x20;are&#x20;not&#x20;Stored&#x20;on&#x20;a&#x20;non-system&#x20;partition','MySQL&#x20;log&#x20;files&#x20;can&#x20;be&#x20;set&#x20;in&#x20;the&#x20;MySQL&#x20;configuration&#x20;to&#x20;exist&#x20;anywhere&#x20;on&#x20;the&#x20;filesystem.&#x20;&#x20;It&#x20;is&#x20;common&#x20;practice&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;filesystem&#x20;is&#x20;left&#x20;uncluttered&#x20;by&#x20;application&#x20;logs.&#x20;&#x20;System&#x20;filesystems&#x20;include&#x20;the&#x20;root,&#x20;/var,&#x20;or&#x20;/usr.','Moving&#x20;the&#x20;MySQL&#x20;logs&#x20;off&#x20;the&#x20;system&#x20;partition&#x20;will&#x20;reduce&#x20;the&#x20;probability&#x20;of&#x20;denial&#x20;of&#x20;service&#x20;via&#x20;the&#x20;exhaustion&#x20;of&#x20;available&#x20;disk&#x20;space&#x20;to&#x20;the&#x20;operating&#x20;system.','','In&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;locate&#x20;the&#x20;log-bin&#x20;entry&#x20;and&#x20;set&#x20;it&#x20;to&#x20;a&#x20;file&#x20;not&#x20;on&#x20;root&#x20;&#40;&#039;/&#039;&#41;,&#x20;/var,&#x20;or&#x20;/usr.','[{\"cis\": [\"6.2\"]}]'),(11011,'Ensure&#x20;&#039;log_warning&#039;&#x20;is&#x20;set&#x20;to&#x20;2','The&#x20;log_warnings&#x20;system&#x20;variable,&#x20;enabled&#x20;by&#x20;default,&#x20;provides&#x20;additional&#x20;information&#x20;to&#x20;the&#x20;MySQL&#x20;log.&#x20;&#x20;A&#x20;value&#x20;of&#x20;1&#x20;enables&#x20;logging&#x20;of&#x20;warning&#x20;messages,&#x20;and&#x20;higher&#x20;integer&#x20;values&#x20;tend&#x20;to&#x20;enable&#x20;more&#x20;logging.','This&#x20;might&#x20;help&#x20;to&#x20;detect&#x20;malicious&#x20;behavior&#x20;by&#x20;logging&#x20;communication&#x20;errors&#x20;and&#x20;aborted&#x20;connections.','','Ensure&#x20;a&#x20;line&#x20;containing&#x20;log-warnings&#x20;=&#x20;2&#x20;is&#x20;found&#x20;in&#x20;the&#x20;mysqld&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;.','[{\"cis\": [\"6.3\"]}]'),(11012,'Ensure&#x20;&#039;log_raw&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;','The&#x20;log-raw&#x20;MySQL&#x20;option&#x20;determines&#x20;whether&#x20;passwords&#x20;are&#x20;rewritten&#x20;by&#x20;the&#x20;server&#x20;so&#x20;as&#x20;not&#x20;to&#x20;appear&#x20;in&#x20;log&#x20;files&#x20;as&#x20;plain&#x20;text.&#x20;&#x20;If&#x20;log-raw&#x20;is&#x20;enabled,&#x20;then&#x20;passwords&#x20;are&#x20;written&#x20;to&#x20;the&#x20;various&#x20;log&#x20;files&#x20;&#40;general&#x20;query&#x20;log,&#x20;slow&#x20;query&#x20;log,&#x20;and&#x20;binary&#x20;log&#41;&#x20;in&#x20;plain&#x20;text.&#x20;','With&#x20;raw&#x20;logging&#x20;of&#x20;passwords&#x20;enabled&#x20;someone&#x20;with&#x20;access&#x20;to&#x20;the&#x20;log&#x20;files&#x20;might&#x20;see&#x20;plain&#x20;text&#x20;passwords.','','IN&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;locate&#x20;and&#x20;set&#x20;the&#x20;value&#x20;of&#x20;this&#x20;option:&#x20;log-raw&#x20;=&#x20;OFF','[{\"cis\": [\"6.4\"]}]'),(11013,'Ensure&#x20;&#039;old_passwords&#039;&#x20;Is&#x20;Not&#x20;Set&#x20;to&#x20;&#039;1&#039;&#x20;or&#x20;&#039;ON&#039;','This&#x20;variable&#x20;controls&#x20;the&#x20;password&#x20;hashing&#x20;method&#x20;used&#x20;by&#x20;the&#x20;PASSWORD&#40;&#41;&#x20;function&#x20;and&#x20;for&#x20;the&#x20;IDENTIFIED&#x20;BY&#x20;clause&#x20;of&#x20;the&#x20;CREATE&#x20;USER&#x20;and&#x20;GRANT&#x20;statements.&#x20;&#x20;Before&#x20;5.6.6,&#x20;the&#x20;value&#x20;can&#x20;be&#x20;0&#x20;&#40;or&#x20;OFF&#41;,&#x20;or&#x20;1&#x20;&#40;or&#x20;ON&#41;.&#x20;As&#x20;of&#x20;5.6.6,&#x20;the&#x20;following&#x20;value&#x20;can&#x20;be&#x20;one&#x20;of&#x20;the&#x20;following:&#x20;0&#x20;-&#x20;authenticate&#x20;with&#x20;the&#x20;mysql_native_password&#x20;plugin;&#x20;1&#x20;-&#x20;authenticate&#x20;with&#x20;the&#x20;mysql_old_password&#x20;plugin;&#x20;2&#x20;-&#x20;authenticate&#x20;with&#x20;the&#x20;sha256_password&#x20;plugin','The&#x20;mysql_old_password&#x20;plugin&#x20;leverages&#x20;an&#x20;algorithm&#x20;that&#x20;can&#x20;be&#x20;quickly&#x20;brute&#x20;forced&#x20;using&#x20;an&#x20;offline&#x20;dictionary&#x20;attack.&#x20;See&#x20;CVE-2003-1480&#x20;for&#x20;additional&#x20;details.','','Configure&#x20;mysql&#x20;to&#x20;leverage&#x20;the&#x20;mysql_native_password&#x20;or&#x20;sha256_password&#x20;plugin.','[{\"cis\": [\"7.1\"]}]'),(11014,'Ensure&#x20;&#039;secure_auth&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;','This&#x20;option&#x20;dictates&#x20;whether&#x20;the&#x20;server&#x20;will&#x20;deny&#x20;connections&#x20;by&#x20;clients&#x20;that&#x20;attempt&#x20;to&#x20;use&#x20;accounts&#x20;that&#x20;have&#x20;their&#x20;password&#x20;stored&#x20;in&#x20;the&#x20;mysql_old_password&#x20;format.','Enabling&#x20;this&#x20;option&#x20;will&#x20;prevent&#x20;all&#x20;use&#x20;of&#x20;passwords&#x20;employing&#x20;the&#x20;old&#x20;format&#x20;&#40;and&#x20;hence&#x20;insecure&#x20;communication&#x20;over&#x20;the&#x20;network&#41;.','','Add&#x20;a&#x20;line&#x20;secure_auth=ON&#x20;to&#x20;the&#x20;[mysqld]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;option&#x20;file.','[{\"cis\": [\"7.2\"]}]'),(11015,'Ensure&#x20;Passwords&#x20;Are&#x20;Not&#x20;Stored&#x20;in&#x20;the&#x20;Global&#x20;Configuration','The&#x20;[client]&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;allows&#x20;setting&#x20;a&#x20;user&#x20;and&#x20;password&#x20;to&#x20;be&#x20;used.&#x20;Verify&#x20;the&#x20;password&#x20;option&#x20;is&#x20;not&#x20;used&#x20;in&#x20;the&#x20;global&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;.','The&#x20;use&#x20;of&#x20;the&#x20;password&#x20;parameter&#x20;may&#x20;negatively&#x20;impact&#x20;the&#x20;confidentiality&#x20;of&#x20;the&#x20;user&#039;s&#x20;password.','','Use&#x20;the&#x20;mysql_config_editor&#x20;to&#x20;store&#x20;authentication&#x20;credentials&#x20;in&#x20;.mylogin.cnf&#x20;in&#x20;encrypted&#x20;form.&#x20;If&#x20;not&#x20;possible,&#x20;use&#x20;the&#x20;user-specific&#x20;options&#x20;file,&#x20;.my.cnf.,&#x20;and&#x20;restricting&#x20;file&#x20;access&#x20;permissions&#x20;to&#x20;the&#x20;user&#x20;identity.&#x20;','[{\"cis\": [\"7.3\"]}]'),(11016,'Ensure&#x20;&#039;sql_mode&#039;&#x20;Contains&#x20;&#039;NO_AUTO_CREATE_USER&#039;','NO_AUTO_CREATE_USER&#x20;is&#x20;an&#x20;option&#x20;for&#x20;sql_mode&#x20;that&#x20;prevents&#x20;a&#x20;GRANT&#x20;statement&#x20;from&#x20;automatically&#x20;creating&#x20;a&#x20;user&#x20;when&#x20;authentication&#x20;information&#x20;is&#x20;not&#x20;provided.','Blank&#x20;passwords&#x20;negate&#x20;the&#x20;benefits&#x20;provided&#x20;by&#x20;authentication&#x20;mechanisms.&#x20;Without&#x20;this&#x20;setting&#x20;an&#x20;administrative&#x20;user&#x20;might&#x20;accidentally&#x20;create&#x20;a&#x20;user&#x20;without&#x20;a&#x20;password.','','In&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;,&#x20;find&#x20;the&#x20;sql_mode&#x20;setting&#x20;in&#x20;the&#x20;[mysqld]&#x20;area,&#x20;and&#x20;add&#x20;the&#x20;NO_AUTO_CREATE_USER&#x20;to&#x20;the&#x20;sql_mode&#x20;setting.','[{\"cis\": [\"7.4\"]}]'),(11017,'Ensure&#x20;Password&#x20;Policy&#x20;is&#x20;in&#x20;Place','Password&#x20;complexity&#x20;includes&#x20;password&#x20;characteristics&#x20;such&#x20;as&#x20;length,&#x20;case,&#x20;length,&#x20;and&#x20;character&#x20;sets.','Complex&#x20;passwords&#x20;help&#x20;mitigate&#x20;dictionary,&#x20;brute&#x20;forcing,&#x20;and&#x20;other&#x20;password&#x20;attacks.&#x20;This&#x20;recommendation&#x20;prevents&#x20;users&#x20;from&#x20;choosing&#x20;weak&#x20;passwords&#x20;which&#x20;can&#x20;easily&#x20;be&#x20;guessed.','','Add&#x20;to&#x20;the&#x20;global&#x20;configuration:&#x20;plugin-load=validate_password.so&#x20;validate-password=FORCE_PLUS_PERMANENT&#x20;validate_password_length=14&#x20;validate_password_mixed_case_count=1&#x20;validate_password_number_count=1&#x20;validate_password_special_char_count=1&#x20;validate_password_policy=MEDIUM.&#x20;And&#x20;change&#x20;passwords&#x20;for&#x20;users&#x20;which&#x20;have&#x20;passwords&#x20;which&#x20;are&#x20;identical&#x20;to&#x20;their&#x20;username.&#x20;Restarting&#x20;the&#x20;server&#x20;is&#x20;required.','[{\"cis\": [\"7.6\"]}]'),(11018,'Ensure&#x20;&#039;master_info_repository&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;TABLE&#039;','The&#x20;master_info_repository&#x20;setting&#x20;determines&#x20;to&#x20;where&#x20;a&#x20;slave&#x20;logs&#x20;master&#x20;status&#x20;and&#x20;connection&#x20;information.&#x20;&#x20;The&#x20;options&#x20;are&#x20;FILE&#x20;or&#x20;TABLE.&#x20;Note&#x20;also&#x20;that&#x20;this&#x20;setting&#x20;is&#x20;associated&#x20;with&#x20;the&#x20;sync_master_info&#x20;setting&#x20;as&#x20;well.','The&#x20;password&#x20;which&#x20;the&#x20;client&#x20;uses&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;master&#x20;info&#x20;repository,&#x20;which&#x20;by&#x20;default&#x20;is&#x20;a&#x20;plaintext&#x20;file.&#x20;The&#x20;TABLE&#x20;master&#x20;info&#x20;repository&#x20;is&#x20;a&#x20;bit&#x20;safer,&#x20;but&#x20;with&#x20;filesystem&#x20;access&#x20;it&#039;s&#x20;still&#x20;possible&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;password&#x20;the&#x20;slave&#x20;is&#x20;using.','','Open&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;;&#x20;locate&#x20;master_info_repository;&#x20;set&#x20;the&#x20;master_info_repository&#x20;value&#x20;to&#x20;TABLE.&#x20;Add&#x20;the&#x20;option&#x20;if&#x20;it&#x20;does&#x20;not&#x20;exist.','[{\"cis\": [\"9.2\"]}]'),(11019,'Ensure&#x20;audit_log_connection_policy&#x20;is&#x20;not&#x20;set&#x20;to&#x20;&#039;NONE&#039;','The&#x20;audit_log_connection_policy&#x20;variable&#x20;controls&#x20;how&#x20;the&#x20;audit&#x20;plugin&#x20;writes&#x20;connection&#x20;events&#x20;to&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;','The&#x20;audit_log_connection_policy&#x20;offers&#x20;three&#x20;options:&#x20;NONE,&#x20;ERRORS,&#x20;and&#x20;ALL.&#x20;Each&#x20;option&#x20;determines&#x20;whether&#x20;connection&#x20;events&#x20;are&#x20;logged&#x20;and&#x20;the&#x20;type&#x20;of&#x20;connection&#x20;events&#x20;that&#x20;are&#x20;logged.&#x20;Setting&#x20;a&#x20;non&#x20;&#039;NONE&#039;&#x20;value&#x20;for&#x20;audit_log_connection_policy&#x20;ensures&#x20;at&#x20;a&#x20;minimum,&#x20;failed&#x20;connection&#x20;events&#x20;are&#x20;being&#x20;logged.&#x20;The&#x20;ERRORS&#x20;setting&#x20;will&#x20;log&#x20;failed&#x20;connection&#x20;events&#x20;and&#x20;the&#x20;ALL&#x20;setting&#x20;will&#x20;log&#x20;all&#x20;connection&#x20;events.&#x20;For&#x20;MySQL&#x20;versions&#x20;=&gt;&#x20;5.6.20,&#x20;the&#x20;audit_log_policy&#x20;variable&#x20;can&#x20;override&#x20;the&#x20;audit_log_connection_policy,&#x20;potentially&#x20;invalidating&#x20;this&#x20;benchmark&#x20;recommendation,&#x20;therefore&#x20;enforcing&#x20;a&#x20;setting&#x20;for&#x20;audit_log_connection_policy&#x20;ensures&#x20;the&#x20;integrity&#x20;of&#x20;this&#x20;recommendation.','','Set&#x20;the&#x20;audit_log_connection_policy&#x20;option&#x20;to&#x20;ERRORS&#x20;or&#x20;ALL&#x20;in&#x20;the&#x20;MySQL&#x20;configuration&#x20;file.','[{\"cis\": [\"6.5\"]}]'),(11020,'Ensure&#x20;audit_log_exclude_account&#x20;is&#x20;set&#x20;to&#x20;NULL','The&#x20;audit_log_exclude_accounts&#x20;variable&#x20;enables&#x20;the&#x20;administrator&#x20;to&#x20;set&#x20;accounts&#x20;for&#x20;which&#x20;events&#x20;will&#x20;not&#x20;be&#x20;logged&#x20;in&#x20;the&#x20;audit&#x20;log.','The&#x20;audit_log_exclude_accounts&#x20;variable&#x20;has&#x20;two&#x20;permitted&#x20;values,&#x20;either&#x20;NULL&#x20;or&#x20;a&#x20;list&#x20;of&#x20;MySQL&#x20;accounts.&#x20;Setting&#x20;this&#x20;variable&#x20;correctly&#x20;ensures&#x20;no&#x20;single&#x20;user&#x20;is&#x20;able&#x20;to&#x20;unintentionally&#x20;evade&#x20;being&#x20;logged.&#x20;Particular&#x20;attention&#x20;should&#x20;be&#x20;made&#x20;to&#x20;privileged&#x20;accounts,&#x20;as&#x20;such&#x20;accounts&#x20;will&#x20;generally&#x20;be&#x20;bestowed&#x20;with&#x20;more&#x20;privileges&#x20;than&#x20;normal&#x20;users,&#x20;and&#x20;should&#x20;not&#x20;be&#x20;listed&#x20;against&#x20;this&#x20;variable.','','Set&#x20;audit_log_exclude_accounts=NULL&#x20;in&#x20;my.cnf.','[{\"cis\": [\"6.6\"]}]'),(11021,'Ensure&#x20;audit_log_include_accounts&#x20;is&#x20;set&#x20;to&#x20;NULL','The&#x20;audit_log_include_accounts&#x20;variable&#x20;enables&#x20;the&#x20;administrator&#x20;to&#x20;set&#x20;accounts&#x20;for&#x20;which&#x20;events&#x20;should&#x20;be&#x20;logged&#x20;in&#x20;the&#x20;audit&#x20;log.','The&#x20;audit_log_include_accounts&#x20;variable&#x20;has&#x20;two&#x20;permitted&#x20;values,&#x20;either&#x20;NULL&#x20;or&#x20;a&#x20;list&#x20;of&#x20;MySQL&#x20;accounts.&#x20;Setting&#x20;this&#x20;variable&#x20;correctly&#x20;ensures&#x20;all&#x20;MySQL&#x20;users&#x20;are&#x20;being&#x20;logged&#x20;in&#x20;the&#x20;audit&#x20;log.','','Set&#x20;audit_log_include_accounts=NULL&#x20;in&#x20;my.cnf.','[{\"cis\": [\"6.7\"]}]'),(11022,'Ensure&#x20;audit_log_policy&#x20;is&#x20;set&#x20;to&#x20;log&#x20;logins&#x20;and&#x20;connections','With&#x20;the&#x20;audit_log_policy&#x20;setting&#x20;the&#x20;amount&#x20;of&#x20;information&#x20;which&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;audit&#x20;log&#x20;is&#x20;controlled.&#x20;&#x20;It&#x20;must&#x20;be&#x20;set&#x20;to&#x20;log&#x20;logins&#x20;and&#x20;connections.','If&#x20;this&#x20;setting&#x20;is&#x20;set&#x20;to&#x20;QUERIES,&#x20;CONNECTIONS&#x20;or&#x20;NONE&#x20;then&#x20;either&#x20;connections&#x20;or&#x20;queries&#x20;are&#x20;not&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;log&#x20;file.','','Set&#x20;audit_log_policy=&#039;ALL&#039;&#x20;in&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;and&#x20;activate&#x20;the&#x20;setting&#x20;by&#x20;restarting&#x20;the&#x20;server&#x20;or&#x20;executing&#x20;SET&#x20;GLOBAL&#x20;audit_log_policy=&#039;ALL&#039;;','[{\"cis\": [\"6.9\"]}]'),(11023,'Ensure&#x20;audit_log_statement_policy&#x20;is&#x20;set&#x20;to&#x20;ALL','This&#x20;setting&#x20;controls&#x20;whether&#x20;statements&#x20;are&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;log.','This&#x20;setting&#x20;must&#x20;be&#x20;set&#x20;to&#x20;ALL&#x20;to&#x20;ensure&#x20;all&#x20;statement&#x20;information&#x20;is&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;log.','','Add&#x20;the&#x20;option&#x20;audit_log_statement_policy=&#039;ALL&#039;&#x20;to&#x20;the&#x20;mysqld&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;and&#x20;restart&#x20;the&#x20;server.','[{\"cis\": [\"6.10\"]}]'),(11024,'Set&#x20;audit_log_strategy&#x20;to&#x20;SYNCHRONOUS&#x20;or&#x20;SEMISYNCRONOUS','The&#x20;audit_log_strategy&#x20;must&#x20;be&#x20;set&#x20;to&#x20;SYNCHRONOUS&#x20;or&#x20;SEMISYNCHRONOUS.','This&#x20;setting&#x20;controls&#x20;how&#x20;information&#x20;is&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;log.&#x20;It&#x20;can&#x20;be&#x20;set&#x20;to&#x20;SYNCHRONOUS&#x20;to&#x20;make&#x20;it&#x20;fully&#x20;durable&#x20;or&#x20;other&#x20;settings&#x20;which&#x20;are&#x20;less&#x20;durable&#x20;but&#x20;have&#x20;less&#x20;performance&#x20;overhead.','','Set&#x20;audit_log_strategy=&#039;SEMISYNCHRONOUS&#039;&#x20;&#40;or&#x20;SYNCHRONOUS&#41;&#x20;in&#x20;the&#x20;mysqld&#x20;section&#x20;of&#x20;the&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;.','[{\"cis\": [\"6.11\"]}]'),(11025,'Make&#x20;sure&#x20;the&#x20;audit&#x20;plugin&#x20;can&#039;t&#x20;be&#x20;unloaded','Set&#x20;audit_log&#x20;to&#x20;FORCE_PLUS_PERMANENT.','This&#x20;makes&#x20;disables&#x20;unloading&#x20;on&#x20;the&#x20;plugin.','','Ensure&#x20;a&#x20;line&#x20;audit_log&#x20;=&#x20;&#039;FORCE_PLUS_PERMANENT&#039;&#x20;is&#x20;found&#x20;in&#x20;the&#x20;mysqld&#x20;section&#x20;of&#x20;the&#x20;MySQL&#x20;configuration&#x20;file&#x20;&#40;my.cnf&#41;.','[{\"cis\": [\"6.12\"]}]'),(11500,'Ensure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','Enabling&#x20;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#x20;allows&#x20;users&#x20;to&#x20;query&#x20;data&#x20;and&#x20;execute&#x20;statements&#x20;on&#x20;external&#x20;data&#x20;sources.&#x20;This&#x20;functionality&#x20;should&#x20;be&#x20;disabled.','This&#x20;feature&#x20;can&#x20;be&#x20;used&#x20;to&#x20;remotely&#x20;access&#x20;and&#x20;exploit&#x20;vulnerabilities&#x20;on&#x20;remote&#x20;SQL&#x20;Server&#x20;instances&#x20;and&#x20;to&#x20;run&#x20;unsafe&#x20;Visual&#x20;Basic&#x20;for&#x20;Application&#x20;functions.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(11501,'Ensure&#x20;&#039;CLR&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;clr&#x20;enabled&#x20;option&#x20;specifies&#x20;whether&#x20;user&#x20;assemblies&#x20;can&#x20;be&#x20;run&#x20;by&#x20;SQL&#x20;Server.','Enabling&#x20;use&#x20;of&#x20;CLR&#x20;assemblies&#x20;widens&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;puts&#x20;it&#x20;at&#x20;risk&#x20;from&#x20;both&#x20;inadvertent&#x20;and&#x20;malicious&#x20;assemblies.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;clr&#x20;enabled&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"18.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(11502,'Ensure&#x20;&#039;Cross&#x20;DB&#x20;Ownership&#x20;Chaining&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;cross&#x20;db&#x20;ownership&#x20;chaining&#x20;option&#x20;controls&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;across&#x20;all&#x20;databases&#x20;at&#x20;the&#x20;instance&#x20;&#40;or&#x20;server&#41;&#x20;level.','When&#x20;enabled,&#x20;this&#x20;option&#x20;allows&#x20;a&#x20;member&#x20;of&#x20;the&#x20;db_owner&#x20;role&#x20;in&#x20;a&#x20;database&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;objects&#x20;owned&#x20;by&#x20;a&#x20;login&#x20;in&#x20;any&#x20;other&#x20;database,&#x20;causing&#x20;an&#x20;unnecessary&#x20;information&#x20;disclosure.&#x20;When&#x20;required,&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;for&#x20;the&#x20;specific&#x20;databases&#x20;requiring&#x20;it&#x20;instead&#x20;of&#x20;at&#x20;the&#x20;instance&#x20;level&#x20;for&#x20;all&#x20;databases&#x20;by&#x20;using&#x20;the&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;DB_CHAINING&#x20;ON&#x20;command.&#x20;This&#x20;database&#x20;option&#x20;may&#x20;not&#x20;be&#x20;changed&#x20;on&#x20;the&#x20;master&#x20;,&#x20;model&#x20;,&#x20;or&#x20;tempdb&#x20;system&#x20;databases.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;cross&#x20;db&#x20;ownership&#x20;chaining&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11503,'Ensure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;controls&#x20;the&#x20;ability&#x20;to&#x20;generate&#x20;and&#x20;transmit&#x20;email&#x20;messages&#x20;from&#x20;SQL&#x20;Server.','Disabling&#x20;the&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;reduces&#x20;the&#x20;SQL&#x20;Server&#x20;surface,&#x20;eliminates&#x20;a&#x20;DOS&#x20;attack&#x20;vector&#x20;and&#x20;channel&#x20;to&#x20;exfiltrate&#x20;data&#x20;from&#x20;the&#x20;database&#x20;server&#x20;to&#x20;a&#x20;remote&#x20;host.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11504,'Ensure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Ole&#x20;Automation&#x20;Procedures&#x20;option&#x20;controls&#x20;whether&#x20;OLE&#x20;Automation&#x20;objects&#x20;can&#x20;be&#x20;instantiated&#x20;within&#x20;Transact-SQL&#x20;batches.&#x20;These&#x20;are&#x20;extended&#x20;stored&#x20;procedures&#x20;that&#x20;allow&#x20;SQL&#x20;Server&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;external&#x20;to&#x20;SQL&#x20;Server.','Enabling&#x20;this&#x20;option&#x20;will&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;in&#x20;the&#x20;security&#x20;context&#x20;of&#x20;SQL&#x20;Server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11505,'Ensure&#x20;&#039;Remote&#x20;Access&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;access&#x20;option&#x20;controls&#x20;the&#x20;execution&#x20;of&#x20;local&#x20;stored&#x20;procedures&#x20;on&#x20;remote&#x20;servers&#x20;or&#x20;remote&#x20;stored&#x20;procedures&#x20;on&#x20;local&#x20;server.','Functionality&#x20;can&#x20;be&#x20;abused&#x20;to&#x20;launch&#x20;a&#x20;Denial-of-Service&#x20;&#40;DoS&#41;&#x20;attack&#x20;on&#x20;remote&#x20;servers&#x20;by&#x20;off-loading&#x20;query&#x20;processing&#x20;to&#x20;a&#x20;target.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;access&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11506,'Ensure&#x20;&#039;Remote&#x20;Admin&#x20;Connections&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;admin&#x20;connections&#x20;option&#x20;controls&#x20;whether&#x20;a&#x20;client&#x20;application&#x20;on&#x20;a&#x20;remote&#x20;computer&#x20;can&#x20;use&#x20;the&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;.','The&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;&#x20;lets&#x20;an&#x20;administrator&#x20;access&#x20;a&#x20;running&#x20;server&#x20;to&#x20;execute&#x20;diagnostic&#x20;functions&#x20;or&#x20;Transact-SQL&#x20;statements,&#x20;or&#x20;to&#x20;troubleshoot&#x20;problems&#x20;on&#x20;the&#x20;server,&#x20;even&#x20;when&#x20;the&#x20;server&#x20;is&#x20;locked&#x20;or&#x20;running&#x20;in&#x20;an&#x20;abnormal&#x20;state&#x20;and&#x20;not&#x20;responding&#x20;to&#x20;a&#x20;SQL&#x20;Server&#x20;Database&#x20;Engine&#x20;connection.&#x20;In&#x20;a&#x20;cluster&#x20;scenario,&#x20;the&#x20;administrator&#x20;may&#x20;not&#x20;actually&#x20;be&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;same&#x20;node&#x20;that&#x20;is&#x20;currently&#x20;hosting&#x20;the&#x20;SQL&#x20;Server&#x20;instance&#x20;and&#x20;thus&#x20;is&#x20;considered&#x20;&quot;remote&quot;.&#x20;Therefore,&#x20;this&#x20;setting&#x20;should&#x20;usually&#x20;be&#x20;enabled&#x20;&#40;&#x20;1&#x20;&#41;&#x20;for&#x20;SQL&#x20;Server&#x20;failover&#x20;clusters;&#x20;otherwise&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;&#40;&#x20;0&#x20;&#41;&#x20;which&#x20;is&#x20;the&#x20;default.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command&#x20;on&#x20;non-clustered&#x20;installations:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;admin&#x20;connections&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11507,'Ensure&#x20;&#039;Scan&#x20;For&#x20;Startup&#x20;Procs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;scan&#x20;for&#x20;startup&#x20;procs&#x20;option,&#x20;if&#x20;enabled,&#x20;causes&#x20;SQL&#x20;Server&#x20;to&#x20;scan&#x20;for&#x20;and&#x20;automatically&#x20;run&#x20;all&#x20;stored&#x20;procedures&#x20;that&#x20;are&#x20;set&#x20;to&#x20;execute&#x20;upon&#x20;service&#x20;startup.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;entity&#x20;leveraging&#x20;these&#x20;facilities&#x20;for&#x20;malicious&#x20;purposes.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;scan&#x20;for&#x20;startup&#x20;procs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.8\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11508,'Ensure&#x20;&#039;Trustworthy&#039;&#x20;Database&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Off&#039;','The&#x20;TRUSTWORTHY&#x20;database&#x20;option&#x20;allows&#x20;database&#x20;objects&#x20;to&#x20;access&#x20;objects&#x20;in&#x20;other&#x20;databases&#x20;under&#x20;certain&#x20;circumstances.','Provides&#x20;protection&#x20;from&#x20;malicious&#x20;CLR&#x20;assemblies&#x20;or&#x20;extended&#x20;procedures.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement&#x20;against&#x20;the&#x20;databases&#x20;&#40;replace&#x20;&lt;dbname&gt;&#x20;below&#41;&#x20;returned&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;[&lt;database_name&gt;]&#x20;SET&#x20;TRUSTWORTHY&#x20;OFF;','[{\"cis\": [\"2.9\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11509,'Ensure&#x20;SQL&#x20;Server&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;non-standard&#x20;ports','If&#x20;enabled,&#x20;the&#x20;default&#x20;SQL&#x20;Server&#x20;instance&#x20;will&#x20;be&#x20;assigned&#x20;a&#x20;default&#x20;port&#x20;of&#x20;TCP:1433&#x20;for&#x20;TCP/IP&#x20;communication.&#x20;Administrators&#x20;can&#x20;also&#x20;configure&#x20;named&#x20;instances&#x20;to&#x20;use&#x20;TCP:1433&#x20;for&#x20;communication.&#x20;TCP:1433&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;SQL&#x20;Server&#x20;port&#x20;and&#x20;this&#x20;port&#x20;assignment&#x20;should&#x20;be&#x20;changed.','Using&#x20;a&#x20;non-default&#x20;port&#x20;helps&#x20;protect&#x20;the&#x20;database&#x20;from&#x20;attacks&#x20;directed&#x20;to&#x20;the&#x20;default&#x20;port.','','1:&#x20;In&#x20;SQL&#x20;Server&#x20;Configuration&#x20;Manager,&#x20;in&#x20;the&#x20;console&#x20;pane,&#x20;expand&#x20;SQL&#x20;Server&#x20;Network&#x20;Configuration,&#x20;expand&#x20;Protocols&#x20;for&#x20;&lt;InstanceName&gt;&#x20;,&#x20;and&#x20;then&#x20;double-click&#x20;the&#x20;TCP/IP&#x20;or&#x20;VIA&#x20;protocol.&#x20;2:&#x20;In&#x20;the&#x20;TCP/IP&#x20;Properties&#x20;dialog&#x20;box,&#x20;on&#x20;the&#x20;IP&#x20;Addresses&#x20;tab,&#x20;several&#x20;IP&#x20;addresses&#x20;appear&#x20;in&#x20;the&#x20;format&#x20;IP1&#x20;,&#x20;IP2&#x20;,&#x20;up&#x20;to&#x20;IPAll&#x20;.&#x20;One&#x20;of&#x20;these&#x20;is&#x20;for&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;loopback&#x20;adapter,&#x20;127.0.0.1&#x20;.&#x20;Additional&#x20;IP&#x20;addresses&#x20;appear&#x20;for&#x20;each&#x20;IP&#x20;Address&#x20;on&#x20;the&#x20;computer.&#x20;3:&#x20;Change&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;from&#x20;1433&#x20;to&#x20;another&#x20;non-standard&#x20;port&#x20;or&#x20;leave&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;empty&#x20;and&#x20;set&#x20;the&#x20;TCP&#x20;Dynamic&#x20;Ports&#x20;value&#x20;to&#x20;0&#x20;to&#x20;enable&#x20;dynamic&#x20;port&#x20;assignment&#x20;and&#x20;then&#x20;click&#x20;OK.&#x20;4:&#x20;In&#x20;the&#x20;console&#x20;pane,&#x20;click&#x20;SQL&#x20;Server&#x20;Services.&#x20;5:&#x20;In&#x20;the&#x20;details&#x20;pane,&#x20;right-click&#x20;SQL&#x20;Server&#x20;&#40;&lt;InstanceName&gt;&#41;&#x20;and&#x20;then&#x20;click&#x20;Restart,&#x20;to&#x20;stop&#x20;and&#x20;restart&#x20;SQL&#x20;Server.','[{\"cis\": [\"2.11\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11510,'Ensure&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;This&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;the&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;query:&#x20;USE&#x20;[master]&#x20;GO&#x20;DECLARE&#x20;@tsql&#x20;nvarchar&#40;max&#41;&#x20;SET&#x20;@tsql&#x20;=&#x20;&#039;ALTER&#x20;LOGIN&#x20;&#039;&#x20;+&#x20;SUSER_NAME&#40;0x01&#41;&#x20;+&#x20;&#039;&#x20;DISABLE&#039;&#x20;EXEC&#x20;&#40;@tsql&#41;&#x20;GO','[{\"cis\": [\"2.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11511,'Ensure&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;has&#x20;been&#x20;renamed','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;login&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;The&#x20;sa&#x20;login&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','It&#x20;is&#x20;more&#x20;difficult&#x20;to&#x20;launch&#x20;password-guessing&#x20;and&#x20;brute-force&#x20;attacks&#x20;against&#x20;the&#x20;sa&#x20;login&#x20;if&#x20;the&#x20;name&#x20;is&#x20;not&#x20;known.','','Replace&#x20;the&#x20;&lt;different_user&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;ALTER&#x20;LOGIN&#x20;sa&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_user&gt;;','[{\"cis\": [\"2.14\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11512,'Ensure&#x20;&#039;xp_cmdshell&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;xp_cmdshell&#x20;option&#x20;controls&#x20;whether&#x20;the&#x20;xp_cmdshell&#x20;extended&#x20;stored&#x20;procedure&#x20;can&#x20;be&#x20;used&#x20;by&#x20;an&#x20;authenticated&#x20;SQL&#x20;Server&#x20;user&#x20;to&#x20;execute&#x20;operating-system&#x20;command&#x20;shell&#x20;commands&#x20;and&#x20;return&#x20;results&#x20;as&#x20;rows&#x20;within&#x20;the&#x20;SQL&#x20;client.','The&#x20;xp_cmdshell&#x20;procedure&#x20;is&#x20;commonly&#x20;used&#x20;by&#x20;attackers&#x20;to&#x20;read&#x20;or&#x20;write&#x20;data&#x20;to/from&#x20;the&#x20;underlying&#x20;Operating&#x20;System&#x20;of&#x20;a&#x20;database&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;xp_cmdshell&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.15\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11513,'Ensure&#x20;&#039;AUTO_CLOSE&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;&#x20;on&#x20;contained&#x20;databases','AUTO_CLOSE&#x20;determines&#x20;if&#x20;a&#x20;given&#x20;database&#x20;is&#x20;closed&#x20;or&#x20;not&#x20;after&#x20;a&#x20;connection&#x20;terminates.&#x20;If&#x20;enabled,&#x20;subsequent&#x20;connections&#x20;to&#x20;the&#x20;given&#x20;database&#x20;will&#x20;require&#x20;the&#x20;database&#x20;to&#x20;be&#x20;reopened&#x20;and&#x20;relevant&#x20;procedure&#x20;caches&#x20;to&#x20;be&#x20;rebuilt.','Because&#x20;authentication&#x20;of&#x20;users&#x20;for&#x20;contained&#x20;databases&#x20;occurs&#x20;within&#x20;the&#x20;database&#x20;not&#x20;at&#x20;the&#x20;serverinstance&#x20;level,&#x20;the&#x20;database&#x20;must&#x20;be&#x20;opened&#x20;every&#x20;time&#x20;to&#x20;authenticate&#x20;a&#x20;user.&#x20;The&#x20;frequent&#x20;opening/closing&#x20;of&#x20;the&#x20;database&#x20;consumes&#x20;additional&#x20;server&#x20;resources&#x20;and&#x20;may&#x20;contribute&#x20;to&#x20;a&#x20;denial&#x20;of&#x20;service.','','Execute&#x20;the&#x20;following&#x20;T-SQL,&#x20;replacing&#x20;&lt;database_name&gt;&#x20;with&#x20;each&#x20;database&#x20;name&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;AUTO_CLOSE&#x20;OFF;','[{\"cis\": [\"2.16\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11514,'Ensure&#x20;no&#x20;login&#x20;exists&#x20;with&#x20;the&#x20;name&#x20;&#039;sa&#039;','The&#x20;sa&#x20;login&#x20;&#40;e.g.&#x20;principal&#41;&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account.&#x20;Therefore,&#x20;there&#x20;should&#x20;not&#x20;be&#x20;a&#x20;login&#x20;called&#x20;sa&#x20;even&#x20;when&#x20;the&#x20;original&#x20;sa&#x20;login&#x20;&#40;&#x20;principal_id&#x20;=&#x20;1&#x20;&#41;&#x20;has&#x20;been&#x20;renamed.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal&#x20;name.','','Execute&#x20;the&#x20;appropriate&#x20;ALTER&#x20;or&#x20;DROP&#x20;statement&#x20;below&#x20;based&#x20;on&#x20;the&#x20;principal_id&#x20;returned&#x20;for&#x20;the&#x20;login&#x20;named&#x20;sa&#x20;.&#x20;Replace&#x20;the&#x20;&lt;different_name&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;USE&#x20;[master]&#x20;GO&#x20;--&#x20;If&#x20;principal_id&#x20;=&#x20;1&#x20;or&#x20;the&#x20;login&#x20;owns&#x20;database&#x20;objects,&#x20;rename&#x20;the&#x20;sa&#x20;login&#x20;ALTER&#x20;LOGIN&#x20;[sa]&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_name&gt;;&#x20;GO&#x20;--&#x20;If&#x20;the&#x20;login&#x20;owns&#x20;no&#x20;database&#x20;objects,&#x20;then&#x20;drop&#x20;it&#x20;--&#x20;Do&#x20;NOT&#x20;drop&#x20;the&#x20;login&#x20;if&#x20;it&#x20;is&#x20;principal_id&#x20;=&#x20;1&#x20;DROP&#x20;LOGIN&#x20;sa','[{\"cis\": [\"2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11515,'Ensure&#x20;&#039;Server&#x20;Authentication&#039;&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Windows&#x20;Authentication&#x20;Mode&#039;','Uses&#x20;Windows&#x20;Authentication&#x20;to&#x20;validate&#x20;attempted&#x20;connections.','Windows&#x20;provides&#x20;a&#x20;more&#x20;robust&#x20;authentication&#x20;mechanism&#x20;than&#x20;SQL&#x20;Server&#x20;authentication.','','Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method:&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;the&#x20;Object&#x20;Explorer&#x20;tab&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;database&#x20;instance.&#x20;3.&#x20;Right&#x20;click&#x20;the&#x20;instance&#x20;name&#x20;and&#x20;select&#x20;Properties.&#x20;4.&#x20;Select&#x20;the&#x20;Security&#x20;page&#x20;from&#x20;the&#x20;left&#x20;menu.&#x20;5.&#x20;Set&#x20;the&#x20;Server&#x20;authentication&#x20;setting&#x20;to&#x20;Windows&#x20;Authentication&#x20;Mode.&#x20;or&#x20;T-SQL&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;in&#x20;a&#x20;Query&#x20;Window:&#x20;USE&#x20;[master]&#x20;GO&#x20;EXEC&#x20;xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;LoginMode&#039;,&#x20;REG_DWORD,&#x20;1&#x20;GO&#x20;Restart&#x20;the&#x20;SQL&#x20;Server&#x20;service&#x20;for&#x20;the&#x20;change&#x20;to&#x20;take&#x20;effect.','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(11516,'Ensure&#x20;only&#x20;the&#x20;default&#x20;permissions&#x20;specified&#x20;by&#x20;Microsoft&#x20;are&#x20;granted&#x20;to&#x20;the&#x20;public&#x20;server&#x20;role','public&#x20;is&#x20;a&#x20;special&#x20;fixed&#x20;server&#x20;role&#x20;containing&#x20;all&#x20;logins.&#x20;Unlike&#x20;other&#x20;fixed&#x20;server&#x20;roles,&#x20;permissions&#x20;can&#x20;be&#x20;changed&#x20;for&#x20;the&#x20;public&#x20;role.&#x20;In&#x20;keeping&#x20;with&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privileges,&#x20;the&#x20;public&#x20;server&#x20;role&#x20;should&#x20;not&#x20;be&#x20;used&#x20;to&#x20;grant&#x20;permissions&#x20;at&#x20;the&#x20;server&#x20;scope&#x20;as&#x20;these&#x20;would&#x20;be&#x20;inherited&#x20;by&#x20;all&#x20;users.','Every&#x20;SQL&#x20;Server&#x20;login&#x20;belongs&#x20;to&#x20;the&#x20;public&#x20;role&#x20;and&#x20;cannot&#x20;be&#x20;removed&#x20;from&#x20;this&#x20;role.&#x20;Therefore,&#x20;any&#x20;permissions&#x20;granted&#x20;to&#x20;this&#x20;role&#x20;will&#x20;be&#x20;available&#x20;to&#x20;all&#x20;logins&#x20;unless&#x20;they&#x20;have&#x20;been&#x20;explicitly&#x20;denied&#x20;to&#x20;specific&#x20;logins&#x20;or&#x20;user-defined&#x20;server&#x20;roles.','','Add&#x20;the&#x20;extraneous&#x20;permissions&#x20;found&#x20;in&#x20;the&#x20;Audit&#x20;query&#x20;results&#x20;to&#x20;the&#x20;specific&#x20;logins&#x20;to&#x20;user-defined&#x20;server&#x20;roles&#x20;which&#x20;require&#x20;the&#x20;access.&#x20;Revoke&#x20;the&#x20;&lt;permission_name&gt;&#x20;from&#x20;the&#x20;public&#x20;role&#x20;as&#x20;shown&#x20;below&#x20;USE&#x20;[master]&#x20;GO&#x20;REVOKE&#x20;&lt;permission_name&gt;&#x20;FROM&#x20;public;&#x20;GO','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(11517,'Ensure&#x20;Windows&#x20;local&#x20;groups&#x20;are&#x20;not&#x20;SQL&#x20;Logins','Local&#x20;Windows&#x20;groups&#x20;should&#x20;not&#x20;be&#x20;used&#x20;as&#x20;logins&#x20;for&#x20;SQL&#x20;Server&#x20;instances.','Allowing&#x20;local&#x20;Windows&#x20;groups&#x20;as&#x20;SQL&#x20;Logins&#x20;provides&#x20;a&#x20;loophole&#x20;whereby&#x20;anyone&#x20;with&#x20;OS&#x20;level&#x20;administrator&#x20;rights&#x20;&#40;and&#x20;no&#x20;SQL&#x20;Server&#x20;rights&#41;&#x20;could&#x20;add&#x20;users&#x20;to&#x20;the&#x20;local&#x20;Windows&#x20;groups&#x20;and&#x20;thereby&#x20;give&#x20;themselves&#x20;or&#x20;others&#x20;access&#x20;to&#x20;the&#x20;SQL&#x20;Server&#x20;instance.','','1.&#x20;For&#x20;each&#x20;LocalGroupName&#x20;login,&#x20;if&#x20;needed&#x20;create&#x20;an&#x20;equivalent&#x20;AD&#x20;group&#x20;containing&#x20;only&#x20;the&#x20;required&#x20;user&#x20;accounts.&#x20;2.&#x20;Add&#x20;the&#x20;AD&#x20;group&#x20;or&#x20;individual&#x20;Windows&#x20;accounts&#x20;as&#x20;a&#x20;SQL&#x20;Server&#x20;login&#x20;and&#x20;grant&#x20;it&#x20;the&#x20;permissions&#x20;required.&#x20;3.&#x20;Drop&#x20;the&#x20;LocalGroupName&#x20;login&#x20;using&#x20;the&#x20;syntax&#x20;below&#x20;after&#x20;replacing&#x20;&lt;name&gt;&#x20;.&#x20;USE&#x20;[master]&#x20;GO&#x20;DROP&#x20;LOGIN&#x20;[&lt;name&gt;]&#x20;GO','[{\"cis\": [\"3.10\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}]'),(11518,'Ensure&#x20;&#039;CHECK_EXPIRATION&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins&#x20;Within&#x20;the&#x20;Sysadmin&#x20;Role','Applies&#x20;the&#x20;same&#x20;password&#x20;expiration&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;inside&#x20;SQL&#x20;Server.','Ensuring&#x20;SQL&#x20;logins&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;will&#x20;ensure&#x20;the&#x20;passwords&#x20;for&#x20;SQL&#x20;logins&#x20;with&#x20;sysadmin&#x20;privileges&#x20;are&#x20;changed&#x20;on&#x20;a&#x20;frequent&#x20;basis&#x20;to&#x20;help&#x20;prevent&#x20;compromise&#x20;via&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;CONTROL&#x20;SERVER&#x20;is&#x20;an&#x20;equivalent&#x20;permission&#x20;to&#x20;sysadmin&#x20;and&#x20;logins&#x20;with&#x20;that&#x20;permission&#x20;should&#x20;also&#x20;be&#x20;required&#x20;to&#x20;have&#x20;expiring&#x20;passwords.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_EXPIRATION&#x20;=&#x20;ON;','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"16.2, 16.10\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(11519,'Ensure&#x20;&#039;CHECK_POLICY&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins','Applies&#x20;the&#x20;same&#x20;password&#x20;complexity&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;insideSQL&#x20;Server.','Ensure&#x20;SQL&#x20;authenticated&#x20;login&#x20;passwords&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;so&#x20;that&#x20;they&#x20;cannot&#x20;be&#x20;easily&#x20;compromised&#x20;via&#x20;brute&#x20;force&#x20;attack.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_POLICY&#x20;=&#x20;ON;&#x20;Note:&#x20;In&#x20;the&#x20;case&#x20;of&#x20;AWS&#x20;RDS&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;remediation&#x20;for&#x20;the&#x20;Master&#x20;account.','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"16, 4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(11520,'Ensure&#x20;&#039;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;&#039;12&#039;','SQL&#x20;Server&#x20;error&#x20;log&#x20;files&#x20;must&#x20;be&#x20;protected&#x20;from&#x20;loss.&#x20;The&#x20;log&#x20;files&#x20;must&#x20;be&#x20;backed&#x20;up&#x20;before&#x20;they&#x20;are&#x20;overwritten.&#x20;Retaining&#x20;more&#x20;error&#x20;logs&#x20;helps&#x20;prevent&#x20;loss&#x20;from&#x20;frequent&#x20;recycling&#x20;before&#x20;backups&#x20;can&#x20;occur.','The&#x20;SQL&#x20;Server&#x20;error&#x20;log&#x20;contains&#x20;important&#x20;information&#x20;about&#x20;major&#x20;server&#x20;events&#x20;and&#x20;login&#x20;attempt&#x20;information&#x20;as&#x20;well.','','Adjust&#x20;the&#x20;number&#x20;of&#x20;logs&#x20;to&#x20;prevent&#x20;data&#x20;loss.&#x20;The&#x20;default&#x20;value&#x20;of&#x20;6&#x20;may&#x20;be&#x20;insufficient&#x20;for&#x20;a&#x20;production&#x20;environment.&#x20;Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;Object&#x20;Explorer&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;instance.&#x20;3.&#x20;Navigate&#x20;to&#x20;the&#x20;Management&#x20;tab&#x20;in&#x20;Object&#x20;Explorer&#x20;and&#x20;expand.&#x20;Right&#x20;click&#x20;on&#x20;the&#x20;SQL&#x20;Server&#x20;Logs&#x20;file&#x20;and&#x20;select&#x20;Configure&#x20;4.&#x20;Check&#x20;the&#x20;Limit&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;before&#x20;they&#x20;are&#x20;recycled&#x20;5.&#x20;Set&#x20;the&#x20;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;12&#x20;T-SQL&#x20;Method&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;to&#x20;change&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files,&#x20;replace&#x20;&lt;NumberAbove12&gt;&#x20;with&#x20;your&#x20;desired&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files:&#x20;EXEC&#x20;master.sys.xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;NumErrorLogs&#039;,&#x20;REG_DWORD,&#x20;&lt;NumberAbove12&gt;;','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(11521,'Ensure&#x20;&#039;Default&#x20;Trace&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#039;','The&#x20;default&#x20;trace&#x20;provides&#x20;audit&#x20;logging&#x20;of&#x20;database&#x20;activity&#x20;including&#x20;account&#x20;creations,&#x20;privilege&#x20;elevation&#x20;and&#x20;execution&#x20;of&#x20;DBCC&#x20;commands.','Default&#x20;trace&#x20;provides&#x20;valuable&#x20;audit&#x20;information&#x20;regarding&#x20;security-related&#x20;activities&#x20;on&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;default&#x20;trace&#x20;enabled&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(11522,'Ensure&#x20;&#039;CLR&#x20;Assembly&#x20;Permission&#x20;Set&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;SAFE_ACCESS&#039;&#x20;for&#x20;All&#x20;CLR&#x20;Assemblies','Setting&#x20;CLR&#x20;Assembly&#x20;Permission&#x20;Sets&#x20;to&#x20;SAFE_ACCESS&#x20;will&#x20;prevent&#x20;assemblies&#x20;from&#x20;accessing&#x20;external&#x20;system&#x20;resources&#x20;such&#x20;as&#x20;files,&#x20;the&#x20;network,&#x20;environment&#x20;variables,&#x20;or&#x20;the&#x20;registry.','Assemblies&#x20;with&#x20;EXTERNAL_ACCESS&#x20;or&#x20;UNSAFE&#x20;permission&#x20;sets&#x20;can&#x20;be&#x20;used&#x20;to&#x20;access&#x20;sensitive&#x20;areas&#x20;of&#x20;the&#x20;operating&#x20;system,&#x20;steal&#x20;and/or&#x20;transmit&#x20;data&#x20;and&#x20;alter&#x20;the&#x20;state&#x20;and&#x20;other&#x20;protection&#x20;measures&#x20;of&#x20;the&#x20;underlying&#x20;Windows&#x20;Operating&#x20;System.&#x20;Assemblies&#x20;which&#x20;are&#x20;Microsoft-created&#x20;&#40;&#x20;is_user_defined&#x20;=&#x20;0&#x20;&#41;&#x20;are&#x20;excluded&#x20;from&#x20;this&#x20;check&#x20;as&#x20;they&#x20;are&#x20;required&#x20;for&#x20;overall&#x20;system&#x20;functionality.','','ALTER&#x20;ASSEMBLY&#x20;&lt;assembly_name&gt;&#x20;WITH&#x20;PERMISSION_SET&#x20;=&#x20;SAFE;','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(12000,'Ensure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','Enabling&#x20;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#x20;allows&#x20;users&#x20;to&#x20;query&#x20;data&#x20;and&#x20;execute&#x20;statements&#x20;on&#x20;external&#x20;data&#x20;sources.&#x20;This&#x20;functionality&#x20;should&#x20;be&#x20;disabled.','This&#x20;feature&#x20;can&#x20;be&#x20;used&#x20;to&#x20;remotely&#x20;access&#x20;and&#x20;exploit&#x20;vulnerabilities&#x20;on&#x20;remote&#x20;SQL&#x20;Server&#x20;instances&#x20;and&#x20;to&#x20;run&#x20;unsafe&#x20;Visual&#x20;Basic&#x20;for&#x20;Application&#x20;functions.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(12001,'Ensure&#x20;&#039;CLR&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;clr&#x20;enabled&#x20;option&#x20;specifies&#x20;whether&#x20;user&#x20;assemblies&#x20;can&#x20;be&#x20;run&#x20;by&#x20;SQL&#x20;Server.','Enabling&#x20;use&#x20;of&#x20;CLR&#x20;assemblies&#x20;widens&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;puts&#x20;it&#x20;at&#x20;risk&#x20;from&#x20;both&#x20;inadvertent&#x20;and&#x20;malicious&#x20;assemblies.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;clr&#x20;enabled&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"18.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(12002,'Ensure&#x20;&#039;Cross&#x20;DB&#x20;Ownership&#x20;Chaining&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;cross&#x20;db&#x20;ownership&#x20;chaining&#x20;option&#x20;controls&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;across&#x20;all&#x20;databases&#x20;at&#x20;the&#x20;instance&#x20;&#40;or&#x20;server&#41;&#x20;level.','When&#x20;enabled,&#x20;this&#x20;option&#x20;allows&#x20;a&#x20;member&#x20;of&#x20;the&#x20;db_owner&#x20;role&#x20;in&#x20;a&#x20;database&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;objects&#x20;owned&#x20;by&#x20;a&#x20;login&#x20;in&#x20;any&#x20;other&#x20;database,&#x20;causing&#x20;an&#x20;unnecessary&#x20;information&#x20;disclosure.&#x20;When&#x20;required,&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;for&#x20;the&#x20;specific&#x20;databases&#x20;requiring&#x20;it&#x20;instead&#x20;of&#x20;at&#x20;the&#x20;instance&#x20;level&#x20;for&#x20;all&#x20;databases&#x20;by&#x20;using&#x20;the&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;DB_CHAINING&#x20;ON&#x20;command.&#x20;This&#x20;database&#x20;option&#x20;may&#x20;not&#x20;be&#x20;changed&#x20;on&#x20;the&#x20;master&#x20;,&#x20;model&#x20;,&#x20;or&#x20;tempdb&#x20;system&#x20;databases.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;cross&#x20;db&#x20;ownership&#x20;chaining&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12003,'Ensure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;controls&#x20;the&#x20;ability&#x20;to&#x20;generate&#x20;and&#x20;transmit&#x20;email&#x20;messages&#x20;from&#x20;SQL&#x20;Server.','Disabling&#x20;the&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;reduces&#x20;the&#x20;SQL&#x20;Server&#x20;surface,&#x20;eliminates&#x20;a&#x20;DOS&#x20;attack&#x20;vector&#x20;and&#x20;channel&#x20;to&#x20;exfiltrate&#x20;data&#x20;from&#x20;the&#x20;database&#x20;server&#x20;to&#x20;a&#x20;remote&#x20;host.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12004,'Ensure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Ole&#x20;Automation&#x20;Procedures&#x20;option&#x20;controls&#x20;whether&#x20;OLE&#x20;Automation&#x20;objects&#x20;can&#x20;be&#x20;instantiated&#x20;within&#x20;Transact-SQL&#x20;batches.&#x20;These&#x20;are&#x20;extended&#x20;stored&#x20;procedures&#x20;that&#x20;allow&#x20;SQL&#x20;Server&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;external&#x20;to&#x20;SQL&#x20;Server.','Enabling&#x20;this&#x20;option&#x20;will&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;in&#x20;the&#x20;security&#x20;context&#x20;of&#x20;SQL&#x20;Server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12005,'Ensure&#x20;&#039;Remote&#x20;Access&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;access&#x20;option&#x20;controls&#x20;the&#x20;execution&#x20;of&#x20;local&#x20;stored&#x20;procedures&#x20;on&#x20;remote&#x20;servers&#x20;or&#x20;remote&#x20;stored&#x20;procedures&#x20;on&#x20;local&#x20;server.','Functionality&#x20;can&#x20;be&#x20;abused&#x20;to&#x20;launch&#x20;a&#x20;Denial-of-Service&#x20;&#40;DoS&#41;&#x20;attack&#x20;on&#x20;remote&#x20;servers&#x20;by&#x20;off-loading&#x20;query&#x20;processing&#x20;to&#x20;a&#x20;target.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;access&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12006,'Ensure&#x20;&#039;Remote&#x20;Admin&#x20;Connections&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;admin&#x20;connections&#x20;option&#x20;controls&#x20;whether&#x20;a&#x20;client&#x20;application&#x20;on&#x20;a&#x20;remote&#x20;computer&#x20;can&#x20;use&#x20;the&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;.','The&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;&#x20;lets&#x20;an&#x20;administrator&#x20;access&#x20;a&#x20;running&#x20;server&#x20;to&#x20;execute&#x20;diagnostic&#x20;functions&#x20;or&#x20;Transact-SQL&#x20;statements,&#x20;or&#x20;to&#x20;troubleshoot&#x20;problems&#x20;on&#x20;the&#x20;server,&#x20;even&#x20;when&#x20;the&#x20;server&#x20;is&#x20;locked&#x20;or&#x20;running&#x20;in&#x20;an&#x20;abnormal&#x20;state&#x20;and&#x20;not&#x20;responding&#x20;to&#x20;a&#x20;SQL&#x20;Server&#x20;Database&#x20;Engine&#x20;connection.&#x20;In&#x20;a&#x20;cluster&#x20;scenario,&#x20;the&#x20;administrator&#x20;may&#x20;not&#x20;actually&#x20;be&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;same&#x20;node&#x20;that&#x20;is&#x20;currently&#x20;hosting&#x20;the&#x20;SQL&#x20;Server&#x20;instance&#x20;and&#x20;thus&#x20;is&#x20;considered&#x20;&quot;remote&quot;.&#x20;Therefore,&#x20;this&#x20;setting&#x20;should&#x20;usually&#x20;be&#x20;enabled&#x20;&#40;&#x20;1&#x20;&#41;&#x20;for&#x20;SQL&#x20;Server&#x20;failover&#x20;clusters;&#x20;otherwise&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;&#40;&#x20;0&#x20;&#41;&#x20;which&#x20;is&#x20;the&#x20;default.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command&#x20;on&#x20;non-clustered&#x20;installations:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;admin&#x20;connections&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12007,'Ensure&#x20;&#039;Scan&#x20;For&#x20;Startup&#x20;Procs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;scan&#x20;for&#x20;startup&#x20;procs&#x20;option,&#x20;if&#x20;enabled,&#x20;causes&#x20;SQL&#x20;Server&#x20;to&#x20;scan&#x20;for&#x20;and&#x20;automatically&#x20;run&#x20;all&#x20;stored&#x20;procedures&#x20;that&#x20;are&#x20;set&#x20;to&#x20;execute&#x20;upon&#x20;service&#x20;startup.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;entity&#x20;leveraging&#x20;these&#x20;facilities&#x20;for&#x20;malicious&#x20;purposes.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;scan&#x20;for&#x20;startup&#x20;procs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.8\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12008,'Ensure&#x20;&#039;Trustworthy&#039;&#x20;Database&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Off&#039;','The&#x20;TRUSTWORTHY&#x20;database&#x20;option&#x20;allows&#x20;database&#x20;objects&#x20;to&#x20;access&#x20;objects&#x20;in&#x20;other&#x20;databases&#x20;under&#x20;certain&#x20;circumstances.','Provides&#x20;protection&#x20;from&#x20;malicious&#x20;CLR&#x20;assemblies&#x20;or&#x20;extended&#x20;procedures.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement&#x20;against&#x20;the&#x20;databases&#x20;&#40;replace&#x20;&lt;dbname&gt;&#x20;below&#41;&#x20;returned&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;[&lt;database_name&gt;]&#x20;SET&#x20;TRUSTWORTHY&#x20;OFF;','[{\"cis\": [\"2.9\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12009,'Ensure&#x20;SQL&#x20;Server&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;non-standard&#x20;ports','If&#x20;enabled,&#x20;the&#x20;default&#x20;SQL&#x20;Server&#x20;instance&#x20;will&#x20;be&#x20;assigned&#x20;a&#x20;default&#x20;port&#x20;of&#x20;TCP:1433&#x20;for&#x20;TCP/IP&#x20;communication.&#x20;Administrators&#x20;can&#x20;also&#x20;configure&#x20;named&#x20;instances&#x20;to&#x20;use&#x20;TCP:1433&#x20;for&#x20;communication.&#x20;TCP:1433&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;SQL&#x20;Server&#x20;port&#x20;and&#x20;this&#x20;port&#x20;assignment&#x20;should&#x20;be&#x20;changed.','Using&#x20;a&#x20;non-default&#x20;port&#x20;helps&#x20;protect&#x20;the&#x20;database&#x20;from&#x20;attacks&#x20;directed&#x20;to&#x20;the&#x20;default&#x20;port.','','1:&#x20;In&#x20;SQL&#x20;Server&#x20;Configuration&#x20;Manager,&#x20;in&#x20;the&#x20;console&#x20;pane,&#x20;expand&#x20;SQL&#x20;Server&#x20;Network&#x20;Configuration,&#x20;expand&#x20;Protocols&#x20;for&#x20;&lt;InstanceName&gt;&#x20;,&#x20;and&#x20;then&#x20;double-click&#x20;the&#x20;TCP/IP&#x20;or&#x20;VIA&#x20;protocol.&#x20;2:&#x20;In&#x20;the&#x20;TCP/IP&#x20;Properties&#x20;dialog&#x20;box,&#x20;on&#x20;the&#x20;IP&#x20;Addresses&#x20;tab,&#x20;several&#x20;IP&#x20;addresses&#x20;appear&#x20;in&#x20;the&#x20;format&#x20;IP1&#x20;,&#x20;IP2&#x20;,&#x20;up&#x20;to&#x20;IPAll&#x20;.&#x20;One&#x20;of&#x20;these&#x20;is&#x20;for&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;loopback&#x20;adapter,&#x20;127.0.0.1&#x20;.&#x20;Additional&#x20;IP&#x20;addresses&#x20;appear&#x20;for&#x20;each&#x20;IP&#x20;Address&#x20;on&#x20;the&#x20;computer.&#x20;3:&#x20;Change&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;from&#x20;1433&#x20;to&#x20;another&#x20;non-standard&#x20;port&#x20;or&#x20;leave&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;empty&#x20;and&#x20;set&#x20;the&#x20;TCP&#x20;Dynamic&#x20;Ports&#x20;value&#x20;to&#x20;0&#x20;to&#x20;enable&#x20;dynamic&#x20;port&#x20;assignment&#x20;and&#x20;then&#x20;click&#x20;OK.&#x20;4:&#x20;In&#x20;the&#x20;console&#x20;pane,&#x20;click&#x20;SQL&#x20;Server&#x20;Services.&#x20;5:&#x20;In&#x20;the&#x20;details&#x20;pane,&#x20;right-click&#x20;SQL&#x20;Server&#x20;&#40;&lt;InstanceName&gt;&#41;&#x20;and&#x20;then&#x20;click&#x20;Restart,&#x20;to&#x20;stop&#x20;and&#x20;restart&#x20;SQL&#x20;Server.','[{\"cis\": [\"2.11\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12010,'Ensure&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;This&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;the&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;query:&#x20;USE&#x20;[master]&#x20;GO&#x20;DECLARE&#x20;@tsql&#x20;nvarchar&#40;max&#41;&#x20;SET&#x20;@tsql&#x20;=&#x20;&#039;ALTER&#x20;LOGIN&#x20;&#039;&#x20;+&#x20;SUSER_NAME&#40;0x01&#41;&#x20;+&#x20;&#039;&#x20;DISABLE&#039;&#x20;EXEC&#x20;&#40;@tsql&#41;&#x20;GO','[{\"cis\": [\"2.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12011,'Ensure&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;has&#x20;been&#x20;renamed','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;login&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;The&#x20;sa&#x20;login&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','It&#x20;is&#x20;more&#x20;difficult&#x20;to&#x20;launch&#x20;password-guessing&#x20;and&#x20;brute-force&#x20;attacks&#x20;against&#x20;the&#x20;sa&#x20;login&#x20;if&#x20;the&#x20;name&#x20;is&#x20;not&#x20;known.','','Replace&#x20;the&#x20;&lt;different_user&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;ALTER&#x20;LOGIN&#x20;sa&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_user&gt;;','[{\"cis\": [\"2.14\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12012,'Ensure&#x20;&#039;xp_cmdshell&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;xp_cmdshell&#x20;option&#x20;controls&#x20;whether&#x20;the&#x20;xp_cmdshell&#x20;extended&#x20;stored&#x20;procedure&#x20;can&#x20;be&#x20;used&#x20;by&#x20;an&#x20;authenticated&#x20;SQL&#x20;Server&#x20;user&#x20;to&#x20;execute&#x20;operating-system&#x20;command&#x20;shell&#x20;commands&#x20;and&#x20;return&#x20;results&#x20;as&#x20;rows&#x20;within&#x20;the&#x20;SQL&#x20;client.','The&#x20;xp_cmdshell&#x20;procedure&#x20;is&#x20;commonly&#x20;used&#x20;by&#x20;attackers&#x20;to&#x20;read&#x20;or&#x20;write&#x20;data&#x20;to/from&#x20;the&#x20;underlying&#x20;Operating&#x20;System&#x20;of&#x20;a&#x20;database&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;xp_cmdshell&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.15\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12013,'Ensure&#x20;&#039;AUTO_CLOSE&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;&#x20;on&#x20;contained&#x20;databases','AUTO_CLOSE&#x20;determines&#x20;if&#x20;a&#x20;given&#x20;database&#x20;is&#x20;closed&#x20;or&#x20;not&#x20;after&#x20;a&#x20;connection&#x20;terminates.&#x20;If&#x20;enabled,&#x20;subsequent&#x20;connections&#x20;to&#x20;the&#x20;given&#x20;database&#x20;will&#x20;require&#x20;the&#x20;database&#x20;to&#x20;be&#x20;reopened&#x20;and&#x20;relevant&#x20;procedure&#x20;caches&#x20;to&#x20;be&#x20;rebuilt.','Because&#x20;authentication&#x20;of&#x20;users&#x20;for&#x20;contained&#x20;databases&#x20;occurs&#x20;within&#x20;the&#x20;database&#x20;not&#x20;at&#x20;the&#x20;serverinstance&#x20;level,&#x20;the&#x20;database&#x20;must&#x20;be&#x20;opened&#x20;every&#x20;time&#x20;to&#x20;authenticate&#x20;a&#x20;user.&#x20;The&#x20;frequent&#x20;opening/closing&#x20;of&#x20;the&#x20;database&#x20;consumes&#x20;additional&#x20;server&#x20;resources&#x20;and&#x20;may&#x20;contribute&#x20;to&#x20;a&#x20;denial&#x20;of&#x20;service.','','Execute&#x20;the&#x20;following&#x20;T-SQL,&#x20;replacing&#x20;&lt;database_name&gt;&#x20;with&#x20;each&#x20;database&#x20;name&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;AUTO_CLOSE&#x20;OFF;','[{\"cis\": [\"2.16\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12014,'Ensure&#x20;no&#x20;login&#x20;exists&#x20;with&#x20;the&#x20;name&#x20;&#039;sa&#039;','The&#x20;sa&#x20;login&#x20;&#40;e.g.&#x20;principal&#41;&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account.&#x20;Therefore,&#x20;there&#x20;should&#x20;not&#x20;be&#x20;a&#x20;login&#x20;called&#x20;sa&#x20;even&#x20;when&#x20;the&#x20;original&#x20;sa&#x20;login&#x20;&#40;&#x20;principal_id&#x20;=&#x20;0x01&#x20;&#41;&#x20;has&#x20;been&#x20;renamed.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal&#x20;name.','','Execute&#x20;the&#x20;appropriate&#x20;ALTER&#x20;or&#x20;DROP&#x20;statement&#x20;below&#x20;based&#x20;on&#x20;the&#x20;principal_id&#x20;returned&#x20;for&#x20;the&#x20;login&#x20;named&#x20;sa&#x20;.&#x20;Replace&#x20;the&#x20;&lt;different_name&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;USE&#x20;[master]&#x20;GO&#x20;--&#x20;If&#x20;principal_id&#x20;=&#x20;1&#x20;or&#x20;the&#x20;login&#x20;owns&#x20;database&#x20;objects,&#x20;rename&#x20;the&#x20;sa&#x20;login&#x20;ALTER&#x20;LOGIN&#x20;[sa]&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_name&gt;;&#x20;GO&#x20;--&#x20;If&#x20;the&#x20;login&#x20;owns&#x20;no&#x20;database&#x20;objects,&#x20;then&#x20;drop&#x20;it&#x20;--&#x20;Do&#x20;NOT&#x20;drop&#x20;the&#x20;login&#x20;if&#x20;it&#x20;is&#x20;principal_id&#x20;=&#x20;1&#x20;DROP&#x20;LOGIN&#x20;sa','[{\"cis\": [\"2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12015,'Ensure&#x20;&#039;Server&#x20;Authentication&#039;&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Windows&#x20;Authentication&#x20;Mode&#039;','Uses&#x20;Windows&#x20;Authentication&#x20;to&#x20;validate&#x20;attempted&#x20;connections.','Windows&#x20;provides&#x20;a&#x20;more&#x20;robust&#x20;authentication&#x20;mechanism&#x20;than&#x20;SQL&#x20;Server&#x20;authentication.','','Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method:&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;the&#x20;Object&#x20;Explorer&#x20;tab&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;database&#x20;instance.&#x20;3.&#x20;Right&#x20;click&#x20;the&#x20;instance&#x20;name&#x20;and&#x20;select&#x20;Properties.&#x20;4.&#x20;Select&#x20;the&#x20;Security&#x20;page&#x20;from&#x20;the&#x20;left&#x20;menu.&#x20;5.&#x20;Set&#x20;the&#x20;Server&#x20;authentication&#x20;setting&#x20;to&#x20;Windows&#x20;Authentication&#x20;Mode.&#x20;or&#x20;T-SQL&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;in&#x20;a&#x20;Query&#x20;Window:&#x20;USE&#x20;[master]&#x20;GO&#x20;EXEC&#x20;xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;LoginMode&#039;,&#x20;REG_DWORD,&#x20;1&#x20;GO&#x20;Restart&#x20;the&#x20;SQL&#x20;Server&#x20;service&#x20;for&#x20;the&#x20;change&#x20;to&#x20;take&#x20;effect.','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(12016,'Ensure&#x20;only&#x20;the&#x20;default&#x20;permissions&#x20;specified&#x20;by&#x20;Microsoft&#x20;are&#x20;granted&#x20;to&#x20;the&#x20;public&#x20;server&#x20;role','public&#x20;is&#x20;a&#x20;special&#x20;fixed&#x20;server&#x20;role&#x20;containing&#x20;all&#x20;logins.&#x20;Unlike&#x20;other&#x20;fixed&#x20;server&#x20;roles,&#x20;permissions&#x20;can&#x20;be&#x20;changed&#x20;for&#x20;the&#x20;public&#x20;role.&#x20;In&#x20;keeping&#x20;with&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privileges,&#x20;the&#x20;public&#x20;server&#x20;role&#x20;should&#x20;not&#x20;be&#x20;used&#x20;to&#x20;grant&#x20;permissions&#x20;at&#x20;the&#x20;server&#x20;scope&#x20;as&#x20;these&#x20;would&#x20;be&#x20;inherited&#x20;by&#x20;all&#x20;users.','Every&#x20;SQL&#x20;Server&#x20;login&#x20;belongs&#x20;to&#x20;the&#x20;public&#x20;role&#x20;and&#x20;cannot&#x20;be&#x20;removed&#x20;from&#x20;this&#x20;role.&#x20;Therefore,&#x20;any&#x20;permissions&#x20;granted&#x20;to&#x20;this&#x20;role&#x20;will&#x20;be&#x20;available&#x20;to&#x20;all&#x20;logins&#x20;unless&#x20;they&#x20;have&#x20;been&#x20;explicitly&#x20;denied&#x20;to&#x20;specific&#x20;logins&#x20;or&#x20;user-defined&#x20;server&#x20;roles.','','Add&#x20;the&#x20;extraneous&#x20;permissions&#x20;found&#x20;in&#x20;the&#x20;Audit&#x20;query&#x20;results&#x20;to&#x20;the&#x20;specific&#x20;logins&#x20;to&#x20;user-defined&#x20;server&#x20;roles&#x20;which&#x20;require&#x20;the&#x20;access.&#x20;Revoke&#x20;the&#x20;&lt;permission_name&gt;&#x20;from&#x20;the&#x20;public&#x20;role&#x20;as&#x20;shown&#x20;below&#x20;USE&#x20;[master]&#x20;GO&#x20;REVOKE&#x20;&lt;permission_name&gt;&#x20;FROM&#x20;public;&#x20;GO','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(12017,'Ensure&#x20;Windows&#x20;local&#x20;groups&#x20;are&#x20;not&#x20;SQL&#x20;Logins','Local&#x20;Windows&#x20;groups&#x20;should&#x20;not&#x20;be&#x20;used&#x20;as&#x20;logins&#x20;for&#x20;SQL&#x20;Server&#x20;instances.','Allowing&#x20;local&#x20;Windows&#x20;groups&#x20;as&#x20;SQL&#x20;Logins&#x20;provides&#x20;a&#x20;loophole&#x20;whereby&#x20;anyone&#x20;with&#x20;OS&#x20;level&#x20;administrator&#x20;rights&#x20;&#40;and&#x20;no&#x20;SQL&#x20;Server&#x20;rights&#41;&#x20;could&#x20;add&#x20;users&#x20;to&#x20;the&#x20;local&#x20;Windows&#x20;groups&#x20;and&#x20;thereby&#x20;give&#x20;themselves&#x20;or&#x20;others&#x20;access&#x20;to&#x20;the&#x20;SQL&#x20;Server&#x20;instance.','','1.&#x20;For&#x20;each&#x20;LocalGroupName&#x20;login,&#x20;if&#x20;needed&#x20;create&#x20;an&#x20;equivalent&#x20;AD&#x20;group&#x20;containing&#x20;only&#x20;the&#x20;required&#x20;user&#x20;accounts.&#x20;2.&#x20;Add&#x20;the&#x20;AD&#x20;group&#x20;or&#x20;individual&#x20;Windows&#x20;accounts&#x20;as&#x20;a&#x20;SQL&#x20;Server&#x20;login&#x20;and&#x20;grant&#x20;it&#x20;the&#x20;permissions&#x20;required.&#x20;3.&#x20;Drop&#x20;the&#x20;LocalGroupName&#x20;login&#x20;using&#x20;the&#x20;syntax&#x20;below&#x20;after&#x20;replacing&#x20;&lt;name&gt;&#x20;.&#x20;USE&#x20;[master]&#x20;GO&#x20;DROP&#x20;LOGIN&#x20;[&lt;name&gt;]&#x20;GO','[{\"cis\": [\"3.10\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}]'),(12018,'Ensure&#x20;&#039;CHECK_EXPIRATION&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins&#x20;Within&#x20;the&#x20;Sysadmin&#x20;Role','Applies&#x20;the&#x20;same&#x20;password&#x20;expiration&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;inside&#x20;SQL&#x20;Server.','Ensuring&#x20;SQL&#x20;logins&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;will&#x20;ensure&#x20;the&#x20;passwords&#x20;for&#x20;SQL&#x20;logins&#x20;with&#x20;sysadmin&#x20;privileges&#x20;are&#x20;changed&#x20;on&#x20;a&#x20;frequent&#x20;basis&#x20;to&#x20;help&#x20;prevent&#x20;compromise&#x20;via&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;CONTROL&#x20;SERVER&#x20;is&#x20;an&#x20;equivalent&#x20;permission&#x20;to&#x20;sysadmin&#x20;and&#x20;logins&#x20;with&#x20;that&#x20;permission&#x20;should&#x20;also&#x20;be&#x20;required&#x20;to&#x20;have&#x20;expiring&#x20;passwords.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_EXPIRATION&#x20;=&#x20;ON;','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"16.2, 16.10\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(12019,'Ensure&#x20;&#039;CHECK_POLICY&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins','Applies&#x20;the&#x20;same&#x20;password&#x20;complexity&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;insideSQL&#x20;Server.','Ensure&#x20;SQL&#x20;authenticated&#x20;login&#x20;passwords&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;so&#x20;that&#x20;they&#x20;cannot&#x20;be&#x20;easily&#x20;compromised&#x20;via&#x20;brute&#x20;force&#x20;attack.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_POLICY&#x20;=&#x20;ON;&#x20;Note:&#x20;In&#x20;the&#x20;case&#x20;of&#x20;AWS&#x20;RDS&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;remediation&#x20;for&#x20;the&#x20;Master&#x20;account.','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"16, 4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(12020,'Ensure&#x20;&#039;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;&#039;12&#039;','SQL&#x20;Server&#x20;error&#x20;log&#x20;files&#x20;must&#x20;be&#x20;protected&#x20;from&#x20;loss.&#x20;The&#x20;log&#x20;files&#x20;must&#x20;be&#x20;backed&#x20;up&#x20;before&#x20;they&#x20;are&#x20;overwritten.&#x20;Retaining&#x20;more&#x20;error&#x20;logs&#x20;helps&#x20;prevent&#x20;loss&#x20;from&#x20;frequent&#x20;recycling&#x20;before&#x20;backups&#x20;can&#x20;occur.','The&#x20;SQL&#x20;Server&#x20;error&#x20;log&#x20;contains&#x20;important&#x20;information&#x20;about&#x20;major&#x20;server&#x20;events&#x20;and&#x20;login&#x20;attempt&#x20;information&#x20;as&#x20;well.','','Adjust&#x20;the&#x20;number&#x20;of&#x20;logs&#x20;to&#x20;prevent&#x20;data&#x20;loss.&#x20;The&#x20;default&#x20;value&#x20;of&#x20;6&#x20;may&#x20;be&#x20;insufficient&#x20;for&#x20;a&#x20;production&#x20;environment.&#x20;Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;Object&#x20;Explorer&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;instance.&#x20;3.&#x20;Navigate&#x20;to&#x20;the&#x20;Management&#x20;tab&#x20;in&#x20;Object&#x20;Explorer&#x20;and&#x20;expand.&#x20;Right&#x20;click&#x20;on&#x20;the&#x20;SQL&#x20;Server&#x20;Logs&#x20;file&#x20;and&#x20;select&#x20;Configure&#x20;4.&#x20;Check&#x20;the&#x20;Limit&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;before&#x20;they&#x20;are&#x20;recycled&#x20;5.&#x20;Set&#x20;the&#x20;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;12&#x20;T-SQL&#x20;Method&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;to&#x20;change&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files,&#x20;replace&#x20;&lt;NumberAbove12&gt;&#x20;with&#x20;your&#x20;desired&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files:&#x20;EXEC&#x20;master.sys.xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;NumErrorLogs&#039;,&#x20;REG_DWORD,&#x20;&lt;NumberAbove12&gt;;','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12021,'Ensure&#x20;&#039;Default&#x20;Trace&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#039;','The&#x20;default&#x20;trace&#x20;provides&#x20;audit&#x20;logging&#x20;of&#x20;database&#x20;activity&#x20;including&#x20;account&#x20;creations,&#x20;privilege&#x20;elevation&#x20;and&#x20;execution&#x20;of&#x20;DBCC&#x20;commands.','Default&#x20;trace&#x20;provides&#x20;valuable&#x20;audit&#x20;information&#x20;regarding&#x20;security-related&#x20;activities&#x20;on&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;default&#x20;trace&#x20;enabled&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(12022,'Ensure&#x20;&#039;CLR&#x20;Assembly&#x20;Permission&#x20;Set&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;SAFE_ACCESS&#039;&#x20;for&#x20;All&#x20;CLR&#x20;Assemblies','Setting&#x20;CLR&#x20;Assembly&#x20;Permission&#x20;Sets&#x20;to&#x20;SAFE_ACCESS&#x20;will&#x20;prevent&#x20;assemblies&#x20;from&#x20;accessing&#x20;external&#x20;system&#x20;resources&#x20;such&#x20;as&#x20;files,&#x20;the&#x20;network,&#x20;environment&#x20;variables,&#x20;or&#x20;the&#x20;registry.','Assemblies&#x20;with&#x20;EXTERNAL_ACCESS&#x20;or&#x20;UNSAFE&#x20;permission&#x20;sets&#x20;can&#x20;be&#x20;used&#x20;to&#x20;access&#x20;sensitive&#x20;areas&#x20;of&#x20;the&#x20;operating&#x20;system,&#x20;steal&#x20;and/or&#x20;transmit&#x20;data&#x20;and&#x20;alter&#x20;the&#x20;state&#x20;and&#x20;other&#x20;protection&#x20;measures&#x20;of&#x20;the&#x20;underlying&#x20;Windows&#x20;Operating&#x20;System.&#x20;Assemblies&#x20;which&#x20;are&#x20;Microsoft-created&#x20;&#40;&#x20;is_user_defined&#x20;=&#x20;0&#x20;&#41;&#x20;are&#x20;excluded&#x20;from&#x20;this&#x20;check&#x20;as&#x20;they&#x20;are&#x20;required&#x20;for&#x20;overall&#x20;system&#x20;functionality.','','ALTER&#x20;ASSEMBLY&#x20;&lt;assembly_name&gt;&#x20;WITH&#x20;PERMISSION_SET&#x20;=&#x20;SAFE;','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(12500,'Ensure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','Enabling&#x20;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#x20;allows&#x20;users&#x20;to&#x20;query&#x20;data&#x20;and&#x20;execute&#x20;statements&#x20;on&#x20;external&#x20;data&#x20;sources.&#x20;This&#x20;functionality&#x20;should&#x20;be&#x20;disabled.','This&#x20;feature&#x20;can&#x20;be&#x20;used&#x20;to&#x20;remotely&#x20;access&#x20;and&#x20;exploit&#x20;vulnerabilities&#x20;on&#x20;remote&#x20;SQL&#x20;Server&#x20;instances&#x20;and&#x20;to&#x20;run&#x20;unsafe&#x20;Visual&#x20;Basic&#x20;for&#x20;Application&#x20;functions.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(12501,'Ensure&#x20;&#039;CLR&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;clr&#x20;enabled&#x20;option&#x20;specifies&#x20;whether&#x20;user&#x20;assemblies&#x20;can&#x20;be&#x20;run&#x20;by&#x20;SQL&#x20;Server.','Enabling&#x20;use&#x20;of&#x20;CLR&#x20;assemblies&#x20;widens&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;puts&#x20;it&#x20;at&#x20;risk&#x20;from&#x20;both&#x20;inadvertent&#x20;and&#x20;malicious&#x20;assemblies.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;clr&#x20;enabled&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"18.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(12502,'Ensure&#x20;&#039;Cross&#x20;DB&#x20;Ownership&#x20;Chaining&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;cross&#x20;db&#x20;ownership&#x20;chaining&#x20;option&#x20;controls&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;across&#x20;all&#x20;databases&#x20;at&#x20;the&#x20;instance&#x20;&#40;or&#x20;server&#41;&#x20;level.','When&#x20;enabled,&#x20;this&#x20;option&#x20;allows&#x20;a&#x20;member&#x20;of&#x20;the&#x20;db_owner&#x20;role&#x20;in&#x20;a&#x20;database&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;objects&#x20;owned&#x20;by&#x20;a&#x20;login&#x20;in&#x20;any&#x20;other&#x20;database,&#x20;causing&#x20;an&#x20;unnecessary&#x20;information&#x20;disclosure.&#x20;When&#x20;required,&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;for&#x20;the&#x20;specific&#x20;databases&#x20;requiring&#x20;it&#x20;instead&#x20;of&#x20;at&#x20;the&#x20;instance&#x20;level&#x20;for&#x20;all&#x20;databases&#x20;by&#x20;using&#x20;the&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;DB_CHAINING&#x20;ON&#x20;command.&#x20;This&#x20;database&#x20;option&#x20;may&#x20;not&#x20;be&#x20;changed&#x20;on&#x20;the&#x20;master&#x20;,&#x20;model&#x20;,&#x20;or&#x20;tempdb&#x20;system&#x20;databases.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;cross&#x20;db&#x20;ownership&#x20;chaining&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12503,'Ensure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;controls&#x20;the&#x20;ability&#x20;to&#x20;generate&#x20;and&#x20;transmit&#x20;email&#x20;messages&#x20;from&#x20;SQL&#x20;Server.','Disabling&#x20;the&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;reduces&#x20;the&#x20;SQL&#x20;Server&#x20;surface,&#x20;eliminates&#x20;a&#x20;DOS&#x20;attack&#x20;vector&#x20;and&#x20;channel&#x20;to&#x20;exfiltrate&#x20;data&#x20;from&#x20;the&#x20;database&#x20;server&#x20;to&#x20;a&#x20;remote&#x20;host.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12504,'Ensure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Ole&#x20;Automation&#x20;Procedures&#x20;option&#x20;controls&#x20;whether&#x20;OLE&#x20;Automation&#x20;objects&#x20;can&#x20;be&#x20;instantiated&#x20;within&#x20;Transact-SQL&#x20;batches.&#x20;These&#x20;are&#x20;extended&#x20;stored&#x20;procedures&#x20;that&#x20;allow&#x20;SQL&#x20;Server&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;external&#x20;to&#x20;SQL&#x20;Server.','Enabling&#x20;this&#x20;option&#x20;will&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;in&#x20;the&#x20;security&#x20;context&#x20;of&#x20;SQL&#x20;Server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12505,'Ensure&#x20;&#039;Remote&#x20;Access&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;access&#x20;option&#x20;controls&#x20;the&#x20;execution&#x20;of&#x20;local&#x20;stored&#x20;procedures&#x20;on&#x20;remote&#x20;servers&#x20;or&#x20;remote&#x20;stored&#x20;procedures&#x20;on&#x20;local&#x20;server.','Functionality&#x20;can&#x20;be&#x20;abused&#x20;to&#x20;launch&#x20;a&#x20;Denial-of-Service&#x20;&#40;DoS&#41;&#x20;attack&#x20;on&#x20;remote&#x20;servers&#x20;by&#x20;off-loading&#x20;query&#x20;processing&#x20;to&#x20;a&#x20;target.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;access&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12506,'Ensure&#x20;&#039;Remote&#x20;Admin&#x20;Connections&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;admin&#x20;connections&#x20;option&#x20;controls&#x20;whether&#x20;a&#x20;client&#x20;application&#x20;on&#x20;a&#x20;remote&#x20;computer&#x20;can&#x20;use&#x20;the&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;.','The&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;&#x20;lets&#x20;an&#x20;administrator&#x20;access&#x20;a&#x20;running&#x20;server&#x20;to&#x20;execute&#x20;diagnostic&#x20;functions&#x20;or&#x20;Transact-SQL&#x20;statements,&#x20;or&#x20;to&#x20;troubleshoot&#x20;problems&#x20;on&#x20;the&#x20;server,&#x20;even&#x20;when&#x20;the&#x20;server&#x20;is&#x20;locked&#x20;or&#x20;running&#x20;in&#x20;an&#x20;abnormal&#x20;state&#x20;and&#x20;not&#x20;responding&#x20;to&#x20;a&#x20;SQL&#x20;Server&#x20;Database&#x20;Engine&#x20;connection.&#x20;In&#x20;a&#x20;cluster&#x20;scenario,&#x20;the&#x20;administrator&#x20;may&#x20;not&#x20;actually&#x20;be&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;same&#x20;node&#x20;that&#x20;is&#x20;currently&#x20;hosting&#x20;the&#x20;SQL&#x20;Server&#x20;instance&#x20;and&#x20;thus&#x20;is&#x20;considered&#x20;&quot;remote&quot;.&#x20;Therefore,&#x20;this&#x20;setting&#x20;should&#x20;usually&#x20;be&#x20;enabled&#x20;&#40;&#x20;1&#x20;&#41;&#x20;for&#x20;SQL&#x20;Server&#x20;failover&#x20;clusters;&#x20;otherwise&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;&#40;&#x20;0&#x20;&#41;&#x20;which&#x20;is&#x20;the&#x20;default.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command&#x20;on&#x20;non-clustered&#x20;installations:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;admin&#x20;connections&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12507,'Ensure&#x20;&#039;Scan&#x20;For&#x20;Startup&#x20;Procs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;scan&#x20;for&#x20;startup&#x20;procs&#x20;option,&#x20;if&#x20;enabled,&#x20;causes&#x20;SQL&#x20;Server&#x20;to&#x20;scan&#x20;for&#x20;and&#x20;automatically&#x20;run&#x20;all&#x20;stored&#x20;procedures&#x20;that&#x20;are&#x20;set&#x20;to&#x20;execute&#x20;upon&#x20;service&#x20;startup.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;entity&#x20;leveraging&#x20;these&#x20;facilities&#x20;for&#x20;malicious&#x20;purposes.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;scan&#x20;for&#x20;startup&#x20;procs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.8\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12508,'Ensure&#x20;&#039;Trustworthy&#039;&#x20;Database&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Off&#039;','The&#x20;TRUSTWORTHY&#x20;database&#x20;option&#x20;allows&#x20;database&#x20;objects&#x20;to&#x20;access&#x20;objects&#x20;in&#x20;other&#x20;databases&#x20;under&#x20;certain&#x20;circumstances.','Provides&#x20;protection&#x20;from&#x20;malicious&#x20;CLR&#x20;assemblies&#x20;or&#x20;extended&#x20;procedures.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement&#x20;against&#x20;the&#x20;databases&#x20;&#40;replace&#x20;&lt;database_name&gt;&#x20;below&#41;&#x20;returned&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;[&lt;database_name&gt;]&#x20;SET&#x20;TRUSTWORTHY&#x20;OFF;','[{\"cis\": [\"2.9\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12509,'Ensure&#x20;SQL&#x20;Server&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;non-standard&#x20;ports','If&#x20;installed,&#x20;a&#x20;default&#x20;SQL&#x20;Server&#x20;instance&#x20;will&#x20;be&#x20;assigned&#x20;a&#x20;default&#x20;port&#x20;of&#x20;TCP:1433&#x20;for&#x20;TCP/IP&#x20;communication.&#x20;Administrators&#x20;can&#x20;also&#x20;configure&#x20;named&#x20;instances&#x20;to&#x20;use&#x20;TCP:1433&#x20;for&#x20;communication&#x20;TCP:1433&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;SQL&#x20;Server&#x20;port&#x20;and&#x20;this&#x20;port&#x20;assignment&#x20;should&#x20;be&#x20;changed.&#x20;In&#x20;a&#x20;multi-instance&#x20;scenario,&#x20;each&#x20;instance&#x20;must&#x20;be&#x20;assigned&#x20;its&#x20;own&#x20;dedicated&#x20;TCP/IP&#x20;port.','Using&#x20;a&#x20;non-default&#x20;port&#x20;helps&#x20;protect&#x20;the&#x20;database&#x20;from&#x20;attacks&#x20;directed&#x20;to&#x20;the&#x20;default&#x20;port.','','1:&#x20;In&#x20;SQL&#x20;Server&#x20;Configuration&#x20;Manager,&#x20;in&#x20;the&#x20;console&#x20;pane,&#x20;expand&#x20;SQL&#x20;Server&#x20;Network&#x20;Configuration,&#x20;expand&#x20;Protocols&#x20;for&#x20;&lt;InstanceName&gt;&#x20;,&#x20;and&#x20;then&#x20;double-click&#x20;the&#x20;TCP/IP&#x20;protocol.&#x20;2:&#x20;In&#x20;the&#x20;TCP/IP&#x20;Properties&#x20;dialog&#x20;box,&#x20;on&#x20;the&#x20;IP&#x20;Addresses&#x20;tab,&#x20;several&#x20;IP&#x20;addresses&#x20;appear&#x20;in&#x20;the&#x20;format&#x20;IP1&#x20;,&#x20;IP2&#x20;,&#x20;up&#x20;to&#x20;IPAll&#x20;.&#x20;One&#x20;of&#x20;these&#x20;is&#x20;for&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;loopback&#x20;adapter,&#x20;127.0.0.1&#x20;.&#x20;Additional&#x20;IP&#x20;addresses&#x20;appear&#x20;for&#x20;each&#x20;IP&#x20;Address&#x20;on&#x20;the&#x20;computer.&#x20;3:&#x20;Under&#x20;IPALL,&#x20;change&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;from&#x20;1433&#x20;to&#x20;a&#x20;non-standard&#x20;port&#x20;or&#x20;leave&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;empty&#x20;and&#x20;set&#x20;the&#x20;TCP&#x20;Dynamic&#x20;Ports&#x20;value&#x20;to&#x20;0&#x20;to&#x20;enable&#x20;dynamic&#x20;port&#x20;assignment&#x20;and&#x20;then&#x20;click&#x20;OK.&#x20;4:&#x20;In&#x20;the&#x20;console&#x20;pane,&#x20;click&#x20;SQL&#x20;Server&#x20;Services.&#x20;5:&#x20;In&#x20;the&#x20;details&#x20;pane,&#x20;right-click&#x20;SQL&#x20;Server&#x20;&#40;&lt;InstanceName&gt;&#41;&#x20;and&#x20;then&#x20;click&#x20;Restart,&#x20;to&#x20;stop&#x20;and&#x20;restart&#x20;SQL&#x20;Server.','[{\"cis\": [\"2.11\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12510,'Ensure&#x20;the&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;This&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;the&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;query:&#x20;USE&#x20;[master]&#x20;GO&#x20;DECLARE&#x20;@tsql&#x20;nvarchar&#40;max&#41;&#x20;SET&#x20;@tsql&#x20;=&#x20;&#039;ALTER&#x20;LOGIN&#x20;&#039;&#x20;+&#x20;SUSER_NAME&#40;0x01&#41;&#x20;+&#x20;&#039;&#x20;DISABLE&#039;&#x20;EXEC&#x20;&#40;@tsql&#41;&#x20;GO','[{\"cis\": [\"2.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12511,'Ensure&#x20;the&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;has&#x20;been&#x20;renamed','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;login&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;The&#x20;sa&#x20;login&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','It&#x20;is&#x20;more&#x20;difficult&#x20;to&#x20;launch&#x20;password-guessing&#x20;and&#x20;brute-force&#x20;attacks&#x20;against&#x20;the&#x20;sa&#x20;login&#x20;if&#x20;the&#x20;name&#x20;is&#x20;not&#x20;known.','','Replace&#x20;the&#x20;&lt;different_user&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;ALTER&#x20;LOGIN&#x20;sa&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_user&gt;;','[{\"cis\": [\"2.14\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12512,'Ensure&#x20;&#039;xp_cmdshell&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;xp_cmdshell&#x20;option&#x20;controls&#x20;whether&#x20;the&#x20;xp_cmdshell&#x20;extended&#x20;stored&#x20;procedure&#x20;can&#x20;be&#x20;used&#x20;by&#x20;an&#x20;authenticated&#x20;SQL&#x20;Server&#x20;user&#x20;to&#x20;execute&#x20;operating-system&#x20;command&#x20;shell&#x20;commands&#x20;and&#x20;return&#x20;results&#x20;as&#x20;rows&#x20;within&#x20;the&#x20;SQL&#x20;client.','The&#x20;xp_cmdshell&#x20;procedure&#x20;is&#x20;commonly&#x20;used&#x20;by&#x20;attackers&#x20;to&#x20;read&#x20;or&#x20;write&#x20;data&#x20;to/from&#x20;the&#x20;underlying&#x20;Operating&#x20;System&#x20;of&#x20;a&#x20;database&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;xp_cmdshell&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.15\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12513,'Ensure&#x20;&#039;AUTO_CLOSE&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;&#x20;on&#x20;contained&#x20;databases','AUTO_CLOSE&#x20;determines&#x20;if&#x20;a&#x20;given&#x20;database&#x20;is&#x20;closed&#x20;or&#x20;not&#x20;after&#x20;a&#x20;connection&#x20;terminates.&#x20;If&#x20;enabled,&#x20;subsequent&#x20;connections&#x20;to&#x20;the&#x20;given&#x20;database&#x20;will&#x20;require&#x20;the&#x20;database&#x20;to&#x20;be&#x20;reopened&#x20;and&#x20;relevant&#x20;procedure&#x20;caches&#x20;to&#x20;be&#x20;rebuilt.','Because&#x20;authentication&#x20;of&#x20;users&#x20;for&#x20;contained&#x20;databases&#x20;occurs&#x20;within&#x20;the&#x20;database&#x20;not&#x20;at&#x20;the&#x20;serverinstance&#x20;level,&#x20;the&#x20;database&#x20;must&#x20;be&#x20;opened&#x20;every&#x20;time&#x20;to&#x20;authenticate&#x20;a&#x20;user.&#x20;The&#x20;frequent&#x20;opening/closing&#x20;of&#x20;the&#x20;database&#x20;consumes&#x20;additional&#x20;server&#x20;resources&#x20;and&#x20;may&#x20;contribute&#x20;to&#x20;a&#x20;denial&#x20;of&#x20;service.','','Execute&#x20;the&#x20;following&#x20;T-SQL,&#x20;replacing&#x20;&lt;database_name&gt;&#x20;with&#x20;each&#x20;database&#x20;name&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;AUTO_CLOSE&#x20;OFF;','[{\"cis\": [\"2.16\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12514,'Ensure&#x20;no&#x20;login&#x20;exists&#x20;with&#x20;the&#x20;name&#x20;&#039;sa&#039;','The&#x20;sa&#x20;login&#x20;&#40;e.g.&#x20;principal&#41;&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account.&#x20;Therefore,&#x20;there&#x20;should&#x20;not&#x20;be&#x20;a&#x20;login&#x20;called&#x20;sa&#x20;even&#x20;when&#x20;the&#x20;original&#x20;sa&#x20;login&#x20;&#40;&#x20;principal_id&#x20;=&#x20;1&#x20;&#41;&#x20;has&#x20;been&#x20;renamed.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal&#x20;name.','','Execute&#x20;the&#x20;appropriate&#x20;ALTER&#x20;or&#x20;DROP&#x20;statement&#x20;below&#x20;based&#x20;on&#x20;the&#x20;principal_id&#x20;returned&#x20;for&#x20;the&#x20;login&#x20;named&#x20;sa&#x20;.&#x20;Replace&#x20;the&#x20;&lt;different_name&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;USE&#x20;[master]&#x20;GO&#x20;--&#x20;If&#x20;principal_id&#x20;=&#x20;1&#x20;or&#x20;the&#x20;login&#x20;owns&#x20;database&#x20;objects,&#x20;rename&#x20;the&#x20;sa&#x20;login&#x20;ALTER&#x20;LOGIN&#x20;[sa]&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_name&gt;;&#x20;GO&#x20;--&#x20;If&#x20;the&#x20;login&#x20;owns&#x20;no&#x20;database&#x20;objects,&#x20;then&#x20;drop&#x20;it&#x20;--&#x20;Do&#x20;NOT&#x20;drop&#x20;the&#x20;login&#x20;if&#x20;it&#x20;is&#x20;principal_id&#x20;=&#x20;1&#x20;DROP&#x20;LOGIN&#x20;sa','[{\"cis\": [\"2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12515,'Ensure&#x20;&#039;Server&#x20;Authentication&#039;&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Windows&#x20;Authentication&#x20;Mode&#039;','Uses&#x20;Windows&#x20;Authentication&#x20;to&#x20;validate&#x20;attempted&#x20;connections.','Windows&#x20;provides&#x20;a&#x20;more&#x20;robust&#x20;authentication&#x20;mechanism&#x20;than&#x20;SQL&#x20;Server&#x20;authentication.','','Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method:&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;the&#x20;Object&#x20;Explorer&#x20;tab&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;database&#x20;instance.&#x20;3.&#x20;Right&#x20;click&#x20;the&#x20;instance&#x20;name&#x20;and&#x20;select&#x20;Properties.&#x20;4.&#x20;Select&#x20;the&#x20;Security&#x20;page&#x20;from&#x20;the&#x20;left&#x20;menu.&#x20;5.&#x20;Set&#x20;the&#x20;Server&#x20;authentication&#x20;setting&#x20;to&#x20;Windows&#x20;Authentication&#x20;Mode.&#x20;or&#x20;T-SQL&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;in&#x20;a&#x20;Query&#x20;Window:&#x20;USE&#x20;[master]&#x20;GO&#x20;EXEC&#x20;xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;LoginMode&#039;,&#x20;REG_DWORD,&#x20;1&#x20;GO&#x20;Restart&#x20;the&#x20;SQL&#x20;Server&#x20;service&#x20;for&#x20;the&#x20;change&#x20;to&#x20;take&#x20;effect.','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(12516,'Ensure&#x20;only&#x20;the&#x20;default&#x20;permissions&#x20;specified&#x20;by&#x20;Microsoft&#x20;are&#x20;granted&#x20;to&#x20;the&#x20;public&#x20;server&#x20;role','public&#x20;is&#x20;a&#x20;special&#x20;fixed&#x20;server&#x20;role&#x20;containing&#x20;all&#x20;logins.&#x20;Unlike&#x20;other&#x20;fixed&#x20;server&#x20;roles,&#x20;permissions&#x20;can&#x20;be&#x20;changed&#x20;for&#x20;the&#x20;public&#x20;role.&#x20;In&#x20;keeping&#x20;with&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privileges,&#x20;the&#x20;public&#x20;server&#x20;role&#x20;should&#x20;not&#x20;be&#x20;used&#x20;to&#x20;grant&#x20;permissions&#x20;at&#x20;the&#x20;server&#x20;scope&#x20;as&#x20;these&#x20;would&#x20;be&#x20;inherited&#x20;by&#x20;all&#x20;users.','Every&#x20;SQL&#x20;Server&#x20;login&#x20;belongs&#x20;to&#x20;the&#x20;public&#x20;role&#x20;and&#x20;cannot&#x20;be&#x20;removed&#x20;from&#x20;this&#x20;role.&#x20;Therefore,&#x20;any&#x20;permissions&#x20;granted&#x20;to&#x20;this&#x20;role&#x20;will&#x20;be&#x20;available&#x20;to&#x20;all&#x20;logins&#x20;unless&#x20;they&#x20;have&#x20;been&#x20;explicitly&#x20;denied&#x20;to&#x20;specific&#x20;logins&#x20;or&#x20;user-defined&#x20;server&#x20;roles.','','Add&#x20;the&#x20;extraneous&#x20;permissions&#x20;found&#x20;in&#x20;the&#x20;Audit&#x20;query&#x20;results&#x20;to&#x20;the&#x20;specific&#x20;logins&#x20;to&#x20;user-defined&#x20;server&#x20;roles&#x20;which&#x20;require&#x20;the&#x20;access.&#x20;Revoke&#x20;the&#x20;_&lt;permission_name&gt;_&#x20;from&#x20;the&#x20;public&#x20;role&#x20;as&#x20;shown&#x20;below&#x20;USE&#x20;[master]&#x20;GO&#x20;REVOKE&#x20;&lt;permission_name&gt;&#x20;FROM&#x20;public;&#x20;GO','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(12517,'Ensure&#x20;Windows&#x20;local&#x20;groups&#x20;are&#x20;not&#x20;SQL&#x20;Logins','Local&#x20;Windows&#x20;groups&#x20;should&#x20;not&#x20;be&#x20;used&#x20;as&#x20;logins&#x20;for&#x20;SQL&#x20;Server&#x20;instances.','Allowing&#x20;local&#x20;Windows&#x20;groups&#x20;as&#x20;SQL&#x20;Logins&#x20;provides&#x20;a&#x20;loophole&#x20;whereby&#x20;anyone&#x20;with&#x20;OS&#x20;level&#x20;administrator&#x20;rights&#x20;&#40;and&#x20;no&#x20;SQL&#x20;Server&#x20;rights&#41;&#x20;could&#x20;add&#x20;users&#x20;to&#x20;the&#x20;local&#x20;Windows&#x20;groups&#x20;and&#x20;thereby&#x20;give&#x20;themselves&#x20;or&#x20;others&#x20;access&#x20;to&#x20;the&#x20;SQL&#x20;Server&#x20;instance.','','1.&#x20;For&#x20;each&#x20;LocalGroupName&#x20;login,&#x20;if&#x20;needed&#x20;create&#x20;an&#x20;equivalent&#x20;AD&#x20;group&#x20;containing&#x20;only&#x20;the&#x20;required&#x20;user&#x20;accounts.&#x20;2.&#x20;Add&#x20;the&#x20;AD&#x20;group&#x20;or&#x20;individual&#x20;Windows&#x20;accounts&#x20;as&#x20;a&#x20;SQL&#x20;Server&#x20;login&#x20;and&#x20;grant&#x20;it&#x20;the&#x20;permissions&#x20;required.&#x20;3.&#x20;Drop&#x20;the&#x20;LocalGroupName&#x20;login&#x20;using&#x20;the&#x20;syntax&#x20;below&#x20;after&#x20;replacing&#x20;&lt;name&gt;&#x20;.&#x20;USE&#x20;[master]&#x20;GO&#x20;DROP&#x20;LOGIN&#x20;[&lt;name&gt;]&#x20;GO','[{\"cis\": [\"3.10\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}]'),(12518,'Ensure&#x20;&#039;CHECK_EXPIRATION&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins&#x20;Within&#x20;the&#x20;Sysadmin&#x20;Role','Applies&#x20;the&#x20;same&#x20;password&#x20;expiration&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;inside&#x20;SQL&#x20;Server.','Ensuring&#x20;SQL&#x20;logins&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;will&#x20;ensure&#x20;the&#x20;passwords&#x20;for&#x20;SQL&#x20;logins&#x20;with&#x20;sysadmin&#x20;privileges&#x20;are&#x20;changed&#x20;on&#x20;a&#x20;frequent&#x20;basis&#x20;to&#x20;help&#x20;prevent&#x20;compromise&#x20;via&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;CONTROL&#x20;SERVER&#x20;is&#x20;an&#x20;equivalent&#x20;permission&#x20;to&#x20;sysadmin&#x20;and&#x20;logins&#x20;with&#x20;that&#x20;permission&#x20;should&#x20;also&#x20;be&#x20;required&#x20;to&#x20;have&#x20;expiring&#x20;passwords.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_EXPIRATION&#x20;=&#x20;ON;','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"16.2, 16.10\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(12519,'Ensure&#x20;&#039;CHECK_POLICY&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins','Applies&#x20;the&#x20;same&#x20;password&#x20;complexity&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;insideSQL&#x20;Server.','Ensure&#x20;SQL&#x20;authenticated&#x20;login&#x20;passwords&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;so&#x20;that&#x20;they&#x20;cannot&#x20;be&#x20;easily&#x20;compromised&#x20;via&#x20;brute&#x20;force&#x20;attack.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_POLICY&#x20;=&#x20;ON;&#x20;Note:&#x20;In&#x20;the&#x20;case&#x20;of&#x20;AWS&#x20;RDS&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;remediation&#x20;for&#x20;the&#x20;Master&#x20;account.','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"16, 4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(12520,'Ensure&#x20;&#039;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;&#039;12&#039;','SQL&#x20;Server&#x20;error&#x20;log&#x20;files&#x20;must&#x20;be&#x20;protected&#x20;from&#x20;loss.&#x20;The&#x20;log&#x20;files&#x20;must&#x20;be&#x20;backed&#x20;up&#x20;before&#x20;they&#x20;are&#x20;overwritten.&#x20;Retaining&#x20;more&#x20;error&#x20;logs&#x20;helps&#x20;prevent&#x20;loss&#x20;from&#x20;frequent&#x20;recycling&#x20;before&#x20;backups&#x20;can&#x20;occur.','The&#x20;SQL&#x20;Server&#x20;error&#x20;log&#x20;contains&#x20;important&#x20;information&#x20;about&#x20;major&#x20;server&#x20;events&#x20;and&#x20;login&#x20;attempt&#x20;information&#x20;as&#x20;well.','','Adjust&#x20;the&#x20;number&#x20;of&#x20;logs&#x20;to&#x20;prevent&#x20;data&#x20;loss.&#x20;The&#x20;default&#x20;value&#x20;of&#x20;6&#x20;may&#x20;be&#x20;insufficient&#x20;for&#x20;a&#x20;production&#x20;environment.&#x20;Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;Object&#x20;Explorer&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;instance.&#x20;3.&#x20;Navigate&#x20;to&#x20;the&#x20;Management&#x20;tab&#x20;in&#x20;Object&#x20;Explorer&#x20;and&#x20;expand.&#x20;Right&#x20;click&#x20;on&#x20;the&#x20;SQL&#x20;Server&#x20;Logs&#x20;file&#x20;and&#x20;select&#x20;Configure&#x20;4.&#x20;Check&#x20;the&#x20;Limit&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;before&#x20;they&#x20;are&#x20;recycled&#x20;5.&#x20;Set&#x20;the&#x20;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;12&#x20;T-SQL&#x20;Method&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;to&#x20;change&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files,&#x20;replace&#x20;&lt;NumberAbove12&gt;&#x20;with&#x20;your&#x20;desired&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files:&#x20;EXEC&#x20;master.sys.xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;NumErrorLogs&#039;,&#x20;REG_DWORD,&#x20;&lt;NumberAbove12&gt;;','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(12521,'Ensure&#x20;&#039;Default&#x20;Trace&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#039;','The&#x20;default&#x20;trace&#x20;provides&#x20;audit&#x20;logging&#x20;of&#x20;database&#x20;activity&#x20;including&#x20;account&#x20;creations,&#x20;privilege&#x20;elevation&#x20;and&#x20;execution&#x20;of&#x20;DBCC&#x20;commands.','Default&#x20;trace&#x20;provides&#x20;valuable&#x20;audit&#x20;information&#x20;regarding&#x20;security-related&#x20;activities&#x20;on&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;default&#x20;trace&#x20;enabled&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(12522,'Ensure&#x20;&#039;CLR&#x20;Assembly&#x20;Permission&#x20;Set&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;SAFE_ACCESS&#039;&#x20;for&#x20;All&#x20;CLR&#x20;Assemblies','Setting&#x20;CLR&#x20;Assembly&#x20;Permission&#x20;Sets&#x20;to&#x20;SAFE_ACCESS&#x20;will&#x20;prevent&#x20;assemblies&#x20;from&#x20;accessing&#x20;external&#x20;system&#x20;resources&#x20;such&#x20;as&#x20;files,&#x20;the&#x20;network,&#x20;environment&#x20;variables,&#x20;or&#x20;the&#x20;registry.','Assemblies&#x20;with&#x20;EXTERNAL_ACCESS&#x20;or&#x20;UNSAFE&#x20;permission&#x20;sets&#x20;can&#x20;be&#x20;used&#x20;to&#x20;access&#x20;sensitive&#x20;areas&#x20;of&#x20;the&#x20;operating&#x20;system,&#x20;steal&#x20;and/or&#x20;transmit&#x20;data&#x20;and&#x20;alter&#x20;the&#x20;state&#x20;and&#x20;other&#x20;protection&#x20;measures&#x20;of&#x20;the&#x20;underlying&#x20;Windows&#x20;Operating&#x20;System.&#x20;Assemblies&#x20;which&#x20;are&#x20;Microsoft-created&#x20;&#40;&#x20;is_user_defined&#x20;=&#x20;0&#x20;&#41;&#x20;are&#x20;excluded&#x20;from&#x20;this&#x20;check&#x20;as&#x20;they&#x20;are&#x20;required&#x20;for&#x20;overall&#x20;system&#x20;functionality.','','ALTER&#x20;ASSEMBLY&#x20;&lt;assembly_name&gt;&#x20;WITH&#x20;PERMISSION_SET&#x20;=&#x20;SAFE;','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(13000,'Ensure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','Enabling&#x20;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#x20;allows&#x20;users&#x20;to&#x20;query&#x20;data&#x20;and&#x20;execute&#x20;statements&#x20;on&#x20;external&#x20;data&#x20;sources.&#x20;This&#x20;functionality&#x20;should&#x20;be&#x20;disabled.&#x0a;','This&#x20;feature&#x20;can&#x20;be&#x20;used&#x20;to&#x20;remotely&#x20;access&#x20;and&#x20;exploit&#x20;vulnerabilities&#x20;on&#x20;remote&#x20;SQL&#x20;Server&#x20;instances&#x20;and&#x20;to&#x20;run&#x20;unsafe&#x20;Visual&#x20;Basic&#x20;for&#x20;Application&#x20;functions.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"2.1\"]}, {\"cis_csc\": [\"9.1\"]}]'),(13001,'Ensure&#x20;&#039;CLR&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;clr&#x20;enabled&#x20;option&#x20;specifies&#x20;whether&#x20;user&#x20;assemblies&#x20;can&#x20;be&#x20;run&#x20;by&#x20;SQL&#x20;Server.','Enabling&#x20;use&#x20;of&#x20;CLR&#x20;assemblies&#x20;widens&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;puts&#x20;it&#x20;at&#x20;risk&#x20;from&#x20;both&#x20;inadvertent&#x20;and&#x20;malicious&#x20;assemblies.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;clr&#x20;enabled&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"18.9\"]}]'),(13002,'Ensure&#x20;&#039;Cross&#x20;DB&#x20;Ownership&#x20;Chaining&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;cross&#x20;db&#x20;ownership&#x20;chaining&#x20;option&#x20;controls&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;across&#x20;all&#x20;databases&#x20;at&#x20;the&#x20;instance&#x20;&#40;or&#x20;server&#41;&#x20;level.&#x0a;','When&#x20;enabled,&#x20;this&#x20;option&#x20;allows&#x20;a&#x20;member&#x20;of&#x20;the&#x20;db_owner&#x20;role&#x20;in&#x20;a&#x20;database&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;objects&#x20;owned&#x20;by&#x20;a&#x20;login&#x20;in&#x20;any&#x20;other&#x20;database,&#x20;causing&#x20;an&#x20;unnecessary&#x20;information&#x20;disclosure.&#x20;When&#x20;required,&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;for&#x20;the&#x20;specific&#x20;databases&#x20;requiring&#x20;it&#x20;instead&#x20;of&#x20;at&#x20;the&#x20;instance&#x20;level&#x20;for&#x20;all&#x20;databases&#x20;by&#x20;using&#x20;the&#x20;ALTER&#x20;DATABASE&lt;database_name&gt;SET&#x20;DB_CHAINING&#x20;ON&#x20;command.&#x20;This&#x20;database&#x20;option&#x20;may&#x20;not&#x20;be&#x20;changed&#x20;on&#x20;the&#x20;master,&#x20;model,&#x20;or&#x20;tempdb&#x20;system&#x20;databases.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;cross&#x20;db&#x20;ownership&#x20;chaining&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"14.4\"]}]'),(13003,'Ensure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;controls&#x20;the&#x20;ability&#x20;to&#x20;generate&#x20;and&#x20;transmit&#x20;email&#x20;messages&#x20;from&#x20;SQL&#x20;Server.&#x0a;','Disabling&#x20;the&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;reduces&#x20;the&#x20;SQL&#x20;Server&#x20;surface,&#x20;eliminates&#x20;a&#x20;DOS&#x20;attack&#x20;vector&#x20;and&#x20;channel&#x20;to&#x20;exfiltrate&#x20;data&#x20;from&#x20;the&#x20;database&#x20;server&#x20;to&#x20;a&#x20;remote&#x20;host.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"18\"]}]'),(13004,'Ensure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Ole&#x20;Automation&#x20;Procedures&#x20;option&#x20;controls&#x20;whether&#x20;OLE&#x20;Automation&#x20;objects&#x20;can&#x20;be&#x20;instantiated&#x20;within&#x20;Transact-SQL&#x20;batches.&#x20;These&#x20;are&#x20;extended&#x20;stored&#x20;procedures&#x20;that&#x20;allow&#x20;SQL&#x20;Server&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;external&#x20;to&#x20;SQL&#x20;Server.&#x0a;','Enabling&#x20;this&#x20;option&#x20;will&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;in&#x20;the&#x20;security&#x20;context&#x20;of&#x20;SQL&#x20;Server.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"18\"]}]'),(13005,'Ensure&#x20;&#039;Remote&#x20;Access&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;access&#x20;option&#x20;controls&#x20;the&#x20;execution&#x20;of&#x20;local&#x20;stored&#x20;procedures&#x20;on&#x20;remote&#x20;servers&#x20;or&#x20;remote&#x20;stored&#x20;procedures&#x20;on&#x20;local&#x20;server.&#x0a;','Functionality&#x20;can&#x20;be&#x20;abused&#x20;to&#x20;launch&#x20;a&#x20;Denial-of-Service&#x20;&#40;DoS&#41;&#x20;attack&#x20;on&#x20;remote&#x20;servers&#x20;by&#x20;off-loading&#x20;query&#x20;processing&#x20;to&#x20;a&#x20;target.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;access&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"2.6\"]}, {\"cis_csc\": [\"9.1\"]}]'),(13006,'Ensure&#x20;&#039;Remote&#x20;Admin&#x20;Connections&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;admin&#x20;connections&#x20;option&#x20;controls&#x20;whether&#x20;a&#x20;client&#x20;application&#x20;on&#x20;a&#x20;remote&#x20;computer&#x20;can&#x20;use&#x20;the&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;.&#x0a;','The&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;&#x20;lets&#x20;an&#x20;administrator&#x20;access&#x20;a&#x20;running&#x20;server&#x20;to&#x20;execute&#x20;diagnostic&#x20;functions&#x20;or&#x20;Transact-SQL&#x20;statements,&#x20;or&#x20;to&#x20;troubleshoot&#x20;problems&#x20;on&#x20;the&#x20;server,&#x20;even&#x20;when&#x20;the&#x20;server&#x20;is&#x20;locked&#x20;or&#x20;running&#x20;in&#x20;an&#x20;abnormal&#x20;state&#x20;and&#x20;not&#x20;responding&#x20;to&#x20;a&#x20;SQL&#x20;Server&#x20;Database&#x20;Engine&#x20;connection.&#x20;In&#x20;a&#x20;cluster&#x20;scenario,&#x20;the&#x20;administrator&#x20;may&#x20;not&#x20;actually&#x20;be&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;same&#x20;node&#x20;that&#x20;is&#x20;currently&#x20;hosting&#x20;the&#x20;SQL&#x20;Server&#x20;instance&#x20;and&#x20;thus&#x20;is&#x20;considered&#x20;&quot;remote&quot;.&#x20;Therefore,&#x20;this&#x20;setting&#x20;should&#x20;usually&#x20;be&#x20;enabled&#x20;&#40;1&#41;&#x20;for&#x20;SQL&#x20;Server&#x20;failover&#x20;clusters;&#x20;otherwise,&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;&#40;0&#41;&#x20;which&#x20;is&#x20;the&#x20;default.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command&#x20;on&#x20;non-clustered&#x20;installations:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;admin&#x20;connections&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;','[{\"cis\": [\"2.7\"]}, {\"cis_csc\": [\"9.1\"]}]'),(13007,'Ensure&#x20;&#039;Scan&#x20;For&#x20;Startup&#x20;Procs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;scan&#x20;for&#x20;startup&#x20;procs&#x20;option,&#x20;if&#x20;enabled,&#x20;causes&#x20;SQL&#x20;Server&#x20;to&#x20;scan&#x20;for&#x20;and&#x20;automatically&#x20;run&#x20;all&#x20;stored&#x20;procedures&#x20;that&#x20;are&#x20;set&#x20;to&#x20;execute&#x20;upon&#x20;service&#x20;startup.&#x0a;','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;entity&#x20;leveraging&#x20;these&#x20;facilities&#x20;for&#x20;malicious&#x20;purposes.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;scan&#x20;for&#x20;startup&#x20;procs&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x0a;Restart&#x20;the&#x20;Database&#x20;Engine.&#x0a;','[{\"cis\": [\"2.8\"]}, {\"cis_csc\": [\"18\"]}]'),(13008,'Ensure&#x20;&#039;Trustworthy&#039;&#x20;Database&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Off&#039;','The&#x20;TRUSTWORTHY&#x20;database&#x20;option&#x20;allows&#x20;database&#x20;objects&#x20;to&#x20;access&#x20;objects&#x20;in&#x20;other&#x20;databases&#x20;under&#x20;certain&#x20;circumstances.&#x0a;','Provides&#x20;protection&#x20;from&#x20;malicious&#x20;CLR&#x20;assemblies&#x20;or&#x20;extended&#x20;procedures.&#x0a;','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement&#x20;against&#x20;the&#x20;databases&#x20;&#40;replace&#x20;&lt;database_name&gt;&#x20;below&#41;&#x20;returned&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x0a;&#x20;&#x20;ALTER&#x20;DATABASE&#x20;[&lt;database_name&gt;]&#x20;SET&#x20;TRUSTWORTHY&#x20;OFF;&#x0a;','[{\"cis\": [\"2.9\"]}, {\"cis_csc\": [\"14.4\"]}]'),(13009,'Ensure&#x20;SQL&#x20;Server&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;non-standard&#x20;ports','If&#x20;installed,&#x20;a&#x20;default&#x20;SQL&#x20;Server&#x20;instance&#x20;will&#x20;be&#x20;assigned&#x20;a&#x20;default&#x20;port&#x20;of&#x20;TCP:1433&#x20;for&#x20;TCP/IP&#x20;communication.&#x20;Administrators&#x20;can&#x20;also&#x20;manually&#x20;configure&#x20;named&#x20;instances&#x20;to&#x20;use&#x20;TCP:1433&#x20;for&#x20;communication.&#x20;TCP:1433&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;SQL&#x20;Server&#x20;port&#x20;and&#x20;this&#x20;port&#x20;assignment&#x20;should&#x20;be&#x20;changed.&#x20;In&#x20;a&#x20;multi-instance&#x20;scenario,&#x20;each&#x20;instance&#x20;must&#x20;be&#x20;assigned&#x20;its&#x20;own&#x20;dedicated&#x20;TCP/IP&#x20;port.&#x0a;','Using&#x20;a&#x20;non-default&#x20;port&#x20;helps&#x20;protect&#x20;the&#x20;database&#x20;from&#x20;attacks&#x20;directed&#x20;to&#x20;the&#x20;default&#x20;port.&#x0a;','','1.&#x20;In&#x20;SQL&#x20;Server&#x20;Configuration&#x20;Manager,&#x20;in&#x20;the&#x20;console&#x20;pane,&#x20;expand&#x20;SQL&#x20;Server&#x20;Network&#x20;Configuration,&#x20;expand&#x20;Protocols&#x20;for&#x20;&lt;InstanceName&gt;,&#x20;and&#x20;then&#x20;doubleclick&#x20;the&#x20;TCP/IP&#x20;protocol&#x20;2.&#x20;In&#x20;the&#x20;TCP/IP&#x20;Properties&#x20;dialog&#x20;box,&#x20;on&#x20;the&#x20;IP&#x20;Addresses&#x20;tab,&#x20;several&#x20;IP&#x20;addresses&#x20;appear&#x20;in&#x20;the&#x20;format&#x20;IP1,&#x20;IP2,&#x20;up&#x20;to&#x20;IPAll.&#x20;One&#x20;of&#x20;these&#x20;is&#x20;for&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;loopback&#x20;adapter,&#x20;127.0.0.1.&#x20;Additional&#x20;IP&#x20;addresses&#x20;appear&#x20;for&#x20;each&#x20;IP&#x20;Address&#x20;on&#x20;the&#x20;computer.&#x20;3.&#x20;Under&#x20;IPAll,&#x20;change&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;from&#x20;1433&#x20;to&#x20;a&#x20;non-standard&#x20;port&#x20;or&#x20;leave&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;empty&#x20;and&#x20;set&#x20;the&#x20;TCP&#x20;Dynamic&#x20;Ports&#x20;value&#x20;to&#x20;0&#x20;to&#x20;enable&#x20;dynamic&#x20;port&#x20;assignment&#x20;and&#x20;then&#x20;click&#x20;OK.&#x20;4.&#x20;In&#x20;the&#x20;console&#x20;pane,&#x20;click&#x20;SQL&#x20;Server&#x20;Services.&#x20;5.&#x20;In&#x20;the&#x20;details&#x20;pane,&#x20;right-click&#x20;SQL&#x20;Server&#x20;&#40;&lt;InstanceName&gt;&#41;&#x20;and&#x20;then&#x20;click&#x20;Restart,&#x20;to&#x20;stop&#x20;and&#x20;restart&#x20;SQL&#x20;Server.&#x0a;','[{\"cis\": [\"2.11\"]}, {\"cis_csc\": [\"9\"]}]'),(13010,'Ensure&#x20;the&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;This&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;the&#x20;principal_id=1&#x20;and&#x20;sid=0x01.&#x0a;','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal.&#x0a;','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;query:&#x0a;&#x20;&#x20;USE&#x20;[master]&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;DECLARE&#x20;@tsql&#x20;nvarchar&#40;max&#41;&#x0a;&#x20;&#x20;SET&#x20;@tsql&#x20;=&#x20;&#039;ALTER&#x20;LOGIN&#x20;&#039;&#x20;+&#x20;SUSER_NAME&#40;0x01&#41;&#x20;+&#x20;&#039;&#x20;DISABLE&#039;&#x0a;&#x20;&#x20;EXEC&#x20;&#40;@tsql&#41;&#x0a;&#x20;&#x20;GO&#x0a;','[{\"cis\": [\"2.13\"]}, {\"cis_csc\": [\"5.1\"]}]'),(13011,'Ensure&#x20;the&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;has&#x20;been&#x20;renamed','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;login&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;The&#x20;sa&#x20;login&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;principal_id=1&#x20;and&#x20;sid=0x01.&#x0a;','It&#x20;is&#x20;more&#x20;difficult&#x20;to&#x20;launch&#x20;password-guessing&#x20;and&#x20;brute-force&#x20;attacks&#x20;against&#x20;the&#x20;sa&#x20;login&#x20;if&#x20;the&#x20;name&#x20;is&#x20;not&#x20;known.&#x0a;','','Replace&#x20;the&#x20;&lt;different_user&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x0a;&#x20;&#x20;ALTER&#x20;LOGIN&#x20;sa&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_user&gt;;&#x0a;','[{\"cis\": [\"2.14\"]}, {\"cis_csc\": [\"5\"]}]'),(13012,'Ensure&#x20;&#039;xp_cmdshell&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;xp_cmdshell&#x20;option&#x20;controls&#x20;whether&#x20;the&#x20;xp_cmdshell&#x20;extended&#x20;stored&#x20;procedure&#x20;can&#x20;be&#x20;used&#x20;by&#x20;an&#x20;authenticated&#x20;SQL&#x20;Server&#x20;user&#x20;to&#x20;execute&#x20;operating-system&#x20;command&#x20;shell&#x20;commands&#x20;and&#x20;return&#x20;results&#x20;as&#x20;rows&#x20;within&#x20;the&#x20;SQL&#x20;client.&#x0a;','The&#x20;xp_cmdshell&#x20;procedure&#x20;is&#x20;commonly&#x20;used&#x20;by&#x20;attackers&#x20;to&#x20;read&#x20;or&#x20;write&#x20;data&#x20;to/from&#x20;the&#x20;underlying&#x20;Operating&#x20;System&#x20;of&#x20;a&#x20;database&#x20;server.&#x0a;','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;xp_cmdshell&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"2.15\"]}, {\"cis_csc\": [\"18\"]}]'),(13013,'Ensure&#x20;&#039;AUTO_CLOSE&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;&#x20;on&#x20;contained&#x20;databases','AUTO_CLOSE&#x20;determines&#x20;if&#x20;a&#x20;given&#x20;database&#x20;is&#x20;closed&#x20;or&#x20;not&#x20;after&#x20;a&#x20;connection&#x20;terminates.&#x20;If&#x20;enabled,&#x20;subsequent&#x20;connections&#x20;to&#x20;the&#x20;given&#x20;database&#x20;will&#x20;require&#x20;the&#x20;database&#x20;to&#x20;be&#x20;reopened&#x20;and&#x20;relevant&#x20;procedure&#x20;caches&#x20;to&#x20;be&#x20;rebuilt.&#x0a;','Because&#x20;authentication&#x20;of&#x20;users&#x20;for&#x20;contained&#x20;databases&#x20;occurs&#x20;within&#x20;the&#x20;database&#x20;not&#x20;at&#x20;the&#x20;serverinstance&#x20;level,&#x20;the&#x20;database&#x20;must&#x20;be&#x20;opened&#x20;every&#x20;time&#x20;to&#x20;authenticate&#x20;a&#x20;user.&#x20;The&#x20;frequent&#x20;opening/closing&#x20;of&#x20;the&#x20;database&#x20;consumes&#x20;additional&#x20;server&#x20;resources&#x20;and&#x20;may&#x20;contribute&#x20;to&#x20;a&#x20;denial&#x20;of&#x20;service.&#x0a;','','Execute&#x20;the&#x20;following&#x20;T-SQL,&#x20;replacing&#x20;&lt;database_name&gt;&#x20;with&#x20;each&#x20;database&#x20;name&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x0a;&#x20;&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;AUTO_CLOSE&#x20;OFF;&#x0a;','[{\"cis\": [\"2.16\"]}, {\"cis_csc\": [\"18\"]}]'),(13014,'Ensure&#x20;no&#x20;login&#x20;exists&#x20;with&#x20;the&#x20;name&#x20;&#039;sa&#039;','The&#x20;sa&#x20;login&#x20;&#40;e.g.&#x20;principal&#41;&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account.&#x20;Therefore,&#x20;there&#x20;should&#x20;not&#x20;be&#x20;a&#x20;login&#x20;called&#x20;sa&#x20;even&#x20;when&#x20;the&#x20;original&#x20;sa&#x20;login&#x20;&#40;principal_id&#x20;=&#x20;1&#41;&#x20;has&#x20;been&#x20;renamed.&#x0a;','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal&#x20;name.&#x0a;','','Execute&#x20;the&#x20;appropriate&#x20;ALTER&#x20;or&#x20;DROP&#x20;statement&#x20;below&#x20;based&#x20;on&#x20;the&#x20;principal_id&#x20;returned&#x20;for&#x20;the&#x20;login&#x20;named&#x20;sa.&#x20;Replace&#x20;the&#x20;&lt;different_name&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x0a;&#x20;&#x20;USE&#x20;[master]&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;--&#x20;If&#x20;principal_id&#x20;=&#x20;1&#x20;or&#x20;the&#x20;login&#x20;owns&#x20;database&#x20;objects,&#x20;rename&#x20;the&#x20;sa&#x0a;&#x20;&#x20;login&#x0a;&#x20;&#x20;ALTER&#x20;LOGIN&#x20;[sa]&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_name&gt;;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;--&#x20;If&#x20;the&#x20;login&#x20;owns&#x20;no&#x20;database&#x20;objects,&#x20;then&#x20;drop&#x20;it&#x0a;&#x20;&#x20;--&#x20;Do&#x20;NOT&#x20;drop&#x20;the&#x20;login&#x20;if&#x20;it&#x20;is&#x20;principal_id&#x20;=&#x20;1&#x0a;&#x20;&#x20;DROP&#x20;LOGIN&#x20;sa&#x0a;','[{\"cis\": [\"2.17\"]}, {\"cis_csc\": [\"5.1\"]}]'),(13015,'Ensure&#x20;&#039;Server&#x20;Authentication&#039;&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Windows&#x20;Authentication&#x20;Mode&#039;','Uses&#x20;Windows&#x20;Authentication&#x20;to&#x20;validate&#x20;attempted&#x20;connections.','Windows&#x20;provides&#x20;a&#x20;more&#x20;robust&#x20;authentication&#x20;mechanism&#x20;than&#x20;SQL&#x20;Server&#x20;authentication.','','Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;1.1.1.5&#x20;GUI&#x20;Method&#x0a;&#x20;&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x0a;&#x20;&#x20;2.&#x20;Open&#x20;the&#x20;Object&#x20;Explorer&#x20;tab&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;database&#x20;instance.&#x0a;&#x20;&#x20;3.&#x20;Right&#x20;click&#x20;the&#x20;instance&#x20;name&#x20;and&#x20;select&#x20;Properties.&#x0a;&#x20;&#x20;4.&#x20;Select&#x20;the&#x20;Security&#x20;page&#x20;from&#x20;the&#x20;left&#x20;menu.&#x0a;&#x20;&#x20;5.&#x20;Set&#x20;the&#x20;Server&#x20;authentication&#x20;setting&#x20;to&#x20;Windows&#x20;Authentication&#x20;Mode.&#x0a;&#x0a;1.1.1.6&#x20;T-SQL&#x20;Method&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;in&#x20;a&#x20;Query&#x20;Window:&#x0a;&#x20;&#x20;USE&#x20;[master]&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXEC&#x20;xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x0a;&#x20;&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;LoginMode&#039;,&#x20;REG_DWORD,&#x20;1&#x0a;&#x20;&#x20;GO&#x0a;&#x0a;Restart&#x20;the&#x20;SQL&#x20;Server&#x20;service&#x20;for&#x20;the&#x20;change&#x20;to&#x20;take&#x20;effect.&#x0a;','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"16.9\"]}]'),(13016,'Ensure&#x20;only&#x20;the&#x20;default&#x20;permissions&#x20;specified&#x20;by&#x20;Microsoft&#x20;are&#x20;granted&#x20;to&#x20;the&#x20;public&#x20;server&#x20;role','public&#x20;is&#x20;a&#x20;special&#x20;fixed&#x20;server&#x20;role&#x20;containing&#x20;all&#x20;logins.&#x20;Unlike&#x20;other&#x20;fixed&#x20;server&#x20;roles,&#x20;permissions&#x20;can&#x20;be&#x20;changed&#x20;for&#x20;the&#x20;public&#x20;role.&#x20;In&#x20;keeping&#x20;with&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privileges,&#x20;the&#x20;public&#x20;server&#x20;role&#x20;should&#x20;not&#x20;be&#x20;used&#x20;to&#x20;grant&#x20;permissions&#x20;at&#x20;the&#x20;server&#x20;scope&#x20;as&#x20;these&#x20;would&#x20;be&#x20;inherited&#x20;by&#x20;all&#x20;users.&#x0a;','Every&#x20;SQL&#x20;Server&#x20;login&#x20;belongs&#x20;to&#x20;the&#x20;public&#x20;role&#x20;and&#x20;cannot&#x20;be&#x20;removed&#x20;from&#x20;this&#x20;role.&#x20;Therefore,&#x20;any&#x20;permissions&#x20;granted&#x20;to&#x20;this&#x20;role&#x20;will&#x20;be&#x20;available&#x20;to&#x20;all&#x20;logins&#x20;unless&#x20;they&#x20;have&#x20;been&#x20;explicitly&#x20;denied&#x20;to&#x20;specific&#x20;logins&#x20;or&#x20;user-defined&#x20;server&#x20;roles.&#x0a;','','1.&#x20;Add&#x20;the&#x20;extraneous&#x20;permissions&#x20;found&#x20;in&#x20;the&#x20;Audit&#x20;query&#x20;results&#x20;to&#x20;the&#x20;specific&#x20;logins&#x20;to&#x20;user-defined&#x20;server&#x20;roles&#x20;which&#x20;require&#x20;the&#x20;access.&#x20;2.&#x20;Revoke&#x20;the&#x20;&lt;permission_name&gt;&#x20;from&#x20;the&#x20;public&#x20;role&#x20;as&#x20;shown&#x20;below&#x0a;&#x20;&#x20;USE&#x20;[master]&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;REVOKE&#x20;&lt;permission_name&gt;&#x20;FROM&#x20;public;&#x0a;&#x20;&#x20;GO&#x0a;','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"5.1\"]}]'),(13017,'Ensure&#x20;Windows&#x20;local&#x20;groups&#x20;are&#x20;not&#x20;SQL&#x20;Logins','Local&#x20;Windows&#x20;groups&#x20;should&#x20;not&#x20;be&#x20;used&#x20;as&#x20;logins&#x20;for&#x20;SQL&#x20;Server&#x20;instances.','Allowing&#x20;local&#x20;Windows&#x20;groups&#x20;as&#x20;SQL&#x20;Logins&#x20;provides&#x20;a&#x20;loophole&#x20;whereby&#x20;anyone&#x20;with&#x20;OS&#x20;level&#x20;administrator&#x20;rights&#x20;&#40;and&#x20;no&#x20;SQL&#x20;Server&#x20;rights&#41;&#x20;could&#x20;add&#x20;users&#x20;to&#x20;the&#x20;local&#x20;Windows&#x20;groups&#x20;and&#x20;thereby&#x20;give&#x20;themselves&#x20;or&#x20;others&#x20;access&#x20;to&#x20;the&#x20;SQL&#x20;Server&#x20;instance.&#x0a;','','1.&#x20;For&#x20;each&#x20;LocalGroupName&#x20;login,&#x20;if&#x20;needed&#x20;create&#x20;an&#x20;equivalent&#x20;AD&#x20;group&#x20;containing&#x20;only&#x20;the&#x20;required&#x20;user&#x20;accounts.&#x20;2.&#x20;Add&#x20;the&#x20;AD&#x20;group&#x20;or&#x20;individual&#x20;Windows&#x20;accounts&#x20;as&#x20;a&#x20;SQL&#x20;Server&#x20;login&#x20;and&#x20;grant&#x20;it&#x20;the&#x20;permissions&#x20;required.&#x20;3.&#x20;Drop&#x20;the&#x20;LocalGroupName&#x20;login&#x20;using&#x20;the&#x20;syntax&#x20;below&#x20;after&#x20;replacing&#x20;&lt;name&gt;.&#x0a;&#x20;&#x20;USE&#x20;[master]&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;DROP&#x20;LOGIN&#x20;[&lt;name&gt;]&#x0a;&#x20;&#x20;GO&#x0a;','[{\"cis\": [\"3.10\"]}, {\"cis_csc\": [\"14.4\"]}]'),(13018,'Ensure&#x20;&#039;CHECK_EXPIRATION&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins&#x20;Within&#x20;the&#x20;Sysadmin&#x20;Role','Applies&#x20;the&#x20;same&#x20;password&#x20;expiration&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;inside&#x20;SQL&#x20;Server.','Ensuring&#x20;SQL&#x20;logins&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;will&#x20;ensure&#x20;the&#x20;passwords&#x20;for&#x20;SQL&#x20;logins&#x20;with&#x20;sysadmin&#x20;privileges&#x20;are&#x20;changed&#x20;on&#x20;a&#x20;frequent&#x20;basis&#x20;to&#x20;help&#x20;prevent&#x20;compromise&#x20;via&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;CONTROL&#x20;SERVER&#x20;is&#x20;an&#x20;equivalent&#x20;permission&#x20;to&#x20;sysadmin&#x20;and&#x20;logins&#x20;with&#x20;that&#x20;permission&#x20;should&#x20;also&#x20;be&#x20;required&#x20;to&#x20;have&#x20;expiring&#x20;passwords.&#x0a;','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x0a;&#x20;&#x20;ALTER&#x20;LOGIN&#x20;[&lt;login_name&gt;]&#x20;WITH&#x20;CHECK_EXPIRATION&#x20;=&#x20;ON;&#x0a;','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"16.2\"]}]'),(13019,'Ensure&#x20;&#039;CHECK_POLICY&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins','Applies&#x20;the&#x20;same&#x20;password&#x20;complexity&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;inside&#x20;SQL&#x20;Server.','Ensure&#x20;SQL&#x20;authenticated&#x20;login&#x20;passwords&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;so&#x20;that&#x20;they&#x20;cannot&#x20;be&#x20;easily&#x20;compromised&#x20;via&#x20;brute&#x20;force&#x20;attack.&#x0a;','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x0a;&#x20;&#x20;ALTER&#x20;LOGIN&#x20;[&lt;login_name&gt;]&#x20;WITH&#x20;CHECK_POLICY&#x20;=&#x20;ON;&#x0a;&#x0a;Note:&#x20;In&#x20;the&#x20;case&#x20;of&#x20;AWS&#x20;RDS&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;remediation&#x20;for&#x20;the&#x20;Master&#x20;account.&#x0a;','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"16\"]}]'),(13020,'Ensure&#x20;&#039;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;&#039;12&#039;','SQL&#x20;Server&#x20;error&#x20;log&#x20;files&#x20;must&#x20;be&#x20;protected&#x20;from&#x20;loss.&#x20;The&#x20;log&#x20;files&#x20;must&#x20;be&#x20;backed&#x20;up&#x20;before&#x20;they&#x20;are&#x20;overwritten.&#x20;Retaining&#x20;more&#x20;error&#x20;logs&#x20;helps&#x20;prevent&#x20;loss&#x20;from&#x20;frequent&#x20;recycling&#x20;before&#x20;backups&#x20;can&#x20;occur.&#x0a;','The&#x20;SQL&#x20;Server&#x20;error&#x20;log&#x20;contains&#x20;important&#x20;information&#x20;about&#x20;major&#x20;server&#x20;events&#x20;and&#x20;login&#x20;attempt&#x20;information&#x20;as&#x20;well.&#x0a;','','Adjust&#x20;the&#x20;number&#x20;of&#x20;logs&#x20;to&#x20;prevent&#x20;data&#x20;loss.&#x20;The&#x20;default&#x20;value&#x20;of&#x20;6&#x20;may&#x20;be&#x20;insufficient&#x20;for&#x20;a&#x20;production&#x20;environment.&#x20;Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x0a;1.1.1.9&#x20;GUI&#x20;Method&#x0a;&#x20;&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x0a;&#x20;&#x20;2.&#x20;Open&#x20;Object&#x20;Explorer&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;instance.&#x0a;&#x20;&#x20;3.&#x20;Navigate&#x20;to&#x20;the&#x20;Management&#x20;tab&#x20;in&#x20;Object&#x20;Explorer&#x20;and&#x20;expand.&#x20;Right&#x20;click&#x20;on&#x20;the&#x20;SQL&#x20;Server&#x20;Logs&#x20;file&#x20;and&#x20;select&#x20;Configure&#x0a;&#x20;&#x20;4.&#x20;Check&#x20;the&#x20;Limit&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;before&#x20;they&#x20;are&#x20;recycled&#x0a;&#x20;&#x20;5.&#x20;Set&#x20;the&#x20;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;12&#x0a;&#x0a;1.1.1.10T-SQL&#x20;Method&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;to&#x20;change&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files,&#x20;replace&#x20;&lt;NumberAbove12&gt;&#x20;with&#x20;your&#x20;desired&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files:&#x0a;&#x20;&#x20;EXEC&#x20;master.sys.xp_instance_regwrite&#x0a;&#x20;&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x0a;&#x20;&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x0a;&#x20;&#x20;N&#039;NumErrorLogs&#039;,&#x0a;&#x20;&#x20;REG_DWORD,&#x0a;&#x20;&#x20;&lt;NumberAbove12&gt;;&#x0a;','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.3\"]}]'),(13021,'Ensure&#x20;&#039;Default&#x20;Trace&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#039;','The&#x20;default&#x20;trace&#x20;provides&#x20;audit&#x20;logging&#x20;of&#x20;database&#x20;activity&#x20;including&#x20;account&#x20;creations,&#x20;privilege&#x20;elevation&#x20;and&#x20;execution&#x20;of&#x20;DBCC&#x20;commands.&#x0a;','Default&#x20;trace&#x20;provides&#x20;valuable&#x20;audit&#x20;information&#x20;regarding&#x20;security-related&#x20;activities&#x20;on&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;default&#x20;trace&#x20;enabled&#039;,&#x20;1;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;&#x20;&#x20;GO&#x0a;&#x20;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x0a;&#x20;&#x20;RECONFIGURE;&#x0a;','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"6.2\"]}]'),(13022,'Ensure&#x20;&#039;CLR&#x20;Assembly&#x20;Permission&#x20;Set&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;SAFE_ACCESS&#039;&#x20;for&#x20;All&#x20;CLR&#x20;Assemblies','Setting&#x20;CLR&#x20;Assembly&#x20;Permission&#x20;Sets&#x20;to&#x20;SAFE_ACCESS&#x20;will&#x20;prevent&#x20;assemblies&#x20;from&#x20;accessing&#x20;external&#x20;system&#x20;resources&#x20;such&#x20;as&#x20;files,&#x20;the&#x20;network,&#x20;environment&#x20;variables,&#x20;or&#x20;the&#x20;registry.&#x0a;','Assemblies&#x20;with&#x20;EXTERNAL_ACCESS&#x20;or&#x20;UNSAFE&#x20;permission&#x20;sets&#x20;can&#x20;be&#x20;used&#x20;to&#x20;access&#x20;sensitive&#x20;areas&#x20;of&#x20;the&#x20;operating&#x20;system,&#x20;steal&#x20;and/or&#x20;transmit&#x20;data&#x20;and&#x20;alter&#x20;the&#x20;state&#x20;and&#x20;other&#x20;protection&#x20;measures&#x20;of&#x20;the&#x20;underlying&#x20;Windows&#x20;Operating&#x20;System.&#x0a;Assemblies&#x20;which&#x20;are&#x20;Microsoft-created&#x20;&#40;is_user_defined&#x20;=&#x20;0&#41;&#x20;are&#x20;excluded&#x20;from&#x20;this&#x20;check&#x20;as&#x20;they&#x20;are&#x20;required&#x20;for&#x20;overall&#x20;system&#x20;functionality.&#x0a;','','USE&#x20;&lt;database_name&gt;;&#x20;GO&#x20;ALTER&#x20;ASSEMBLY&#x20;&lt;assembly_name&gt;&#x20;WITH&#x20;PERMISSION_SET&#x20;=&#x20;SAFE;&#x0a;','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"18\"]}]'),(13500,'Ensure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','Enabling&#x20;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#x20;allows&#x20;users&#x20;to&#x20;query&#x20;data&#x20;and&#x20;execute&#x20;statements&#x20;on&#x20;external&#x20;data&#x20;sources.&#x20;This&#x20;functionality&#x20;should&#x20;be&#x20;disabled.','This&#x20;feature&#x20;can&#x20;be&#x20;used&#x20;to&#x20;remotely&#x20;access&#x20;and&#x20;exploit&#x20;vulnerabilities&#x20;on&#x20;remote&#x20;SQL&#x20;Server&#x20;instances&#x20;and&#x20;to&#x20;run&#x20;unsafe&#x20;Visual&#x20;Basic&#x20;for&#x20;Application&#x20;functions.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ad&#x20;Hoc&#x20;Distributed&#x20;Queries&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(13501,'Ensure&#x20;&#039;CLR&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;clr&#x20;enabled&#x20;option&#x20;specifies&#x20;whether&#x20;user&#x20;assemblies&#x20;can&#x20;be&#x20;run&#x20;by&#x20;SQL&#x20;Server.','Enabling&#x20;use&#x20;of&#x20;CLR&#x20;assemblies&#x20;widens&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;puts&#x20;it&#x20;at&#x20;risk&#x20;from&#x20;both&#x20;inadvertent&#x20;and&#x20;malicious&#x20;assemblies.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;clr&#x20;enabled&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"18.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}]'),(13502,'Ensure&#x20;&#039;Cross&#x20;DB&#x20;Ownership&#x20;Chaining&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;cross&#x20;db&#x20;ownership&#x20;chaining&#x20;option&#x20;controls&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;across&#x20;all&#x20;databases&#x20;at&#x20;the&#x20;instance&#x20;&#40;or&#x20;server&#41;&#x20;level.','When&#x20;enabled,&#x20;this&#x20;option&#x20;allows&#x20;a&#x20;member&#x20;of&#x20;the&#x20;db_owner&#x20;role&#x20;in&#x20;a&#x20;database&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;objects&#x20;owned&#x20;by&#x20;a&#x20;login&#x20;in&#x20;any&#x20;other&#x20;database,&#x20;causing&#x20;an&#x20;unnecessary&#x20;information&#x20;disclosure.&#x20;When&#x20;required,&#x20;cross-database&#x20;ownership&#x20;chaining&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;for&#x20;the&#x20;specific&#x20;databases&#x20;requiring&#x20;it&#x20;instead&#x20;of&#x20;at&#x20;the&#x20;instance&#x20;level&#x20;for&#x20;all&#x20;databases&#x20;by&#x20;using&#x20;the&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;DB_CHAINING&#x20;ON&#x20;command.&#x20;This&#x20;database&#x20;option&#x20;may&#x20;not&#x20;be&#x20;changed&#x20;on&#x20;the&#x20;master&#x20;,&#x20;model&#x20;,&#x20;or&#x20;tempdb&#x20;system&#x20;databases.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;cross&#x20;db&#x20;ownership&#x20;chaining&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13503,'Ensure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;controls&#x20;the&#x20;ability&#x20;to&#x20;generate&#x20;and&#x20;transmit&#x20;email&#x20;messages&#x20;from&#x20;SQL&#x20;Server.','Disabling&#x20;the&#x20;Database&#x20;Mail&#x20;XPs&#x20;option&#x20;reduces&#x20;the&#x20;SQL&#x20;Server&#x20;surface,&#x20;eliminates&#x20;a&#x20;DOS&#x20;attack&#x20;vector&#x20;and&#x20;channel&#x20;to&#x20;exfiltrate&#x20;data&#x20;from&#x20;the&#x20;database&#x20;server&#x20;to&#x20;a&#x20;remote&#x20;host.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Database&#x20;Mail&#x20;XPs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13504,'Ensure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;Ole&#x20;Automation&#x20;Procedures&#x20;option&#x20;controls&#x20;whether&#x20;OLE&#x20;Automation&#x20;objects&#x20;can&#x20;be&#x20;instantiated&#x20;within&#x20;Transact-SQL&#x20;batches.&#x20;These&#x20;are&#x20;extended&#x20;stored&#x20;procedures&#x20;that&#x20;allow&#x20;SQL&#x20;Server&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;external&#x20;to&#x20;SQL&#x20;Server.','Enabling&#x20;this&#x20;option&#x20;will&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;SQL&#x20;Server&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;execute&#x20;functions&#x20;in&#x20;the&#x20;security&#x20;context&#x20;of&#x20;SQL&#x20;Server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;Ole&#x20;Automation&#x20;Procedures&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"2.5\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13505,'Ensure&#x20;&#039;Remote&#x20;Access&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;access&#x20;option&#x20;controls&#x20;the&#x20;execution&#x20;of&#x20;local&#x20;stored&#x20;procedures&#x20;on&#x20;remote&#x20;servers&#x20;or&#x20;remote&#x20;stored&#x20;procedures&#x20;on&#x20;local&#x20;server.','Functionality&#x20;can&#x20;be&#x20;abused&#x20;to&#x20;launch&#x20;a&#x20;Denial-of-Service&#x20;&#40;DoS&#41;&#x20;attack&#x20;on&#x20;remote&#x20;servers&#x20;by&#x20;off-loading&#x20;query&#x20;processing&#x20;to&#x20;a&#x20;target.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;access&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13506,'Ensure&#x20;&#039;Remote&#x20;Admin&#x20;Connections&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;remote&#x20;admin&#x20;connections&#x20;option&#x20;controls&#x20;whether&#x20;a&#x20;client&#x20;application&#x20;on&#x20;a&#x20;remote&#x20;computer&#x20;can&#x20;use&#x20;the&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;.','The&#x20;Dedicated&#x20;Administrator&#x20;Connection&#x20;&#40;DAC&#41;&#x20;lets&#x20;an&#x20;administrator&#x20;access&#x20;a&#x20;running&#x20;server&#x20;to&#x20;execute&#x20;diagnostic&#x20;functions&#x20;or&#x20;Transact-SQL&#x20;statements,&#x20;or&#x20;to&#x20;troubleshoot&#x20;problems&#x20;on&#x20;the&#x20;server,&#x20;even&#x20;when&#x20;the&#x20;server&#x20;is&#x20;locked&#x20;or&#x20;running&#x20;in&#x20;an&#x20;abnormal&#x20;state&#x20;and&#x20;not&#x20;responding&#x20;to&#x20;a&#x20;SQL&#x20;Server&#x20;Database&#x20;Engine&#x20;connection.&#x20;In&#x20;a&#x20;cluster&#x20;scenario,&#x20;the&#x20;administrator&#x20;may&#x20;not&#x20;actually&#x20;be&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;same&#x20;node&#x20;that&#x20;is&#x20;currently&#x20;hosting&#x20;the&#x20;SQL&#x20;Server&#x20;instance&#x20;and&#x20;thus&#x20;is&#x20;considered&#x20;&quot;remote&quot;.&#x20;Therefore,&#x20;this&#x20;setting&#x20;should&#x20;usually&#x20;be&#x20;enabled&#x20;&#40;&#x20;1&#x20;&#41;&#x20;for&#x20;SQL&#x20;Server&#x20;failover&#x20;clusters;&#x20;otherwise&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;&#40;&#x20;0&#x20;&#41;&#x20;which&#x20;is&#x20;the&#x20;default.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command&#x20;on&#x20;non-clustered&#x20;installations:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;remote&#x20;admin&#x20;connections&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO','[{\"cis\": [\"2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13507,'Ensure&#x20;&#039;Scan&#x20;For&#x20;Startup&#x20;Procs&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#039;','The&#x20;scan&#x20;for&#x20;startup&#x20;procs&#x20;option,&#x20;if&#x20;enabled,&#x20;causes&#x20;SQL&#x20;Server&#x20;to&#x20;scan&#x20;for&#x20;and&#x20;automatically&#x20;run&#x20;all&#x20;stored&#x20;procedures&#x20;that&#x20;are&#x20;set&#x20;to&#x20;execute&#x20;upon&#x20;service&#x20;startup.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;entity&#x20;leveraging&#x20;these&#x20;facilities&#x20;for&#x20;malicious&#x20;purposes.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;scan&#x20;for&#x20;startup&#x20;procs&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;&#x20;Restart&#x20;the&#x20;Database&#x20;Engine.','[{\"cis\": [\"2.8\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13508,'Ensure&#x20;&#039;Trustworthy&#039;&#x20;Database&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Off&#039;','The&#x20;TRUSTWORTHY&#x20;database&#x20;option&#x20;allows&#x20;database&#x20;objects&#x20;to&#x20;access&#x20;objects&#x20;in&#x20;other&#x20;databases&#x20;under&#x20;certain&#x20;circumstances.','Provides&#x20;protection&#x20;from&#x20;malicious&#x20;CLR&#x20;assemblies&#x20;or&#x20;extended&#x20;procedures.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement&#x20;against&#x20;the&#x20;databases&#x20;&#40;replace&#x20;&lt;dbname&gt;&#x20;below&#41;&#x20;returned&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;[&lt;database_name&gt;]&#x20;SET&#x20;TRUSTWORTHY&#x20;OFF;','[{\"cis\": [\"2.9\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13509,'Ensure&#x20;SQL&#x20;Server&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;non-standard&#x20;ports','If&#x20;installed,&#x20;the&#x20;default&#x20;SQL&#x20;Server&#x20;instance&#x20;will&#x20;be&#x20;assigned&#x20;a&#x20;default&#x20;port&#x20;of&#x20;TCP:1433&#x20;for&#x20;TCP/IP&#x20;communication.&#x20;Administrators&#x20;can&#x20;also&#x20;manually&#x20;configure&#x20;named&#x20;instances&#x20;to&#x20;use&#x20;TCP:1433&#x20;for&#x20;communication.&#x20;TCP:1433&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;SQL&#x20;Server&#x20;port&#x20;and&#x20;this&#x20;port&#x20;assignment&#x20;should&#x20;be&#x20;changed.&#x20;In&#x20;a&#x20;multi-instance&#x20;scenario,&#x20;each&#x20;instance&#x20;must&#x20;be&#x20;assigned&#x20;its&#x20;own&#x20;TCP/IP&#x20;port.','Using&#x20;a&#x20;non-default&#x20;port&#x20;helps&#x20;protect&#x20;the&#x20;database&#x20;from&#x20;attacks&#x20;directed&#x20;to&#x20;the&#x20;default&#x20;port.','','1:&#x20;In&#x20;SQL&#x20;Server&#x20;Configuration&#x20;Manager,&#x20;in&#x20;the&#x20;console&#x20;pane,&#x20;expand&#x20;SQL&#x20;Server&#x20;Network&#x20;Configuration,&#x20;expand&#x20;Protocols&#x20;for&#x20;&lt;InstanceName&gt;&#x20;,&#x20;and&#x20;then&#x20;double-click&#x20;the&#x20;TCP/IP&#x20;protocol.&#x20;2:&#x20;In&#x20;the&#x20;TCP/IP&#x20;Properties&#x20;dialog&#x20;box,&#x20;on&#x20;the&#x20;IP&#x20;Addresses&#x20;tab,&#x20;several&#x20;IP&#x20;addresses&#x20;appear&#x20;in&#x20;the&#x20;format&#x20;IP1&#x20;,&#x20;IP2&#x20;,&#x20;up&#x20;to&#x20;IPAll&#x20;.&#x20;One&#x20;of&#x20;these&#x20;is&#x20;for&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;loopback&#x20;adapter,&#x20;127.0.0.1&#x20;.&#x20;Additional&#x20;IP&#x20;addresses&#x20;appear&#x20;for&#x20;each&#x20;IP&#x20;Address&#x20;on&#x20;the&#x20;computer.&#x20;3:&#x20;Under&#x20;IPALL,&#x20;change&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;from&#x20;1433&#x20;to&#x20;another&#x20;non-standard&#x20;port&#x20;or&#x20;leave&#x20;the&#x20;TCP&#x20;Port&#x20;field&#x20;empty&#x20;and&#x20;set&#x20;the&#x20;TCP&#x20;Dynamic&#x20;Ports&#x20;value&#x20;to&#x20;0&#x20;to&#x20;enable&#x20;dynamic&#x20;port&#x20;assignment&#x20;and&#x20;then&#x20;click&#x20;OK.&#x20;4:&#x20;In&#x20;the&#x20;console&#x20;pane,&#x20;click&#x20;SQL&#x20;Server&#x20;Services.&#x20;5:&#x20;In&#x20;the&#x20;details&#x20;pane,&#x20;right-click&#x20;SQL&#x20;Server&#x20;&#40;&lt;InstanceName&gt;&#41;&#x20;and&#x20;then&#x20;click&#x20;Restart,&#x20;to&#x20;stop&#x20;and&#x20;restart&#x20;SQL&#x20;Server.','[{\"cis\": [\"2.11\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13510,'Ensure&#x20;the&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;This&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;the&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal.','','Execute&#x20;the&#x20;following&#x20;T-SQL&#x20;query:&#x20;USE&#x20;[master]&#x20;GO&#x20;DECLARE&#x20;@tsql&#x20;nvarchar&#40;max&#41;&#x20;SET&#x20;@tsql&#x20;=&#x20;&#039;ALTER&#x20;LOGIN&#x20;&#039;&#x20;+&#x20;SUSER_NAME&#40;0x01&#41;&#x20;+&#x20;&#039;&#x20;DISABLE&#039;&#x20;EXEC&#x20;&#40;@tsql&#41;&#x20;GO','[{\"cis\": [\"2.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13511,'Ensure&#x20;the&#x20;&#039;sa&#039;&#x20;Login&#x20;Account&#x20;has&#x20;been&#x20;renamed','The&#x20;sa&#x20;account&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;login&#x20;with&#x20;sysadmin&#x20;privileges.&#x20;The&#x20;sa&#x20;login&#x20;is&#x20;the&#x20;original&#x20;login&#x20;created&#x20;during&#x20;installation&#x20;and&#x20;always&#x20;has&#x20;principal_id=1&#x20;and&#x20;sid=0x01&#x20;.','It&#x20;is&#x20;more&#x20;difficult&#x20;to&#x20;launch&#x20;password-guessing&#x20;and&#x20;brute-force&#x20;attacks&#x20;against&#x20;the&#x20;sa&#x20;login&#x20;if&#x20;the&#x20;name&#x20;is&#x20;not&#x20;known.','','Replace&#x20;the&#x20;&lt;different_user&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;ALTER&#x20;LOGIN&#x20;sa&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_user&gt;;','[{\"cis\": [\"2.14\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13512,'Ensure&#x20;&#039;AUTO_CLOSE&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;OFF&#039;&#x20;on&#x20;contained&#x20;databases','AUTO_CLOSE&#x20;determines&#x20;if&#x20;a&#x20;given&#x20;database&#x20;is&#x20;closed&#x20;or&#x20;not&#x20;after&#x20;a&#x20;connection&#x20;terminates.&#x20;If&#x20;enabled,&#x20;subsequent&#x20;connections&#x20;to&#x20;the&#x20;given&#x20;database&#x20;will&#x20;require&#x20;the&#x20;database&#x20;to&#x20;be&#x20;reopened&#x20;and&#x20;relevant&#x20;procedure&#x20;caches&#x20;to&#x20;be&#x20;rebuilt.','Because&#x20;authentication&#x20;of&#x20;users&#x20;for&#x20;contained&#x20;databases&#x20;occurs&#x20;within&#x20;the&#x20;database&#x20;not&#x20;at&#x20;the&#x20;serverinstance&#x20;level,&#x20;the&#x20;database&#x20;must&#x20;be&#x20;opened&#x20;every&#x20;time&#x20;to&#x20;authenticate&#x20;a&#x20;user.&#x20;The&#x20;frequent&#x20;opening/closing&#x20;of&#x20;the&#x20;database&#x20;consumes&#x20;additional&#x20;server&#x20;resources&#x20;and&#x20;may&#x20;contribute&#x20;to&#x20;a&#x20;denial&#x20;of&#x20;service.','','Execute&#x20;the&#x20;following&#x20;T-SQL,&#x20;replacing&#x20;&lt;database_name&gt;&#x20;with&#x20;each&#x20;database&#x20;name&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure:&#x20;ALTER&#x20;DATABASE&#x20;&lt;database_name&gt;&#x20;SET&#x20;AUTO_CLOSE&#x20;OFF;','[{\"cis\": [\"2.15\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13513,'Ensure&#x20;no&#x20;login&#x20;exists&#x20;with&#x20;the&#x20;name&#x20;&#039;sa&#039;','The&#x20;sa&#x20;login&#x20;&#40;e.g.&#x20;principal&#41;&#x20;is&#x20;a&#x20;widely&#x20;known&#x20;and&#x20;often&#x20;widely&#x20;used&#x20;SQL&#x20;Server&#x20;account.&#x20;Therefore,&#x20;there&#x20;should&#x20;not&#x20;be&#x20;a&#x20;login&#x20;called&#x20;sa&#x20;even&#x20;when&#x20;the&#x20;original&#x20;sa&#x20;login&#x20;&#40;&#x20;principal_id&#x20;=&#x20;1&#x20;&#41;&#x20;has&#x20;been&#x20;renamed.','Enforcing&#x20;this&#x20;control&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;an&#x20;attacker&#x20;executing&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;a&#x20;well-known&#x20;principal&#x20;name.','','Execute&#x20;the&#x20;appropriate&#x20;ALTER&#x20;or&#x20;DROP&#x20;statement&#x20;below&#x20;based&#x20;on&#x20;the&#x20;principal_id&#x20;returned&#x20;for&#x20;the&#x20;login&#x20;named&#x20;sa&#x20;.&#x20;Replace&#x20;the&#x20;&lt;different_name&gt;&#x20;value&#x20;within&#x20;the&#x20;below&#x20;syntax&#x20;and&#x20;execute&#x20;to&#x20;rename&#x20;the&#x20;sa&#x20;login.&#x20;USE&#x20;[master]&#x20;GO&#x20;--&#x20;If&#x20;principal_id&#x20;=&#x20;1&#x20;or&#x20;the&#x20;login&#x20;owns&#x20;database&#x20;objects,&#x20;rename&#x20;the&#x20;sa&#x20;login&#x20;ALTER&#x20;LOGIN&#x20;[sa]&#x20;WITH&#x20;NAME&#x20;=&#x20;&lt;different_name&gt;;&#x20;GO&#x20;--&#x20;If&#x20;the&#x20;login&#x20;owns&#x20;no&#x20;database&#x20;objects,&#x20;then&#x20;drop&#x20;it&#x20;--&#x20;Do&#x20;NOT&#x20;drop&#x20;the&#x20;login&#x20;if&#x20;it&#x20;is&#x20;principal_id&#x20;=&#x20;1&#x20;DROP&#x20;LOGIN&#x20;sa','[{\"cis\": [\"2.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.6\", \"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13514,'Ensure&#x20;&#039;Server&#x20;Authentication&#039;&#x20;Property&#x20;is&#x20;set&#x20;to&#x20;&#039;Windows&#x20;Authentication&#x20;Mode&#039;','Uses&#x20;Windows&#x20;Authentication&#x20;to&#x20;validate&#x20;attempted&#x20;connections.','Windows&#x20;provides&#x20;a&#x20;more&#x20;robust&#x20;authentication&#x20;mechanism&#x20;than&#x20;SQL&#x20;Server&#x20;authentication.','','Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method:&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;the&#x20;Object&#x20;Explorer&#x20;tab&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;database&#x20;instance.&#x20;3.&#x20;Right&#x20;click&#x20;the&#x20;instance&#x20;name&#x20;and&#x20;select&#x20;Properties.&#x20;4.&#x20;Select&#x20;the&#x20;Security&#x20;page&#x20;from&#x20;the&#x20;left&#x20;menu.&#x20;5.&#x20;Set&#x20;the&#x20;Server&#x20;authentication&#x20;setting&#x20;to&#x20;Windows&#x20;Authentication&#x20;Mode.&#x20;or&#x20;T-SQL&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;in&#x20;a&#x20;Query&#x20;Window:&#x20;USE&#x20;[master]&#x20;GO&#x20;EXEC&#x20;xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;LoginMode&#039;,&#x20;REG_DWORD,&#x20;1&#x20;GO&#x20;Restart&#x20;the&#x20;SQL&#x20;Server&#x20;service&#x20;for&#x20;the&#x20;change&#x20;to&#x20;take&#x20;effect.','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(13515,'Ensure&#x20;only&#x20;the&#x20;default&#x20;permissions&#x20;specified&#x20;by&#x20;Microsoft&#x20;are&#x20;granted&#x20;to&#x20;the&#x20;public&#x20;server&#x20;role','public&#x20;is&#x20;a&#x20;special&#x20;fixed&#x20;server&#x20;role&#x20;containing&#x20;all&#x20;logins.&#x20;Unlike&#x20;other&#x20;fixed&#x20;server&#x20;roles,&#x20;permissions&#x20;can&#x20;be&#x20;changed&#x20;for&#x20;the&#x20;public&#x20;role.&#x20;In&#x20;keeping&#x20;with&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privileges,&#x20;the&#x20;public&#x20;server&#x20;role&#x20;should&#x20;not&#x20;be&#x20;used&#x20;to&#x20;grant&#x20;permissions&#x20;at&#x20;the&#x20;server&#x20;scope&#x20;as&#x20;these&#x20;would&#x20;be&#x20;inherited&#x20;by&#x20;all&#x20;users.','Every&#x20;SQL&#x20;Server&#x20;login&#x20;belongs&#x20;to&#x20;the&#x20;public&#x20;role&#x20;and&#x20;cannot&#x20;be&#x20;removed&#x20;from&#x20;this&#x20;role.&#x20;Therefore,&#x20;any&#x20;permissions&#x20;granted&#x20;to&#x20;this&#x20;role&#x20;will&#x20;be&#x20;available&#x20;to&#x20;all&#x20;logins&#x20;unless&#x20;they&#x20;have&#x20;been&#x20;explicitly&#x20;denied&#x20;to&#x20;specific&#x20;logins&#x20;or&#x20;user-defined&#x20;server&#x20;roles.','','Add&#x20;the&#x20;extraneous&#x20;permissions&#x20;found&#x20;in&#x20;the&#x20;Audit&#x20;query&#x20;results&#x20;to&#x20;the&#x20;specific&#x20;logins&#x20;to&#x20;user-defined&#x20;server&#x20;roles&#x20;which&#x20;require&#x20;the&#x20;access.&#x20;Revoke&#x20;the&#x20;&lt;permission_name&gt;&#x20;from&#x20;the&#x20;public&#x20;role&#x20;as&#x20;shown&#x20;below&#x20;USE&#x20;[master]&#x20;GO&#x20;REVOKE&#x20;&lt;permission_name&gt;&#x20;FROM&#x20;public;&#x20;GO','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(13516,'Ensure&#x20;Windows&#x20;local&#x20;groups&#x20;are&#x20;not&#x20;SQL&#x20;Logins','Local&#x20;Windows&#x20;groups&#x20;should&#x20;not&#x20;be&#x20;used&#x20;as&#x20;logins&#x20;for&#x20;SQL&#x20;Server&#x20;instances.','Allowing&#x20;local&#x20;Windows&#x20;groups&#x20;as&#x20;SQL&#x20;Logins&#x20;provides&#x20;a&#x20;loophole&#x20;whereby&#x20;anyone&#x20;with&#x20;OS&#x20;level&#x20;administrator&#x20;rights&#x20;&#40;and&#x20;no&#x20;SQL&#x20;Server&#x20;rights&#41;&#x20;could&#x20;add&#x20;users&#x20;to&#x20;the&#x20;local&#x20;Windows&#x20;groups&#x20;and&#x20;thereby&#x20;give&#x20;themselves&#x20;or&#x20;others&#x20;access&#x20;to&#x20;the&#x20;SQL&#x20;Server&#x20;instance.','','1.&#x20;For&#x20;each&#x20;LocalGroupName&#x20;login,&#x20;if&#x20;needed&#x20;create&#x20;an&#x20;equivalent&#x20;AD&#x20;group&#x20;containing&#x20;only&#x20;the&#x20;required&#x20;user&#x20;accounts.&#x20;2.&#x20;Add&#x20;the&#x20;AD&#x20;group&#x20;or&#x20;individual&#x20;Windows&#x20;accounts&#x20;as&#x20;a&#x20;SQL&#x20;Server&#x20;login&#x20;and&#x20;grant&#x20;it&#x20;the&#x20;permissions&#x20;required.&#x20;3.&#x20;Drop&#x20;the&#x20;LocalGroupName&#x20;login&#x20;using&#x20;the&#x20;syntax&#x20;below&#x20;after&#x20;replacing&#x20;&lt;name&gt;&#x20;.&#x20;USE&#x20;[master]&#x20;GO&#x20;DROP&#x20;LOGIN&#x20;[&lt;name&gt;]&#x20;GO','[{\"cis\": [\"3.10\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}]'),(13517,'Ensure&#x20;&#039;CHECK_EXPIRATION&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins&#x20;Within&#x20;the&#x20;Sysadmin&#x20;Role','Applies&#x20;the&#x20;same&#x20;password&#x20;expiration&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;inside&#x20;SQL&#x20;Server.','Ensuring&#x20;SQL&#x20;logins&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;will&#x20;ensure&#x20;the&#x20;passwords&#x20;for&#x20;SQL&#x20;logins&#x20;with&#x20;sysadmin&#x20;privileges&#x20;are&#x20;changed&#x20;on&#x20;a&#x20;frequent&#x20;basis&#x20;to&#x20;help&#x20;prevent&#x20;compromise&#x20;via&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;CONTROL&#x20;SERVER&#x20;is&#x20;an&#x20;equivalent&#x20;permission&#x20;to&#x20;sysadmin&#x20;and&#x20;logins&#x20;with&#x20;that&#x20;permission&#x20;should&#x20;also&#x20;be&#x20;required&#x20;to&#x20;have&#x20;expiring&#x20;passwords.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_EXPIRATION&#x20;=&#x20;ON;','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"16.2, 16.10\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(13518,'Ensure&#x20;&#039;CHECK_POLICY&#039;&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;ON&#039;&#x20;for&#x20;All&#x20;SQL&#x20;Authenticated&#x20;Logins','Applies&#x20;the&#x20;same&#x20;password&#x20;complexity&#x20;policy&#x20;used&#x20;in&#x20;Windows&#x20;to&#x20;passwords&#x20;used&#x20;insideSQL&#x20;Server.','Ensure&#x20;SQL&#x20;authenticated&#x20;login&#x20;passwords&#x20;comply&#x20;with&#x20;the&#x20;secure&#x20;password&#x20;policy&#x20;applied&#x20;by&#x20;the&#x20;Windows&#x20;Server&#x20;Benchmark&#x20;so&#x20;that&#x20;they&#x20;cannot&#x20;be&#x20;easily&#x20;compromised&#x20;via&#x20;brute&#x20;force&#x20;attack.','','For&#x20;each&#x20;&lt;login_name&gt;&#x20;found&#x20;by&#x20;the&#x20;Audit&#x20;Procedure,&#x20;execute&#x20;the&#x20;following&#x20;T-SQL&#x20;statement:&#x20;ALTER&#x20;LOGIN&#x20;&lt;login_name&gt;&#x20;WITH&#x20;CHECK_POLICY&#x20;=&#x20;ON;&#x20;Note:&#x20;In&#x20;the&#x20;case&#x20;of&#x20;AWS&#x20;RDS&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;remediation&#x20;for&#x20;the&#x20;Master&#x20;account.','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"16, 4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(13519,'Ensure&#x20;&#039;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;&#039;12&#039;','SQL&#x20;Server&#x20;error&#x20;log&#x20;files&#x20;must&#x20;be&#x20;protected&#x20;from&#x20;loss.&#x20;The&#x20;log&#x20;files&#x20;must&#x20;be&#x20;backed&#x20;up&#x20;before&#x20;they&#x20;are&#x20;overwritten.&#x20;Retaining&#x20;more&#x20;error&#x20;logs&#x20;helps&#x20;prevent&#x20;loss&#x20;from&#x20;frequent&#x20;recycling&#x20;before&#x20;backups&#x20;can&#x20;occur.','The&#x20;SQL&#x20;Server&#x20;error&#x20;log&#x20;contains&#x20;important&#x20;information&#x20;about&#x20;major&#x20;server&#x20;events&#x20;and&#x20;login&#x20;attempt&#x20;information&#x20;as&#x20;well.','','Adjust&#x20;the&#x20;number&#x20;of&#x20;logs&#x20;to&#x20;prevent&#x20;data&#x20;loss.&#x20;The&#x20;default&#x20;value&#x20;of&#x20;6&#x20;may&#x20;be&#x20;insufficient&#x20;for&#x20;a&#x20;production&#x20;environment.&#x20;Perform&#x20;either&#x20;the&#x20;GUI&#x20;or&#x20;T-SQL&#x20;method&#x20;shown:&#x20;GUI&#x20;Method:&#x20;1.&#x20;Open&#x20;SQL&#x20;Server&#x20;Management&#x20;Studio.&#x20;2.&#x20;Open&#x20;Object&#x20;Explorer&#x20;and&#x20;connect&#x20;to&#x20;the&#x20;target&#x20;instance.&#x20;3.&#x20;Navigate&#x20;to&#x20;the&#x20;Management&#x20;tab&#x20;in&#x20;Object&#x20;Explorer&#x20;and&#x20;expand.&#x20;Right&#x20;click&#x20;on&#x20;the&#x20;SQL&#x20;Server&#x20;Logs&#x20;file&#x20;and&#x20;select&#x20;Configure&#x20;4.&#x20;Check&#x20;the&#x20;Limit&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;before&#x20;they&#x20;are&#x20;recycled&#x20;5.&#x20;Set&#x20;the&#x20;Maximum&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;12.&#x20;T-SQL&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;T-SQL&#x20;to&#x20;change&#x20;the&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files,&#x20;replace&#x20;&lt;NumberAbove12&gt;&#x20;with&#x20;your&#x20;desired&#x20;number&#x20;of&#x20;error&#x20;log&#x20;files:&#x20;EXEC&#x20;master.sys.xp_instance_regwrite&#x20;N&#039;HKEY_LOCAL_MACHINE&#039;,&#x20;N&#039;SoftwareMicrosoftMSSQLServerMSSQLServer&#039;,&#x20;N&#039;NumErrorLogs&#039;,&#x20;REG_DWORD,&#x20;&lt;NumberAbove12&gt;;','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(13520,'Ensure&#x20;&#039;Default&#x20;Trace&#x20;Enabled&#039;&#x20;Server&#x20;Configuration&#x20;Option&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#039;','The&#x20;default&#x20;trace&#x20;provides&#x20;audit&#x20;logging&#x20;of&#x20;database&#x20;activity&#x20;including&#x20;account&#x20;creations,&#x20;privilege&#x20;elevation&#x20;and&#x20;execution&#x20;of&#x20;DBCC&#x20;commands.','Default&#x20;trace&#x20;provides&#x20;valuable&#x20;audit&#x20;information&#x20;regarding&#x20;security-related&#x20;activities&#x20;on&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;T-SQL&#x20;command:&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;default&#x20;trace&#x20;enabled&#039;,&#x20;1;&#x20;RECONFIGURE;&#x20;GO&#x20;EXECUTE&#x20;sp_configure&#x20;&#039;show&#x20;advanced&#x20;options&#039;,&#x20;0;&#x20;RECONFIGURE;','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(13521,'Ensure&#x20;&#039;CLR&#x20;Assembly&#x20;Permission&#x20;Set&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;SAFE_ACCESS&#039;&#x20;for&#x20;All&#x20;CLR&#x20;Assemblies','Setting&#x20;CLR&#x20;Assembly&#x20;Permission&#x20;Sets&#x20;to&#x20;SAFE_ACCESS&#x20;will&#x20;prevent&#x20;assemblies&#x20;from&#x20;accessing&#x20;external&#x20;system&#x20;resources&#x20;such&#x20;as&#x20;files,&#x20;the&#x20;network,&#x20;environment&#x20;variables,&#x20;or&#x20;the&#x20;registry.','Assemblies&#x20;with&#x20;EXTERNAL_ACCESS&#x20;or&#x20;UNSAFE&#x20;permission&#x20;sets&#x20;can&#x20;be&#x20;used&#x20;to&#x20;access&#x20;sensitive&#x20;areas&#x20;of&#x20;the&#x20;operating&#x20;system,&#x20;steal&#x20;and/or&#x20;transmit&#x20;data&#x20;and&#x20;alter&#x20;the&#x20;state&#x20;and&#x20;other&#x20;protection&#x20;measures&#x20;of&#x20;the&#x20;underlying&#x20;Windows&#x20;Operating&#x20;System.&#x20;Assemblies&#x20;which&#x20;are&#x20;Microsoft-created&#x20;&#40;&#x20;is_user_defined&#x20;=&#x20;0&#x20;&#41;&#x20;are&#x20;excluded&#x20;from&#x20;this&#x20;check&#x20;as&#x20;they&#x20;are&#x20;required&#x20;for&#x20;overall&#x20;system&#x20;functionality.','','ALTER&#x20;ASSEMBLY&#x20;&lt;assembly_name&gt;&#x20;WITH&#x20;PERMISSION_SET&#x20;=&#x20;SAFE;','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"18\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14000,'PHP&#x20;-&#x20;Ensure&#x20;&#039;Register&#x20;globals&#039;&#x20;are&#x20;not&#x20;enabled','','','','','\"\"'),(14001,'PHP&#x20;-&#x20;Ensure&#x20;&#039;Expose&#x20;PHP&#039;&#x20;is&#x20;not&#x20;enabled','','','','','\"\"'),(14002,'PHP&#x20;-&#x20;Ensure&#x20;&#039;Allow&#x20;URL&#x20;fopen&#039;&#x20;is&#x20;not&#x20;enabled','','','','','\"\"'),(14003,'PHP&#x20;-&#x20;Ensure&#x20;&#039;Displaying&#x20;of&#x20;errors&#039;&#x20;is&#x20;not&#x20;enabled','','','','','\"\"'),(14004,'Web&#x20;exploits:&#x20;&#039;.yop&#039;&#x20;is&#x20;an&#x20;uncommon&#x20;file&#x20;name&#x20;inside&#x20;htdocs&#x20;-&#x20;Possible&#x20;compromise','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14005,'Web&#x20;exploits:&#x20;&#039;id&#039;&#x20;is&#x20;an&#x20;uncommon&#x20;file&#x20;name&#x20;inside&#x20;htdocs&#x20;-&#x20;Possible&#x20;compromise','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14006,'Web&#x20;exploits:&#x20;&#039;.ssh&#039;&#x20;is&#x20;an&#x20;uncommon&#x20;file&#x20;name&#x20;inside&#x20;htdocs','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14007,'Web&#x20;exploits:&#x20;&#039;...&#039;&#x20;is&#x20;an&#x20;uncommon&#x20;file&#x20;name&#x20;inside&#x20;htdocs&#x20;-&#x20;Possible&#x20;compromise','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14008,'Web&#x20;exploits:&#x20;&#039;.shell&#039;&#x20;is&#x20;an&#x20;uncommon&#x20;file&#x20;name&#x20;inside&#x20;htdocs&#x20;-&#x20;Possible&#x20;compromise','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14009,'Web&#x20;vulnerability&#x20;-&#x20;Outdated&#x20;WordPress&#x20;installation','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14010,'Web&#x20;vulnerability&#x20;-&#x20;Outdated&#x20;Joomla&#x20;installation','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14011,'Web&#x20;vulnerability&#x20;-&#x20;Outdated&#x20;osCommerce&#x20;&#40;v2.2&#41;&#x20;installation','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14012,'Web&#x20;vulnerability&#x20;-&#x20;Backdoors&#x20;/&#x20;Web&#x20;based&#x20;malware&#x20;found&#x20;-&#x20;eval&#40;base64_decode&#41;','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14013,'Web&#x20;vulnerability&#x20;-&#x20;Backdoors&#x20;/&#x20;Web&#x20;based&#x20;malware&#x20;found&#x20;-&#x20;eval&#40;base64_decode&#40;POST&#41;&#41;','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14014,'Web&#x20;vulnerability&#x20;-&#x20;.htaccess&#x20;file&#x20;compromised','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(14015,'Web&#x20;vulnerability&#x20;-&#x20;.htaccess&#x20;file&#x20;compromised&#x20;-&#x20;auto&#x20;append','','','','','[{\"pci_dss\": [\"6.5\", \"6.6\", \"11.4\"]}, {\"nist_800_53\": [\"SA.11\", \"SC.5\", \"SI.3\", \"SI.4\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\", \"CC8.1\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(15000,'Ensure&#x20;&#039;Maximum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;','This&#x20;policy&#x20;setting&#x20;defines&#x20;how&#x20;long&#x20;a&#x20;user&#x20;can&#x20;use&#x20;their&#x20;password&#x20;before&#x20;it&#x20;expires.&#x20;Values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;range&#x20;from&#x20;0&#x20;to&#x20;999&#x20;days.&#x20;If&#x20;you&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0,&#x20;the&#x20;password&#x20;will&#x20;never&#x20;expire.&#x20;Because&#x20;attackers&#x20;can&#x20;crack&#x20;passwords,&#x20;the&#x20;more&#x20;frequently&#x20;you&#x20;change&#x20;the&#x20;password&#x20;the&#x20;less&#x20;opportunity&#x20;an&#x20;attacker&#x20;has&#x20;to&#x20;use&#x20;a&#x20;cracked&#x20;password.&#x20;However,&#x20;the&#x20;lower&#x20;this&#x20;value&#x20;is&#x20;set,&#x20;the&#x20;higher&#x20;the&#x20;potential&#x20;for&#x20;an&#x20;increase&#x20;in&#x20;calls&#x20;to&#x20;help&#x20;desk&#x20;support&#x20;due&#x20;to&#x20;users&#x20;having&#x20;to&#x20;change&#x20;their&#x20;password&#x20;or&#x20;forgetting&#x20;which&#x20;password&#x20;is&#x20;current.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.','The&#x20;longer&#x20;a&#x20;password&#x20;exists&#x20;the&#x20;higher&#x20;the&#x20;likelihood&#x20;that&#x20;it&#x20;will&#x20;be&#x20;compromised&#x20;by&#x20;a&#x20;brute&#x20;force&#x20;attack,&#x20;by&#x20;an&#x20;attacker&#x20;gaining&#x20;general&#x20;knowledge&#x20;about&#x20;the&#x20;user,&#x20;or&#x20;by&#x20;the&#x20;user&#x20;sharing&#x20;the&#x20;password.&#x20;Configuring&#x20;the&#x20;Maximum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;0&#x20;so&#x20;that&#x20;users&#x20;are&#x20;never&#x20;required&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;is&#x20;a&#x20;major&#x20;security&#x20;risk&#x20;because&#x20;that&#x20;allows&#x20;a&#x20;compromised&#x20;password&#x20;to&#x20;be&#x20;used&#x20;by&#x20;the&#x20;malicious&#x20;user&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;valid&#x20;user&#x20;is&#x20;authorized&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMaximum&#x20;password&#x20;age.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15001,'Ensure&#x20;&#039;Accounts:&#x20;Block&#x20;Microsoft&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;adding&#x20;new&#x20;Microsoft&#x20;accounts&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;onto&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Block&#x20;Microsoft&#x20;accounts.','[{\"cis\": [\"2.3.1.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15002,'Ensure&#x20;&#039;Accounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;local&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;password&#x20;protected&#x20;can&#x20;be&#x20;used&#x20;to&#x20;log&#x20;on&#x20;from&#x20;locations&#x20;other&#x20;than&#x20;the&#x20;physical&#x20;computer&#x20;console.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;local&#x20;accounts&#x20;that&#x20;have&#x20;blank&#x20;passwords&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;network&#x20;from&#x20;remote&#x20;client&#x20;computers.&#x20;Such&#x20;accounts&#x20;will&#x20;only&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;at&#x20;the&#x20;keyboard&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blank&#x20;passwords&#x20;are&#x20;a&#x20;serious&#x20;threat&#x20;to&#x20;computer&#x20;security&#x20;and&#x20;should&#x20;be&#x20;forbidden&#x20;through&#x20;both&#x20;organizational&#x20;policy&#x20;and&#x20;suitable&#x20;technical&#x20;measures.&#x20;In&#x20;fact,&#x20;the&#x20;default&#x20;settings&#x20;for&#x20;Active&#x20;Directory&#x20;domains&#x20;require&#x20;complex&#x20;passwords&#x20;of&#x20;at&#x20;least&#x20;seven&#x20;characters.&#x20;However,&#x20;if&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;create&#x20;new&#x20;accounts&#x20;bypass&#x20;your&#x20;domainbased&#x20;password&#x20;policies,&#x20;they&#x20;could&#x20;create&#x20;accounts&#x20;with&#x20;blank&#x20;passwords.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;could&#x20;build&#x20;a&#x20;stand-alone&#x20;computer,&#x20;create&#x20;one&#x20;or&#x20;more&#x20;accounts&#x20;with&#x20;blank&#x20;passwords,&#x20;and&#x20;then&#x20;join&#x20;the&#x20;computer&#x20;to&#x20;the&#x20;domain.&#x20;The&#x20;local&#x20;accounts&#x20;with&#x20;blank&#x20;passwords&#x20;would&#x20;still&#x20;function.&#x20;Anyone&#x20;who&#x20;knows&#x20;the&#x20;name&#x20;of&#x20;one&#x20;of&#x20;these&#x20;unprotected&#x20;accounts&#x20;could&#x20;then&#x20;use&#x20;it&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only.','[{\"cis\": [\"2.3.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15003,'Ensure&#x20;&#039;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#0','This&#x20;policy&#x20;setting&#x20;allows&#x20;administrators&#x20;to&#x20;enable&#x20;the&#x20;more&#x20;precise&#x20;auditing&#x20;capabilities&#x20;present&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;Audit&#x20;Policy&#x20;settings&#x20;available&#x20;in&#x20;Windows&#x20;Server&#x20;2003&#x20;Active&#x20;Directory&#x20;do&#x20;not&#x20;yet&#x20;contain&#x20;settings&#x20;for&#x20;managing&#x20;the&#x20;new&#x20;auditing&#x20;subcategories.&#x20;To&#x20;properly&#x20;apply&#x20;the&#x20;auditing&#x20;policies&#x20;prescribed&#x20;in&#x20;this&#x20;baseline,&#x20;the&#x20;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#x20;setting&#x20;needs&#x20;to&#x20;be&#x20;configured&#x20;to&#x20;Enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;*Important*:&#x20;Be&#x20;very&#x20;cautious&#x20;about&#x20;audit&#x20;settings&#x20;that&#x20;can&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;traffic.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;enable&#x20;either&#x20;success&#x20;or&#x20;failure&#x20;auditing&#x20;for&#x20;all&#x20;of&#x20;the&#x20;Privilege&#x20;Use&#x20;subcategories,&#x20;the&#x20;high&#x20;volume&#x20;of&#x20;audit&#x20;events&#x20;generated&#x20;can&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;find&#x20;other&#x20;types&#x20;of&#x20;entries&#x20;in&#x20;the&#x20;Security&#x20;log.&#x20;Such&#x20;a&#x20;configuration&#x20;could&#x20;also&#x20;have&#x20;a&#x20;significant&#x20;impact&#x20;on&#x20;system&#x20;performance.','Prior&#x20;to&#x20;the&#x20;introduction&#x20;of&#x20;auditing&#x20;subcategories&#x20;in&#x20;Windows&#x20;Vista,&#x20;it&#x20;was&#x20;difficult&#x20;to&#x20;track&#x20;events&#x20;at&#x20;a&#x20;per-system&#x20;or&#x20;per-user&#x20;level.&#x20;The&#x20;larger&#x20;event&#x20;categories&#x20;created&#x20;too&#x20;many&#x20;events&#x20;and&#x20;the&#x20;key&#x20;information&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;audited&#x20;was&#x20;difficult&#x20;to&#x20;find.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings.','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15004,'Ensure&#x20;&#039;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;system&#x20;shuts&#x20;down&#x20;if&#x20;it&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;Security&#x20;events.&#x20;It&#x20;is&#x20;a&#x20;requirement&#x20;for&#x20;Trusted&#x20;Computer&#x20;System&#x20;Evaluation&#x20;Criteria&#x20;&#40;TCSEC&#41;-C2&#x20;and&#x20;Common&#x20;Criteria&#x20;certification&#x20;to&#x20;prevent&#x20;auditable&#x20;events&#x20;from&#x20;occurring&#x20;if&#x20;the&#x20;audit&#x20;system&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;them.&#x20;Microsoft&#x20;has&#x20;chosen&#x20;to&#x20;meet&#x20;this&#x20;requirement&#x20;by&#x20;halting&#x20;the&#x20;system&#x20;and&#x20;displaying&#x20;a&#x20;stop&#x20;message&#x20;if&#x20;the&#x20;auditing&#x20;system&#x20;experiences&#x20;a&#x20;failure.&#x20;When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;system&#x20;will&#x20;be&#x20;shut&#x20;down&#x20;if&#x20;a&#x20;security&#x20;audit&#x20;cannot&#x20;be&#x20;logged&#x20;for&#x20;any&#x20;reason.&#x20;If&#x20;the&#x20;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#x20;setting&#x20;is&#x20;enabled,&#x20;unplanned&#x20;system&#x20;failures&#x20;can&#x20;occur.&#x20;The&#x20;administrative&#x20;burden&#x20;can&#x20;be&#x20;significant,&#x20;especially&#x20;if&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Retention&#x20;method&#x20;for&#x20;the&#x20;Security&#x20;log&#x20;to&#x20;Do&#x20;not&#x20;overwrite&#x20;events&#x20;&#40;clear&#x20;log&#x20;manually&#41;.&#x20;This&#x20;configuration&#x20;causes&#x20;a&#x20;repudiation&#x20;threat&#x20;&#40;a&#x20;backup&#x20;operator&#x20;could&#x20;deny&#x20;that&#x20;they&#x20;backed&#x20;up&#x20;or&#x20;restored&#x20;data&#41;&#x20;to&#x20;become&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;vulnerability,&#x20;because&#x20;a&#x20;server&#x20;could&#x20;be&#x20;forced&#x20;to&#x20;shut&#x20;down&#x20;if&#x20;it&#x20;is&#x20;overwhelmed&#x20;with&#x20;logon&#x20;events&#x20;and&#x20;other&#x20;security&#x20;events&#x20;that&#x20;are&#x20;written&#x20;to&#x20;the&#x20;Security&#x20;log.&#x20;Also,&#x20;because&#x20;the&#x20;shutdown&#x20;is&#x20;not&#x20;graceful,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;irreparable&#x20;damage&#x20;to&#x20;the&#x20;operating&#x20;system,&#x20;applications,&#x20;or&#x20;data&#x20;could&#x20;result.&#x20;Although&#x20;the&#x20;NTFS&#x20;file&#x20;system&#x20;guarantees&#x20;its&#x20;integrity&#x20;when&#x20;an&#x20;ungraceful&#x20;computer&#x20;shutdown&#x20;occurs,&#x20;it&#x20;cannot&#x20;guarantee&#x20;that&#x20;every&#x20;data&#x20;file&#x20;for&#x20;every&#x20;application&#x20;will&#x20;still&#x20;be&#x20;in&#x20;a&#x20;usable&#x20;form&#x20;when&#x20;the&#x20;computer&#x20;restarts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;the&#x20;computer&#x20;is&#x20;unable&#x20;to&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;critical&#x20;evidence&#x20;or&#x20;important&#x20;troubleshooting&#x20;information&#x20;may&#x20;not&#x20;be&#x20;available&#x20;for&#x20;review&#x20;after&#x20;a&#x20;security&#x20;incident.&#x20;Also,&#x20;an&#x20;attacker&#x20;could&#x20;potentially&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;Security&#x20;log&#x20;events&#x20;to&#x20;purposely&#x20;force&#x20;a&#x20;computer&#x20;shutdown.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits.','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15005,'Ensure&#x20;&#039;Devices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;NTFS&#x20;media.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;unauthorized&#x20;users&#x20;from&#x20;removing&#x20;data&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;access&#x20;it&#x20;on&#x20;another&#x20;computer&#x20;on&#x20;which&#x20;they&#x20;have&#x20;local&#x20;administrator&#x20;privileges.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators.','Users&#x20;may&#x20;be&#x20;able&#x20;to&#x20;move&#x20;data&#x20;on&#x20;removable&#x20;disks&#x20;to&#x20;a&#x20;different&#x20;computer&#x20;where&#x20;they&#x20;have&#x20;administrative&#x20;privileges.&#x20;The&#x20;user&#x20;could&#x20;then&#x20;take&#x20;ownership&#x20;of&#x20;any&#x20;file,&#x20;grant&#x20;themselves&#x20;full&#x20;control,&#x20;and&#x20;view&#x20;or&#x20;modify&#x20;any&#x20;file.&#x20;The&#x20;fact&#x20;that&#x20;most&#x20;removable&#x20;storage&#x20;devices&#x20;will&#x20;eject&#x20;media&#x20;by&#x20;pressing&#x20;a&#x20;mechanical&#x20;button&#x20;diminishes&#x20;the&#x20;advantage&#x20;of&#x20;this&#x20;policy&#x20;setting.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media.','[{\"cis\": [\"2.3.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15006,'Ensure&#x20;&#039;Devices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','For&#x20;a&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;a&#x20;shared&#x20;printer,&#x20;the&#x20;driver&#x20;for&#x20;that&#x20;shared&#x20;printer&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;This&#x20;security&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;install&#x20;a&#x20;printer&#x20;driver&#x20;as&#x20;part&#x20;of&#x20;connecting&#x20;to&#x20;a&#x20;shared&#x20;printer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;ability&#x20;to&#x20;add&#x20;a&#x20;local&#x20;printer.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;Administrators.','It&#x20;may&#x20;be&#x20;appropriate&#x20;in&#x20;some&#x20;organizations&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;install&#x20;printer&#x20;drivers&#x20;on&#x20;their&#x20;own&#x20;workstations.&#x20;However,&#x20;you&#x20;should&#x20;allow&#x20;only&#x20;Administrators,&#x20;not&#x20;users,&#x20;to&#x20;do&#x20;so&#x20;on&#x20;servers,&#x20;because&#x20;printer&#x20;driver&#x20;installation&#x20;on&#x20;a&#x20;server&#x20;may&#x20;unintentionally&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;become&#x20;less&#x20;stable.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;install&#x20;inappropriate&#x20;printer&#x20;drivers&#x20;in&#x20;a&#x20;deliberate&#x20;attempt&#x20;to&#x20;damage&#x20;the&#x20;computer,&#x20;or&#x20;a&#x20;user&#x20;might&#x20;accidentally&#x20;install&#x20;malicious&#x20;software&#x20;that&#x20;masquerades&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;It&#x20;is&#x20;feasible&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;disguise&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;The&#x20;program&#x20;may&#x20;appear&#x20;to&#x20;users&#x20;as&#x20;if&#x20;they&#x20;must&#x20;use&#x20;it&#x20;to&#x20;print,&#x20;but&#x20;such&#x20;a&#x20;program&#x20;could&#x20;unleash&#x20;malicious&#x20;code&#x20;on&#x20;your&#x20;computer&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers.','[{\"cis\": [\"2.3.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\", \"2,2,5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\", \"CC5.2\"]}]'),(15007,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;members&#x20;of&#x20;the&#x20;Server&#x20;Operators&#x20;group&#x20;are&#x20;allowed&#x20;to&#x20;submit&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;schedule&#x20;facility.&#x20;The&#x20;impact&#x20;of&#x20;this&#x20;policy&#x20;setting&#x20;configuration&#x20;should&#x20;be&#x20;small&#x20;for&#x20;most&#x20;organizations.&#x20;Users,&#x20;including&#x20;those&#x20;in&#x20;the&#x20;Server&#x20;Operators&#x20;group,&#x20;will&#x20;still&#x20;be&#x20;able&#x20;to&#x20;create&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;Task&#x20;Scheduler&#x20;Wizard,&#x20;but&#x20;those&#x20;jobs&#x20;will&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;with&#x20;which&#x20;the&#x20;user&#x20;authenticates&#x20;when&#x20;they&#x20;set&#x20;up&#x20;the&#x20;job.&#x20;Note:&#x20;An&#x20;AT&#x20;Service&#x20;Account&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;select&#x20;a&#x20;different&#x20;account&#x20;rather&#x20;than&#x20;the&#x20;LOCAL&#x20;SYSTEM&#x20;account.&#x20;To&#x20;change&#x20;the&#x20;account,&#x20;open&#x20;System&#x20;Tools,&#x20;click&#x20;Scheduled&#x20;Tasks,&#x20;and&#x20;then&#x20;click&#x20;Accessories&#x20;folder.&#x20;Then&#x20;click&#x20;AT&#x20;Service&#x20;Account&#x20;on&#x20;the&#x20;Advanced&#x20;menu.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;jobs&#x20;that&#x20;are&#x20;created&#x20;by&#x20;server&#x20;operators&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;service&#x20;will&#x20;execute&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;that&#x20;runs&#x20;that&#x20;service.&#x20;By&#x20;default,&#x20;that&#x20;is&#x20;the&#x20;local&#x20;SYSTEM&#x20;account.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;server&#x20;operators&#x20;could&#x20;perform&#x20;tasks&#x20;that&#x20;SYSTEM&#x20;is&#x20;able&#x20;to&#x20;do&#x20;but&#x20;that&#x20;they&#x20;would&#x20;typically&#x20;not&#x20;be&#x20;able&#x20;to&#x20;do,&#x20;such&#x20;as&#x20;add&#x20;their&#x20;account&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;group.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks.','[{\"cis\": [\"2.3.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15008,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;signing&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;server&#x20;requires&#x20;LDAP&#x20;clients&#x20;to&#x20;negotiate&#x20;data&#x20;signing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;signing.&#x20;Note:&#x20;Domain&#x20;member&#x20;computers&#x20;must&#x20;have&#x20;Network&#x20;security:&#x20;LDAP&#x20;signing&#x20;requirements&#x20;&#40;Rule&#x20;2.3.11.8&#41;&#x20;set&#x20;to&#x20;Negotiate&#x20;signing&#x20;or&#x20;higher.&#x20;If&#x20;not,&#x20;they&#x20;will&#x20;fail&#x20;to&#x20;authenticate&#x20;once&#x20;the&#x20;above&#x20;Require&#x20;signing&#x20;value&#x20;is&#x20;configured&#x20;on&#x20;the&#x20;Domain&#x20;Controllers.&#x20;Fortunately,&#x20;Negotiate&#x20;signing&#x20;is&#x20;the&#x20;default&#x20;in&#x20;the&#x20;client&#x20;configuration.&#x20;Note&#x20;#2:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;shipped&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;LDAP&#x20;simple&#x20;bind&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;to&#x20;talk&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;Note&#x20;#3:&#x20;Before&#x20;enabling&#x20;this&#x20;setting,&#x20;you&#x20;should&#x20;first&#x20;ensure&#x20;that&#x20;there&#x20;are&#x20;no&#x20;clients&#x20;&#40;including&#x20;server-based&#x20;applications&#41;&#x20;that&#x20;are&#x20;configured&#x20;to&#x20;authenticate&#x20;with&#x20;Active&#x20;Directory&#x20;via&#x20;unsigned&#x20;LDAP,&#x20;because&#x20;changing&#x20;this&#x20;setting&#x20;will&#x20;break&#x20;those&#x20;applications.&#x20;Such&#x20;applications&#x20;should&#x20;first&#x20;be&#x20;reconfigured&#x20;to&#x20;use&#x20;signed&#x20;LDAP,&#x20;Secure&#x20;LDAP&#x20;&#40;LDAPS&#41;,&#x20;or&#x20;IPsec-protected&#x20;connections.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;In&#x20;such&#x20;attacks,&#x20;an&#x20;intruder&#x20;captures&#x20;packets&#x20;between&#x20;the&#x20;server&#x20;and&#x20;the&#x20;client,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;client.&#x20;Where&#x20;LDAP&#x20;servers&#x20;are&#x20;concerned,&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;client&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;records&#x20;from&#x20;the&#x20;LDAP&#x20;directory.&#x20;To&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;intrusion&#x20;in&#x20;an&#x20;organization&#039;s&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;could&#x20;implement&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;authentication&#x20;header&#x20;mode&#x20;&#40;AH&#41;,&#x20;which&#x20;performs&#x20;mutual&#x20;authentication&#x20;and&#x20;packet&#x20;integrity&#x20;for&#x20;IP&#x20;traffic&#x20;to&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-&#x20;in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult.&#x20;Additionally,&#x20;allowing&#x20;the&#x20;use&#x20;of&#x20;regular,&#x20;unsigned&#x20;LDAP&#x20;permits&#x20;credentials&#x20;to&#x20;be&#x20;received&#x20;over&#x20;the&#x20;network&#x20;in&#x20;clear&#x20;text,&#x20;which&#x20;could&#x20;very&#x20;easily&#x20;result&#x20;in&#x20;the&#x20;interception&#x20;of&#x20;account&#x20;passwords&#x20;by&#x20;other&#x20;systems&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;signing:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements.','[{\"cis\": [\"2.3.5.2\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15009,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;Domain&#x20;Controllers&#x20;will&#x20;refuse&#x20;requests&#x20;from&#x20;member&#x20;computers&#x20;to&#x20;change&#x20;computer&#x20;account&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;a&#x20;domain,&#x20;domain&#x20;members&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;change&#x20;their&#x20;computer&#x20;account&#x20;passwords,&#x20;and&#x20;those&#x20;passwords&#x20;will&#x20;be&#x20;more&#x20;susceptible&#x20;to&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes.','[{\"cis\": [\"2.3.5.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15010,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;is&#x20;initiated&#x20;by&#x20;the&#x20;domain&#x20;member&#x20;must&#x20;be&#x20;signed&#x20;or&#x20;encrypted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.6.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15011,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;encryption&#x20;for&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;.','[{\"cis\": [\"2.3.6.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15012,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates&#x20;must&#x20;be&#x20;digitally&#x20;signed.&#x20;Digital&#x20;signatures&#x20;protect&#x20;the&#x20;traffic&#x20;from&#x20;being&#x20;modified&#x20;by&#x20;anyone&#x20;who&#x20;captures&#x20;the&#x20;data&#x20;as&#x20;it&#x20;traverses&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;.','[{\"cis\": [\"2.3.6.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15013,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;can&#x20;periodically&#x20;change&#x20;its&#x20;computer&#x20;account&#x20;password.&#x20;Computers&#x20;that&#x20;cannot&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;passwords&#x20;are&#x20;potentially&#x20;vulnerable,&#x20;because&#x20;an&#x20;attacker&#x20;might&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;system&#039;s&#x20;domain&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;default&#x20;configuration&#x20;for&#x20;Windows&#x20;Server&#x20;2003-based&#x20;computers&#x20;that&#x20;belong&#x20;to&#x20;a&#x20;domain&#x20;is&#x20;that&#x20;they&#x20;are&#x20;automatically&#x20;required&#x20;to&#x20;change&#x20;the&#x20;passwords&#x20;for&#x20;their&#x20;accounts&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;computers&#x20;that&#x20;run&#x20;Windows&#x20;Server&#x20;2003&#x20;will&#x20;retain&#x20;the&#x20;same&#x20;passwords&#x20;as&#x20;their&#x20;computer&#x20;accounts.&#x20;Computers&#x20;that&#x20;are&#x20;no&#x20;longer&#x20;able&#x20;to&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;password&#x20;are&#x20;at&#x20;risk&#x20;from&#x20;an&#x20;attacker&#x20;who&#x20;could&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;computer&#039;s&#x20;domain&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes.','[{\"cis\": [\"2.3.6.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15014,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;secure&#x20;channel&#x20;can&#x20;only&#x20;be&#x20;established&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;encrypting&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;&#40;128-bit&#41;&#x20;session&#x20;key.&#x20;To&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;the&#x20;domain&#x20;must&#x20;be&#x20;able&#x20;to&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;key,&#x20;which&#x20;means&#x20;all&#x20;Domain&#x20;Controllers&#x20;must&#x20;be&#x20;running&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;or&#x20;newer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;keys&#x20;that&#x20;are&#x20;used&#x20;to&#x20;establish&#x20;secure&#x20;channel&#x20;communications&#x20;between&#x20;Domain&#x20;Controllers&#x20;and&#x20;member&#x20;computers&#x20;are&#x20;much&#x20;stronger&#x20;in&#x20;Windows&#x20;2000&#x20;than&#x20;they&#x20;were&#x20;in&#x20;previous&#x20;Microsoft&#x20;operating&#x20;systems.&#x20;Whenever&#x20;possible,&#x20;you&#x20;should&#x20;take&#x20;advantage&#x20;of&#x20;these&#x20;stronger&#x20;session&#x20;keys&#x20;to&#x20;help&#x20;protect&#x20;secure&#x20;channel&#x20;communications&#x20;from&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;hijack&#x20;network&#x20;sessions&#x20;and&#x20;eavesdropping.&#x20;&#40;Eavesdropping&#x20;is&#x20;a&#x20;form&#x20;of&#x20;hacking&#x20;in&#x20;which&#x20;network&#x20;data&#x20;is&#x20;read&#x20;or&#x20;altered&#x20;in&#x20;transit.&#x20;The&#x20;data&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;hide&#x20;or&#x20;change&#x20;the&#x20;sender,&#x20;or&#x20;be&#x20;redirected.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key.','[{\"cis\": [\"2.3.6.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15015,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;account&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;client&#x20;computers&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;be&#x20;displayed&#x20;in&#x20;each&#x20;computer&#039;s&#x20;respective&#x20;Windows&#x20;logon&#x20;screen.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;intruders&#x20;from&#x20;collecting&#x20;account&#x20;names&#x20;visually&#x20;from&#x20;the&#x20;screens&#x20;of&#x20;desktop&#x20;or&#x20;laptop&#x20;computers&#x20;in&#x20;your&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name.','[{\"cis\": [\"2.3.7.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15016,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;must&#x20;press&#x20;CTRL+ALT+DEL&#x20;before&#x20;they&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Microsoft&#x20;developed&#x20;this&#x20;feature&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;users&#x20;with&#x20;certain&#x20;types&#x20;of&#x20;physical&#x20;impairments&#x20;to&#x20;log&#x20;on&#x20;to&#x20;computers&#x20;that&#x20;run&#x20;Windows.&#x20;If&#x20;users&#x20;are&#x20;not&#x20;required&#x20;to&#x20;press&#x20;CTRL+ALT+DEL,&#x20;they&#x20;are&#x20;susceptible&#x20;to&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;intercept&#x20;their&#x20;passwords.&#x20;If&#x20;CTRL+ALT+DEL&#x20;is&#x20;required&#x20;before&#x20;logon,&#x20;user&#x20;passwords&#x20;are&#x20;communicated&#x20;by&#x20;means&#x20;of&#x20;a&#x20;trusted&#x20;path.&#x20;An&#x20;attacker&#x20;could&#x20;install&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;that&#x20;looks&#x20;like&#x20;the&#x20;standard&#x20;Windows&#x20;logon&#x20;dialog&#x20;box&#x20;and&#x20;capture&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;attacker&#x20;would&#x20;then&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;compromised&#x20;account&#x20;with&#x20;whatever&#x20;level&#x20;of&#x20;privilege&#x20;that&#x20;user&#x20;has.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL','[{\"cis\": [\"2.3.7.2\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15017,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;','Windows&#x20;notices&#x20;inactivity&#x20;of&#x20;a&#x20;logon&#x20;session,&#x20;and&#x20;if&#x20;the&#x20;amount&#x20;of&#x20;inactive&#x20;time&#x20;exceeds&#x20;the&#x20;inactivity&#x20;limit,&#x20;then&#x20;the&#x20;screen&#x20;saver&#x20;will&#x20;run,&#x20;locking&#x20;the&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;inactivity&#x20;limit.','If&#x20;a&#x20;user&#x20;forgets&#x20;to&#x20;lock&#x20;their&#x20;computer&#x20;when&#x20;they&#x20;walk&#x20;away&#x20;it&#039;s&#x20;possible&#x20;that&#x20;a&#x20;passerby&#x20;will&#x20;hijack&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;900&#x20;or&#x20;fewer&#x20;seconds,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit.','[{\"cis\": [\"2.3.7.3\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15018,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;4&#x20;or&#x20;few','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;user&#x20;can&#x20;log&#x20;on&#x20;to&#x20;a&#x20;Windows&#x20;domain&#x20;using&#x20;cached&#x20;account&#x20;information.&#x20;Logon&#x20;information&#x20;for&#x20;domain&#x20;accounts&#x20;can&#x20;be&#x20;cached&#x20;locally&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;log&#x20;on&#x20;even&#x20;if&#x20;a&#x20;Domain&#x20;Controller&#x20;cannot&#x20;be&#x20;contacted.&#x20;This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;unique&#x20;users&#x20;for&#x20;whom&#x20;logon&#x20;information&#x20;is&#x20;cached&#x20;locally.&#x20;If&#x20;this&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;the&#x20;logon&#x20;cache&#x20;feature&#x20;is&#x20;disabled.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;server&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;&#x20;.','The&#x20;number&#x20;that&#x20;is&#x20;assigned&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;indicates&#x20;the&#x20;number&#x20;of&#x20;users&#x20;whose&#x20;logon&#x20;information&#x20;the&#x20;computer&#x20;will&#x20;cache&#x20;locally.&#x20;If&#x20;the&#x20;number&#x20;is&#x20;set&#x20;to&#x20;4,&#x20;then&#x20;the&#x20;computer&#x20;caches&#x20;logon&#x20;information&#x20;for&#x20;4&#x20;users.&#x20;When&#x20;a&#x20;5th&#x20;user&#x20;logs&#x20;on&#x20;to&#x20;the&#x20;computer,&#x20;the&#x20;server&#x20;overwrites&#x20;the&#x20;oldest&#x20;cached&#x20;logon&#x20;session.&#x20;Users&#x20;who&#x20;access&#x20;the&#x20;computer&#x20;console&#x20;will&#x20;have&#x20;their&#x20;logon&#x20;credentials&#x20;cached&#x20;on&#x20;that&#x20;computer.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;computer&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;attempt&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;To&#x20;mitigate&#x20;this&#x20;type&#x20;of&#x20;attack,&#x20;Windows&#x20;encrypts&#x20;the&#x20;information&#x20;and&#x20;obscures&#x20;its&#x20;physical&#x20;location.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;','[{\"cis\": [\"2.3.7.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15019,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;between&#x20;5&#x20;and&#x20;14&#x20;days&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;far&#x20;in&#x20;advance&#x20;users&#x20;are&#x20;warned&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;at&#x20;least&#x20;5&#x20;days&#x20;but&#x20;no&#x20;more&#x20;than&#x20;14&#x20;days&#x20;to&#x20;sufficiently&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;passwords&#x20;will&#x20;expire.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days.','It&#x20;is&#x20;recommended&#x20;that&#x20;user&#x20;passwords&#x20;be&#x20;configured&#x20;to&#x20;expire&#x20;periodically.&#x20;Users&#x20;will&#x20;need&#x20;to&#x20;be&#x20;warned&#x20;that&#x20;their&#x20;passwords&#x20;are&#x20;going&#x20;to&#x20;expire,&#x20;or&#x20;they&#x20;may&#x20;inadvertently&#x20;be&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;computer&#x20;when&#x20;their&#x20;passwords&#x20;expire.&#x20;This&#x20;condition&#x20;could&#x20;lead&#x20;to&#x20;confusion&#x20;for&#x20;users&#x20;who&#x20;access&#x20;the&#x20;network&#x20;locally,&#x20;or&#x20;make&#x20;it&#x20;impossible&#x20;for&#x20;users&#x20;to&#x20;access&#x20;your&#x20;organization&#039;s&#x20;network&#x20;through&#x20;dial-up&#x20;or&#x20;virtual&#x20;private&#x20;network&#x20;&#40;VPN&#41;&#x20;connections.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration.','[{\"cis\": [\"2.3.7.7\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15020,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Logon&#x20;information&#x20;is&#x20;required&#x20;to&#x20;unlock&#x20;a&#x20;locked&#x20;computer.&#x20;For&#x20;domain&#x20;accounts,&#x20;this&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;it&#x20;is&#x20;necessary&#x20;to&#x20;contact&#x20;a&#x20;Domain&#x20;Controller&#x20;to&#x20;unlock&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','By&#x20;default,&#x20;the&#x20;computer&#x20;caches&#x20;in&#x20;memory&#x20;the&#x20;credentials&#x20;of&#x20;any&#x20;users&#x20;who&#x20;are&#x20;authenticated&#x20;locally.&#x20;The&#x20;computer&#x20;uses&#x20;these&#x20;cached&#x20;credentials&#x20;to&#x20;authenticate&#x20;anyone&#x20;who&#x20;attempts&#x20;to&#x20;unlock&#x20;the&#x20;console.&#x20;When&#x20;cached&#x20;credentials&#x20;are&#x20;used,&#x20;any&#x20;changes&#x20;that&#x20;have&#x20;recently&#x20;been&#x20;made&#x20;to&#x20;the&#x20;account&#x20;-&#x20;such&#x20;as&#x20;user&#x20;rights&#x20;assignments,&#x20;account&#x20;lockout,&#x20;or&#x20;the&#x20;account&#x20;being&#x20;disabled&#x20;-&#x20;are&#x20;not&#x20;considered&#x20;or&#x20;applied&#x20;after&#x20;the&#x20;account&#x20;is&#x20;authenticated.&#x20;User&#x20;privileges&#x20;are&#x20;not&#x20;updated,&#x20;and&#x20;&#40;more&#x20;importantly&#41;&#x20;disabled&#x20;accounts&#x20;are&#x20;still&#x20;able&#x20;to&#x20;unlock&#x20;the&#x20;console&#x20;of&#x20;the&#x20;computer.','','To&#x20;implement&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation','[{\"cis\": [\"2.3.7.8\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15021,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Lock&#x20;Workstation&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;happens&#x20;when&#x20;the&#x20;smart&#x20;card&#x20;for&#x20;a&#x20;logged-on&#x20;user&#x20;is&#x20;removed&#x20;from&#x20;the&#x20;smart&#x20;card&#x20;reader.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Lock&#x20;Workstation.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Users&#x20;sometimes&#x20;forget&#x20;to&#x20;lock&#x20;their&#x20;workstations&#x20;when&#x20;they&#x20;are&#x20;away&#x20;from&#x20;them,&#x20;allowing&#x20;the&#x20;possibility&#x20;for&#x20;malicious&#x20;users&#x20;to&#x20;access&#x20;their&#x20;computers.&#x20;If&#x20;smart&#x20;cards&#x20;are&#x20;used&#x20;for&#x20;authentication,&#x20;the&#x20;computer&#x20;should&#x20;automatically&#x20;lock&#x20;itself&#x20;when&#x20;the&#x20;card&#x20;is&#x20;removed&#x20;to&#x20;ensure&#x20;that&#x20;only&#x20;the&#x20;user&#x20;with&#x20;the&#x20;smart&#x20;card&#x20;is&#x20;accessing&#x20;resources&#x20;using&#x20;those&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Lock&#x20;Workstation&#x20;&#40;or,&#x20;if&#x20;applicable&#x20;for&#x20;your&#x20;environment,&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior.','[{\"cis\": [\"2.3.7.9\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15022,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;client&#x20;component.&#x20;Note:&#x20;When&#x20;Windows&#x20;Vista-based&#x20;computers&#x20;have&#x20;this&#x20;policy&#x20;setting&#x20;enabled&#x20;and&#x20;they&#x20;connect&#x20;to&#x20;file&#x20;or&#x20;print&#x20;shares&#x20;on&#x20;remote&#x20;servers,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;setting&#x20;is&#x20;synchronized&#x20;with&#x20;its&#x20;companion&#x20;setting,&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;,&#x20;on&#x20;those&#x20;servers.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;these&#x20;settings,&#x20;see&#x20;the&#x20;&#039;Microsoft&#x20;network&#x20;client&#x20;and&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;four&#x20;related&#x20;settings&#41;&#039;&#x20;section&#x20;in&#x20;Chapter&#x20;5&#x20;of&#x20;the&#x20;Threats&#x20;and&#x20;Countermeasures&#x20;guide.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.8.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15023,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;attempt&#x20;to&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing.&#x20;Note:&#x20;Enabling&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;makes&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;.','[{\"cis\": [\"2.3.8.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15024,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;redirector&#x20;will&#x20;send&#x20;plaintext&#x20;passwords&#x20;during&#x20;authentication&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#x20;that&#x20;do&#x20;not&#x20;support&#x20;password&#x20;encryption.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;strong&#x20;business&#x20;case&#x20;to&#x20;enable&#x20;it.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;unencrypted&#x20;passwords&#x20;will&#x20;be&#x20;allowed&#x20;across&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;the&#x20;server&#x20;can&#x20;transmit&#x20;passwords&#x20;in&#x20;plaintext&#x20;across&#x20;the&#x20;network&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;offer&#x20;SMB&#x20;services,&#x20;which&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;risk.&#x20;These&#x20;other&#x20;computers&#x20;may&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;SMB&#x20;security&#x20;mechanisms&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;Server&#x20;2003.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers.','[{\"cis\": [\"2.3.8.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15025,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;amount&#x20;of&#x20;continuous&#x20;idle&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;in&#x20;an&#x20;SMB&#x20;session&#x20;before&#x20;the&#x20;session&#x20;is&#x20;suspended&#x20;because&#x20;of&#x20;inactivity.&#x20;Administrators&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;control&#x20;when&#x20;a&#x20;computer&#x20;suspends&#x20;an&#x20;inactive&#x20;SMB&#x20;session.&#x20;If&#x20;client&#x20;activity&#x20;resumes,&#x20;the&#x20;session&#x20;is&#x20;automatically&#x20;reestablished.&#x20;A&#x20;value&#x20;of&#x20;0&#x20;appears&#x20;to&#x20;allow&#x20;sessions&#x20;to&#x20;persist&#x20;indefinitely.&#x20;The&#x20;maximum&#x20;value&#x20;is&#x20;99999,&#x20;which&#x20;is&#x20;over&#x20;69&#x20;days;&#x20;in&#x20;effect,&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&#x20;0.','Each&#x20;SMB&#x20;session&#x20;consumes&#x20;server&#x20;resources,&#x20;and&#x20;numerous&#x20;null&#x20;sessions&#x20;will&#x20;slow&#x20;the&#x20;server&#x20;or&#x20;possibly&#x20;cause&#x20;it&#x20;to&#x20;fail.&#x20;An&#x20;attacker&#x20;could&#x20;repeatedly&#x20;establish&#x20;SMB&#x20;sessions&#x20;until&#x20;the&#x20;server&#039;s&#x20;SMB&#x20;services&#x20;become&#x20;slow&#x20;or&#x20;unresponsive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session.','[{\"cis\": [\"2.3.9.1\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15026,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;server&#x20;component.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;in&#x20;a&#x20;mixed&#x20;environment&#x20;to&#x20;prevent&#x20;downstream&#x20;clients&#x20;from&#x20;using&#x20;the&#x20;workstation&#x20;as&#x20;a&#x20;network&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.9.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15027,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;server&#x20;will&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing&#x20;with&#x20;clients&#x20;that&#x20;request&#x20;it.&#x20;If&#x20;no&#x20;signing&#x20;request&#x20;comes&#x20;from&#x20;the&#x20;client,&#x20;a&#x20;connection&#x20;will&#x20;be&#x20;allowed&#x20;without&#x20;a&#x20;signature&#x20;if&#x20;the&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#x20;setting&#x20;is&#x20;not&#x20;enabled.&#x20;Note:&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;to&#x20;make&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;.','[{\"cis\": [\"2.3.9.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15028,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.11.6&#41;.&#x20;If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;necessary&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;effective.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;then&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting.&#x20;Otherwise,&#x20;users&#x20;who&#x20;should&#x20;not&#x20;have&#x20;access&#x20;to&#x20;network&#x20;resources&#x20;outside&#x20;of&#x20;their&#x20;logon&#x20;hours&#x20;may&#x20;actually&#x20;be&#x20;able&#x20;to&#x20;continue&#x20;to&#x20;use&#x20;those&#x20;resources&#x20;with&#x20;sessions&#x20;that&#x20;were&#x20;established&#x20;during&#x20;allowed&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire.','[{\"cis\": [\"2.3.9.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15029,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;level&#x20;of&#x20;validation&#x20;a&#x20;computer&#x20;with&#x20;shared&#x20;folders&#x20;or&#x20;printers&#x20;&#40;the&#x20;server&#41;&#x20;performs&#x20;on&#x20;the&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;that&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;client&#x20;computer&#x20;when&#x20;it&#x20;establishes&#x20;a&#x20;session&#x20;using&#x20;the&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;The&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;provides&#x20;the&#x20;basis&#x20;for&#x20;file&#x20;and&#x20;print&#x20;sharing&#x20;and&#x20;other&#x20;networking&#x20;operations,&#x20;such&#x20;as&#x20;remote&#x20;Windows&#x20;administration.&#x20;The&#x20;SMB&#x20;protocol&#x20;supports&#x20;validating&#x20;the&#x20;SMB&#x20;server&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;within&#x20;the&#x20;authentication&#x20;blob&#x20;provided&#x20;by&#x20;a&#x20;SMB&#x20;client&#x20;to&#x20;prevent&#x20;a&#x20;class&#x20;of&#x20;attacks&#x20;against&#x20;SMB&#x20;servers&#x20;referred&#x20;to&#x20;as&#x20;SMB&#x20;relay&#x20;attacks.&#x20;This&#x20;setting&#x20;will&#x20;affect&#x20;both&#x20;SMB1&#x20;and&#x20;SMB2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.&#x20;Note:&#x20;Since&#x20;the&#x20;release&#x20;of&#x20;the&#x20;MS&#x20;KB3161561&#x20;security&#x20;patch,&#x20;this&#x20;setting&#x20;can&#x20;cause&#x20;significant&#x20;issues&#x20;&#40;such&#x20;as&#x20;replication&#x20;problems,&#x20;group&#x20;policy&#x20;editing&#x20;issues&#x20;and&#x20;blue&#x20;screen&#x20;crashes&#41;&#x20;on&#x20;Domain&#x20;Controllers&#x20;when&#x20;used&#x20;simultaneously&#x20;with&#x20;UNC&#x20;path&#x20;hardening&#x20;&#40;i.e.&#x20;Rule&#x20;18.5.14.1&#41;.&#x20;CIS&#x20;therefore&#x20;recommends&#x20;against&#x20;deploying&#x20;this&#x20;setting&#x20;on&#x20;Domain&#x20;Controllers.','The&#x20;identity&#x20;of&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;spoofed&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;network&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;&#40;configuring&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level','[{\"cis\": [\"2.3.9.5\"]}, {\"cis_csc\": [\"14\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15030,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;the&#x20;accounts&#x20;in&#x20;the&#x20;Security&#x20;Accounts&#x20;Manager&#x20;&#40;SAM&#41;.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;with&#x20;anonymous&#x20;connections&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;allows&#x20;additional&#x20;restrictions&#x20;on&#x20;anonymous&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts.','[{\"cis\": [\"2.3.10.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15031,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;SAM&#x20;accounts&#x20;as&#x20;well&#x20;as&#x20;shares.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;anonymous&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;and&#x20;network&#x20;share&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;U&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares.','[{\"cis\": [\"2.3.10.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15032,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Credential&#x20;Manager&#x20;&#40;formerly&#x20;called&#x20;Stored&#x20;User&#x20;Names&#x20;and&#x20;Passwords&#41;&#x20;saves&#x20;passwords&#x20;or&#x20;credentials&#x20;for&#x20;later&#x20;use&#x20;when&#x20;it&#x20;gains&#x20;domain&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Changes&#x20;to&#x20;this&#x20;setting&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;Windows&#x20;is&#x20;restarted.','Passwords&#x20;that&#x20;are&#x20;cached&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;the&#x20;user&#x20;when&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;computer.&#x20;Although&#x20;this&#x20;information&#x20;may&#x20;sound&#x20;obvious,&#x20;a&#x20;problem&#x20;can&#x20;arise&#x20;if&#x20;the&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;reads&#x20;the&#x20;passwords&#x20;and&#x20;forwards&#x20;them&#x20;to&#x20;another,&#x20;unauthorized&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication.','[{\"cis\": [\"2.3.10.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15033,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;additional&#x20;permissions&#x20;are&#x20;assigned&#x20;for&#x20;anonymous&#x20;connections&#x20;to&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords,&#x20;perform&#x20;social&#x20;engineering&#x20;attacks,&#x20;or&#x20;launch&#x20;DoS&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users.','[{\"cis\": [\"2.3.10.5\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15034,'Configure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;-&#x20;Level&#x20;1&#x20;-&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;LSARPC,&#x20;NETLOGON,&#x20;SAMR&#x20;and&#x20;&#40;when&#x20;the&#x20;legacy&#x20;Computer&#x20;Browser&#x20;service&#x20;is&#x20;enabled&#41;&#x20;BROWSER.&#x20;-&#x20;Level&#x20;1&#x20;-&#x20;Member&#x20;Server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;,&#x20;or&#x20;&#40;when&#x20;the&#x20;legacy&#x20;Computer&#x20;Browser&#x20;service&#x20;is&#x20;enabled&#41;&#x20;BROWSER.&#x20;Note:&#x20;A&#x20;Member&#x20;Server&#x20;that&#x20;holds&#x20;the&#x20;Remote&#x20;Desktop&#x20;Services&#x20;Role&#x20;with&#x20;Remote&#x20;Desktop&#x20;Licensing&#x20;Role&#x20;Service&#x20;will&#x20;require&#x20;a&#x20;special&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;allow&#x20;the&#x20;HydraLSPipe&#x20;and&#x20;TermServLicensing&#x20;Named&#x20;Pipes&#x20;to&#x20;be&#x20;accessed&#x20;anonymously.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously.','[{\"cis\": [\"2.3.10.6\"]}, {\"cis_csc\": [\"14.1\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15035,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;There&#x20;was&#x20;a&#x20;setting&#x20;with&#x20;that&#x20;name&#x20;in&#x20;Windows&#x20;XP,&#x20;but&#x20;it&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-&#x20;paths&#039;&#x20;in&#x20;Windows&#x20;Server&#x20;2003,&#x20;Windows&#x20;Vista,&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.','The&#x20;registry&#x20;is&#x20;a&#x20;database&#x20;that&#x20;contains&#x20;computer&#x20;configuration&#x20;information,&#x20;and&#x20;much&#x20;of&#x20;the&#x20;information&#x20;is&#x20;sensitive.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;information&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack,&#x20;suitable&#x20;ACLs&#x20;are&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;to&#x20;help&#x20;protect&#x20;it&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlProductOptions&#x20;|&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths.','[{\"cis\": [\"2.3.10.7\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15036,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;In&#x20;Windows&#x20;XP&#x20;this&#x20;setting&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths,&#039;&#x20;the&#x20;setting&#x20;with&#x20;that&#x20;same&#x20;name&#x20;in&#x20;Windows&#x20;Vista,&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;and&#x20;Windows&#x20;Server&#x20;2003&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.','The&#x20;registry&#x20;contains&#x20;sensitive&#x20;computer&#x20;configuration&#x20;information&#x20;that&#x20;could&#x20;be&#x20;used&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;The&#x20;fact&#x20;that&#x20;the&#x20;default&#x20;ACLs&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;are&#x20;fairly&#x20;restrictive&#x20;and&#x20;help&#x20;to&#x20;protect&#x20;the&#x20;registry&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;|&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;|&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;|&#x20;SystemCurrentControlSetServicesSysmonLog&#x20;|&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;|&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;|&#x20;and&#x20;sub-paths.&#x20;When&#x20;a&#x20;server&#x20;holds&#x20;the&#x20;Active&#x20;Directory&#x20;Certificate&#x20;Services&#x20;Role&#x20;with&#x20;Certification&#x20;Authority&#x20;Role&#x20;Service,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesCertSvc.&#x20;When&#x20;a&#x20;server&#x20;has&#x20;the&#x20;WINS&#x20;Server&#x20;Feature&#x20;installed,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesWINS','[{\"cis\": [\"2.3.10.8\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15037,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','When&#x20;enabled,&#x20;this&#x20;policy&#x20;setting&#x20;restricts&#x20;anonymous&#x20;access&#x20;to&#x20;only&#x20;those&#x20;shares&#x20;and&#x20;pipes&#x20;that&#x20;are&#x20;named&#x20;in&#x20;the&#x20;Network&#x20;access:&#x20;Named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;and&#x20;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;settings.&#x20;This&#x20;policy&#x20;setting&#x20;controls&#x20;null&#x20;session&#x20;access&#x20;to&#x20;shares&#x20;on&#x20;your&#x20;computers&#x20;by&#x20;adding&#x20;RestrictNullSessAccess&#x20;with&#x20;the&#x20;value&#x20;1&#x20;in&#x20;the&#x20;HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParameters&#x20;registry&#x20;key.&#x20;This&#x20;registry&#x20;value&#x20;toggles&#x20;null&#x20;session&#x20;shares&#x20;on&#x20;or&#x20;off&#x20;to&#x20;control&#x20;whether&#x20;the&#x20;server&#x20;service&#x20;restricts&#x20;unauthenticated&#x20;clients&#039;&#x20;access&#x20;to&#x20;named&#x20;resources.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Null&#x20;sessions&#x20;are&#x20;a&#x20;weakness&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;through&#x20;shares&#x20;&#40;including&#x20;the&#x20;default&#x20;shares&#41;&#x20;on&#x20;computers&#x20;in&#x20;your&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares.','[{\"cis\": [\"2.3.10.9\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15038,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;network&#x20;shares&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;anonymous&#x20;users.&#x20;The&#x20;default&#x20;configuration&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;has&#x20;little&#x20;effect&#x20;because&#x20;all&#x20;users&#x20;have&#x20;to&#x20;be&#x20;authenticated&#x20;before&#x20;they&#x20;can&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;.','It&#x20;is&#x20;very&#x20;dangerous&#x20;to&#x20;allow&#x20;any&#x20;values&#x20;in&#x20;this&#x20;setting.&#x20;Any&#x20;shares&#x20;that&#x20;are&#x20;listed&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;any&#x20;network&#x20;user,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously.','[{\"cis\": [\"2.3.10.10\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15039,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;network&#x20;logons&#x20;that&#x20;use&#x20;local&#x20;accounts&#x20;are&#x20;authenticated.&#x20;The&#x20;Classic&#x20;option&#x20;allows&#x20;precise&#x20;control&#x20;over&#x20;access&#x20;to&#x20;resources,&#x20;including&#x20;the&#x20;ability&#x20;to&#x20;assign&#x20;different&#x20;types&#x20;of&#x20;access&#x20;to&#x20;different&#x20;users&#x20;for&#x20;the&#x20;same&#x20;resource.&#x20;The&#x20;Guest&#x20;only&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;treat&#x20;all&#x20;users&#x20;equally.&#x20;In&#x20;this&#x20;context,&#x20;all&#x20;users&#x20;authenticate&#x20;as&#x20;Guest&#x20;only&#x20;to&#x20;receive&#x20;the&#x20;same&#x20;access&#x20;level&#x20;to&#x20;a&#x20;given&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;interactive&#x20;logons&#x20;that&#x20;are&#x20;performed&#x20;remotely&#x20;by&#x20;using&#x20;such&#x20;services&#x20;as&#x20;Telnet&#x20;or&#x20;Remote&#x20;Desktop&#x20;Services&#x20;&#40;formerly&#x20;called&#x20;Terminal&#x20;Services&#41;.','With&#x20;the&#x20;Guest&#x20;only&#x20;model,&#x20;any&#x20;user&#x20;who&#x20;can&#x20;authenticate&#x20;to&#x20;your&#x20;computer&#x20;over&#x20;the&#x20;network&#x20;does&#x20;so&#x20;with&#x20;guest&#x20;privileges,&#x20;which&#x20;probably&#x20;means&#x20;that&#x20;they&#x20;will&#x20;not&#x20;have&#x20;write&#x20;access&#x20;to&#x20;shared&#x20;resources&#x20;on&#x20;that&#x20;computer.&#x20;Although&#x20;this&#x20;restriction&#x20;does&#x20;increase&#x20;security,&#x20;it&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;authorized&#x20;users&#x20;to&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;those&#x20;computers&#x20;because&#x20;ACLs&#x20;on&#x20;those&#x20;resources&#x20;must&#x20;include&#x20;access&#x20;control&#x20;entries&#x20;&#40;ACEs&#41;&#x20;for&#x20;the&#x20;Guest&#x20;account.&#x20;With&#x20;the&#x20;Classic&#x20;model,&#x20;local&#x20;accounts&#x20;should&#x20;be&#x20;password&#x20;protected.&#x20;Otherwise,&#x20;if&#x20;Guest&#x20;access&#x20;is&#x20;enabled,&#x20;anyone&#x20;can&#x20;use&#x20;those&#x20;user&#x20;accounts&#x20;to&#x20;access&#x20;shared&#x20;system&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts.','[{\"cis\": [\"2.3.10.11\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1.3\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15040,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Local&#x20;System&#x20;services&#x20;that&#x20;use&#x20;Negotiate&#x20;when&#x20;reverting&#x20;to&#x20;NTLM&#x20;authentication&#x20;can&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;This&#x20;policy&#x20;is&#x20;supported&#x20;on&#x20;at&#x20;least&#x20;Windows&#x20;7&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;R2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;connecting&#x20;to&#x20;computers&#x20;running&#x20;versions&#x20;of&#x20;Windows&#x20;earlier&#x20;than&#x20;Windows&#x20;Vista&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;services&#x20;running&#x20;as&#x20;Local&#x20;System&#x20;and&#x20;using&#x20;SPNEGO&#x20;&#40;Negotiate&#41;&#x20;that&#x20;revert&#x20;to&#x20;NTLM&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;In&#x20;Windows&#x20;7,&#x20;if&#x20;you&#x20;are&#x20;connecting&#x20;to&#x20;a&#x20;computer&#x20;running&#x20;Windows&#x20;Server&#x20;2008&#x20;or&#x20;Windows&#x20;Vista,&#x20;then&#x20;a&#x20;system&#x20;service&#x20;uses&#x20;either&#x20;the&#x20;computer&#x20;identity&#x20;or&#x20;a&#x20;NULL&#x20;session.&#x20;When&#x20;connecting&#x20;with&#x20;a&#x20;NULL&#x20;session,&#x20;a&#x20;system-generated&#x20;session&#x20;key&#x20;is&#x20;created,&#x20;which&#x20;provides&#x20;no&#x20;protection&#x20;but&#x20;allows&#x20;applications&#x20;to&#x20;sign&#x20;and&#x20;encrypt&#x20;data&#x20;without&#x20;errors.&#x20;When&#x20;connecting&#x20;with&#x20;the&#x20;computer&#x20;identity,&#x20;both&#x20;signing&#x20;and&#x20;encryption&#x20;is&#x20;supported&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;data&#x20;protection.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM.','[{\"cis\": [\"2.3.11.1\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15041,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;NTLM&#x20;is&#x20;allowed&#x20;to&#x20;fall&#x20;back&#x20;to&#x20;a&#x20;NULL&#x20;session&#x20;when&#x20;used&#x20;with&#x20;LocalSystem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','NULL&#x20;sessions&#x20;are&#x20;less&#x20;secure&#x20;because&#x20;by&#x20;definition&#x20;they&#x20;are&#x20;unauthenticated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback.','[{\"cis\": [\"2.3.11.2\"]}, {\"cis_csc\": [\"14\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15042,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;determines&#x20;if&#x20;online&#x20;identities&#x20;are&#x20;able&#x20;to&#x20;authenticate&#x20;to&#x20;this&#x20;computer.&#x20;The&#x20;Public&#x20;Key&#x20;Cryptography&#x20;Based&#x20;User-to-User&#x20;&#40;PKU2U&#41;&#x20;protocol&#x20;introduced&#x20;in&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;R2&#x20;is&#x20;implemented&#x20;as&#x20;a&#x20;security&#x20;support&#x20;provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;enables&#x20;peer-to-peer&#x20;authentication,&#x20;particularly&#x20;through&#x20;the&#x20;Windows&#x20;7&#x20;media&#x20;and&#x20;file&#x20;sharing&#x20;feature&#x20;called&#x20;Homegroup,&#x20;which&#x20;permits&#x20;sharing&#x20;between&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;members&#x20;of&#x20;a&#x20;domain.&#x20;With&#x20;PKU2U,&#x20;a&#x20;new&#x20;extension&#x20;was&#x20;introduced&#x20;to&#x20;the&#x20;Negotiate&#x20;authentication&#x20;package,&#x20;Spnego.dll.&#x20;In&#x20;previous&#x20;versions&#x20;of&#x20;Windows,&#x20;Negotiate&#x20;decided&#x20;whether&#x20;to&#x20;use&#x20;Kerberos&#x20;or&#x20;NTLM&#x20;for&#x20;authentication.&#x20;The&#x20;extension&#x20;SSP&#x20;for&#x20;Negotiate,&#x20;Negoexts.dll,&#x20;which&#x20;is&#x20;treated&#x20;as&#x20;an&#x20;authentication&#x20;protocol&#x20;by&#x20;Windows,&#x20;supports&#x20;Microsoft&#x20;SSPs&#x20;including&#x20;PKU2U.&#x20;When&#x20;computers&#x20;are&#x20;configured&#x20;to&#x20;accept&#x20;authentication&#x20;requests&#x20;by&#x20;using&#x20;online&#x20;IDs,&#x20;Negoexts.dll&#x20;calls&#x20;the&#x20;PKU2U&#x20;SSP&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;PKU2U&#x20;SSP&#x20;obtains&#x20;a&#x20;local&#x20;certificate&#x20;and&#x20;exchanges&#x20;the&#x20;policy&#x20;between&#x20;the&#x20;peer&#x20;computers.&#x20;When&#x20;validated&#x20;on&#x20;the&#x20;peer&#x20;computer,&#x20;the&#x20;certificate&#x20;within&#x20;the&#x20;metadata&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;logon&#x20;peer&#x20;for&#x20;validation&#x20;and&#x20;associates&#x20;the&#x20;user&#039;s&#x20;certificate&#x20;to&#x20;a&#x20;security&#x20;token&#x20;and&#x20;the&#x20;logon&#x20;process&#x20;completes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;PKU2U&#x20;protocol&#x20;is&#x20;a&#x20;peer-to-peer&#x20;authentication&#x20;protocol&#x20;-&#x20;authentication&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;in&#x20;most&#x20;managed&#x20;networks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities.','[{\"cis\": [\"2.3.11.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15043,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;RC4_HMAC_MD5,&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;t','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;encryption&#x20;types&#x20;that&#x20;Kerberos&#x20;is&#x20;allowed&#x20;to&#x20;use.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types.&#x20;Note:&#x20;Some&#x20;legacy&#x20;applications&#x20;and&#x20;OSes&#x20;may&#x20;require&#x20;RC4_HMAC_MD5&#x20;-&#x20;we&#x20;recommend&#x20;you&#x20;test&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;verify&#x20;whether&#x20;you&#x20;can&#x20;safely&#x20;remove&#x20;it.&#x20;For&#x20;the&#x20;purposes&#x20;of&#x20;scoring&#x20;we&#x20;have&#x20;allowed&#x20;the&#x20;use&#x20;of&#x20;RC4_HMAC_MD5&#x20;as&#x20;an&#x20;optional&#x20;setting.','he&#x20;strength&#x20;of&#x20;each&#x20;encryption&#x20;algorithm&#x20;varies&#x20;from&#x20;one&#x20;to&#x20;the&#x20;next,&#x20;choosing&#x20;stronger&#x20;algorithms&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;compromise&#x20;however&#x20;doing&#x20;so&#x20;may&#x20;cause&#x20;issues&#x20;when&#x20;the&#x20;computer&#x20;attempts&#x20;to&#x20;authenticate&#x20;with&#x20;systems&#x20;that&#x20;do&#x20;not&#x20;support&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos.','[{\"cis\": [\"2.3.11.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15044,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;hash&#x20;value&#x20;for&#x20;the&#x20;new&#x20;password&#x20;is&#x20;stored&#x20;when&#x20;the&#x20;password&#x20;is&#x20;changed.&#x20;The&#x20;LM&#x20;hash&#x20;is&#x20;relatively&#x20;weak&#x20;and&#x20;prone&#x20;to&#x20;attack&#x20;compared&#x20;to&#x20;the&#x20;cryptographically&#x20;stronger&#x20;Microsoft&#x20;Windows&#x20;NT&#x20;hash.&#x20;Since&#x20;LM&#x20;hashes&#x20;are&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;in&#x20;the&#x20;security&#x20;database,&#x20;passwords&#x20;can&#x20;then&#x20;be&#x20;easily&#x20;compromised&#x20;if&#x20;the&#x20;database&#x20;is&#x20;attacked.&#x20;Note:&#x20;Older&#x20;operating&#x20;systems&#x20;and&#x20;some&#x20;third-party&#x20;applications&#x20;may&#x20;fail&#x20;when&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled.&#x20;Also,&#x20;note&#x20;that&#x20;the&#x20;password&#x20;will&#x20;need&#x20;to&#x20;be&#x20;changed&#x20;on&#x20;all&#x20;accounts&#x20;after&#x20;you&#x20;enable&#x20;this&#x20;setting&#x20;to&#x20;gain&#x20;the&#x20;proper&#x20;benefit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;SAM&#x20;file&#x20;can&#x20;be&#x20;targeted&#x20;by&#x20;attackers&#x20;who&#x20;seek&#x20;access&#x20;to&#x20;username&#x20;and&#x20;password&#x20;hashes.&#x20;Such&#x20;attacks&#x20;use&#x20;special&#x20;tools&#x20;to&#x20;crack&#x20;passwords,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;users&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;resources&#x20;on&#x20;your&#x20;network.&#x20;These&#x20;types&#x20;of&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;prevented&#x20;if&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;but&#x20;it&#x20;will&#x20;be&#x20;much&#x20;more&#x20;difficult&#x20;for&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;to&#x20;succeed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change.','[{\"cis\": [\"2.3.11.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15045,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.9.4&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;unscored&#x20;because&#x20;there&#x20;is&#x20;not&#x20;a&#x20;documented&#x20;registry&#x20;value&#x20;that&#x20;corresponds&#x20;to&#x20;it.&#x20;We&#x20;still&#x20;strongly&#x20;encourage&#x20;that&#x20;it&#x20;be&#x20;configured&#x20;as&#x20;Enabled,&#x20;to&#x20;ensure&#x20;that&#x20;logon&#x20;hours&#x20;&#40;when&#x20;configured&#41;&#x20;are&#x20;properly&#x20;enforced.','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;a&#x20;user&#x20;could&#x20;remain&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;outside&#x20;of&#x20;their&#x20;allotted&#x20;logon&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire.','[{\"cis\": [\"2.3.11.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15046,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM&#039;','LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;was&#x20;a&#x20;family&#x20;of&#x20;early&#x20;Microsoft&#x20;client/server&#x20;software&#x20;&#40;predating&#x20;Windows&#x20;NT&#41;&#x20;that&#x20;allowed&#x20;users&#x20;to&#x20;link&#x20;personal&#x20;computers&#x20;together&#x20;on&#x20;a&#x20;single&#x20;network.&#x20;LM&#x20;network&#x20;capabilities&#x20;included&#x20;transparent&#x20;file&#x20;and&#x20;print&#x20;sharing,&#x20;user&#x20;security&#x20;features,&#x20;and&#x20;network&#x20;administration&#x20;tools.&#x20;In&#x20;Active&#x20;Directory&#x20;domains,&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;the&#x20;default&#x20;authentication&#x20;protocol.&#x20;However,&#x20;if&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;not&#x20;negotiated&#x20;for&#x20;some&#x20;reason,&#x20;Active&#x20;Directory&#x20;will&#x20;use&#x20;LM,&#x20;NTLM,&#x20;or&#x20;NTLMv2.&#x20;LAN&#x20;Manager&#x20;authentication&#x20;includes&#x20;the&#x20;LM,&#x20;NTLM,&#x20;and&#x20;NTLM&#x20;version&#x20;2&#x20;&#40;NTLMv2&#41;&#x20;variants,&#x20;and&#x20;is&#x20;the&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;to&#x20;authenticate&#x20;all&#x20;Windows&#x20;clients&#x20;when&#x20;they&#x20;perform&#x20;the&#x20;following&#x20;operations:&#x20;-Join&#x20;a&#x20;domain&#x20;-Authenticate&#x20;between&#x20;Active&#x20;Directory&#x20;forests&#x20;-Authenticate&#x20;to&#x20;down-level&#x20;domains&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;do&#x20;not&#x20;run&#x20;Windows&#x20;2000,&#x20;Windows&#x20;Server&#x20;2003,&#x20;or&#x20;Windows&#x20;XP&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;in&#x20;the&#x20;domain.&#x20;The&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#x20;setting&#x20;determines&#x20;which&#x20;challenge/response&#x20;authentication&#x20;protocol&#x20;is&#x20;used&#x20;for&#x20;network&#x20;logons.&#x20;This&#x20;choice&#x20;affects&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;protocol&#x20;used&#x20;by&#x20;clients,&#x20;the&#x20;level&#x20;of&#x20;session&#x20;security&#x20;negotiated,&#x20;and&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;accepted&#x20;by&#x20;servers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM.','Windows&#x20;2000&#x20;and&#x20;Windows&#x20;XP&#x20;clients&#x20;were&#x20;configured&#x20;by&#x20;default&#x20;to&#x20;send&#x20;LM&#x20;and&#x20;NTLM&#x20;authentication&#x20;responses&#x20;&#40;Windows&#x20;95-based&#x20;and&#x20;Windows&#x20;98-based&#x20;clients&#x20;only&#x20;send&#x20;LM&#41;.&#x20;The&#x20;default&#x20;settings&#x20;in&#x20;OSes&#x20;predating&#x20;Windows&#x20;Vista&#x20;/&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-&#x20;R2&#41;&#x20;allowed&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;with&#x20;servers&#x20;and&#x20;use&#x20;their&#x20;resources.&#x20;However,&#x20;this&#x20;meant&#x20;that&#x20;LM&#x20;responses&#x20;-&#x20;the&#x20;weakest&#x20;form&#x20;of&#x20;authentication&#x20;response&#x20;-&#x20;were&#x20;sent&#x20;over&#x20;the&#x20;network,&#x20;and&#x20;it&#x20;was&#x20;potentially&#x20;possible&#x20;for&#x20;attackers&#x20;to&#x20;sniff&#x20;that&#x20;traffic&#x20;to&#x20;more&#x20;easily&#x20;reproduce&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;operating&#x20;systems&#x20;cannot&#x20;use&#x20;the&#x20;Kerberos&#x20;version&#x20;5&#x20;protocol&#x20;for&#x20;authentication.&#x20;For&#x20;this&#x20;reason,&#x20;in&#x20;a&#x20;Windows&#x20;Server&#x20;2003&#x20;domain,&#x20;these&#x20;computers&#x20;authenticate&#x20;by&#x20;default&#x20;with&#x20;both&#x20;the&#x20;LM&#x20;and&#x20;NTLM&#x20;protocols&#x20;for&#x20;network&#x20;authentication.&#x20;You&#x20;can&#x20;enforce&#x20;a&#x20;more&#x20;secure&#x20;authentication&#x20;protocol&#x20;for&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;by&#x20;using&#x20;NTLMv2.&#x20;For&#x20;the&#x20;logon&#x20;process,&#x20;NTLMv2&#x20;uses&#x20;a&#x20;secure&#x20;channel&#x20;to&#x20;protect&#x20;the&#x20;authentication&#x20;process.&#x20;Even&#x20;if&#x20;you&#x20;use&#x20;NTLMv2&#x20;for&#x20;older&#x20;clients&#x20;and&#x20;servers,&#x20;Windows-based&#x20;clients&#x20;and&#x20;servers&#x20;that&#x20;are&#x20;members&#x20;of&#x20;the&#x20;domain&#x20;will&#x20;use&#x20;the&#x20;Kerberos&#x20;authentication&#x20;protocol&#x20;to&#x20;authenticate&#x20;with&#x20;Windows&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;Domain&#x20;Controllers.&#x20;For&#x20;these&#x20;reasons,&#x20;it&#x20;is&#x20;strongly&#x20;preferred&#x20;to&#x20;restrict&#x20;the&#x20;use&#x20;of&#x20;LM&#x20;&amp;&#x20;NTLM&#x20;&#40;non-v2&#41;&#x20;as&#x20;much&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level.','[{\"cis\": [\"2.3.11.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15047,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Negotiate&#x20;signing&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;data&#x20;signing&#x20;that&#x20;is&#x20;requested&#x20;on&#x20;behalf&#x20;of&#x20;clients&#x20;that&#x20;issue&#x20;LDAP&#x20;BIND&#x20;requests.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;ldap_simple_bind&#x20;or&#x20;ldap_simple_bind_s&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Negotiate&#x20;signing.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x20;in&#x20;which&#x20;an&#x20;intruder&#x20;captures&#x20;the&#x20;packets&#x20;between&#x20;the&#x20;client&#x20;and&#x20;server,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;server.&#x20;For&#x20;an&#x20;LDAP&#x20;server,&#x20;this&#x20;susceptibility&#x20;means&#x20;that&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;server&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;or&#x20;altered&#x20;data&#x20;from&#x20;the&#x20;LDAP&#x20;queries.&#x20;To&#x20;lower&#x20;this&#x20;risk&#x20;in&#x20;your&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;can&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult&#x20;if&#x20;you&#x20;require&#x20;digital&#x20;signatures&#x20;on&#x20;all&#x20;network&#x20;packets&#x20;by&#x20;means&#x20;of&#x20;IPsec&#x20;authentication&#x20;headers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Negotiate&#x20;signing&#x20;&#40;configuring&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements.','[{\"cis\": [\"2.3.11.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15048,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;clients&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;both&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;In&#x20;other&#x20;words,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients.','[{\"cis\": [\"2.3.11.9\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15049,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;servers&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;all&#x20;of&#x20;the&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;That&#x20;is,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers.','[{\"cis\": [\"2.3.11.10\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15050,'Ensure&#x20;&#039;Shutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;shut&#x20;down&#x20;when&#x20;a&#x20;user&#x20;is&#x20;not&#x20;logged&#x20;on.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;shutdown&#x20;command&#x20;is&#x20;available&#x20;on&#x20;the&#x20;Windows&#x20;logon&#x20;screen.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;restrict&#x20;the&#x20;ability&#x20;to&#x20;shut&#x20;down&#x20;the&#x20;computer&#x20;to&#x20;users&#x20;with&#x20;credentials&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Server&#x20;2008&#x20;R2&#x20;and&#x20;older&#x20;versions,&#x20;this&#x20;setting&#x20;had&#x20;no&#x20;impact&#x20;on&#x20;Remote&#x20;Desktop&#x20;&#40;RDP&#41;&#x20;/&#x20;Terminal&#x20;Services&#x20;sessions&#x20;-&#x20;it&#x20;only&#x20;affected&#x20;the&#x20;local&#x20;console.&#x20;However,&#x20;Microsoft&#x20;changed&#x20;the&#x20;behavior&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;where&#x20;if&#x20;set&#x20;to&#x20;Enabled,&#x20;RDP&#x20;sessions&#x20;are&#x20;also&#x20;allowed&#x20;to&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server.','Users&#x20;who&#x20;can&#x20;access&#x20;the&#x20;console&#x20;locally&#x20;could&#x20;shut&#x20;down&#x20;the&#x20;computer.&#x20;Attackers&#x20;could&#x20;also&#x20;walk&#x20;to&#x20;the&#x20;local&#x20;console&#x20;and&#x20;restart&#x20;the&#x20;server,&#x20;which&#x20;would&#x20;cause&#x20;a&#x20;temporary&#x20;DoS&#x20;condition.&#x20;Attackers&#x20;could&#x20;also&#x20;shut&#x20;down&#x20;the&#x20;server&#x20;and&#x20;leave&#x20;all&#x20;of&#x20;its&#x20;applications&#x20;and&#x20;services&#x20;unavailable.&#x20;As&#x20;noted&#x20;in&#x20;the&#x20;Description&#x20;above,&#x20;the&#x20;Denial&#x20;of&#x20;Service&#x20;&#40;DoS&#41;&#x20;risk&#x20;of&#x20;enabling&#x20;this&#x20;setting&#x20;dramatically&#x20;increases&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;as&#x20;even&#x20;remote&#x20;users&#x20;could&#x20;then&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server&#x20;from&#x20;the&#x20;logon&#x20;screen&#x20;of&#x20;an&#x20;RDP&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsShutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on.','[{\"cis\": [\"2.3.13.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15051,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;case&#x20;insensitivity&#x20;is&#x20;enforced&#x20;for&#x20;all&#x20;subsystems.&#x20;The&#x20;Microsoft&#x20;Win32&#x20;subsystem&#x20;is&#x20;case&#x20;insensitive.&#x20;However,&#x20;the&#x20;kernel&#x20;supports&#x20;case&#x20;sensitivity&#x20;for&#x20;other&#x20;subsystems,&#x20;such&#x20;as&#x20;the&#x20;Portable&#x20;Operating&#x20;System&#x20;Interface&#x20;for&#x20;UNIX&#x20;&#40;POSIX&#41;.&#x20;Because&#x20;Windows&#x20;is&#x20;case&#x20;insensitive&#x20;&#40;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity&#41;,&#x20;failure&#x20;to&#x20;enforce&#x20;this&#x20;policy&#x20;setting&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;the&#x20;POSIX&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;by&#x20;using&#x20;mixed&#x20;case&#x20;to&#x20;label&#x20;it.&#x20;Such&#x20;a&#x20;situation&#x20;can&#x20;block&#x20;access&#x20;to&#x20;these&#x20;files&#x20;by&#x20;another&#x20;user&#x20;who&#x20;uses&#x20;typical&#x20;Win32&#x20;tools,&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Because&#x20;Windows&#x20;is&#x20;case-insensitive&#x20;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity,&#x20;failure&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;would&#x20;make&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;that&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;but&#x20;with&#x20;a&#x20;different&#x20;mix&#x20;of&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letters.&#x20;Such&#x20;a&#x20;situation&#x20;could&#x20;potentially&#x20;confuse&#x20;users&#x20;when&#x20;they&#x20;try&#x20;to&#x20;access&#x20;such&#x20;files&#x20;from&#x20;normal&#x20;Win32&#x20;tools&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-&#x20;Windows&#x20;subsystems.','[{\"cis\": [\"2.3.15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15052,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;discretionary&#x20;access&#x20;control&#x20;list&#x20;&#40;DACL&#41;&#x20;for&#x20;objects.&#x20;Active&#x20;Directory&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;system&#x20;resources,&#x20;such&#x20;as&#x20;DOS&#x20;device&#x20;names,&#x20;mutexes,&#x20;and&#x20;semaphores.&#x20;In&#x20;this&#x20;way,&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;what&#x20;permissions&#x20;are&#x20;granted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;DACL&#x20;for&#x20;objects.&#x20;Windows&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;computer&#x20;resources&#x20;so&#x20;that&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;with&#x20;what&#x20;permissions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;.','[{\"cis\": [\"2.3.15.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15053,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;built-in&#x20;Administrator&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;An&#x20;attack&#x20;vector&#x20;for&#x20;these&#x20;programs&#x20;was&#x20;to&#x20;discover&#x20;the&#x20;password&#x20;of&#x20;the&#x20;account&#x20;named&#x20;&#039;Administrator&#039;&#x20;because&#x20;that&#x20;user&#x20;account&#x20;was&#x20;created&#x20;for&#x20;all&#x20;installations&#x20;of&#x20;Windows.&#x20;To&#x20;address&#x20;this&#x20;risk,&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;newer,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;is&#x20;now&#x20;disabled&#x20;by&#x20;default.&#x20;In&#x20;a&#x20;default&#x20;installation&#x20;of&#x20;a&#x20;new&#x20;computer,&#x20;accounts&#x20;with&#x20;administrative&#x20;control&#x20;over&#x20;the&#x20;computer&#x20;are&#x20;initially&#x20;set&#x20;up&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;not&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;the&#x20;first&#x20;user&#x20;account&#x20;you&#x20;create&#x20;has&#x20;the&#x20;equivalent&#x20;permissions&#x20;as&#x20;a&#x20;local&#x20;administrator.&#x20;-If&#x20;the&#x20;computer&#x20;is&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;no&#x20;local&#x20;administrator&#x20;accounts&#x20;are&#x20;created.&#x20;The&#x20;Enterprise&#x20;or&#x20;Domain&#x20;Administrator&#x20;must&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;and&#x20;create&#x20;one&#x20;if&#x20;a&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;warranted.&#x20;Once&#x20;Windows&#x20;is&#x20;installed,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;may&#x20;be&#x20;manually&#x20;enabled,&#x20;but&#x20;we&#x20;strongly&#x20;recommend&#x20;that&#x20;this&#x20;account&#x20;remain&#x20;disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account.','[{\"cis\": [\"2.3.17.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15054,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Allow&#x20;UIAccess&#x20;applications&#x20;to&#x20;prompt&#x20;for&#x20;elevation&#x20;without&#x20;using&#x20;the&#x20;secure&#x20;desktop&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#x20;or&#x20;UIA&#41;&#x20;programs&#x20;can&#x20;automatically&#x20;disable&#x20;the&#x20;secure&#x20;desktop&#x20;for&#x20;elevation&#x20;prompts&#x20;used&#x20;by&#x20;a&#x20;standard&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;allows&#x20;the&#x20;administrator&#x20;to&#x20;perform&#x20;operations&#x20;that&#x20;require&#x20;elevated&#x20;privileges&#x20;while&#x20;connected&#x20;via&#x20;Remote&#x20;Assistance.&#x20;This&#x20;increases&#x20;security&#x20;in&#x20;that&#x20;organizations&#x20;can&#x20;use&#x20;UAC&#x20;even&#x20;when&#x20;end&#x20;user&#x20;support&#x20;is&#x20;provided&#x20;remotely.&#x20;However,&#x20;it&#x20;also&#x20;reduces&#x20;security&#x20;by&#x20;adding&#x20;the&#x20;risk&#x20;that&#x20;an&#x20;administrator&#x20;might&#x20;allow&#x20;an&#x20;unprivileged&#x20;user&#x20;to&#x20;share&#x20;elevated&#x20;privileges&#x20;for&#x20;an&#x20;application&#x20;that&#x20;the&#x20;administrator&#x20;needs&#x20;to&#x20;use&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Allow&#x20;UIAccess&#x20;applications&#x20;to&#x20;prompt&#x20;for&#x20;elevation&#x20;without&#x20;using&#x20;the&#x20;secure&#x20;desktop.','[{\"cis\": [\"2.3.17.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15055,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Prompt&#x20;for&#x20;consent&#x20','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;administrator&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;permits&#x20;the&#x20;administrator&#x20;to&#x20;prevent&#x20;a&#x20;malicious&#x20;program&#x20;from&#x20;elevating&#x20;its&#x20;privilege&#x20;when&#x20;the&#x20;program&#x20;attempts&#x20;to&#x20;do&#x20;so.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode.','[{\"cis\": [\"2.3.17.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15056,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Automatically&#x20;deny&#x20;elevation&#x20;requests&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;programs&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;their&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;user&#x20;that&#x20;a&#x20;program&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;requires&#x20;that&#x20;the&#x20;user&#x20;be&#x20;able&#x20;to&#x20;supply&#x20;administrative&#x20;credentials&#x20;in&#x20;order&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.','[{\"cis\": [\"2.3.17.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15057,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;application&#x20;installation&#x20;detection&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Some&#x20;malicious&#x20;software&#x20;will&#x20;attempt&#x20;to&#x20;install&#x20;itself&#x20;after&#x20;being&#x20;given&#x20;permission&#x20;to&#x20;run.&#x20;For&#x20;example,&#x20;malicious&#x20;software&#x20;with&#x20;a&#x20;trusted&#x20;application&#x20;shell.&#x20;The&#x20;user&#x20;may&#x20;have&#x20;given&#x20;permission&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run&#x20;because&#x20;the&#x20;program&#x20;is&#x20;trusted,&#x20;but&#x20;if&#x20;they&#x20;are&#x20;then&#x20;prompted&#x20;for&#x20;installation&#x20;of&#x20;an&#x20;unknown&#x20;component&#x20;this&#x20;provides&#x20;another&#x20;way&#x20;of&#x20;trapping&#x20;the&#x20;software&#x20;before&#x20;it&#x20;can&#x20;do&#x20;damage.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation.','[{\"cis\": [\"2.3.17.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15058,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;applications&#x20;that&#x20;request&#x20;to&#x20;run&#x20;with&#x20;a&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#41;&#x20;integrity&#x20;level&#x20;must&#x20;reside&#x20;in&#x20;a&#x20;secure&#x20;location&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;Secure&#x20;locations&#x20;are&#x20;limited&#x20;to&#x20;the&#x20;following:&#x20;...Program&#x20;Files,&#x20;including&#x20;subfolders;&#x20;...Windowssystem32;&#x20;...Program&#x20;Files&#x20;&#40;x86&#41;,&#x20;including&#x20;subfolders&#x20;&#40;for&#x20;64-bit&#x20;versions&#x20;of&#x20;Windows&#41;.&#x20;Note:&#x20;Windows&#x20;enforces&#x20;a&#x20;public&#x20;key&#x20;infrastructure&#x20;&#40;PKI&#41;&#x20;signature&#x20;check&#x20;on&#x20;any&#x20;interactive&#x20;application&#x20;that&#x20;requests&#x20;to&#x20;run&#x20;with&#x20;a&#x20;UIAccess&#x20;integrity&#x20;level&#x20;regardless&#x20;of&#x20;the&#x20;state&#x20;of&#x20;this&#x20;security&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','UIAccess&#x20;Integrity&#x20;allows&#x20;an&#x20;application&#x20;to&#x20;bypass&#x20;User&#x20;Interface&#x20;Privilege&#x20;Isolation&#x20;&#40;UIPI&#41;&#x20;restrictions&#x20;when&#x20;an&#x20;application&#x20;is&#x20;elevated&#x20;in&#x20;privilege&#x20;from&#x20;a&#x20;standard&#x20;user&#x20;to&#x20;an&#x20;administrator.&#x20;This&#x20;is&#x20;required&#x20;to&#x20;support&#x20;accessibility&#x20;features&#x20;such&#x20;as&#x20;screen&#x20;readers&#x20;that&#x20;are&#x20;transmitting&#x20;user&#x20;interfaces&#x20;to&#x20;alternative&#x20;forms.&#x20;A&#x20;process&#x20;that&#x20;is&#x20;started&#x20;with&#x20;UIAccess&#x20;rights&#x20;has&#x20;the&#x20;following&#x20;abilities:&#x20;-To&#x20;set&#x20;the&#x20;foreground&#x20;window.&#x20;-To&#x20;drive&#x20;any&#x20;application&#x20;window&#x20;using&#x20;SendInput&#x20;function.&#x20;-To&#x20;use&#x20;read&#x20;input&#x20;for&#x20;all&#x20;integrity&#x20;levels&#x20;using&#x20;low-level&#x20;hooks,&#x20;raw&#x20;input,&#x20;GetKeyState,&#x20;GetAsyncKeyState,&#x20;and&#x20;GetKeyboardInput.&#x20;-To&#x20;set&#x20;journal&#x20;hooks.&#x20;-To&#x20;uses&#x20;AttachThreadInput&#x20;to&#x20;attach&#x20;a&#x20;thread&#x20;to&#x20;a&#x20;higher&#x20;integrity&#x20;input&#x20;queue.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations.','[{\"cis\": [\"2.3.17.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15059,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;all&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;policy&#x20;settings&#x20;for&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;change&#x20;this&#x20;policy&#x20;setting,&#x20;you&#x20;must&#x20;restart&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;Security&#x20;Center&#x20;notifies&#x20;you&#x20;that&#x20;the&#x20;overall&#x20;security&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;reduced.','This&#x20;is&#x20;the&#x20;setting&#x20;that&#x20;turns&#x20;on&#x20;or&#x20;off&#x20;UAC.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;used&#x20;and&#x20;any&#x20;security&#x20;benefits&#x20;and&#x20;risk&#x20;mitigations&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;present&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode.','[{\"cis\": [\"2.3.17.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15060,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;elevation&#x20;request&#x20;prompt&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;interactive&#x20;user&#039;s&#x20;desktop&#x20;or&#x20;the&#x20;secure&#x20;desktop.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Standard&#x20;elevation&#x20;prompt&#x20;dialog&#x20;boxes&#x20;can&#x20;be&#x20;spoofed,&#x20;which&#x20;may&#x20;cause&#x20;users&#x20;to&#x20;disclose&#x20;their&#x20;passwords&#x20;to&#x20;malicious&#x20;software.&#x20;The&#x20;secure&#x20;desktop&#x20;presents&#x20;a&#x20;very&#x20;distinct&#x20;appearance&#x20;when&#x20;prompting&#x20;for&#x20;elevation,&#x20;where&#x20;the&#x20;user&#x20;desktop&#x20;dims,&#x20;and&#x20;the&#x20;elevation&#x20;prompt&#x20;UI&#x20;is&#x20;more&#x20;prominent.&#x20;This&#x20;increases&#x20;the&#x20;likelihood&#x20;that&#x20;users&#x20;who&#x20;become&#x20;accustomed&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;will&#x20;recognize&#x20;a&#x20;spoofed&#x20;elevation&#x20;prompt&#x20;dialog&#x20;box&#x20;and&#x20;not&#x20;fall&#x20;for&#x20;the&#x20;trick.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation.','[{\"cis\": [\"2.3.17.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15061,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;application&#x20;write&#x20;failures&#x20;are&#x20;redirected&#x20;to&#x20;defined&#x20;registry&#x20;and&#x20;file&#x20;system&#x20;locations.&#x20;This&#x20;policy&#x20;setting&#x20;mitigates&#x20;applications&#x20;that&#x20;run&#x20;as&#x20;administrator&#x20;and&#x20;write&#x20;run-time&#x20;application&#x20;data&#x20;to:&#x20;-&#x20;%ProgramFiles%&#x20;-&#x20;%Windir%&#x20;-&#x20;%Windir%system32&#x20;-&#x20;HKEY_LOCAL_MACHINESoftware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;reduces&#x20;vulnerabilities&#x20;by&#x20;ensuring&#x20;that&#x20;legacy&#x20;applications&#x20;only&#x20;write&#x20;data&#x20;to&#x20;permitted&#x20;locations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations.','[{\"cis\": [\"2.3.17.9\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15062,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15063,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15064,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.1.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15065,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.1.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15066,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewalldomainfw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewalldomainfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewalldomainfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.1.5\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15067,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.1.6\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15068,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.1.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15069,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.1.8\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15070,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.2.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15071,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.2.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15072,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15073,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.2.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15074,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewallprivatefw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewallprivatefw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewallprivatefw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.2.5\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15075,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.2.6\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15076,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.2.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15077,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.2.8\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15078,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.3.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15079,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.3.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15080,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.3.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15081,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;avoid&#x20;alarming&#x20;users&#x20;when&#x20;firewall&#x20;rules&#x20;block&#x20;certain&#x20;types&#x20;of&#x20;network&#x20;activity.&#x20;However,&#x20;notifications&#x20;can&#x20;be&#x20;helpful&#x20;when&#x20;troubleshooting&#x20;network&#x20;issues&#x20;involving&#x20;the&#x20;firewall.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;No&#039;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.3.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15082,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;local&#x20;firewall&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;firewall&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','iWhen&#x20;in&#x20;the&#x20;Public&#x20;profile,&#x20;there&#x20;should&#x20;be&#x20;no&#x20;special&#x20;local&#x20;firewall&#x20;exceptions&#x20;per&#x20;computer.&#x20;These&#x20;settings&#x20;should&#x20;be&#x20;managed&#x20;by&#x20;a&#x20;centralized&#x20;policy.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;firewall&#x20;rules.','[{\"cis\": [\"9.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15083,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;connection&#x20;security&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;connection&#x20;security&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;connection&#x20;security&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Users&#x20;with&#x20;administrative&#x20;privileges&#x20;might&#x20;create&#x20;firewall&#x20;rules&#x20;that&#x20;expose&#x20;the&#x20;system&#x20;to&#x20;remote&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;connection&#x20;security&#x20;rules.','[{\"cis\": [\"9.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15084,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewallpublicfw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewallpublicfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewallpublicfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.3.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15085,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.3.8\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15086,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.3.9\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15087,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.3.10\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15088,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Disables&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;toggle&#x20;switch&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;camera&#x20;from&#x20;being&#x20;invoked&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;camera&#x20;features.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15089,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Disables&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;settings&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;slide&#x20;show&#x20;from&#x20;playing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;slide&#x20;show&#x20;contents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15090,'Ensure&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;is&#x20;installed','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','In&#x20;order&#x20;to&#x20;utilize&#x20;LAPS,&#x20;a&#x20;minor&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;is&#x20;required,&#x20;and&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;each&#x20;managed&#x20;computer.&#x20;When&#x20;LAPS&#x20;is&#x20;installed,&#x20;the&#x20;file&#x20;AdmPwd.dll&#x20;must&#x20;be&#x20;present&#x20;in&#x20;the&#x20;following&#x20;location&#x20;and&#x20;registered&#x20;in&#x20;Windows&#x20;&#40;the&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;installation&#x20;does&#x20;this&#x20;for&#x20;you&#41;:&#x20;C:Program&#x20;FilesLAPSCSEAdmPwd.dll','[{\"cis\": [\"18.2.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15091,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSDo&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15092,'Ensure&#x20;&#039;Enable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSEnable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15093,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Complexity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Complexity&#x20;option&#x20;to&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.4\"]}, {\"cis_csc\": [\"5.7\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15094,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;or&#x20;more&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;or&#x20;more.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Length&#x20;option&#x20;to&#x20;15&#x20;or&#x20;more:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.5\"]}, {\"cis_csc\": [\"5.7\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15095,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;30&#x20;or&#x20;fewer&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;30&#x20;or&#x20;fewer.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#x20;option&#x20;to&#x20;30&#x20;or&#x20;fewer:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.6\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15096,'Ensure&#x20;&#039;Apply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;accounts&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;administration&#x20;via&#x20;network&#x20;logon&#x20;&#40;e.g.,&#x20;NET&#x20;USE,&#x20;connecting&#x20;to&#x20;C$,&#x20;etc.&#41;.&#x20;Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Enabling&#x20;this&#x20;policy&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.&#x20;Enabled:&#x20;Applies&#x20;UAC&#x20;token-filtering&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Membership&#x20;in&#x20;powerful&#x20;group&#x20;such&#x20;as&#x20;Administrators&#x20;is&#x20;disabled&#x20;and&#x20;powerful&#x20;privileges&#x20;are&#x20;removed&#x20;from&#x20;the&#x20;resulting&#x20;access&#x20;token.&#x20;This&#x20;configures&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;0.&#x20;This&#x20;is&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Windows.&#x20;Disabled:&#x20;Allows&#x20;local&#x20;accounts&#x20;to&#x20;have&#x20;full&#x20;administrative&#x20;rights&#x20;when&#x20;authenticating&#x20;via&#x20;network&#x20;logon,&#x20;by&#x20;configuring&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;1.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;LocalAccountTokenFilterPolicy,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;951016:&#x20;Description&#x20;of&#x20;User&#x20;Account&#x20;Control&#x20;and&#x20;remote&#x20;restrictions&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Ensuring&#x20;this&#x20;policy&#x20;is&#x20;Enabled&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideApply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;Microsoft.','[{\"cis\": [\"18.3.1\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15097,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;driver&#039;','This&#x20;setting&#x20;configures&#x20;the&#x20;start&#x20;type&#x20;for&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;client&#x20;driver&#x20;service&#x20;&#40;&#x20;MRxSmb10&#x20;&#41;,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;disabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;driver.&#x20;Note:&#x20;Do&#x20;not,&#x20;under&#x20;any&#x20;circumstances,&#x20;configure&#x20;this&#x20;overall&#x20;setting&#x20;as&#x20;Disabled&#x20;,&#x20;as&#x20;doing&#x20;so&#x20;will&#x20;delete&#x20;the&#x20;underlying&#x20;registry&#x20;entry&#x20;altogether,&#x20;which&#x20;will&#x20;cause&#x20;serious&#x20;problems.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;client&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;Microsoft','[{\"cis\": [\"18.3.2\"]}, {\"cis_csc\": [\"9.1\"]}]'),(15098,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;configures&#x20;the&#x20;server-side&#x20;processing&#x20;of&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;protocol.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;server&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15099,'Ensure&#x20;&#039;Enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Windows&#x20;includes&#x20;support&#x20;for&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;We&#x20;recommend&#x20;enabling&#x20;this&#x20;feature&#x20;to&#x20;improve&#x20;the&#x20;security&#x20;profile&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','This&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;block&#x20;exploits&#x20;that&#x20;use&#x20;the&#x20;Structured&#x20;Exception&#x20;Handler&#x20;&#40;SEH&#41;&#x20;overwrite&#x20;technique.&#x20;This&#x20;protection&#x20;mechanism&#x20;is&#x20;provided&#x20;at&#x20;run-time.&#x20;Therefore,&#x20;it&#x20;helps&#x20;protect&#x20;applications&#x20;regardless&#x20;of&#x20;whether&#x20;they&#x20;have&#x20;been&#x20;compiled&#x20;with&#x20;the&#x20;latest&#x20;improvements,&#x20;such&#x20;as&#x20;the&#x20;/SAFESEH&#x20;option.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideEnable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(15100,'Ensure&#x20;&#039;WDigest&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','When&#x20;WDigest&#x20;authentication&#x20;is&#x20;enabled,&#x20;Lsass.exe&#x20;retains&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;user&#039;s&#x20;plaintext&#x20;password&#x20;in&#x20;memory,&#x20;where&#x20;it&#x20;can&#x20;be&#x20;at&#x20;risk&#x20;of&#x20;theft.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured,&#x20;WDigest&#x20;authentication&#x20;is&#x20;disabled&#x20;in&#x20;Windows&#x20;8.1&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;R2;&#x20;it&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;in&#x20;earlier&#x20;versions&#x20;of&#x20;Windows&#x20;and&#x20;Windows&#x20;Server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideWDigest&#x20;Authentication&#x20;&#40;disabling&#x20;may&#x20;require&#x20;KB2871997&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;Microsoft.','[{\"cis\": [\"18.3.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15101,'Ensure&#x20;&#039;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;is&#x20;separate&#x20;from&#x20;the&#x20;Welcome&#x20;screen&#x20;feature&#x20;in&#x20;Windows&#x20;XP&#x20;and&#x20;Windows&#x20;Vista;&#x20;if&#x20;that&#x20;feature&#x20;is&#x20;disabled,&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;disabled.&#x20;If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;to&#x20;which&#x20;the&#x20;computer&#x20;is&#x20;connected.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext,&#x20;and&#x20;the&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;value&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;that&#x20;the&#x20;computer&#x20;is&#x20;connected&#x20;to.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext.&#x20;The&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;setting&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;As&#x20;a&#x20;result,&#x20;this&#x20;entry&#x20;is&#x20;appropriate&#x20;only&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;physically&#x20;secured&#x20;and&#x20;if&#x20;you&#x20;ensure&#x20;that&#x20;untrusted&#x20;users&#x20;cannot&#x20;remotely&#x20;see&#x20;the&#x20;registry.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15102,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highe','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;follow&#x20;through&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15103,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highest&#x20;pr','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;take&#x20;through&#x20;the&#x20;network.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;Not&#x20;Defined&#x20;for&#x20;enterprise&#x20;environments&#x20;and&#x20;to&#x20;Highest&#x20;Protection&#x20;for&#x20;high&#x20;security&#x20;environments&#x20;to&#x20;completely&#x20;disable&#x20;source&#x20;routing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.3\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15104,'Ensure&#x20;&#039;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Internet&#x20;Control&#x20;Message&#x20;Protocol&#x20;&#40;ICMP&#41;&#x20;redirects&#x20;cause&#x20;the&#x20;IPv4&#x20;stack&#x20;to&#x20;plumb&#x20;host&#x20;routes.&#x20;These&#x20;routes&#x20;override&#x20;the&#x20;Open&#x20;Shortest&#x20;Path&#x20;First&#x20;&#40;OSPF&#41;&#x20;generated&#x20;routes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;behavior&#x20;is&#x20;expected.&#x20;The&#x20;problem&#x20;is&#x20;that&#x20;the&#x20;10&#x20;minute&#x20;time-out&#x20;period&#x20;for&#x20;the&#x20;ICMP&#x20;redirect-plumbed&#x20;routes&#x20;temporarily&#x20;creates&#x20;a&#x20;network&#x20;situation&#x20;in&#x20;which&#x20;traffic&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;routed&#x20;properly&#x20;for&#x20;the&#x20;affected&#x20;host.&#x20;Ignoring&#x20;such&#x20;ICMP&#x20;redirects&#x20;will&#x20;limit&#x20;the&#x20;system&#039;s&#x20;exposure&#x20;to&#x20;attacks&#x20;that&#x20;will&#x20;impact&#x20;its&#x20;ability&#x20;to&#x20;participate&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.4\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15105,'Ensure&#x20;&#039;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#039;','This&#x20;value&#x20;controls&#x20;how&#x20;often&#x20;TCP&#x20;attempts&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;idle&#x20;connection&#x20;is&#x20;still&#x20;intact&#x20;by&#x20;sending&#x20;a&#x20;keep-alive&#x20;packet.&#x20;If&#x20;the&#x20;remote&#x20;computer&#x20;is&#x20;still&#x20;reachable,&#x20;it&#x20;acknowledges&#x20;the&#x20;keep-alive&#x20;packet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;.','An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;network&#x20;applications&#x20;could&#x20;establish&#x20;numerous&#x20;connections&#x20;to&#x20;cause&#x20;a&#x20;DoS&#x20;condition.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.5\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(15106,'Ensure&#x20;&#039;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enab','NetBIOS&#x20;over&#x20;TCP/IP&#x20;is&#x20;a&#x20;network&#x20;protocol&#x20;that&#x20;among&#x20;other&#x20;things&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;easily&#x20;resolve&#x20;NetBIOS&#x20;names&#x20;that&#x20;are&#x20;registered&#x20;on&#x20;Windows-based&#x20;systems&#x20;to&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;configured&#x20;on&#x20;those&#x20;systems.&#x20;This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;computer&#x20;releases&#x20;its&#x20;NetBIOS&#x20;name&#x20;when&#x20;it&#x20;receives&#x20;a&#x20;name-release&#x20;request.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;NetBT&#x20;protocol&#x20;is&#x20;designed&#x20;not&#x20;to&#x20;use&#x20;authentication,&#x20;and&#x20;is&#x20;therefore&#x20;vulnerable&#x20;to&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;exploit&#x20;the&#x20;unauthenticated&#x20;nature&#x20;of&#x20;the&#x20;protocol&#x20;to&#x20;send&#x20;a&#x20;name-conflict&#x20;datagram&#x20;to&#x20;a&#x20;target&#x20;computer,&#x20;which&#x20;would&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;relinquish&#x20;its&#x20;name&#x20;and&#x20;not&#x20;respond&#x20;to&#x20;queries.&#x20;An&#x20;attacker&#x20;could&#x20;send&#x20;a&#x20;request&#x20;over&#x20;the&#x20;network&#x20;and&#x20;query&#x20;a&#x20;computer&#x20;to&#x20;release&#x20;its&#x20;NetBIOS&#x20;name.&#x20;As&#x20;with&#x20;any&#x20;change&#x20;that&#x20;could&#x20;affect&#x20;applications,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;test&#x20;this&#x20;change&#x20;in&#x20;a&#x20;non-production&#x20;environment&#x20;before&#x20;you&#x20;change&#x20;the&#x20;production&#x20;environment.&#x20;The&#x20;result&#x20;of&#x20;such&#x20;an&#x20;attack&#x20;could&#x20;be&#x20;to&#x20;cause&#x20;intermittent&#x20;connectivity&#x20;issues&#x20;on&#x20;the&#x20;target&#x20;computer,&#x20;or&#x20;even&#x20;to&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;Network&#x20;Neighborhood,&#x20;domain&#x20;logons,&#x20;the&#x20;NET&#x20;SEND&#x20;command,&#x20;or&#x20;additional&#x20;NetBIOS&#x20;name&#x20;resolution.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15107,'Ensure&#x20;&#039;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','This&#x20;setting&#x20;is&#x20;used&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;the&#x20;Internet&#x20;Router&#x20;Discovery&#x20;Protocol&#x20;&#40;IRDP&#41;,&#x20;which&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;default&#x20;gateway&#x20;addresses&#x20;automatically&#x20;as&#x20;described&#x20;in&#x20;RFC&#x20;1256&#x20;on&#x20;a&#x20;per-interface&#x20;basis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;control&#x20;of&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;network&#x20;segment&#x20;could&#x20;configure&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;network&#x20;to&#x20;impersonate&#x20;a&#x20;router.&#x20;Other&#x20;computers&#x20;with&#x20;IRDP&#x20;enabled&#x20;would&#x20;then&#x20;attempt&#x20;to&#x20;route&#x20;their&#x20;traffic&#x20;through&#x20;the&#x20;already&#x20;compromised&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(15108,'Ensure&#x20;&#039;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;DLL&#x20;search&#x20;order&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;that&#x20;are&#x20;requested&#x20;by&#x20;running&#x20;processes&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-Search&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;-Search&#x20;current&#x20;working&#x20;folder&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;When&#x20;enabled,&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;1.&#x20;With&#x20;a&#x20;setting&#x20;of&#x20;1,&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;When&#x20;disabled&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0&#x20;and&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;Applications&#x20;will&#x20;be&#x20;forced&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first.&#x20;For&#x20;applications&#x20;that&#x20;require&#x20;unique&#x20;versions&#x20;of&#x20;these&#x20;DLLs&#x20;that&#x20;are&#x20;included&#x20;with&#x20;the&#x20;application,&#x20;this&#x20;entry&#x20;could&#x20;cause&#x20;performance&#x20;or&#x20;stability&#x20;problems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;was&#x20;packaged&#x20;with&#x20;additional&#x20;files&#x20;that&#x20;include&#x20;modified&#x20;versions&#x20;of&#x20;system&#x20;DLLs,&#x20;the&#x20;hostile&#x20;code&#x20;could&#x20;load&#x20;its&#x20;own&#x20;versions&#x20;of&#x20;those&#x20;DLLs&#x20;and&#x20;potentially&#x20;increase&#x20;the&#x20;type&#x20;and&#x20;degree&#x20;of&#x20;damage&#x20;the&#x20;code&#x20;can&#x20;render.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.8\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15109,'Ensure&#x20;&#039;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','Windows&#x20;includes&#x20;a&#x20;grace&#x20;period&#x20;between&#x20;when&#x20;the&#x20;screen&#x20;saver&#x20;is&#x20;launched&#x20;and&#x20;when&#x20;the&#x20;console&#x20;is&#x20;actually&#x20;locked&#x20;automatically&#x20;when&#x20;screen&#x20;saver&#x20;locking&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds.','The&#x20;default&#x20;grace&#x20;period&#x20;that&#x20;is&#x20;allowed&#x20;for&#x20;user&#x20;movement&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;lock&#x20;takes&#x20;effect&#x20;is&#x20;five&#x20;seconds.&#x20;If&#x20;you&#x20;leave&#x20;the&#x20;default&#x20;grace&#x20;period&#x20;configuration,&#x20;your&#x20;computer&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;potential&#x20;attack&#x20;from&#x20;someone&#x20;who&#x20;could&#x20;approach&#x20;the&#x20;console&#x20;and&#x20;attempt&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;before&#x20;the&#x20;lock&#x20;takes&#x20;effect.&#x20;An&#x20;entry&#x20;to&#x20;the&#x20;registry&#x20;can&#x20;be&#x20;made&#x20;to&#x20;adjust&#x20;the&#x20;length&#x20;of&#x20;the&#x20;grace&#x20;period.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.9\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15110,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.10\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(15111,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.11\"]}, {\"cis_csc\": [\"9\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15112,'Ensure&#x20;&#039;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#039;&#x20;is&#x20;set&#x20;to&#x20;&','This&#x20;setting&#x20;can&#x20;generate&#x20;a&#x20;security&#x20;audit&#x20;in&#x20;the&#x20;Security&#x20;event&#x20;log&#x20;when&#x20;the&#x20;log&#x20;reaches&#x20;a&#x20;user-defined&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;90%&#x20;or&#x20;less.&#x20;Note:&#x20;If&#x20;log&#x20;settings&#x20;are&#x20;configured&#x20;to&#x20;Overwrite&#x20;events&#x20;as&#x20;needed&#x20;or&#x20;Overwrite&#x20;events&#x20;older&#x20;than&#x20;x&#x20;days,&#x20;this&#x20;event&#x20;will&#x20;not&#x20;be&#x20;generated.','If&#x20;the&#x20;Security&#x20;log&#x20;reaches&#x20;90&#x20;percent&#x20;of&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;not&#x20;been&#x20;configured&#x20;to&#x20;overwrite&#x20;events&#x20;as&#x20;needed,&#x20;more&#x20;recent&#x20;events&#x20;will&#x20;not&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.&#x20;If&#x20;the&#x20;log&#x20;reaches&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;shut&#x20;down&#x20;when&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;the&#x20;computer&#x20;will&#x20;shut&#x20;down&#x20;and&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;available&#x20;to&#x20;provide&#x20;network&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;90%&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(15113,'Ensure&#x20;&#039;Turn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','LLMNR&#x20;is&#x20;a&#x20;secondary&#x20;name&#x20;resolution&#x20;protocol.&#x20;With&#x20;LLMNR,&#x20;queries&#x20;are&#x20;sent&#x20;using&#x20;multicast&#x20;over&#x20;a&#x20;local&#x20;network&#x20;link&#x20;on&#x20;a&#x20;single&#x20;subnet&#x20;from&#x20;a&#x20;client&#x20;computer&#x20;to&#x20;another&#x20;client&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;subnet&#x20;that&#x20;also&#x20;has&#x20;LLMNR&#x20;enabled.&#x20;LLMNR&#x20;does&#x20;not&#x20;require&#x20;a&#x20;DNS&#x20;server&#x20;or&#x20;DNS&#x20;client&#x20;configuration,&#x20;and&#x20;provides&#x20;name&#x20;resolution&#x20;in&#x20;scenarios&#x20;in&#x20;which&#x20;conventional&#x20;DNS&#x20;name&#x20;resolution&#x20;is&#x20;not&#x20;possible.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','An&#x20;attacker&#x20;can&#x20;listen&#x20;on&#x20;a&#x20;network&#x20;for&#x20;these&#x20;LLMNR&#x20;&#40;UDP/5355&#41;&#x20;or&#x20;NBT-NS&#x20;&#40;UDP/137&#41;&#x20;broadcasts&#x20;and&#x20;respond&#x20;to&#x20;them,&#x20;tricking&#x20;the&#x20;host&#x20;into&#x20;thinking&#x20;that&#x20;it&#x20;knows&#x20;the&#x20;location&#x20;of&#x20;the&#x20;requested&#x20;system.&#x20;Note:&#x20;To&#x20;completely&#x20;mitigate&#x20;local&#x20;name&#x20;resolution&#x20;poisoning,&#x20;in&#x20;addition&#x20;to&#x20;this&#x20;setting,&#x20;the&#x20;properties&#x20;of&#x20;each&#x20;installed&#x20;NIC&#x20;should&#x20;also&#x20;be&#x20;set&#x20;to&#x20;Disable&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;on&#x20;the&#x20;WINS&#x20;tab&#x20;in&#x20;the&#x20;NIC&#x20;properties&#41;.&#x20;Unfortunately,&#x20;there&#x20;is&#x20;no&#x20;global&#x20;setting&#x20;to&#x20;achieve&#x20;this&#x20;that&#x20;automatically&#x20;applies&#x20;to&#x20;all&#x20;NICs&#x20;-&#x20;it&#x20;is&#x20;a&#x20;per-NIC&#x20;setting&#x20;that&#x20;varies&#x20;with&#x20;different&#x20;NIC&#x20;hardware&#x20;installations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientTurn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15114,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Mapper&#x20;I/O&#x20;network&#x20;protocol&#x20;driver.&#x20;LLTDIO&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;discover&#x20;the&#x20;topology&#x20;of&#x20;a&#x20;network&#x20;it&#039;s&#x20;connected&#x20;to.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;initiate&#x20;Quality-of-Service&#x20;requests&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15115,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Responder&#x20;network&#x20;protocol&#x20;driver.&#x20;The&#x20;Responder&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Link&#x20;Layer&#x20;Topology&#x20;Discovery&#x20;requests&#x20;so&#x20;that&#x20;it&#x20;can&#x20;be&#x20;discovered&#x20;and&#x20;located&#x20;on&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Quality-of-Service&#x20;activities&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15116,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;allows&#x20;for&#x20;distributed&#x20;resolution&#x20;of&#x20;a&#x20;name&#x20;to&#x20;an&#x20;IPv6&#x20;address&#x20;and&#x20;port&#x20;number.&#x20;The&#x20;protocol&#x20;operates&#x20;in&#x20;the&#x20;context&#x20;of&#x20;clouds.&#x20;A&#x20;cloud&#x20;is&#x20;a&#x20;set&#x20;of&#x20;peer&#x20;computers&#x20;that&#x20;can&#x20;communicate&#x20;with&#x20;each&#x20;other&#x20;by&#x20;using&#x20;the&#x20;same&#x20;IPv6&#x20;scope.&#x20;Peer-to-Peer&#x20;protocols&#x20;allow&#x20;for&#x20;applications&#x20;in&#x20;the&#x20;areas&#x20;of&#x20;RTC,&#x20;collaboration,&#x20;content&#x20;distribution&#x20;and&#x20;distributed&#x20;processing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;peer-to-peer&#x20;networking.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkMicrosoft&#x20;Peer-to-Peer&#x20;Networking&#x20;ServicesTurn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;P2P-&#x20;pnrp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.10.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15117,'Ensure&#x20;&#039;Prohibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','You&#x20;can&#x20;use&#x20;this&#x20;procedure&#x20;to&#x20;controls&#x20;user&#039;s&#x20;ability&#x20;to&#x20;install&#x20;and&#x20;configure&#x20;a&#x20;Network&#x20;Bridge.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Network&#x20;Bridge&#x20;setting,&#x20;if&#x20;enabled,&#x20;allows&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Layer&#x20;2&#x20;Media&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;bridge,&#x20;enabling&#x20;them&#x20;to&#x20;connect&#x20;two&#x20;or&#x20;more&#x20;physical&#x20;network&#x20;segments&#x20;together.&#x20;A&#x20;Network&#x20;Bridge&#x20;thus&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;has&#x20;connections&#x20;to&#x20;two&#x20;different&#x20;networks&#x20;to&#x20;share&#x20;data&#x20;between&#x20;those&#x20;networks.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;where&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;control&#x20;network&#x20;traffic&#x20;to&#x20;only&#x20;authorized&#x20;paths,&#x20;allowing&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Network&#x20;Bridge&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface&#x20;from&#x20;the&#x20;bridged&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15118,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15119,'Ensure&#x20;&#039;Hardened&#x20;UNC&#x20;Paths&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&','This&#x20;policy&#x20;setting&#x20;configures&#x20;secure&#x20;access&#x20;to&#x20;UNC&#x20;paths.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&#x20;and&#x20;SYSVOL&#x20;shares&#x20;.','In&#x20;February&#x20;2015,&#x20;Microsoft&#x20;released&#x20;a&#x20;new&#x20;control&#x20;mechanism&#x20;to&#x20;mitigate&#x20;a&#x20;security&#x20;risk&#x20;in&#x20;Group&#x20;Policy&#x20;as&#x20;part&#x20;of&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update.&#x20;This&#x20;mechanism&#x20;requires&#x20;both&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;new&#x20;security&#x20;update&#x20;and&#x20;also&#x20;the&#x20;deployment&#x20;of&#x20;specific&#x20;group&#x20;policy&#x20;settings&#x20;to&#x20;all&#x20;computers&#x20;on&#x20;the&#x20;domain&#x20;from&#x20;Windows&#x20;Vista&#x20;/&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;&#40;the&#x20;associated&#x20;security&#x20;patch&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;was&#x20;not&#x20;released&#x20;for&#x20;Server&#x20;2003&#41;.&#x20;A&#x20;new&#x20;group&#x20;policy&#x20;template&#x20;&#40;&#x20;NetworkProvider.admx/adml&#x20;&#41;&#x20;was&#x20;also&#x20;provided&#x20;with&#x20;the&#x20;security&#x20;update.&#x20;Once&#x20;the&#x20;new&#x20;GPO&#x20;template&#x20;is&#x20;in&#x20;place,&#x20;the&#x20;following&#x20;are&#x20;the&#x20;minimum&#x20;requirements&#x20;to&#x20;remediate&#x20;the&#x20;Group&#x20;Policy&#x20;security&#x20;risk:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;the&#x20;following&#x20;paths&#x20;configured,&#x20;at&#x20;a&#x20;minimum:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ProviderHardened&#x20;UNC&#x20;Paths&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;NetworkProvider.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.5.14.1\"]}, {\"cis_csc\": [\"3\"]}]'),(15120,'Disable&#x20;IPv6&#x20;&#40;Ensure&#x20;TCPIP6&#x20;Parameter&#x20;&#039;DisabledComponents&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0xff&#x20;&#40;255&#41;&#039;&#41;','Internet&#x20;Protocol&#x20;version&#x20;6&#x20;&#40;IPv6&#41;&#x20;is&#x20;a&#x20;set&#x20;of&#x20;protocols&#x20;that&#x20;computers&#x20;use&#x20;to&#x20;exchange&#x20;information&#x20;over&#x20;the&#x20;Internet&#x20;and&#x20;over&#x20;home&#x20;and&#x20;business&#x20;networks.&#x20;IPv6&#x20;allows&#x20;for&#x20;many&#x20;more&#x20;IP&#x20;addresses&#x20;to&#x20;be&#x20;assigned&#x20;than&#x20;IPv4&#x20;did.&#x20;Older&#x20;networking,&#x20;hosts&#x20;and&#x20;operating&#x20;systems&#x20;may&#x20;not&#x20;support&#x20;IPv6&#x20;natively.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;DisabledComponents&#x20;-&#x20;0xff&#x20;&#40;255&#41;','Since&#x20;the&#x20;vast&#x20;majority&#x20;of&#x20;private&#x20;enterprise&#x20;managed&#x20;networks&#x20;have&#x20;no&#x20;need&#x20;to&#x20;utilize&#x20;IPv6&#x20;&#40;because&#x20;they&#x20;have&#x20;access&#x20;to&#x20;private&#x20;IPv4&#x20;addressing&#41;,&#x20;disabling&#x20;IPv6&#x20;components&#x20;reduces&#x20;a&#x20;possible&#x20;attack&#x20;surface&#x20;that&#x20;is&#x20;also&#x20;harder&#x20;to&#x20;monitor&#x20;the&#x20;traffic&#x20;on.&#x20;As&#x20;a&#x20;result,&#x20;we&#x20;recommend&#x20;configuring&#x20;IPv6&#x20;to&#x20;a&#x20;Disabled&#x20;state&#x20;when&#x20;it&#x20;is&#x20;not&#x20;needed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0xff&#x20;&#40;255&#41;&#x20;&#40;DWORD&#41;:&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTCPIP6Parameters:DisabledComponents.&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;Although&#x20;Microsoft&#x20;does&#x20;not&#x20;provide&#x20;an&#x20;ADMX&#x20;template&#x20;to&#x20;configure&#x20;this&#x20;registry&#x20;value,&#x20;a&#x20;custom&#x20;.ADM&#x20;template&#x20;&#40;Disable-IPv6-Components-KB929852.adm&#41;&#x20;is&#x20;provided&#x20;in&#x20;the&#x20;CIS&#x20;Benchmark&#x20;Remediation&#x20;Kit&#x20;to&#x20;facilitate&#x20;its&#x20;configuration.&#x20;Be&#x20;aware&#x20;though&#x20;that&#x20;simply&#x20;turning&#x20;off&#x20;the&#x20;group&#x20;policy&#x20;setting&#x20;in&#x20;the&#x20;.ADM&#x20;template&#x20;will&#x20;not&#x20;&quot;undo&quot;&#x20;the&#x20;change&#x20;once&#x20;applied.&#x20;Instead,&#x20;the&#x20;opposite&#x20;setting&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;change&#x20;the&#x20;registry&#x20;value&#x20;to&#x20;the&#x20;opposite&#x20;state.','[{\"cis\": [\"18.5.19.2.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15121,'Ensure&#x20;&#039;Configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;the&#x20;configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;.&#x20;The&#x20;WCN&#x20;Registrar&#x20;enables&#x20;the&#x20;discovery&#x20;and&#x20;configuration&#x20;of&#x20;devices&#x20;over&#x20;Ethernet&#x20;&#40;UPnP&#41;&#x20;over&#x20;in-band&#x20;802.11&#x20;Wi-Fi&#x20;through&#x20;the&#x20;Windows&#x20;Portable&#x20;Device&#x20;API&#x20;&#40;WPD&#41;&#x20;and&#x20;via&#x20;USB&#x20;Flash&#x20;drives.&#x20;Additional&#x20;options&#x20;are&#x20;available&#x20;to&#x20;allow&#x20;discovery&#x20;and&#x20;configuration&#x20;over&#x20;a&#x20;specific&#x20;medium.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;user&#x20;configuration&#x20;of&#x20;wireless&#x20;settings.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowConfiguration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.20.1\"]}, {\"cis_csc\": [\"15.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15122,'Ensure&#x20;&#039;Prohibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prohibits&#x20;access&#x20;to&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;standard&#x20;users&#x20;to&#x20;access&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizard&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetworkWindows&#x20;Connect&#x20;NowProhibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.20.2\"]}, {\"cis_csc\": [\"15.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15123,'Ensure&#x20;&#039;Minimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blocking&#x20;simultaneous&#x20;connections&#x20;can&#x20;help&#x20;prevent&#x20;a&#x20;user&#x20;unknowingly&#x20;allowing&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;Internet&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerMinimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.21.1\"]}, {\"cis_csc\": [\"12\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15124,'Ensure&#x20;&#039;Prohibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.','The&#x20;potential&#x20;concern&#x20;is&#x20;that&#x20;a&#x20;user&#x20;would&#x20;unknowingly&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;insecure&#x20;public&#x20;network&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesetworkWindows&#x20;Connection&#x20;ManagerProhibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network.','[{\"cis\": [\"18.5.21.2\"]}, {\"cis_csc\": [\"12\"]}, {\"pci_dss\": [\"2.2.4\", \"1.3.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\"]}]'),(15125,'Ensure&#x20;&#039;Include&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;information&#x20;is&#x20;logged&#x20;in&#x20;security&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;any&#x20;user&#x20;who&#x20;has&#x20;read&#x20;access&#x20;to&#x20;the&#x20;security&#x20;events&#x20;can&#x20;read&#x20;the&#x20;command-line&#x20;arguments&#x20;for&#x20;any&#x20;successfully&#x20;created&#x20;process.&#x20;Command-line&#x20;arguments&#x20;may&#x20;contain&#x20;sensitive&#x20;or&#x20;private&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;or&#x20;user&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemAudit&#x20;Process&#x20;CreationInclude&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AuditSettings.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.3.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15126,'Ensure&#x20;&#039;Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;When&#x20;using&#x20;credential&#x20;delegation,&#x20;devices&#x20;provide&#x20;an&#x20;exportable&#x20;version&#x20;of&#x20;credentials&#x20;to&#x20;the&#x20;remote&#x20;host.&#x20;This&#x20;exposes&#x20;users&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;credential&#x20;theft&#x20;from&#x20;attackers&#x20;on&#x20;the&#x20;remote&#x20;host.&#x20;The&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;and&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;features&#x20;are&#x20;two&#x20;options&#x20;to&#x20;help&#x20;protect&#x20;against&#x20;this&#x20;risk.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Restricted&#x20;Admin&#x20;Mode&#x20;was&#x20;designed&#x20;to&#x20;help&#x20;protect&#x20;administrator&#x20;accounts&#x20;by&#x20;ensuring&#x20;that&#x20;reusable&#x20;credentials&#x20;are&#x20;not&#x20;stored&#x20;in&#x20;memory&#x20;on&#x20;remote&#x20;devices&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;compromised.&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;helps&#x20;you&#x20;protect&#x20;your&#x20;credentials&#x20;over&#x20;a&#x20;Remote&#x20;Desktop&#x20;connection&#x20;by&#x20;redirecting&#x20;Kerberos&#x20;requests&#x20;back&#x20;to&#x20;the&#x20;device&#x20;that&#x20;is&#x20;requesting&#x20;the&#x20;connection.&#x20;Both&#x20;features&#x20;should&#x20;be&#x20;enabled&#x20;and&#x20;supported,&#x20;as&#x20;they&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationRemote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15127,'Ensure&#x20;&#039;Boot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;which&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized&#x20;based&#x20;on&#x20;a&#x20;classification&#x20;determined&#x20;by&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;The&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;can&#x20;return&#x20;the&#x20;following&#x20;classifications&#x20;for&#x20;each&#x20;boot-start&#x20;driver:&#x20;-Good:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;signed&#x20;and&#x20;has&#x20;not&#x20;been&#x20;tampered&#x20;with.&#x20;-Bad:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;allow&#x20;known&#x20;bad&#x20;drivers&#x20;to&#x20;be&#x20;initialized.&#x20;-Bad,&#x20;but&#x20;required&#x20;for&#x20;boot:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware,&#x20;but&#x20;the&#x20;computer&#x20;cannot&#x20;successfully&#x20;boot&#x20;without&#x20;loading&#x20;this&#x20;driver.&#x20;-Unknown:&#x20;This&#x20;driver&#x20;has&#x20;not&#x20;been&#x20;attested&#x20;to&#x20;by&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;and&#x20;has&#x20;not&#x20;been&#x20;classified&#x20;by&#x20;the&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;choose&#x20;which&#x20;boot-start&#x20;drivers&#x20;to&#x20;initialize&#x20;the&#x20;next&#x20;time&#x20;the&#x20;computer&#x20;is&#x20;started.&#x20;If&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;does&#x20;not&#x20;include&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-&#x20;start&#x20;driver&#x20;or&#x20;if&#x20;your&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;has&#x20;been&#x20;disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;and&#x20;all&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical.','This&#x20;policy&#x20;setting&#x20;helps&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;malware&#x20;that&#x20;has&#x20;already&#x20;infected&#x20;your&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemEarly&#x20;Launch&#x20;AntimalwareBoot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EarlyLaunchAM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.14.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"5.1.1\"]}, {\"nist_800_53\": [\"SI.3\"]}, {\"tsc\": [\"CC6.8\"]}]'),(15128,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;FALSE&#039;','The&#x20;&#039;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;option&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;updating&#x20;affected&#x20;policies&#x20;in&#x20;the&#x20;background&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;When&#x20;background&#x20;updates&#x20;are&#x20;disabled,&#x20;policy&#x20;changes&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;FALSE&#x20;&#40;unchecked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;false&#x20;&#40;unchecked&#41;&#x20;will&#x20;ensure&#x20;that&#x20;domain&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#x20;option&#x20;to&#x20;FALSE&#x20;&#40;unchecked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.2\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15129,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;TRUE&#039;','The&#x20;&#039;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;option&#x20;updates&#x20;and&#x20;reapplies&#x20;policies&#x20;even&#x20;if&#x20;the&#x20;policies&#x20;have&#x20;not&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;TRUE&#x20;&#40;checked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;true&#x20;&#40;checked&#41;&#x20;will&#x20;ensure&#x20;unauthorized&#x20;changes&#x20;that&#x20;might&#x20;have&#x20;been&#x20;configured&#x20;locally&#x20;are&#x20;forced&#x20;to&#x20;match&#x20;the&#x20;domain-based&#x20;Group&#x20;Policy&#x20;settings&#x20;again.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#x20;option&#x20;to&#x20;TRUE&#x20;&#40;checked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.3\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"11.5.1\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(15130,'Ensure&#x20;&#039;Turn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;Group&#x20;Policy&#x20;from&#x20;being&#x20;updated&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;to&#x20;Group&#x20;Policy&#x20;for&#x20;computers,&#x20;users&#x20;and&#x20;Domain&#x20;Controllers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;group&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyTurn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.21.4\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15131,'Ensure&#x20;&#039;Turn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;computer&#x20;can&#x20;download&#x20;print&#x20;driver&#x20;packages&#x20;over&#x20;HTTP.&#x20;To&#x20;set&#x20;up&#x20;HTTP&#x20;printing,&#x20;printer&#x20;drivers&#x20;that&#x20;are&#x20;not&#x20;available&#x20;in&#x20;the&#x20;standard&#x20;operating&#x20;system&#x20;installation&#x20;might&#x20;need&#x20;to&#x20;be&#x20;downloaded&#x20;over&#x20;HTTP.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;might&#x20;download&#x20;drivers&#x20;that&#x20;include&#x20;malicious&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"6\"]}, {\"nist_800_53\": [\"SI.3\"]}]'),(15132,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;turns&#x20;off&#x20;data&#x20;sharing&#x20;from&#x20;the&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool&#x20;enables&#x20;Tablet&#x20;PC&#x20;users&#x20;to&#x20;adapt&#x20;handwriting&#x20;recognition&#x20;to&#x20;their&#x20;own&#x20;writing&#x20;style&#x20;by&#x20;providing&#x20;writing&#x20;samples.&#x20;The&#x20;tool&#x20;can&#x20;optionally&#x20;share&#x20;user&#x20;writing&#x20;samples&#x20;with&#x20;Microsoft&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;tool&#x20;generates&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ShapeCollector.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15133,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Turns&#x20;off&#x20;the&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool&#x20;enables&#x20;users&#x20;to&#x20;report&#x20;errors&#x20;encountered&#x20;in&#x20;Tablet&#x20;PC&#x20;Input&#x20;Panel.&#x20;The&#x20;tool&#x20;generates&#x20;error&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;Microsoft&#x20;uses&#x20;these&#x20;error&#x20;reports&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InkWatson.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15134,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;can&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;Internet&#x20;Service&#x20;Providers&#x20;&#40;ISPs&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15135,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;will&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;for&#x20;the&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Although&#x20;the&#x20;risk&#x20;is&#x20;minimal,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;downloading&#x20;malicious&#x20;content&#x20;through&#x20;this&#x20;feature.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.5\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15136,'Ensure&#x20;&#039;Turn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;disable&#x20;the&#x20;client&#x20;computer&#039;s&#x20;ability&#x20;to&#x20;print&#x20;over&#x20;HTTP,&#x20;which&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;printers&#x20;on&#x20;the&#x20;intranet&#x20;as&#x20;well&#x20;as&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Information&#x20;that&#x20;is&#x20;transmitted&#x20;over&#x20;HTTP&#x20;through&#x20;this&#x20;capability&#x20;is&#x20;not&#x20;protected&#x20;and&#x20;can&#x20;be&#x20;intercepted&#x20;by&#x20;malicious&#x20;users.&#x20;For&#x20;this&#x20;reason,&#x20;it&#x20;is&#x20;not&#x20;often&#x20;used&#x20;in&#x20;enterprise&#x20;managed&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.6\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15137,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Registration&#x20;Wizard&#x20;connects&#x20;to&#x20;Microsoft.com&#x20;for&#x20;online&#x20;registration.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;should&#x20;not&#x20;be&#x20;registering&#x20;their&#x20;own&#x20;copies&#x20;of&#x20;Windows,&#x20;providing&#x20;their&#x20;own&#x20;PII&#x20;in&#x20;the&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15138,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Search&#x20;Companion&#x20;should&#x20;automatically&#x20;download&#x20;content&#x20;updates&#x20;during&#x20;local&#x20;and&#x20;Internet&#x20;searches.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;users&#x20;will&#x20;unknowingly&#x20;reveal&#x20;sensitive&#x20;information&#x20;because&#x20;of&#x20;the&#x20;topics&#x20;they&#x20;are&#x20;searching&#x20;for.&#x20;This&#x20;risk&#x20;is&#x20;very&#x20;low&#x20;because&#x20;even&#x20;if&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;users&#x20;still&#x20;must&#x20;submit&#x20;search&#x20;queries&#x20;to&#x20;the&#x20;desired&#x20;search&#x20;engine&#x20;in&#x20;order&#x20;to&#x20;perform&#x20;searches.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15139,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;&quot;Order&#x20;Prints&#x20;Online&quot;&#x20;task&#x20;is&#x20;available&#x20;from&#x20;Picture&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Order&#x20;Prints&#x20;Online&#x20;Wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;order&#x20;prints&#x20;online.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.9\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15140,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;tasks&#x20;Publish&#x20;this&#x20;file&#x20;to&#x20;the&#x20;Web,&#x20;Publish&#x20;this&#x20;folder&#x20;to&#x20;the&#x20;Web,&#x20;and&#x20;Publish&#x20;the&#x20;selected&#x20;items&#x20;to&#x20;the&#x20;Web&#x20;are&#x20;available&#x20;from&#x20;File&#x20;and&#x20;Folder&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Web&#x20;Publishing&#x20;wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;publish&#x20;content&#x20;to&#x20;the&#x20;Web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;may&#x20;publish&#x20;confidential&#x20;or&#x20;sensitive&#x20;information&#x20;to&#x20;a&#x20;public&#x20;service&#x20;outside&#x20;of&#x20;the&#x20;control&#x20;of&#x20;the&#x20;organization.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.10\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15141,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.11\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15142,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.12\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15143,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;errors&#x20;are&#x20;reported&#x20;to&#x20;Microsoft.&#x20;Error&#x20;Reporting&#x20;is&#x20;used&#x20;to&#x20;report&#x20;information&#x20;about&#x20;a&#x20;system&#x20;or&#x20;application&#x20;that&#x20;has&#x20;failed&#x20;or&#x20;has&#x20;stopped&#x20;responding&#x20;and&#x20;is&#x20;used&#x20;to&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;the&#x20;product.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15144,'Ensure&#x20;&#039;Disallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;prevents&#x20;automatic&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;use&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;user&#x20;is&#x20;restricted&#x20;to&#x20;the&#x20;set&#x20;of&#x20;input&#x20;methods&#x20;that&#x20;are&#x20;enabled&#x20;in&#x20;the&#x20;system&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;way&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLocale&#x20;ServicesDisallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15145,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;anyone&#x20;can&#x20;interact&#x20;with&#x20;available&#x20;networks&#x20;UI&#x20;on&#x20;the&#x20;logon&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;disconnect&#x20;the&#x20;PC&#x20;from&#x20;the&#x20;network&#x20;or&#x20;can&#x20;connect&#x20;the&#x20;PC&#x20;to&#x20;other&#x20;available&#x20;networks&#x20;without&#x20;signing&#x20;into&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.1\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15146,'Ensure&#x20;&#039;Do&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;connected&#x20;users&#x20;from&#x20;being&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.2\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15147,'Ensure&#x20;&#039;Enumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;local&#x20;users&#x20;to&#x20;be&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonEnumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15148,'Ensure&#x20;&#039;Turn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;app&#x20;notifications&#x20;from&#x20;appearing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','App&#x20;notifications&#x20;might&#x20;display&#x20;sensitive&#x20;business&#x20;or&#x20;personal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.4\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15149,'Ensure&#x20;&#039;Turn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;picture&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;picture&#x20;password&#x20;feature&#x20;is&#x20;permitted,&#x20;the&#x20;user&#039;s&#x20;domain&#x20;password&#x20;is&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;it.','Picture&#x20;passwords&#x20;bypass&#x20;the&#x20;requirement&#x20;for&#x20;a&#x20;typed&#x20;complex&#x20;password.&#x20;In&#x20;a&#x20;shared&#x20;work&#x20;environment,&#x20;a&#x20;simple&#x20;shoulder&#x20;surf&#x20;where&#x20;someone&#x20;observed&#x20;the&#x20;on-screen&#x20;gestures&#x20;would&#x20;allow&#x20;that&#x20;person&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;the&#x20;need&#x20;to&#x20;know&#x20;the&#x20;complex&#x20;password.&#x20;Vertical&#x20;monitor&#x20;screens&#x20;with&#x20;an&#x20;image&#x20;are&#x20;much&#x20;more&#x20;visible&#x20;at&#x20;a&#x20;distance&#x20;than&#x20;horizontal&#x20;key&#x20;strokes,&#x20;increasing&#x20;the&#x20;likelihood&#x20;of&#x20;a&#x20;successful&#x20;observation&#x20;of&#x20;the&#x20;mouse&#x20;gestures.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.5\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15150,'Ensure&#x20;&#039;Turn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;convenience&#x20;PIN.&#x20;In&#x20;Windows&#x20;10,&#x20;convenience&#x20;PIN&#x20;was&#x20;replaced&#x20;with&#x20;Passport,&#x20;which&#x20;has&#x20;stronger&#x20;security&#x20;properties.&#x20;To&#x20;configure&#x20;Passport&#x20;for&#x20;domain&#x20;users,&#x20;use&#x20;the&#x20;policies&#x20;under&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Passport&#x20;for&#x20;Work.&#x20;Note:&#x20;The&#x20;user&#039;s&#x20;domain&#x20;password&#x20;will&#x20;be&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;this&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;PIN&#x20;is&#x20;created&#x20;from&#x20;a&#x20;much&#x20;smaller&#x20;selection&#x20;of&#x20;characters&#x20;than&#x20;a&#x20;password,&#x20;so&#x20;in&#x20;most&#x20;cases&#x20;a&#x20;PIN&#x20;will&#x20;be&#x20;much&#x20;less&#x20;robust&#x20;than&#x20;a&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;on&#x20;PIN&#x20;sign-in,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.27.6\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15151,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15152,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15153,'Ensure&#x20;&#039;Configure&#x20;Offer&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Offer&#x20;&#40;Unsolicited&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;Help&#x20;desk&#x20;and&#x20;support&#x20;personnel&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;proactively&#x20;offer&#x20;assistance,&#x20;although&#x20;they&#x20;can&#x20;still&#x20;respond&#x20;to&#x20;user&#x20;assistance&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;user&#x20;might&#x20;be&#x20;tricked&#x20;and&#x20;accept&#x20;an&#x20;unsolicited&#x20;Remote&#x20;Assistance&#x20;offer&#x20;from&#x20;a&#x20;malicious&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Offer&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.35.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15154,'Ensure&#x20;&#039;Configure&#x20;Solicited&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Solicited&#x20;&#40;Ask&#x20;for&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','There&#x20;is&#x20;slight&#x20;risk&#x20;that&#x20;a&#x20;rogue&#x20;administrator&#x20;will&#x20;gain&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;desktop&#x20;session,&#x20;however,&#x20;they&#x20;cannot&#x20;connect&#x20;to&#x20;a&#x20;user&#039;s&#x20;computer&#x20;unannounced&#x20;or&#x20;control&#x20;it&#x20;without&#x20;permission&#x20;from&#x20;the&#x20;user.&#x20;When&#x20;an&#x20;expert&#x20;tries&#x20;to&#x20;connect,&#x20;the&#x20;user&#x20;can&#x20;still&#x20;choose&#x20;to&#x20;deny&#x20;the&#x20;connection&#x20;or&#x20;give&#x20;the&#x20;expert&#x20;view-only&#x20;privileges.&#x20;The&#x20;user&#x20;must&#x20;explicitly&#x20;click&#x20;the&#x20;Yes&#x20;button&#x20;to&#x20;allow&#x20;the&#x20;expert&#x20;to&#x20;remotely&#x20;control&#x20;the&#x20;workstation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Solicited&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.35.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15155,'Ensure&#x20;&#039;Enable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;RPC&#x20;clients&#x20;authenticate&#x20;with&#x20;the&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;when&#x20;the&#x20;call&#x20;they&#x20;are&#x20;making&#x20;contains&#x20;authentication&#x20;information.&#x20;The&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;on&#x20;computers&#x20;running&#x20;Windows&#x20;NT4&#x20;&#40;all&#x20;service&#x20;packs&#41;&#x20;cannot&#x20;process&#x20;authentication&#x20;information&#x20;supplied&#x20;in&#x20;this&#x20;manner.&#x20;This&#x20;policy&#x20;setting&#x20;can&#x20;cause&#x20;a&#x20;specific&#x20;issue&#x20;with&#x20;1-way&#x20;forest&#x20;trusts&#x20;if&#x20;it&#x20;is&#x20;applied&#x20;to&#x20;the&#x20;trusting&#x20;domain&#x20;DCs&#x20;&#40;see&#x20;Microsoft&#x20;KB3073942&#41;,&#x20;so&#x20;we&#x20;do&#x20;not&#x20;recommend&#x20;applying&#x20;it&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;This&#x20;policy&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Anonymous&#x20;access&#x20;to&#x20;RPC&#x20;services&#x20;could&#x20;result&#x20;in&#x20;accidental&#x20;disclosure&#x20;of&#x20;information&#x20;to&#x20;unauthenticated&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallEnable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15156,'Ensure&#x20;&#039;Restrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Authenticated&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;how&#x20;the&#x20;RPC&#x20;server&#x20;runtime&#x20;handles&#x20;unauthenticated&#x20;RPC&#x20;clients&#x20;connecting&#x20;to&#x20;RPC&#x20;servers.','Unauthenticated&#x20;RPC&#x20;communication&#x20;can&#x20;create&#x20;a&#x20;security&#x20;vulnerability.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Authenticated:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallRestrict&#x20;Unauthenticated&#x20;RPC&#x20;clients.','[{\"cis\": [\"18.8.36.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15157,'Ensure&#x20;&#039;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool&#x20;&#40;MSDT&#41;&#x20;interactive&#x20;communication&#x20;with&#x20;the&#x20;support&#x20;provider.&#x20;MSDT&#x20;gathers&#x20;diagnostic&#x20;data&#x20;for&#x20;analysis&#x20;by&#x20;support&#x20;professionals.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsMicrosoft&#x20;Support&#x20;Diagnostic&#x20;ToolMicrosoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSDT.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.44.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15158,'Ensure&#x20;&#039;Enable/Disable&#x20;PerfTrack&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;tracking&#x20;of&#x20;responsiveness&#x20;events.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;enabled&#x20;the&#x20;aggregated&#x20;data&#x20;of&#x20;a&#x20;given&#x20;event&#x20;will&#x20;be&#x20;transmitted&#x20;to&#x20;Microsoft.&#x20;The&#x20;option&#x20;exists&#x20;to&#x20;restrict&#x20;this&#x20;feature&#x20;for&#x20;a&#x20;specific&#x20;user,&#x20;set&#x20;the&#x20;consent&#x20;level,&#x20;and&#x20;designate&#x20;specific&#x20;programs&#x20;for&#x20;which&#x20;error&#x20;reports&#x20;could&#x20;be&#x20;sent.&#x20;However,&#x20;centrally&#x20;restricting&#x20;the&#x20;ability&#x20;to&#x20;execute&#x20;PerfTrack&#x20;to&#x20;limit&#x20;the&#x20;potential&#x20;for&#x20;unauthorized&#x20;or&#x20;undesired&#x20;usage,&#x20;data&#x20;leakage,&#x20;or&#x20;unintentional&#x20;communications&#x20;is&#x20;highly&#x20;recommended.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsWindows&#x20;Performance&#x20;PerfTrackEnable/Disable&#x20;PerfTrack.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PerformancePerftrack.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.44.11.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15159,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;advertising&#x20;ID,&#x20;preventing&#x20;apps&#x20;from&#x20;using&#x20;the&#x20;ID&#x20;for&#x20;experiences&#x20;across&#x20;apps.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Tracking&#x20;user&#x20;activity&#x20;for&#x20;advertising&#x20;purposes,&#x20;even&#x20;anonymously,&#x20;may&#x20;be&#x20;a&#x20;privacy&#x20;concern.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;applications&#x20;should&#x20;not&#x20;need&#x20;or&#x20;require&#x20;tracking&#x20;for&#x20;targeted&#x20;advertising.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemUser&#x20;ProfilesTurn&#x20;off&#x20;the&#x20;advertising&#x20;ID.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;UserProfiles.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.46.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15160,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Client&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;is&#x20;enabled.&#x20;Enabling&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;allows&#x20;your&#x20;computer&#x20;to&#x20;synchronize&#x20;its&#x20;computer&#x20;clock&#x20;with&#x20;other&#x20;NTP&#x20;servers.&#x20;You&#x20;might&#x20;want&#x20;to&#x20;disable&#x20;this&#x20;service&#x20;if&#x20;you&#x20;decide&#x20;to&#x20;use&#x20;a&#x20;third-party&#x20;time&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;reliable&#x20;and&#x20;accurate&#x20;account&#x20;of&#x20;time&#x20;is&#x20;important&#x20;for&#x20;a&#x20;number&#x20;of&#x20;services&#x20;and&#x20;security&#x20;requirements,&#x20;including&#x20;but&#x20;not&#x20;limited&#x20;to&#x20;distributed&#x20;applications,&#x20;authentication&#x20;services,&#x20;multi-user&#x20;databases&#x20;and&#x20;logging&#x20;services.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;NTP&#x20;client&#x20;&#40;with&#x20;secure&#x20;operation&#41;&#x20;establishes&#x20;functional&#x20;accuracy&#x20;and&#x20;is&#x20;a&#x20;focal&#x20;point&#x20;when&#x20;reviewing&#x20;security&#x20;relevant&#x20;events.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Client.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.49.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(15161,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;is&#x20;enabled.','The&#x20;configuration&#x20;of&#x20;proper&#x20;time&#x20;synchronization&#x20;is&#x20;critically&#x20;important&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;both&#x20;due&#x20;to&#x20;the&#x20;sensitivity&#x20;of&#x20;Kerberos&#x20;authentication&#x20;timestamps&#x20;and&#x20;also&#x20;to&#x20;ensure&#x20;accurate&#x20;security&#x20;logging.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Server.','[{\"cis\": [\"18.8.49.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.3\", \"CC7.2\"]}]'),(15162,'Ensure&#x20;&#039;Allow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;control&#x20;whether&#x20;Microsoft&#x20;accounts&#x20;are&#x20;optional&#x20;for&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;require&#x20;an&#x20;account&#x20;to&#x20;sign&#x20;in.&#x20;This&#x20;policy&#x20;only&#x20;affects&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;use&#x20;their&#x20;enterprise&#x20;user&#x20;accounts&#x20;instead&#x20;of&#x20;using&#x20;their&#x20;Microsoft&#x20;accounts&#x20;when&#x20;accessing&#x20;Windows&#x20;store&#x20;apps.&#x20;This&#x20;provides&#x20;the&#x20;organization&#x20;with&#x20;greater&#x20;control&#x20;over&#x20;relevant&#x20;credentials.&#x20;Microsoft&#x20;accounts&#x20;cannot&#x20;be&#x20;centrally&#x20;managed&#x20;and&#x20;as&#x20;such&#x20;enterprise&#x20;credential&#x20;security&#x20;policies&#x20;cannot&#x20;be&#x20;applied&#x20;to&#x20;them,&#x20;which&#x20;could&#x20;put&#x20;any&#x20;information&#x20;accessed&#x20;by&#x20;using&#x20;Microsoft&#x20;accounts&#x20;at&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeAllow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.6.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15163,'Ensure&#x20;&#039;Disallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;disallows&#x20;AutoPlay&#x20;for&#x20;MTP&#x20;devices&#x20;like&#x20;cameras&#x20;or&#x20;phones.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesDisallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15164,'Ensure&#x20;&#039;Set&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands&#039;','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Autorun&#x20;commands.&#x20;Autorun&#x20;commands&#x20;are&#x20;generally&#x20;stored&#x20;in&#x20;autorun.inf&#x20;files.&#x20;They&#x20;often&#x20;launch&#x20;the&#x20;installation&#x20;program&#x20;or&#x20;other&#x20;routines.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands.','Prior&#x20;to&#x20;Windows&#x20;Vista,&#x20;when&#x20;media&#x20;containing&#x20;an&#x20;autorun&#x20;command&#x20;is&#x20;inserted,&#x20;the&#x20;system&#x20;will&#x20;automatically&#x20;execute&#x20;the&#x20;program&#x20;without&#x20;user&#x20;intervention.&#x20;This&#x20;creates&#x20;a&#x20;major&#x20;security&#x20;concern&#x20;as&#x20;code&#x20;may&#x20;be&#x20;executed&#x20;without&#x20;user&#039;s&#x20;knowledge.&#x20;The&#x20;default&#x20;behavior&#x20;starting&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;to&#x20;prompt&#x20;the&#x20;user&#x20;whether&#x20;autorun&#x20;command&#x20;is&#x20;to&#x20;be&#x20;run.&#x20;The&#x20;autorun&#x20;command&#x20;is&#x20;represented&#x20;as&#x20;a&#x20;handler&#x20;in&#x20;the&#x20;Autoplay&#x20;dialog.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesSet&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15165,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Autoplay&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;All&#x20;drives&#039;','Autoplay&#x20;starts&#x20;to&#x20;read&#x20;from&#x20;a&#x20;drive&#x20;as&#x20;soon&#x20;as&#x20;you&#x20;insert&#x20;media&#x20;in&#x20;the&#x20;drive,&#x20;which&#x20;causes&#x20;the&#x20;setup&#x20;file&#x20;for&#x20;programs&#x20;or&#x20;audio&#x20;media&#x20;to&#x20;start&#x20;immediately.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;the&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.&#x20;Autoplay&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;on&#x20;some&#x20;removable&#x20;drive&#x20;types,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives,&#x20;but&#x20;not&#x20;on&#x20;CD-ROM&#x20;drives.&#x20;Note:&#x20;You&#x20;cannot&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enable&#x20;Autoplay&#x20;on&#x20;computer&#x20;drives&#x20;in&#x20;which&#x20;it&#x20;is&#x20;disabled&#x20;by&#x20;default,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;All&#x20;drives.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;All&#x20;drives:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesTurn&#x20;off&#x20;Autoplay&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.8.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15166,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;display&#x20;of&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;in&#x20;password&#x20;entry&#x20;user&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;useful&#x20;feature&#x20;when&#x20;entering&#x20;a&#x20;long&#x20;and&#x20;complex&#x20;password,&#x20;especially&#x20;when&#x20;using&#x20;a&#x20;touchscreen.&#x20;The&#x20;potential&#x20;risk&#x20;is&#x20;that&#x20;someone&#x20;else&#x20;may&#x20;see&#x20;your&#x20;password&#x20;while&#x20;surreptitiously&#x20;observing&#x20;your&#x20;screen.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceDo&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.15.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15167,'Ensure&#x20;&#039;Enumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;administrator&#x20;accounts&#x20;are&#x20;displayed&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;elevate&#x20;a&#x20;running&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;could&#x20;see&#x20;the&#x20;list&#x20;of&#x20;administrator&#x20;accounts,&#x20;making&#x20;it&#x20;slightly&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;user&#x20;who&#x20;has&#x20;logged&#x20;onto&#x20;a&#x20;console&#x20;session&#x20;to&#x20;try&#x20;to&#x20;crack&#x20;the&#x20;passwords&#x20;of&#x20;those&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceEnumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.15.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15168,'Ensure&#x20;&#039;Default&#x20;Action&#x20;and&#x20;Mitigation&#x20;Settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;plus&#x20;subsettings&#41;','This&#x20;setting&#x20;configures&#x20;the&#x20;default&#x20;action&#x20;after&#x20;detection&#x20;and&#x20;advanced&#x20;ROP&#x20;mitigation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Default&#x20;Action&#x20;and&#x20;Mitigation&#x20;Settings&#x20;-&#x20;Enabled;&#x20;Deep&#x20;Hooks&#x20;-&#x20;Enabled;&#x20;&#x20;Anti&#x20;Detours&#x20;-&#x20;Enabled;&#x20;Banned&#x20;Functions&#x20;-&#x20;Enabled;&#x20;Exploit&#x20;Action&#x20;-&#x20;User&#x20;Configured','These&#x20;advanced&#x20;mitigations&#x20;for&#x20;ROP&#x20;mitigations&#x20;apply&#x20;to&#x20;all&#x20;configured&#x20;software&#x20;in&#x20;EMET:&#x20;Deep&#x20;Hooks&#x20;protects&#x20;critical&#x20;APIs&#x20;and&#x20;the&#x20;subsequent&#x20;lower&#x20;level&#x20;APIs&#x20;used&#x20;by&#x20;the&#x20;top&#x20;level&#x20;critical&#x20;API.&#x20;Anti&#x20;Detours&#x20;renders&#x20;ineffective&#x20;exploits&#x20;that&#x20;evade&#x20;hooks&#x20;by&#x20;executing&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;hooked&#x20;function&#x20;prologue&#x20;and&#x20;then&#x20;jump&#x20;to&#x20;the&#x20;function&#x20;past&#x20;the&#x20;prologue.&#x20;Banned&#x20;Functions&#x20;will&#x20;block&#x20;calls&#x20;to&#x20;ntdll!LdrHotPatchRoutine&#x20;to&#x20;mitigate&#x20;potential&#x20;exploits&#x20;abusing&#x20;the&#x20;API.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETDefault&#x20;Action&#x20;and&#x20;Mitigation&#x20;Settings&#x20;.Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15169,'Ensure&#x20;&#039;Default&#x20;Protections&#x20;for&#x20;Internet&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;determines&#x20;if&#x20;recommended&#x20;EMET&#x20;mitigations&#x20;are&#x20;applied&#x20;to&#x20;Internet&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Applying&#x20;EMET&#x20;mitigations&#x20;to&#x20;Internet&#x20;Explorer&#x20;will&#x20;help&#x20;reduce&#x20;the&#x20;reliability&#x20;of&#x20;exploits&#x20;that&#x20;target&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETDefault&#x20;Protections&#x20;for&#x20;Internet&#x20;Explorer&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15170,'Ensure&#x20;&#039;Default&#x20;Protections&#x20;for&#x20;Popular&#x20;Software&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;determines&#x20;if&#x20;recommended&#x20;EMET&#x20;mitigations&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;following&#x20;popular&#x20;software:&#x20;7-Zip;&#x20;Adobe&#x20;Photoshop;&#x20;Foxit&#x20;Reader;&#x20;Google&#x20;Chrome;&#x20;Google&#x20;Talk;&#x20;iTunes;&#x20;Microsoft&#x20;Live&#x20;Writer;Microsoft&#x20;Lync&#x20;Communicator&#x20;;Microsoft&#x20;Photo&#x20;Gallery&#x20;;Microsoft&#x20;SkyDrive;&#x20;mIRC;&#x20;Mozilla&#x20;Firefox;&#x20;Mozilla&#x20;Thunderbird;&#x20;Opera;Pidgin&#x20;;QuickTime&#x20;Player;&#x20;RealPlayer;&#x20;Safari;&#x20;Skype;&#x20;VideoLAN&#x20;VLC;&#x20;Winamp;&#x20;Windows&#x20;Live&#x20;Mail;&#x20;Windows&#x20;Media&#x20;Player;&#x20;WinRAR;&#x20;WinZip.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Applying&#x20;EMET&#x20;mitigations&#x20;to&#x20;popular&#x20;software&#x20;packages&#x20;will&#x20;help&#x20;reduce&#x20;the&#x20;reliability&#x20;of&#x20;exploits&#x20;that&#x20;target&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETDefault&#x20;Protections&#x20;for&#x20;Popular&#x20;Software&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15171,'Ensure&#x20;&#039;Default&#x20;Protections&#x20;for&#x20;Recommended&#x20;Software&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;determines&#x20;if&#x20;recommended&#x20;EMET&#x20;mitigations&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;following&#x20;software:&#x20;Adobe&#x20;Acrobat;&#x20;Adobe&#x20;Acrobat&#x20;Reader;&#x20;Microsoft&#x20;Office&#x20;suite&#x20;applications;&#x20;Oracle&#x20;Java;&#x20;WordPad.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Applying&#x20;EMET&#x20;mitigations&#x20;to&#x20;recommended&#x20;software&#x20;will&#x20;help&#x20;reduce&#x20;the&#x20;reliability&#x20;of&#x20;exploits&#x20;that&#x20;target&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETDefault&#x20;Protections&#x20;for&#x20;Recommended&#x20;Software&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.5\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15172,'Ensure&#x20;&#039;System&#x20;ASLR&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Application&#x20;Opt-In&#039;','This&#x20;setting&#x20;determines&#x20;how&#x20;applications&#x20;become&#x20;enrolled&#x20;in&#x20;Address&#x20;Space&#x20;Layout&#x20;Randomization&#x20;&#40;ASLR&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Application&#x20;Opt-In&#x20;.','ASLR&#x20;reduces&#x20;the&#x20;predictability&#x20;of&#x20;process&#x20;memory,&#x20;which&#x20;in-turn&#x20;helps&#x20;reduce&#x20;the&#x20;reliability&#x20;of&#x20;exploits&#x20;targeting&#x20;memory&#x20;corruption&#x20;vulnerabilities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Application&#x20;Opt-In&#x20;:Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETSystem&#x20;ASLR&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.6\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15173,'Ensure&#x20;&#039;System&#x20;DEP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Application&#x20;Opt-Out&#039;','This&#x20;setting&#x20;determines&#x20;how&#x20;applications&#x20;become&#x20;enrolled&#x20;in&#x20;Data&#x20;Execution&#x20;Protection&#x20;&#40;DEP&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Application&#x20;Opt-Out&#x20;.','DEP&#x20;marks&#x20;pages&#x20;of&#x20;application&#x20;memory&#x20;as&#x20;non-executable,&#x20;which&#x20;reduces&#x20;a&#x20;given&#x20;exploit&#039;s&#x20;ability&#x20;to&#x20;run&#x20;attacker-controlled&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Application&#x20;Opt-Out&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETSystem&#x20;DEP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.7\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15174,'Ensure&#x20;&#039;System&#x20;SEHOP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Application&#x20;Opt-Out&#039;','This&#x20;setting&#x20;determines&#x20;how&#x20;applications&#x20;become&#x20;enrolled&#x20;in&#x20;Structured&#x20;Exception&#x20;Handler&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Application&#x20;Opt-Out&#x20;.','When&#x20;a&#x20;software&#x20;component&#x20;suffers&#x20;from&#x20;a&#x20;memory&#x20;corruption&#x20;vulnerability,&#x20;an&#x20;exploit&#x20;may&#x20;be&#x20;able&#x20;to&#x20;overwrite&#x20;memory&#x20;that&#x20;contains&#x20;data&#x20;structures&#x20;that&#x20;control&#x20;how&#x20;the&#x20;software&#x20;handles&#x20;exceptions.&#x20;By&#x20;corrupting&#x20;these&#x20;structures&#x20;in&#x20;a&#x20;controlled&#x20;manner,&#x20;an&#x20;exploit&#x20;may&#x20;be&#x20;able&#x20;to&#x20;execute&#x20;arbitrary&#x20;code.&#x20;SEHOP&#x20;verifies&#x20;the&#x20;integrity&#x20;of&#x20;those&#x20;structures&#x20;before&#x20;they&#x20;are&#x20;used&#x20;to&#x20;handle&#x20;exceptions,&#x20;which&#x20;reduces&#x20;the&#x20;reliability&#x20;of&#x20;exploits&#x20;that&#x20;leverage&#x20;structured&#x20;exception&#x20;handler&#x20;overwrites.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Application&#x20;Opt-Out&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEMETSystem&#x20;SEHOP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;EMET.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Enhanced&#x20;Mitigation&#x20;Experience&#x20;Toolkit&#x20;&#40;EMET&#41;.','[{\"cis\": [\"18.9.24.7\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15175,'Ensure&#x20;&#039;Application:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15176,'Ensure&#x20;&#039;Application:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15177,'Ensure&#x20;&#039;Security:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecurityControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.2.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15178,'Ensure&#x20;&#039;Security:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;196,608&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecuritySpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.2.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15179,'Ensure&#x20;&#039;Setup:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.3.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15180,'Ensure&#x20;&#039;Setup:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.3.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15181,'Ensure&#x20;&#039;System:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.4.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15182,'Ensure&#x20;&#039;System:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.4.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15183,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Disabling&#x20;Data&#x20;Execution&#x20;Prevention&#x20;can&#x20;allow&#x20;certain&#x20;legacy&#x20;plug-in&#x20;applications&#x20;to&#x20;function&#x20;without&#x20;terminating&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Data&#x20;Execution&#x20;Prevention&#x20;is&#x20;an&#x20;important&#x20;security&#x20;feature&#x20;supported&#x20;by&#x20;Explorer&#x20;that&#x20;helps&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;of&#x20;certain&#x20;types&#x20;of&#x20;malware.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.30.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15184,'Ensure&#x20;&#039;Turn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.30.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15185,'Ensure&#x20;&#039;Turn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.30.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15186,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Location&#x20;Provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;Windows&#x20;Location&#x20;Provider&#x20;feature&#x20;for&#x20;the&#x20;computer.','This&#x20;setting&#x20;affects&#x20;the&#x20;Windows&#x20;Location&#x20;Provider&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsWindows&#x20;Location&#x20;ProviderTurn&#x20;off&#x20;Windows&#x20;Location&#x20;Provider.','[{\"cis\": [\"18.9.39.1.1\"]}]'),(15187,'Ensure&#x20;&#039;Turn&#x20;off&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;location&#x20;feature&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&#039;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsTurn&#x20;off&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sensors.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.39.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15188,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;However,&#x20;we&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;the&#x20;version&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Prevent&#x20;the&#x20;usage&#x20;of&#x20;SkyDrive&#x20;for&#x20;file&#x20;storage,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.52.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15189,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#x20;on&#x20;Windows&#x20;8.1&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;legacy&#x20;OneDrive/SkyDrive&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Despite&#x20;the&#x20;name&#x20;of&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;applicable&#x20;to&#x20;the&#x20;legacy&#x20;OneDrive&#x20;client&#x20;on&#x20;any&#x20;Windows&#x20;OS.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;legacy&#x20;OneDrive/SkyDrive&#x20;client.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#x20;on&#x20;Windows&#x20;8.1&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;We&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;either&#x20;that&#x20;version&#x20;of&#x20;the&#x20;template&#x20;or&#x20;a&#x20;newer&#x20;one.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.','[{\"cis\": [\"18.9.52.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15190,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;helps&#x20;prevent&#x20;Remote&#x20;Desktop&#x20;clients&#x20;from&#x20;saving&#x20;passwords&#x20;on&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;was&#x20;previously&#x20;configured&#x20;as&#x20;Disabled&#x20;or&#x20;Not&#x20;configured,&#x20;any&#x20;previously&#x20;saved&#x20;passwords&#x20;will&#x20;be&#x20;deleted&#x20;the&#x20;first&#x20;time&#x20;a&#x20;Remote&#x20;Desktop&#x20;client&#x20;disconnects&#x20;from&#x20;any&#x20;server.','An&#x20;attacker&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;may&#x20;be&#x20;able&#x20;to&#x20;break&#x20;the&#x20;protection&#x20;guarding&#x20;saved&#x20;passwords.&#x20;An&#x20;attacker&#x20;who&#x20;compromises&#x20;a&#x20;user&#039;s&#x20;account&#x20;and&#x20;connects&#x20;to&#x20;their&#x20;computer&#x20;could&#x20;use&#x20;saved&#x20;passwords&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;additional&#x20;hosts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Connection&#x20;ClientDo&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.2.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15191,'Ensure&#x20;&#039;Restrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;users&#x20;&amp;&#x20;administrators&#x20;who&#x20;Remote&#x20;Desktop&#x20;to&#x20;a&#x20;server&#x20;will&#x20;continue&#x20;to&#x20;use&#x20;the&#x20;same&#x20;session&#x20;-&#x20;if&#x20;they&#x20;disconnect&#x20;and&#x20;reconnect,&#x20;they&#x20;will&#x20;go&#x20;back&#x20;to&#x20;the&#x20;same&#x20;session&#x20;they&#x20;were&#x20;using&#x20;before,&#x20;preventing&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;second&#x20;simultaneous&#x20;session.&#x20;This&#x20;both&#x20;prevents&#x20;unnecessary&#x20;resource&#x20;usage&#x20;by&#x20;having&#x20;the&#x20;server&#x20;host&#x20;unnecessary&#x20;additional&#x20;sessions&#x20;&#40;which&#x20;would&#x20;put&#x20;extra&#x20;load&#x20;on&#x20;the&#x20;server&#41;&#x20;and&#x20;also&#x20;ensures&#x20;a&#x20;consistency&#x20;of&#x20;experience&#x20;for&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostConnectionsRestrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Restrict&#x20;Terminal&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;remote&#x20;session,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.2.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15192,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;COM&#x20;ports&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;COM&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15193,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;sharing&#x20;the&#x20;local&#x20;drives&#x20;on&#x20;their&#x20;client&#x20;computers&#x20;to&#x20;Remote&#x20;Desktop&#x20;Servers&#x20;that&#x20;they&#x20;access.&#x20;Mapped&#x20;drives&#x20;appear&#x20;in&#x20;the&#x20;session&#x20;folder&#x20;tree&#x20;in&#x20;Windows&#x20;Explorer&#x20;in&#x20;the&#x20;following&#x20;format:&#x20;&#92;TSClient&lt;driveletter&gt;$&#x20;If&#x20;local&#x20;drives&#x20;are&#x20;shared&#x20;they&#x20;are&#x20;left&#x20;vulnerable&#x20;to&#x20;intruders&#x20;who&#x20;want&#x20;to&#x20;exploit&#x20;the&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Data&#x20;could&#x20;be&#x20;forwarded&#x20;from&#x20;the&#x20;user&#039;s&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;without&#x20;any&#x20;direct&#x20;user&#x20;interaction.&#x20;Malicious&#x20;software&#x20;already&#x20;present&#x20;on&#x20;a&#x20;compromised&#x20;server&#x20;would&#x20;have&#x20;direct&#x20;and&#x20;stealthy&#x20;disk&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15194,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;LPT&#x20;ports&#x20;during&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;LPT&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15195,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;redirection&#x20;of&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;devices,&#x20;such&#x20;as&#x20;Windows&#x20;Portable&#x20;Devices,&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15196,'Ensure&#x20;&#039;Always&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;always&#x20;prompts&#x20;the&#x20;client&#x20;computer&#x20;for&#x20;a&#x20;password&#x20;upon&#x20;connection.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enforce&#x20;a&#x20;password&#x20;prompt&#x20;for&#x20;users&#x20;who&#x20;log&#x20;on&#x20;to&#x20;Remote&#x20;Desktop&#x20;Services,&#x20;even&#x20;if&#x20;they&#x20;already&#x20;provided&#x20;the&#x20;password&#x20;in&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;have&#x20;the&#x20;option&#x20;to&#x20;store&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;when&#x20;they&#x20;create&#x20;a&#x20;new&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut.&#x20;If&#x20;the&#x20;server&#x20;that&#x20;runs&#x20;Remote&#x20;Desktop&#x20;Services&#x20;allows&#x20;users&#x20;who&#x20;have&#x20;used&#x20;this&#x20;feature&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;server&#x20;but&#x20;not&#x20;enter&#x20;their&#x20;password,&#x20;then&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer&#x20;could&#x20;connect&#x20;to&#x20;a&#x20;Remote&#x20;Desktop&#x20;Server&#x20;through&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut,&#x20;even&#x20;though&#x20;they&#x20;may&#x20;not&#x20;know&#x20;the&#x20;user&#039;s&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityAlways&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Always&#x20;prompt&#x20;client&#x20;for&#x20;password&#x20;upon&#x20;connection,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.9.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15197,'Ensure&#x20;&#039;Require&#x20;secure&#x20;RPC&#x20;communication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;requires&#x20;secure&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;communication&#x20;with&#x20;all&#x20;clients&#x20;or&#x20;allows&#x20;unsecured&#x20;communication.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;strengthen&#x20;the&#x20;security&#x20;of&#x20;RPC&#x20;communication&#x20;with&#x20;clients&#x20;by&#x20;allowing&#x20;only&#x20;authenticated&#x20;and&#x20;encrypted&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;unsecure&#x20;RPC&#x20;communication&#x20;can&#x20;exposes&#x20;the&#x20;server&#x20;to&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks&#x20;and&#x20;data&#x20;disclosure&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;secure&#x20;RPC&#x20;communication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.9.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15198,'Ensure&#x20;&#039;Set&#x20;client&#x20;connection&#x20;encryption&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;High&#x20;Level&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;encryption&#x20;level&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;client&#x20;computers&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;This&#x20;policy&#x20;only&#x20;applies&#x20;when&#x20;you&#x20;are&#x20;using&#x20;native&#x20;RDP&#x20;encryption.&#x20;However,&#x20;native&#x20;RDP&#x20;encryption&#x20;&#40;as&#x20;opposed&#x20;to&#x20;SSL&#x20;encryption&#41;&#x20;is&#x20;not&#x20;recommended.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;SSL&#x20;encryption.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;High&#x20;Level.','If&#x20;Remote&#x20;Desktop&#x20;client&#x20;connections&#x20;that&#x20;use&#x20;low&#x20;level&#x20;encryption&#x20;are&#x20;allowed,&#x20;it&#x20;is&#x20;more&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;any&#x20;captured&#x20;Remote&#x20;Desktop&#x20;Services&#x20;network&#x20;traffic.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.9.3\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15199,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;time&#x20;that&#x20;an&#x20;active&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;can&#x20;be&#x20;idle&#x20;&#40;without&#x20;user&#x20;input&#41;&#x20;before&#x20;it&#x20;is&#x20;automatically&#x20;disconnected.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;inactive&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Terminal&#x20;Services&#x20;sessions,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.10.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15200,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;1&#x20;minute&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;a&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;1&#x20;minute.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;disconnected&#x20;but&#x20;still&#x20;active&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.&#x20;This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;disconnected&#x20;session&#x20;is&#x20;properly&#x20;terminated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;1&#x20;minute:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.10.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15201,'Ensure&#x20;&#039;Do&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;retains&#x20;a&#x20;user&#039;s&#x20;per-session&#x20;temporary&#x20;folders&#x20;at&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;inside&#x20;the&#x20;temporary&#x20;folders&#x20;and&#x20;visible&#x20;to&#x20;other&#x20;administrators&#x20;that&#x20;log&#x20;into&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Do&#x20;not&#x20;delete&#x20;temp&#x20;folder&#x20;upon&#x20;exit,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.11.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15202,'Ensure&#x20;&#039;Do&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','By&#x20;default,&#x20;Remote&#x20;Desktop&#x20;Services&#x20;creates&#x20;a&#x20;separate&#x20;temporary&#x20;folder&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;for&#x20;each&#x20;active&#x20;session&#x20;that&#x20;a&#x20;user&#x20;maintains&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server.&#x20;The&#x20;temporary&#x20;folder&#x20;is&#x20;created&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;in&#x20;a&#x20;Temp&#x20;folder&#x20;under&#x20;the&#x20;user&#039;s&#x20;profile&#x20;folder&#x20;and&#x20;is&#x20;named&#x20;with&#x20;the&#x20;sessionid.&#x20;This&#x20;temporary&#x20;folder&#x20;is&#x20;used&#x20;to&#x20;store&#x20;individual&#x20;temporary&#x20;files.&#x20;To&#x20;reclaim&#x20;disk&#x20;space,&#x20;the&#x20;temporary&#x20;folder&#x20;is&#x20;deleted&#x20;when&#x20;the&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;a&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;keeps&#x20;the&#x20;cached&#x20;data&#x20;independent&#x20;for&#x20;each&#x20;session,&#x20;both&#x20;reducing&#x20;the&#x20;chance&#x20;of&#x20;problems&#x20;from&#x20;shared&#x20;cached&#x20;data&#x20;between&#x20;sessions,&#x20;and&#x20;keeping&#x20;possibly&#x20;sensitive&#x20;data&#x20;separate&#x20;to&#x20;each&#x20;user&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.11.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15203,'Ensure&#x20;&#039;Prevent&#x20;downloading&#x20;of&#x20;enclosures&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;having&#x20;enclosures&#x20;&#40;file&#x20;attachments&#41;&#x20;downloaded&#x20;from&#x20;an&#x20;RSS&#x20;feed&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;attachments&#x20;to&#x20;be&#x20;downloaded&#x20;through&#x20;the&#x20;RSS&#x20;feed&#x20;can&#x20;introduce&#x20;files&#x20;that&#x20;could&#x20;have&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRSS&#x20;FeedsPrevent&#x20;downloading&#x20;of&#x20;enclosures&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InetRes.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Turn&#x20;off&#x20;downloading&#x20;of&#x20;enclosures,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.1\"]}, {\"cis_csc\": [\"7.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15204,'Ensure&#x20;&#039;Allow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;encrypted&#x20;items&#x20;are&#x20;allowed&#x20;to&#x20;be&#x20;indexed.&#x20;When&#x20;this&#x20;setting&#x20;is&#x20;changed,&#x20;the&#x20;index&#x20;is&#x20;rebuilt&#x20;completely.&#x20;Full&#x20;volume&#x20;encryption&#x20;&#40;such&#x20;as&#x20;BitLocker&#x20;Drive&#x20;Encryption&#x20;or&#x20;a&#x20;non-Microsoft&#x20;solution&#41;&#x20;must&#x20;be&#x20;used&#x20;for&#x20;the&#x20;location&#x20;of&#x20;the&#x20;index&#x20;to&#x20;maintain&#x20;security&#x20;for&#x20;encrypted&#x20;files.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Indexing&#x20;and&#x20;allowing&#x20;users&#x20;to&#x20;search&#x20;encrypted&#x20;files&#x20;could&#x20;potentially&#x20;reveal&#x20;confidential&#x20;data&#x20;stored&#x20;within&#x20;the&#x20;encrypted&#x20;files.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.60.2\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15205,'Ensure&#x20;&#039;Set&#x20;what&#x20;information&#x20;is&#x20;shared&#x20;in&#x20;Search&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Anonymous&#x20;info&#039;','Various&#x20;levels&#x20;of&#x20;information&#x20;can&#x20;be&#x20;shared&#x20;with&#x20;Bing&#x20;in&#x20;Search,&#x20;to&#x20;include&#x20;user&#x20;information&#x20;and&#x20;location.&#x20;Configuring&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;selecting&#x20;the&#x20;level&#x20;of&#x20;information&#x20;shared&#x20;and&#x20;enables&#x20;the&#x20;most&#x20;restrictive&#x20;selection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Anonymous&#x20;info.','Limiting&#x20;the&#x20;search&#x20;information&#x20;shared&#x20;with&#x20;Microsoft&#x20;Bing&#x20;enhances&#x20;privacy&#x20;and&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Anonymous&#x20;info:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchSet&#x20;what&#x20;information&#x20;is&#x20;shared&#x20;in&#x20;Search.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.60.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15206,'Ensure&#x20;&#039;Turn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;Key&#x20;Management&#x20;Service&#x20;&#40;KMS&#41;&#x20;is&#x20;a&#x20;Microsoft&#x20;license&#x20;activation&#x20;method&#x20;that&#x20;entails&#x20;setting&#x20;up&#x20;a&#x20;local&#x20;server&#x20;to&#x20;store&#x20;the&#x20;software&#x20;licenses.&#x20;The&#x20;KMS&#x20;server&#x20;itself&#x20;needs&#x20;to&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;activate&#x20;the&#x20;KMS&#x20;service,&#x20;but&#x20;subsequent&#x20;on-network&#x20;clients&#x20;can&#x20;activate&#x20;Microsoft&#x20;Windows&#x20;OS&#x20;and/or&#x20;their&#x20;Microsoft&#x20;Office&#x20;via&#x20;the&#x20;KMS&#x20;server&#x20;instead&#x20;of&#x20;connecting&#x20;directly&#x20;to&#x20;Microsoft.&#x20;This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;opt-out&#x20;of&#x20;sending&#x20;KMS&#x20;client&#x20;activation&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Even&#x20;though&#x20;the&#x20;KMS&#x20;licensing&#x20;method&#x20;does&#x20;not&#x20;require&#x20;KMS&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;Microsoft,&#x20;they&#x20;still&#x20;send&#x20;KMS&#x20;client&#x20;activation&#x20;state&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSoftware&#x20;Protection&#x20;PlatformTurn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AVSValidationGP.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15207,'Ensure&#x20;&#039;Configure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;a&#x20;local&#x20;override&#x20;for&#x20;the&#x20;configuration&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&quot;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&quot;.&#x20;This&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;set&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','The&#x20;decision&#x20;on&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;participate&#x20;in&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;for&#x20;malicious&#x20;software&#x20;reporting&#x20;should&#x20;be&#x20;made&#x20;centrally&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;so&#x20;that&#x20;all&#x20;computers&#x20;within&#x20;it&#x20;behave&#x20;consistently&#x20;in&#x20;that&#x20;regard.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Disabled&#x20;ensures&#x20;that&#x20;the&#x20;decision&#x20;remains&#x20;centrally&#x20;managed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusMAPSConfigure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.3.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15208,'Ensure&#x20;&#039;Join&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&#039;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#039;.&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;is&#x20;the&#x20;online&#x20;community&#x20;that&#x20;helps&#x20;you&#x20;choose&#x20;how&#x20;to&#x20;respond&#x20;to&#x20;potential&#x20;threats.&#x20;The&#x20;community&#x20;also&#x20;helps&#x20;stop&#x20;the&#x20;spread&#x20;of&#x20;new&#x20;malicious&#x20;software&#x20;infections.&#x20;You&#x20;can&#x20;choose&#x20;to&#x20;send&#x20;basic&#x20;or&#x20;additional&#x20;information&#x20;about&#x20;detected&#x20;software.&#x20;Additional&#x20;information&#x20;helps&#x20;Microsoft&#x20;create&#x20;new&#x20;definitions&#x20;and&#x20;help&#x20;it&#x20;to&#x20;protect&#x20;your&#x20;computer.&#x20;Possible&#x20;options&#x20;are:&#x20;-&#x20;&#40;0x0&#41;&#x20;Disabled&#x20;&#40;default&#41;&#x20;-&#x20;&#40;0x1&#41;&#x20;Basic&#x20;membership&#x20;-&#x20;&#40;0x2&#41;&#x20;Advanced&#x20;membership&#x20;&#x20;&#x20;Basic&#x20;membership&#x20;will&#x20;send&#x20;basic&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;software&#x20;that&#x20;has&#x20;been&#x20;detected&#x20;including&#x20;where&#x20;the&#x20;software&#x20;came&#x20;from&#x20;the&#x20;actions&#x20;that&#x20;you&#x20;apply&#x20;or&#x20;that&#x20;are&#x20;applied&#x20;automatically&#x20;and&#x20;whether&#x20;the&#x20;actions&#x20;were&#x20;successful.&#x20;Advanced&#x20;membership&#x20;in&#x20;addition&#x20;to&#x20;basic&#x20;information&#x20;will&#x20;send&#x20;more&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;malicious&#x20;software&#x20;spyware&#x20;and&#x20;potentially&#x20;unwanted&#x20;software&#x20;including&#x20;the&#x20;location&#x20;of&#x20;the&#x20;software&#x20;file&#x20;names&#x20;how&#x20;the&#x20;software&#x20;operates&#x20;and&#x20;how&#x20;it&#x20;has&#x20;impacted&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;information&#x20;that&#x20;would&#x20;be&#x20;sent&#x20;can&#x20;include&#x20;things&#x20;like&#x20;location&#x20;of&#x20;detected&#x20;items&#x20;on&#x20;your&#x20;computer&#x20;if&#x20;harmful&#x20;software&#x20;was&#x20;removed.&#x20;The&#x20;information&#x20;would&#x20;be&#x20;automatically&#x20;collected&#x20;and&#x20;sent.&#x20;In&#x20;some&#x20;instances&#x20;personal&#x20;information&#x20;might&#x20;unintentionally&#x20;be&#x20;sent&#x20;to&#x20;Microsoft.&#x20;However,&#x20;Microsoft&#x20;states&#x20;that&#x20;it&#x20;will&#x20;not&#x20;use&#x20;this&#x20;information&#x20;to&#x20;identify&#x20;you&#x20;or&#x20;contact&#x20;you.&#x20;For&#x20;privacy&#x20;reasons&#x20;in&#x20;high&#x20;security&#x20;environments,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;prevent&#x20;these&#x20;data&#x20;submissions&#x20;altogether.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusMAPSJoin&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.3.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15209,'Ensure&#x20;&#039;Turn&#x20;on&#x20;behavior&#x20;monitoring&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;behavior&#x20;monitoring&#x20;for&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Windows&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;behavior&#x20;monitoring&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.7.1\"]}, {\"cis_csc\": [\"8.1\"]}, {\"pci_dss\": [\"5.2\"]}]'),(15210,'Ensure&#x20;&#039;Configure&#x20;Watson&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;whether&#x20;or&#x20;not&#x20;Watson&#x20;events&#x20;are&#x20;sent.','Watson&#x20;events&#x20;are&#x20;the&#x20;reports&#x20;that&#x20;get&#x20;sent&#x20;to&#x20;Microsoft&#x20;when&#x20;a&#x20;program&#x20;or&#x20;service&#x20;crashes&#x20;or&#x20;fails,&#x20;including&#x20;the&#x20;possibility&#x20;of&#x20;automatic&#x20;submission.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusReportingConfigure&#x20;Watson&#x20;events.','[{\"cis\": [\"18.9.76.9.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15211,'Ensure&#x20;&#039;Scan&#x20;removable&#x20;drives&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;scan&#x20;for&#x20;malicious&#x20;software&#x20;and&#x20;unwanted&#x20;software&#x20;in&#x20;the&#x20;contents&#x20;of&#x20;removable&#x20;drives,&#x20;such&#x20;as&#x20;USB&#x20;flash&#x20;drives,&#x20;when&#x20;running&#x20;a&#x20;full&#x20;scan.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;present&#x20;removable&#x20;drives&#x20;are&#x20;always&#x20;included&#x20;in&#x20;any&#x20;type&#x20;of&#x20;scan,&#x20;as&#x20;removable&#x20;drives&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;contain&#x20;malicious&#x20;software&#x20;brought&#x20;in&#x20;to&#x20;the&#x20;enterprise&#x20;managed&#x20;environment&#x20;from&#x20;an&#x20;external,&#x20;unmanaged&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusScanScan&#x20;removable&#x20;drives&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.10.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15212,'Ensure&#x20;&#039;Turn&#x20;on&#x20;e-mail&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;e-mail&#x20;scanning.&#x20;When&#x20;e-mail&#x20;scanning&#x20;is&#x20;enabled,&#x20;the&#x20;engine&#x20;will&#x20;parse&#x20;the&#x20;mailbox&#x20;and&#x20;mail&#x20;files,&#x20;according&#x20;to&#x20;their&#x20;specific&#x20;format,&#x20;in&#x20;order&#x20;to&#x20;analyze&#x20;the&#x20;mail&#x20;bodies&#x20;and&#x20;attachments.&#x20;Several&#x20;e-mail&#x20;formats&#x20;are&#x20;currently&#x20;supported,&#x20;for&#x20;example:&#x20;pst&#x20;&#40;Outlook&#41;,&#x20;dbx,&#x20;mbx,&#x20;mime&#x20;&#40;Outlook&#x20;Express&#41;,&#x20;binhex&#x20;&#40;Mac&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Incoming&#x20;e-mails&#x20;should&#x20;be&#x20;scanned&#x20;by&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Windows&#x20;Defender&#x20;Antivirus,&#x20;as&#x20;email&#x20;attachments&#x20;are&#x20;a&#x20;commonly&#x20;used&#x20;attack&#x20;vector&#x20;to&#x20;infiltrate&#x20;computers&#x20;with&#x20;malicious&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusScanTurn&#x20;on&#x20;e-mail&#x20;scanning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.10.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15213,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Defender&#x20;AntiVirus&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;If&#x20;the&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;Disabled,&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;runs&#x20;and&#x20;computers&#x20;are&#x20;scanned&#x20;for&#x20;malware&#x20;and&#x20;other&#x20;potentially&#x20;unwanted&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;current,&#x20;updated&#x20;antivirus&#x20;product&#x20;is&#x20;scanning&#x20;each&#x20;computer&#x20;for&#x20;malicious&#x20;file&#x20;activity.&#x20;Microsoft&#x20;provides&#x20;a&#x20;competent&#x20;solution&#x20;out&#x20;of&#x20;the&#x20;box&#x20;in&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;Organizations&#x20;that&#x20;choose&#x20;to&#x20;purchase&#x20;a&#x20;reputable&#x20;3rd-party&#x20;antivirus&#x20;solution&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;in&#x20;lieu&#x20;of&#x20;the&#x20;commercial&#x20;alternative.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusTurn&#x20;off&#x20;Windows&#x20;Defender&#x20;AntiVirus&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;off&#x20;Windows&#x20;Defender,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.76.14\"]}, {\"cis_csc\": [\"8.1\"]}, {\"pci_dss\": [\"5.2\"]}, {\"tsc\": [\"CC6.8\"]}]'),(15214,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;the&#x20;behavior&#x20;of&#x20;Windows&#x20;SmartScreen.&#x20;Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;Some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;with&#x20;this&#x20;feature&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass.','Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;However,&#x20;due&#x20;to&#x20;the&#x20;fact&#x20;that&#x20;some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;disable&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenExplorerConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Configure&#x20;Windows&#x20;SmartScreen,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.80.1.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15215,'Ensure&#x20;&#039;Configure&#x20;Default&#x20;consent&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Always&#x20;ask&#x20;before&#x20;sending&#x20;data&#039;','This&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;default&#x20;consent&#x20;handling&#x20;for&#x20;error&#x20;reports.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Always&#x20;ask&#x20;before&#x20;sending&#x20;data.','Error&#x20;reports&#x20;may&#x20;contain&#x20;sensitive&#x20;information&#x20;and&#x20;should&#x20;not&#x20;be&#x20;sent&#x20;to&#x20;anyone&#x20;automatically.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Always&#x20;ask&#x20;before&#x20;sending&#x20;data:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Error&#x20;ReportingConsentConfigure&#x20;Default&#x20;consent&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ErrorReporting.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.81.2.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15216,'Ensure&#x20;&#039;Automatically&#x20;send&#x20;memory&#x20;dumps&#x20;for&#x20;OS-generated&#x20;error&#x20;reports&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;memory&#x20;dumps&#x20;in&#x20;support&#x20;of&#x20;OS-generated&#x20;error&#x20;reports&#x20;can&#x20;be&#x20;sent&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;error&#x20;reports&#x20;generated&#x20;by&#x20;3rd-party&#x20;products,&#x20;or&#x20;additional&#x20;data&#x20;other&#x20;than&#x20;memory&#x20;dumps.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Memory&#x20;dumps&#x20;may&#x20;contain&#x20;sensitive&#x20;information&#x20;and&#x20;should&#x20;not&#x20;be&#x20;automatically&#x20;sent&#x20;to&#x20;anyone.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Error&#x20;ReportingAutomatically&#x20;send&#x20;memory&#x20;dumps&#x20;for&#x20;OS-&#x20;generated&#x20;error&#x20;reports&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ErrorReporting.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.81.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15217,'Ensure&#x20;&#039;Allow&#x20;user&#x20;control&#x20;over&#x20;installs&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;are&#x20;permitted&#x20;to&#x20;change&#x20;installation&#x20;options&#x20;that&#x20;typically&#x20;are&#x20;available&#x20;only&#x20;to&#x20;system&#x20;administrators.&#x20;The&#x20;security&#x20;features&#x20;of&#x20;Windows&#x20;Installer&#x20;normally&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;installation&#x20;options&#x20;that&#x20;are&#x20;typically&#x20;reserved&#x20;for&#x20;system&#x20;administrators,&#x20;such&#x20;as&#x20;specifying&#x20;the&#x20;directory&#x20;to&#x20;which&#x20;files&#x20;are&#x20;installed.&#x20;If&#x20;Windows&#x20;Installer&#x20;detects&#x20;that&#x20;an&#x20;installation&#x20;package&#x20;has&#x20;permitted&#x20;the&#x20;user&#x20;to&#x20;change&#x20;a&#x20;protected&#x20;option,&#x20;it&#x20;stops&#x20;the&#x20;installation&#x20;and&#x20;displays&#x20;a&#x20;message.&#x20;These&#x20;security&#x20;features&#x20;operate&#x20;only&#x20;when&#x20;the&#x20;installation&#x20;program&#x20;is&#x20;running&#x20;in&#x20;a&#x20;privileged&#x20;security&#x20;context&#x20;in&#x20;which&#x20;it&#x20;has&#x20;access&#x20;to&#x20;directories&#x20;denied&#x20;to&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;only&#x20;IT&#x20;staff&#x20;with&#x20;administrative&#x20;rights&#x20;should&#x20;be&#x20;installing&#x20;or&#x20;changing&#x20;software&#x20;on&#x20;a&#x20;system.&#x20;Allowing&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;have&#x20;any&#x20;control&#x20;over&#x20;installs&#x20;can&#x20;risk&#x20;unapproved&#x20;software&#x20;from&#x20;being&#x20;installed&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;system,&#x20;which&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;become&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAllow&#x20;user&#x20;control&#x20;over&#x20;installs&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Enable&#x20;user&#x20;control&#x20;over&#x20;installs,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15218,'Ensure&#x20;&#039;Always&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;Windows&#x20;Installer&#x20;should&#x20;use&#x20;system&#x20;permissions&#x20;when&#x20;it&#x20;installs&#x20;any&#x20;program&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;This&#x20;setting&#x20;appears&#x20;both&#x20;in&#x20;the&#x20;Computer&#x20;Configuration&#x20;and&#x20;User&#x20;Configuration&#x20;folders.&#x20;To&#x20;make&#x20;this&#x20;setting&#x20;effective,&#x20;you&#x20;must&#x20;enable&#x20;the&#x20;setting&#x20;in&#x20;both&#x20;folders.&#x20;Caution:&#x20;If&#x20;enabled,&#x20;skilled&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;permissions&#x20;this&#x20;setting&#x20;grants&#x20;to&#x20;change&#x20;their&#x20;privileges&#x20;and&#x20;gain&#x20;permanent&#x20;access&#x20;to&#x20;restricted&#x20;files&#x20;and&#x20;folders.&#x20;Note&#x20;that&#x20;the&#x20;User&#x20;Configuration&#x20;version&#x20;of&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;guaranteed&#x20;to&#x20;be&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;with&#x20;limited&#x20;privileges&#x20;can&#x20;exploit&#x20;this&#x20;feature&#x20;by&#x20;creating&#x20;a&#x20;Windows&#x20;Installer&#x20;installation&#x20;package&#x20;that&#x20;creates&#x20;a&#x20;new&#x20;local&#x20;account&#x20;that&#x20;belongs&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;adds&#x20;their&#x20;current&#x20;account&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;installs&#x20;malicious&#x20;software,&#x20;or&#x20;performs&#x20;other&#x20;unauthorized&#x20;activities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAlways&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15219,'Ensure&#x20;&#039;Prevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Web-based&#x20;programs&#x20;are&#x20;allowed&#x20;to&#x20;install&#x20;software&#x20;on&#x20;the&#x20;computer&#x20;without&#x20;notifying&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Suppressing&#x20;the&#x20;system&#x20;warning&#x20;can&#x20;pose&#x20;a&#x20;security&#x20;risk&#x20;and&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerPrevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;IE&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.3\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15220,'Ensure&#x20;&#039;Sign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;a&#x20;device&#x20;will&#x20;automatically&#x20;sign-in&#x20;the&#x20;last&#x20;interactive&#x20;user&#x20;after&#x20;Windows&#x20;Update&#x20;restarts&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;feature&#x20;will&#x20;prevent&#x20;the&#x20;caching&#x20;of&#x20;user&#039;s&#x20;credentials&#x20;and&#x20;unauthorized&#x20;use&#x20;of&#x20;the&#x20;device,&#x20;and&#x20;also&#x20;ensure&#x20;the&#x20;user&#x20;is&#x20;aware&#x20;of&#x20;the&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Logon&#x20;OptionsSign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinLogon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.86.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15221,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;enables&#x20;logging&#x20;of&#x20;all&#x20;PowerShell&#x20;script&#x20;input&#x20;to&#x20;the&#x20;Microsoft-Windows-&#x20;PowerShell/Operational&#x20;event&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Microsoft&#039;s&#x20;own&#x20;hardening&#x20;guidance,&#x20;they&#x20;recommend&#x20;the&#x20;opposite&#x20;value,&#x20;Enabled,&#x20;because&#x20;having&#x20;this&#x20;data&#x20;logged&#x20;improves&#x20;investigations&#x20;of&#x20;PowerShell&#x20;attack&#x20;incidents.&#x20;However,&#x20;the&#x20;default&#x20;ACL&#x20;on&#x20;the&#x20;PowerShell&#x20;Operational&#x20;log&#x20;allows&#x20;Interactive&#x20;User&#x20;&#40;i.e.&#x20;any&#x20;logged&#x20;on&#x20;user&#41;&#x20;to&#x20;read&#x20;it,&#x20;and&#x20;therefore&#x20;possibly&#x20;expose&#x20;passwords&#x20;or&#x20;other&#x20;sensitive&#x20;information&#x20;to&#x20;unauthorized&#x20;users.&#x20;If&#x20;Microsoft&#x20;locks&#x20;down&#x20;the&#x20;default&#x20;ACL&#x20;on&#x20;that&#x20;log&#x20;in&#x20;the&#x20;future&#x20;&#40;e.g.&#x20;to&#x20;restrict&#x20;it&#x20;only&#x20;to&#x20;Administrators&#41;,&#x20;then&#x20;we&#x20;will&#x20;revisit&#x20;this&#x20;recommendation&#x20;in&#x20;a&#x20;future&#x20;release.','There&#x20;are&#x20;potential&#x20;risks&#x20;of&#x20;capturing&#x20;passwords&#x20;in&#x20;the&#x20;PowerShell&#x20;logs.&#x20;This&#x20;setting&#x20;should&#x20;only&#x20;be&#x20;needed&#x20;for&#x20;debugging&#x20;purposes,&#x20;and&#x20;not&#x20;in&#x20;normal&#x20;operation,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;this&#x20;is&#x20;set&#x20;to&#x20;Disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.95.1\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15222,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Transcription&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;Policy&#x20;setting&#x20;lets&#x20;you&#x20;capture&#x20;the&#x20;input&#x20;and&#x20;output&#x20;of&#x20;Windows&#x20;PowerShell&#x20;commands&#x20;into&#x20;text-based&#x20;transcripts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;that&#x20;passwords&#x20;could&#x20;get&#x20;stored&#x20;in&#x20;plain&#x20;text&#x20;in&#x20;the&#x20;PowerShell_transcript&#x20;output&#x20;file.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Transcription&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.95.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15223,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;uses&#x20;Basic&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.1\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15224,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.2\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15225,'Ensure&#x20;&#039;Disallow&#x20;Digest&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;will&#x20;not&#x20;use&#x20;Digest&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Digest&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM,&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientDisallow&#x20;Digest&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.3\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15226,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;accepts&#x20;Basic&#x20;authentication&#x20;from&#x20;a&#x20;remote&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.1\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15227,'Ensure&#x20;&#039;Allow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;automatically&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;requests&#x20;on&#x20;the&#x20;HTTP&#x20;transport&#x20;over&#x20;the&#x20;default&#x20;HTTP&#x20;port.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;automatic&#x20;configuration&#x20;of&#x20;listeners,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15228,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.3\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15229,'Ensure&#x20;&#039;Disallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;will&#x20;allow&#x20;RunAs&#x20;credentials&#x20;to&#x20;be&#x20;stored&#x20;for&#x20;any&#x20;plug-ins.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;you&#x20;enable&#x20;and&#x20;then&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;any&#x20;values&#x20;that&#x20;were&#x20;previously&#x20;configured&#x20;for&#x20;RunAsPassword&#x20;will&#x20;need&#x20;to&#x20;be&#x20;reset.','Although&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;RunAs&#x20;credentials&#x20;is&#x20;a&#x20;convenient&#x20;feature&#x20;it&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;account&#x20;compromise&#x20;slightly.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;forget&#x20;to&#x20;lock&#x20;your&#x20;desktop&#x20;before&#x20;leaving&#x20;it&#x20;unattended&#x20;for&#x20;a&#x20;few&#x20;minutes&#x20;another&#x20;person&#x20;could&#x20;access&#x20;not&#x20;only&#x20;the&#x20;desktop&#x20;of&#x20;your&#x20;computer&#x20;but&#x20;also&#x20;any&#x20;hosts&#x20;you&#x20;manage&#x20;via&#x20;WinRM&#x20;with&#x20;cached&#x20;RunAs&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceDisallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.97.2.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15230,'Ensure&#x20;&#039;Allow&#x20;Remote&#x20;Shell&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;configuration&#x20;of&#x20;remote&#x20;access&#x20;to&#x20;all&#x20;supported&#x20;shells&#x20;to&#x20;execute&#x20;scripts&#x20;and&#x20;commands.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;GPME&#x20;help&#x20;text&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded,&#x20;implying&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;reject&#x20;new&#x20;Remote&#x20;Shell&#x20;connections,&#x20;and&#x20;setting&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;allow&#x20;Remote&#x20;Shell&#x20;connections.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;title&#x20;of&#x20;the&#x20;setting&#41;.&#x20;This&#x20;is&#x20;a&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Shell&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;ShellAllow&#x20;Remote&#x20;Shell&#x20;Access.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteShell.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.98.1\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15231,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;recognize&#x20;when&#x20;a&#x20;network&#x20;connection&#x20;is&#x20;available&#x20;and&#x20;then&#x20;use&#x20;the&#x20;network&#x20;connection&#x20;to&#x20;search&#x20;Windows&#x20;Update&#x20;or&#x20;your&#x20;designated&#x20;intranet&#x20;site&#x20;for&#x20;updates&#x20;that&#x20;apply&#x20;to&#x20;them.&#x20;After&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;select&#x20;one&#x20;of&#x20;the&#x20;following&#x20;three&#x20;options&#x20;in&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;Properties&#x20;dialog&#x20;box&#x20;to&#x20;specify&#x20;how&#x20;the&#x20;service&#x20;will&#x20;work:&#x20;-&#x20;2&#x20;-&#x20;Notify&#x20;for&#x20;download&#x20;and&#x20;auto&#x20;install&#x20;&#40;Notify&#x20;before&#x20;downloading&#x20;any&#x20;updates&#41;&#x20;-&#x20;3&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;notify&#x20;for&#x20;install&#x20;&#40;Download&#x20;the&#x20;updates&#x20;automatically&#x20;and&#x20;notify&#x20;when&#x20;they&#x20;are&#x20;ready&#x20;to&#x20;be&#x20;installed.&#41;&#x20;&#40;Default&#x20;setting&#41;&#x20;-&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;&#40;Automatically&#x20;download&#x20;updates&#x20;and&#x20;install&#x20;them&#x20;on&#x20;the&#x20;schedule&#x20;specified&#x20;below.&#41;&#41;&#x20;-&#x20;5&#x20;-&#x20;Allow&#x20;local&#x20;admin&#x20;to&#x20;choose&#x20;setting&#x20;&#40;Leave&#x20;decision&#x20;on&#x20;above&#x20;choices&#x20;up&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;&#40;Not&#x20;Recommended&#41;&#41;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;sub-setting&#x20;&#039;Configure&#x20;automatic&#x20;updating:&#039;&#x20;has&#x20;4&#x20;possible&#x20;values&#x20;-&#x20;all&#x20;of&#x20;them&#x20;are&#x20;valid&#x20;depending&#x20;on&#x20;specific&#x20;organizational&#x20;needs,&#x20;however&#x20;if&#x20;feasible&#x20;we&#x20;suggest&#x20;using&#x20;a&#x20;value&#x20;of&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install.&#x20;This&#x20;suggestion&#x20;is&#x20;not&#x20;a&#x20;scored&#x20;requirement.&#x20;Note&#x20;#2:&#x20;Organizations&#x20;that&#x20;utilize&#x20;a&#x20;3rd-party&#x20;solution&#x20;for&#x20;patching&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;setting,&#x20;and&#x20;instead&#x20;configure&#x20;it&#x20;to&#x20;Disabled&#x20;so&#x20;that&#x20;the&#x20;native&#x20;Windows&#x20;Update&#x20;mechanism&#x20;does&#x20;not&#x20;interfere&#x20;with&#x20;the&#x20;3rd-party&#x20;patching&#x20;process.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateConfigure&#x20;Automatic&#x20;Updates&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15232,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#x20;-&#x20;Every&#x20;day&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;when&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;0&#x20;-&#x20;Every&#x20;day.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;applicable&#x20;if&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;is&#x20;selected&#x20;in&#x20;Rule&#x20;18.9.101.2.&#x20;It&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;if&#x20;any&#x20;other&#x20;option&#x20;is&#x20;selected.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;0&#x20;-&#x20;Every&#x20;day:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateConfigure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}]'),(15233,'Ensure&#x20;&#039;No&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;that&#x20;Automatic&#x20;Updates&#x20;will&#x20;wait&#x20;for&#x20;computers&#x20;to&#x20;be&#x20;restarted&#x20;by&#x20;the&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;on&#x20;to&#x20;them&#x20;to&#x20;complete&#x20;a&#x20;scheduled&#x20;installation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;applies&#x20;only&#x20;when&#x20;you&#x20;configure&#x20;Automatic&#x20;Updates&#x20;to&#x20;perform&#x20;scheduled&#x20;update&#x20;installations.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;to&#x20;Disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect.','Some&#x20;security&#x20;updates&#x20;require&#x20;that&#x20;the&#x20;computer&#x20;be&#x20;restarted&#x20;to&#x20;complete&#x20;an&#x20;installation.&#x20;If&#x20;the&#x20;computer&#x20;cannot&#x20;restart&#x20;automatically,&#x20;then&#x20;the&#x20;most&#x20;recent&#x20;update&#x20;will&#x20;not&#x20;completely&#x20;install&#x20;and&#x20;no&#x20;new&#x20;updates&#x20;will&#x20;download&#x20;to&#x20;the&#x20;computer&#x20;until&#x20;it&#x20;is&#x20;restarted.&#x20;Without&#x20;the&#x20;auto-restart&#x20;functionality,&#x20;users&#x20;who&#x20;are&#x20;not&#x20;security-conscious&#x20;may&#x20;choose&#x20;to&#x20;indefinitely&#x20;delay&#x20;the&#x20;restart,&#x20;therefore&#x20;keeping&#x20;the&#x20;computer&#x20;in&#x20;a&#x20;less&#x20;secure&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateNo&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;No&#x20;auto-restart&#x20;for&#x20;scheduled&#x20;Automatic&#x20;Updates&#x20;installations,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}]'),(15500,'Ensure&#x20;&#039;Enforce&#x20;password&#x20;history&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;24&#x20;or&#x20;more&#x20;password&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;renewed,&#x20;unique&#x20;passwords&#x20;that&#x20;have&#x20;to&#x20;be&#x20;associated&#x20;with&#x20;a&#x20;user&#x20;account&#x20;before&#x20;you&#x20;can&#x20;reuse&#x20;an&#x20;old&#x20;password.&#x20;The&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;must&#x20;be&#x20;between&#x20;0&#x20;and&#x20;24&#x20;passwords.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;Windows&#x20;Vista&#x20;is&#x20;0&#x20;passwords,&#x20;but&#x20;the&#x20;default&#x20;setting&#x20;in&#x20;a&#x20;domain&#x20;is&#x20;24&#x20;passwords.&#x20;To&#x20;maintain&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;policy&#x20;setting,&#x20;use&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;24&#x20;or&#x20;more&#x20;password&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.&#x20;Note&#x20;#2:&#x20;As&#x20;of&#x20;the&#x20;publication&#x20;of&#x20;this&#x20;benchmark,&#x20;Microsoft&#x20;currently&#x20;has&#x20;a&#x20;maximum&#x20;limit&#x20;of&#x20;24&#x20;saved&#x20;passwords.&#x20;For&#x20;more&#x20;information,&#x20;please&#x20;visit&#x20;Enforce&#x20;password&#x20;history&#x20;&#40;Windows&#x20;10&#41;&#x20;-&#x20;Windows&#x20;security&#x20;|&#x20;Microsoft&#x20;Docs','The&#x20;longer&#x20;a&#x20;user&#x20;uses&#x20;the&#x20;same&#x20;password,&#x20;the&#x20;greater&#x20;the&#x20;chance&#x20;that&#x20;an&#x20;attacker&#x20;can&#x20;determine&#x20;the&#x20;password&#x20;through&#x20;brute&#x20;force&#x20;attacks.&#x20;Also,&#x20;any&#x20;accounts&#x20;that&#x20;may&#x20;have&#x20;been&#x20;compromised&#x20;will&#x20;remain&#x20;exploitable&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;password&#x20;is&#x20;left&#x20;unchanged.&#x20;If&#x20;password&#x20;changes&#x20;are&#x20;required&#x20;but&#x20;password&#x20;reuse&#x20;is&#x20;not&#x20;prevented,&#x20;or&#x20;if&#x20;users&#x20;continually&#x20;reuse&#x20;a&#x20;small&#x20;number&#x20;of&#x20;passwords,&#x20;the&#x20;effectiveness&#x20;of&#x20;a&#x20;good&#x20;password&#x20;policy&#x20;is&#x20;greatly&#x20;reduced.&#x20;If&#x20;you&#x20;specify&#x20;a&#x20;low&#x20;number&#x20;for&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;use&#x20;the&#x20;same&#x20;small&#x20;number&#x20;of&#x20;passwords&#x20;repeatedly.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;also&#x20;configure&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting,&#x20;users&#x20;might&#x20;repeatedly&#x20;change&#x20;their&#x20;passwords&#x20;until&#x20;they&#x20;can&#x20;reuse&#x20;their&#x20;original&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;24&#x20;or&#x20;more&#x20;password&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyEnforce&#x20;password&#x20;history','[{\"cis\": [\"1.1.1\"]}, {\"cis_csc\": [\"5.2\"]}]'),(15501,'Ensure&#x20;&#039;Maximum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;defines&#x20;how&#x20;long&#x20;a&#x20;user&#x20;can&#x20;use&#x20;their&#x20;password&#x20;before&#x20;it&#x20;expires.&#x20;Values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;range&#x20;from&#x20;0&#x20;to&#x20;999&#x20;days.&#x20;If&#x20;you&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0,&#x20;the&#x20;password&#x20;will&#x20;never&#x20;expire.&#x20;Because&#x20;attackers&#x20;can&#x20;crack&#x20;passwords,&#x20;the&#x20;more&#x20;frequently&#x20;you&#x20;change&#x20;the&#x20;password&#x20;the&#x20;less&#x20;opportunity&#x20;an&#x20;attacker&#x20;has&#x20;to&#x20;use&#x20;a&#x20;cracked&#x20;password.&#x20;However,&#x20;the&#x20;lower&#x20;this&#x20;value&#x20;is&#x20;set,&#x20;the&#x20;higher&#x20;the&#x20;potential&#x20;for&#x20;an&#x20;increase&#x20;in&#x20;calls&#x20;to&#x20;help&#x20;desk&#x20;support&#x20;due&#x20;to&#x20;users&#x20;having&#x20;to&#x20;change&#x20;their&#x20;password&#x20;or&#x20;forgetting&#x20;which&#x20;password&#x20;is&#x20;current.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','The&#x20;longer&#x20;a&#x20;password&#x20;exists&#x20;the&#x20;higher&#x20;the&#x20;likelihood&#x20;that&#x20;it&#x20;will&#x20;be&#x20;compromised&#x20;by&#x20;a&#x20;brute&#x20;force&#x20;attack,&#x20;by&#x20;an&#x20;attacker&#x20;gaining&#x20;general&#x20;knowledge&#x20;about&#x20;the&#x20;user,&#x20;or&#x20;by&#x20;the&#x20;user&#x20;sharing&#x20;the&#x20;password.&#x20;Configuring&#x20;the&#x20;Maximum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;0&#x20;so&#x20;that&#x20;users&#x20;are&#x20;never&#x20;required&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;is&#x20;a&#x20;major&#x20;security&#x20;risk&#x20;because&#x20;that&#x20;allows&#x20;a&#x20;compromised&#x20;password&#x20;to&#x20;be&#x20;used&#x20;by&#x20;the&#x20;malicious&#x20;user&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;valid&#x20;user&#x20;has&#x20;authorized&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMaximum&#x20;password&#x20;age','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.2\"]}]'),(15502,'Ensure&#x20;&#039;Minimum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#x20;or&#x20;more&#x20;day&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;days&#x20;that&#x20;you&#x20;must&#x20;use&#x20;a&#x20;password&#x20;before&#x20;you&#x20;can&#x20;change&#x20;it.&#x20;The&#x20;range&#x20;of&#x20;values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;between&#x20;1&#x20;and&#x20;999&#x20;days.&#x20;&#40;You&#x20;may&#x20;also&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0&#x20;to&#x20;allow&#x20;immediate&#x20;password&#x20;changes.&#41;&#x20;The&#x20;default&#x20;value&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;0&#x20;days.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;1&#x20;or&#x20;more&#x20;day&#40;s&#41;&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Users&#x20;may&#x20;have&#x20;favorite&#x20;passwords&#x20;that&#x20;they&#x20;like&#x20;to&#x20;use&#x20;because&#x20;they&#x20;are&#x20;easy&#x20;to&#x20;remember&#x20;and&#x20;they&#x20;believe&#x20;that&#x20;their&#x20;password&#x20;choice&#x20;is&#x20;secure&#x20;from&#x20;compromise.&#x20;Unfortunately,&#x20;passwords&#x20;are&#x20;compromised&#x20;and&#x20;if&#x20;an&#x20;attacker&#x20;is&#x20;targeting&#x20;a&#x20;specific&#x20;individual&#039;s&#x20;user&#x20;account,&#x20;with&#x20;foreknowledge&#x20;of&#x20;data&#x20;about&#x20;that&#x20;user,&#x20;reuse&#x20;of&#x20;old&#x20;passwords&#x20;can&#x20;cause&#x20;a&#x20;security&#x20;breach.&#x20;To&#x20;address&#x20;password&#x20;reuse&#x20;a&#x20;combination&#x20;of&#x20;security&#x20;settings&#x20;is&#x20;required.&#x20;Using&#x20;this&#x20;policy&#x20;setting&#x20;with&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;prevents&#x20;the&#x20;easy&#x20;reuse&#x20;of&#x20;old&#x20;passwords.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;configure&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;reuse&#x20;any&#x20;of&#x20;their&#x20;last&#x20;12&#x20;passwords,&#x20;they&#x20;could&#x20;change&#x20;their&#x20;password&#x20;13&#x20;times&#x20;in&#x20;a&#x20;few&#x20;minutes&#x20;and&#x20;reuse&#x20;the&#x20;password&#x20;they&#x20;started&#x20;with,&#x20;unless&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;a&#x20;number&#x20;that&#x20;is&#x20;greater&#x20;than&#x20;0.&#x20;You&#x20;must&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;a&#x20;number&#x20;that&#x20;is&#x20;greater&#x20;than&#x20;0&#x20;for&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;to&#x20;be&#x20;effective.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;1&#x20;or&#x20;more&#x20;day&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMinimum&#x20;password&#x20;age','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.2\"]}]'),(15503,'Ensure&#x20;&#039;Minimum&#x20;password&#x20;length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;14&#x20;or&#x20;more&#x20;character&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;least&#x20;number&#x20;of&#x20;characters&#x20;that&#x20;make&#x20;up&#x20;a&#x20;password&#x20;for&#x20;a&#x20;user&#x20;account.&#x20;There&#x20;are&#x20;many&#x20;different&#x20;theories&#x20;about&#x20;how&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;password&#x20;length&#x20;for&#x20;an&#x20;organization,&#x20;but&#x20;perhaps&#x20;&#039;passphrase&#039;&#x20;is&#x20;a&#x20;better&#x20;term&#x20;than&#x20;&#039;password.&#039;&#x20;In&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;and&#x20;newer,&#x20;passphrases&#x20;can&#x20;be&#x20;quite&#x20;long&#x20;and&#x20;can&#x20;include&#x20;spaces.&#x20;Therefore,&#x20;a&#x20;phrase&#x20;such&#x20;as&#x20;&#039;I&#x20;want&#x20;to&#x20;drink&#x20;a&#x20;$5&#x20;milkshake&#039;&#x20;is&#x20;a&#x20;valid&#x20;passphrase;&#x20;it&#x20;is&#x20;a&#x20;considerably&#x20;stronger&#x20;password&#x20;than&#x20;an&#x20;8&#x20;or&#x20;10&#x20;character&#x20;string&#x20;of&#x20;random&#x20;numbers&#x20;and&#x20;letters,&#x20;and&#x20;yet&#x20;is&#x20;easier&#x20;to&#x20;remember.&#x20;Users&#x20;must&#x20;be&#x20;educated&#x20;about&#x20;the&#x20;proper&#x20;selection&#x20;and&#x20;maintenance&#x20;of&#x20;passwords,&#x20;especially&#x20;with&#x20;regard&#x20;to&#x20;password&#x20;length.&#x20;In&#x20;enterprise&#x20;environments,&#x20;the&#x20;ideal&#x20;value&#x20;for&#x20;the&#x20;Minimum&#x20;password&#x20;length&#x20;setting&#x20;is&#x20;14&#x20;characters,&#x20;however&#x20;you&#x20;should&#x20;adjust&#x20;this&#x20;value&#x20;to&#x20;meet&#x20;your&#x20;organization&#039;s&#x20;business&#x20;requirements.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;14&#x20;or&#x20;more&#x20;character&#40;s&#41;.&#x20;Note:&#x20;In&#x20;Windows&#x20;Server&#x20;2016&#x20;and&#x20;older&#x20;versions&#x20;of&#x20;Windows&#x20;Server,&#x20;the&#x20;GUI&#x20;of&#x20;the&#x20;Local&#x20;Security&#x20;Policy&#x20;&#40;LSP&#41;,&#x20;Local&#x20;Group&#x20;Policy&#x20;Editor&#x20;&#40;LGPE&#41;&#x20;and&#x20;Group&#x20;Policy&#x20;Management&#x20;Editor&#x20;&#40;GPME&#41;&#x20;would&#x20;not&#x20;let&#x20;you&#x20;set&#x20;this&#x20;value&#x20;higher&#x20;than&#x20;14&#x20;characters.&#x20;However,&#x20;starting&#x20;with&#x20;Windows&#x20;Server&#x20;2019,&#x20;Microsoft&#x20;changed&#x20;the&#x20;GUI&#x20;to&#x20;allow&#x20;up&#x20;to&#x20;a&#x20;20&#x20;character&#x20;minimum&#x20;password&#x20;length.&#x20;Note&#x20;#2:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Types&#x20;of&#x20;password&#x20;attacks&#x20;include&#x20;dictionary&#x20;attacks&#x20;&#40;which&#x20;attempt&#x20;to&#x20;use&#x20;common&#x20;words&#x20;and&#x20;phrases&#41;&#x20;and&#x20;brute&#x20;force&#x20;attacks&#x20;&#40;which&#x20;try&#x20;every&#x20;possible&#x20;combination&#x20;of&#x20;characters&#41;.&#x20;Also,&#x20;attackers&#x20;sometimes&#x20;try&#x20;to&#x20;obtain&#x20;the&#x20;account&#x20;database&#x20;so&#x20;they&#x20;can&#x20;use&#x20;tools&#x20;to&#x20;discover&#x20;the&#x20;accounts&#x20;and&#x20;passwords.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;14&#x20;or&#x20;more&#x20;character&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMinimum&#x20;password&#x20;length','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.2\"]}]'),(15504,'Ensure&#x20;&#039;Password&#x20;must&#x20;meet&#x20;complexity&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;checks&#x20;all&#x20;new&#x20;passwords&#x20;to&#x20;ensure&#x20;that&#x20;they&#x20;meet&#x20;basic&#x20;requirements&#x20;for&#x20;strong&#x20;passwords.&#x20;When&#x20;this&#x20;policy&#x20;is&#x20;enabled,&#x20;passwords&#x20;must&#x20;meet&#x20;the&#x20;following&#x20;minimum&#x20;requirements:&#x20;-&#x20;Not&#x20;contain&#x20;the&#x20;user&#039;s&#x20;account&#x20;name&#x20;or&#x20;parts&#x20;of&#x20;the&#x20;user&#039;s&#x20;full&#x20;name&#x20;that&#x20;exceed&#x20;two&#x20;consecutive&#x20;characters&#x20;-&#x20;Be&#x20;at&#x20;least&#x20;six&#x20;characters&#x20;in&#x20;length&#x20;-&#x20;Contain&#x20;characters&#x20;from&#x20;three&#x20;of&#x20;the&#x20;following&#x20;categories:&#x20;-&#x20;English&#x20;uppercase&#x20;characters&#x20;&#40;A&#x20;through&#x20;Z&#41;&#x20;-&#x20;English&#x20;lowercase&#x20;characters&#x20;&#40;a&#x20;through&#x20;z&#41;&#x20;-&#x20;Base&#x20;10&#x20;digits&#x20;&#40;0&#x20;through&#x20;9&#41;&#x20;-&#x20;Non-alphabetic&#x20;characters&#x20;&#40;for&#x20;example,&#x20;!,&#x20;$,&#x20;#,&#x20;%&#41;&#x20;o&#x20;A&#x20;catch-all&#x20;category&#x20;of&#x20;any&#x20;Unicode&#x20;character&#x20;that&#x20;does&#x20;not&#x20;fall&#x20;under&#x20;the&#x20;&#x20;&#x20;&#x20;previous&#x20;four&#x20;categories.&#x20;This&#x20;fifth&#x20;category&#x20;can&#x20;be&#x20;regionally&#x20;specific.&#x20;Each&#x20;additional&#x20;character&#x20;in&#x20;a&#x20;password&#x20;increases&#x20;its&#x20;complexity&#x20;exponentially.&#x20;For&#x20;instance,&#x20;a&#x20;seven-character,&#x20;all&#x20;lower-case&#x20;alphabetic&#x20;password&#x20;would&#x20;have&#x20;267&#x20;&#40;approximately&#x20;8&#x20;x&#x20;109&#x20;or&#x20;8&#x20;billion&#41;&#x20;possible&#x20;combinations.&#x20;At&#x20;1,000,000&#x20;attempts&#x20;per&#x20;second&#x20;&#40;a&#x20;capability&#x20;of&#x20;many&#x20;password-cracking&#x20;utilities&#41;,&#x20;it&#x20;would&#x20;only&#x20;take&#x20;133&#x20;minutes&#x20;to&#x20;crack.&#x20;A&#x20;seven-character&#x20;alphabetic&#x20;password&#x20;with&#x20;case&#x20;sensitivity&#x20;has&#x20;527&#x20;combinations.&#x20;A&#x20;seven-character&#x20;case-sensitive&#x20;alphanumeric&#x20;password&#x20;without&#x20;punctuation&#x20;has&#x20;627&#x20;combinations.&#x20;An&#x20;eight-character&#x20;password&#x20;has&#x20;268&#x20;&#40;or&#x20;2&#x20;x&#x20;1011&#41;&#x20;possible&#x20;combinations.&#x20;Although&#x20;this&#x20;might&#x20;seem&#x20;to&#x20;be&#x20;a&#x20;large&#x20;number,&#x20;at&#x20;1,000,000&#x20;attempts&#x20;per&#x20;second&#x20;it&#x20;would&#x20;take&#x20;only&#x20;59&#x20;hours&#x20;to&#x20;try&#x20;all&#x20;possible&#x20;passwords.&#x20;Remember,&#x20;these&#x20;times&#x20;will&#x20;significantly&#x20;increase&#x20;for&#x20;passwords&#x20;that&#x20;use&#x20;ALT&#x20;characters&#x20;and&#x20;other&#x20;special&#x20;keyboard&#x20;characters&#x20;such&#x20;as&#x20;&#039;!&#039;&#039;&#x20;or&#x20;&#039;@&#039;&#039;.&#x20;Proper&#x20;use&#x20;of&#x20;the&#x20;password&#x20;settings&#x20;can&#x20;help&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;mount&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Passwords&#x20;that&#x20;contain&#x20;only&#x20;alphanumeric&#x20;characters&#x20;are&#x20;extremely&#x20;easy&#x20;to&#x20;discover&#x20;with&#x20;several&#x20;publicly&#x20;available&#x20;tools.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyPassword&#x20;must&#x20;meet&#x20;complexity&#x20;requirements','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.2\"]}]'),(15505,'Ensure&#x20;&#039;Relax&#x20;minimum&#x20;password&#x20;length&#x20;limits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;minimum&#x20;password&#x20;length&#x20;setting&#x20;can&#x20;be&#x20;increased&#x20;beyond&#x20;the&#x20;legacy&#x20;limit&#x20;of&#x20;14&#x20;characters.&#x20;For&#x20;more&#x20;information&#x20;please&#x20;see&#x20;the&#x20;following&#x20;Microsoft&#x20;Security&#x20;Blog.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;only&#x20;affects&#x20;local&#x20;accounts&#x20;on&#x20;the&#x20;computer.&#x20;Domain&#x20;accounts&#x20;are&#x20;only&#x20;affected&#x20;by&#x20;settings&#x20;on&#x20;the&#x20;Domain&#x20;Controllers,&#x20;because&#x20;that&#x20;is&#x20;where&#x20;domain&#x20;accounts&#x20;are&#x20;stored.','This&#x20;setting&#x20;will&#x20;enable&#x20;the&#x20;enforcement&#x20;of&#x20;longer&#x20;and&#x20;generally&#x20;stronger&#x20;passwords&#x20;or&#x20;passphrases&#x20;where&#x20;MFA&#x20;is&#x20;not&#x20;in&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyRelax&#x20;minimum&#x20;password&#x20;length&#x20;limits.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;available&#x20;within&#x20;the&#x20;built-in&#x20;OS&#x20;security&#x20;template&#x20;of&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;and&#x20;Server&#x20;2022&#x20;&#40;or&#x20;newer&#41;,&#x20;and&#x20;is&#x20;not&#x20;available&#x20;via&#x20;older&#x20;versions&#x20;of&#x20;the&#x20;OS,&#x20;or&#x20;via&#x20;downloadable&#x20;Administrative&#x20;Templates&#x20;&#40;ADMX/ADML&#41;.&#x20;Therefore,&#x20;you&#x20;must&#x20;use&#x20;a&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;or&#x20;Server&#x20;2022&#x20;system&#x20;&#40;or&#x20;newer&#41;&#x20;to&#x20;view&#x20;or&#x20;edit&#x20;this&#x20;setting&#x20;with&#x20;the&#x20;Group&#x20;Policy&#x20;Management&#x20;Console&#x20;&#40;GPMC&#41;&#x20;or&#x20;Group&#x20;Policy&#x20;Management&#x20;Editor&#x20;&#40;GPME&#41;.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.2\"]}]'),(15506,'Ensure&#x20;&#039;Account&#x20;lockout&#x20;duration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;length&#x20;of&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;before&#x20;a&#x20;locked&#x20;account&#x20;is&#x20;unlocked&#x20;and&#x20;a&#x20;user&#x20;can&#x20;try&#x20;to&#x20;log&#x20;on&#x20;again.&#x20;The&#x20;setting&#x20;does&#x20;this&#x20;by&#x20;specifying&#x20;the&#x20;number&#x20;of&#x20;minutes&#x20;a&#x20;locked&#x20;out&#x20;account&#x20;will&#x20;remain&#x20;unavailable.&#x20;If&#x20;the&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;0,&#x20;locked&#x20;out&#x20;accounts&#x20;will&#x20;remain&#x20;locked&#x20;out&#x20;until&#x20;an&#x20;administrator&#x20;manually&#x20;unlocks&#x20;them.&#x20;Although&#x20;it&#x20;might&#x20;seem&#x20;like&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;configure&#x20;the&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;a&#x20;high&#x20;value,&#x20;such&#x20;a&#x20;configuration&#x20;will&#x20;likely&#x20;increase&#x20;the&#x20;number&#x20;of&#x20;calls&#x20;that&#x20;the&#x20;help&#x20;desk&#x20;receives&#x20;to&#x20;unlock&#x20;accounts&#x20;locked&#x20;by&#x20;mistake.&#x20;Users&#x20;should&#x20;be&#x20;aware&#x20;of&#x20;the&#x20;length&#x20;of&#x20;time&#x20;a&#x20;lock&#x20;remains&#x20;in&#x20;place,&#x20;so&#x20;that&#x20;they&#x20;realize&#x20;they&#x20;only&#x20;need&#x20;to&#x20;call&#x20;the&#x20;help&#x20;desk&#x20;if&#x20;they&#x20;have&#x20;an&#x20;extremely&#x20;urgent&#x20;need&#x20;to&#x20;regain&#x20;access&#x20;to&#x20;their&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','A&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;condition&#x20;can&#x20;be&#x20;created&#x20;if&#x20;an&#x20;attacker&#x20;abuses&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;and&#x20;repeatedly&#x20;attempts&#x20;to&#x20;log&#x20;on&#x20;with&#x20;a&#x20;specific&#x20;account.&#x20;Once&#x20;you&#x20;configure&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;setting,&#x20;the&#x20;account&#x20;will&#x20;be&#x20;locked&#x20;out&#x20;after&#x20;the&#x20;specified&#x20;number&#x20;of&#x20;failed&#x20;attempts.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Account&#x20;lockout&#x20;duration&#x20;setting&#x20;to&#x20;0,&#x20;then&#x20;the&#x20;account&#x20;will&#x20;remain&#x20;locked&#x20;out&#x20;until&#x20;an&#x20;administrator&#x20;unlocks&#x20;it&#x20;manually.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyAccount&#x20;lockout&#x20;duration','[{\"cis\": [\"1.2.1\"]}, {\"cis_csc\": [\"4.10\"]}]'),(15507,'Ensure&#x20;&#039;Account&#x20;lockout&#x20;threshold&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;5&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;Setting&#x20;this&#x20;policy&#x20;to&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;doing&#x20;so&#x20;disables&#x20;the&#x20;account&#x20;lockout&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;5&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Setting&#x20;an&#x20;account&#x20;lockout&#x20;threshold&#x20;reduces&#x20;the&#x20;likelihood&#x20;that&#x20;an&#x20;online&#x20;password&#x20;brute&#x20;force&#x20;attack&#x20;will&#x20;be&#x20;successful.&#x20;Setting&#x20;the&#x20;account&#x20;lockout&#x20;threshold&#x20;too&#x20;low&#x20;introduces&#x20;risk&#x20;of&#x20;increased&#x20;accidental&#x20;lockouts&#x20;and/or&#x20;a&#x20;malicious&#x20;actor&#x20;intentionally&#x20;locking&#x20;out&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;5&#x20;or&#x20;fewer&#x20;invalid&#x20;login&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyAccount&#x20;lockout&#x20;threshold','[{\"cis\": [\"1.2.2\"]}, {\"cis_csc\": [\"4.10\"]}]'),(15508,'Ensure&#x20;&#039;Reset&#x20;account&#x20;lockout&#x20;counter&#x20;after&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;length&#x20;of&#x20;time&#x20;before&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;resets&#x20;to&#x20;zero.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;Not&#x20;Defined.&#x20;If&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;is&#x20;defined,&#x20;this&#x20;reset&#x20;time&#x20;must&#x20;be&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;the&#x20;value&#x20;for&#x20;the&#x20;Account&#x20;lockout&#x20;duration&#x20;setting.&#x20;If&#x20;you&#x20;leave&#x20;this&#x20;policy&#x20;setting&#x20;at&#x20;its&#x20;default&#x20;value&#x20;or&#x20;configure&#x20;the&#x20;value&#x20;to&#x20;an&#x20;interval&#x20;that&#x20;is&#x20;too&#x20;long,&#x20;your&#x20;environment&#x20;could&#x20;be&#x20;vulnerable&#x20;to&#x20;a&#x20;DoS&#x20;attack.&#x20;An&#x20;attacker&#x20;could&#x20;maliciously&#x20;perform&#x20;a&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;on&#x20;all&#x20;users&#x20;in&#x20;the&#x20;organization,&#x20;which&#x20;will&#x20;lock&#x20;out&#x20;their&#x20;accounts.&#x20;If&#x20;no&#x20;policy&#x20;were&#x20;determined&#x20;to&#x20;reset&#x20;the&#x20;account&#x20;lockout,&#x20;it&#x20;would&#x20;be&#x20;a&#x20;manual&#x20;task&#x20;for&#x20;administrators.&#x20;Conversely,&#x20;if&#x20;a&#x20;reasonable&#x20;time&#x20;value&#x20;is&#x20;configured&#x20;for&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;would&#x20;be&#x20;locked&#x20;out&#x20;for&#x20;a&#x20;set&#x20;period&#x20;until&#x20;all&#x20;of&#x20;the&#x20;accounts&#x20;are&#x20;unlocked&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Users&#x20;can&#x20;accidentally&#x20;lock&#x20;themselves&#x20;out&#x20;of&#x20;their&#x20;accounts&#x20;if&#x20;they&#x20;mistype&#x20;their&#x20;password&#x20;multiple&#x20;times.&#x20;To&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;such&#x20;accidental&#x20;lockouts,&#x20;the&#x20;Reset&#x20;account&#x20;lockout&#x20;counter&#x20;after&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;minutes&#x20;that&#x20;must&#x20;elapse&#x20;before&#x20;the&#x20;counter&#x20;that&#x20;tracks&#x20;failed&#x20;logon&#x20;attempts&#x20;and&#x20;triggers&#x20;lockouts&#x20;is&#x20;reset&#x20;to&#x20;0.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyReset&#x20;account&#x20;lockout&#x20;counter&#x20;after','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"4.10\"]}]'),(15509,'Ensure&#x20;&#039;Accounts:&#x20;Administrator&#x20;account&#x20;status&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;Administrator&#x20;account&#x20;during&#x20;normal&#x20;operation.&#x20;When&#x20;a&#x20;computer&#x20;is&#x20;booted&#x20;into&#x20;safe&#x20;mode,&#x20;the&#x20;Administrator&#x20;account&#x20;is&#x20;always&#x20;enabled,&#x20;regardless&#x20;of&#x20;how&#x20;this&#x20;setting&#x20;is&#x20;configured.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;when&#x20;applied&#x20;to&#x20;the&#x20;Domain&#x20;Controllers&#x20;organizational&#x20;unit&#x20;via&#x20;group&#x20;policy&#x20;because&#x20;Domain&#x20;Controllers&#x20;have&#x20;no&#x20;local&#x20;account&#x20;database.&#x20;It&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;domain&#x20;level&#x20;via&#x20;group&#x20;policy,&#x20;similar&#x20;to&#x20;account&#x20;lockout&#x20;and&#x20;password&#x20;policy&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;some&#x20;organizations,&#x20;it&#x20;can&#x20;be&#x20;a&#x20;daunting&#x20;management&#x20;challenge&#x20;to&#x20;maintain&#x20;a&#x20;regular&#x20;schedule&#x20;for&#x20;periodic&#x20;password&#x20;changes&#x20;for&#x20;local&#x20;accounts.&#x20;Therefore,&#x20;you&#x20;may&#x20;want&#x20;to&#x20;disable&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;instead&#x20;of&#x20;relying&#x20;on&#x20;regular&#x20;password&#x20;changes&#x20;to&#x20;protect&#x20;it&#x20;from&#x20;attack.&#x20;Another&#x20;reason&#x20;to&#x20;disable&#x20;this&#x20;built-in&#x20;account&#x20;is&#x20;that&#x20;it&#x20;cannot&#x20;be&#x20;locked&#x20;out&#x20;no&#x20;matter&#x20;how&#x20;many&#x20;failed&#x20;logons&#x20;it&#x20;accrues,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;prime&#x20;target&#x20;for&#x20;brute&#x20;force&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;guess&#x20;passwords.&#x20;Also,&#x20;this&#x20;account&#x20;has&#x20;a&#x20;well-known&#x20;security&#x20;identifier&#x20;&#40;SID&#41;&#x20;and&#x20;there&#x20;are&#x20;third-party&#x20;tools&#x20;that&#x20;allow&#x20;authentication&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;rather&#x20;than&#x20;the&#x20;account&#x20;name.&#x20;This&#x20;capability&#x20;means&#x20;that&#x20;even&#x20;if&#x20;you&#x20;rename&#x20;the&#x20;Administrator&#x20;account,&#x20;an&#x20;attacker&#x20;could&#x20;launch&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Administrator&#x20;account&#x20;status','[{\"cis\": [\"2.3.1.1\"]}, {\"cis_csc\": [\"4.7\"]}]'),(15510,'Ensure&#x20;&#039;Accounts:&#x20;Block&#x20;Microsoft&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;adding&#x20;new&#x20;Microsoft&#x20;accounts&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;onto&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Block&#x20;Microsoft&#x20;accounts','[{\"cis\": [\"2.3.1.2\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15511,'Ensure&#x20;&#039;Accounts:&#x20;Guest&#x20;account&#x20;status&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;enabled&#x20;or&#x20;disabled.&#x20;The&#x20;Guest&#x20;account&#x20;allows&#x20;unauthenticated&#x20;network&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;when&#x20;applied&#x20;to&#x20;the&#x20;Domain&#x20;Controllers&#x20;organizational&#x20;unit&#x20;via&#x20;group&#x20;policy&#x20;because&#x20;Domain&#x20;Controllers&#x20;have&#x20;no&#x20;local&#x20;account&#x20;database.&#x20;It&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;domain&#x20;level&#x20;via&#x20;group&#x20;policy,&#x20;similar&#x20;to&#x20;account&#x20;lockout&#x20;and&#x20;password&#x20;policy&#x20;settings.','The&#x20;default&#x20;Guest&#x20;account&#x20;allows&#x20;unauthenticated&#x20;network&#x20;users&#x20;to&#x20;log&#x20;on&#x20;as&#x20;Guest&#x20;with&#x20;no&#x20;password.&#x20;These&#x20;unauthorized&#x20;users&#x20;could&#x20;access&#x20;any&#x20;resources&#x20;that&#x20;are&#x20;accessible&#x20;to&#x20;the&#x20;Guest&#x20;account&#x20;over&#x20;the&#x20;network.&#x20;This&#x20;capability&#x20;means&#x20;that&#x20;any&#x20;network&#x20;shares&#x20;with&#x20;permissions&#x20;that&#x20;allow&#x20;access&#x20;to&#x20;the&#x20;Guest&#x20;account,&#x20;the&#x20;Guests&#x20;group,&#x20;or&#x20;the&#x20;Everyone&#x20;group&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Guest&#x20;account&#x20;status','[{\"cis\": [\"2.3.1.3\"]}, {\"cis_csc\": [\"4.7\"]}]'),(15512,'Ensure&#x20;&#039;Accounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;local&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;password&#x20;protected&#x20;can&#x20;be&#x20;used&#x20;to&#x20;log&#x20;on&#x20;from&#x20;locations&#x20;other&#x20;than&#x20;the&#x20;physical&#x20;computer&#x20;console.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;local&#x20;accounts&#x20;that&#x20;have&#x20;blank&#x20;passwords&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;network&#x20;from&#x20;remote&#x20;client&#x20;computers.&#x20;Such&#x20;accounts&#x20;will&#x20;only&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;at&#x20;the&#x20;keyboard&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blank&#x20;passwords&#x20;are&#x20;a&#x20;serious&#x20;threat&#x20;to&#x20;computer&#x20;security&#x20;and&#x20;should&#x20;be&#x20;forbidden&#x20;through&#x20;both&#x20;organizational&#x20;policy&#x20;and&#x20;suitable&#x20;technical&#x20;measures.&#x20;In&#x20;fact,&#x20;the&#x20;default&#x20;settings&#x20;for&#x20;Active&#x20;Directory&#x20;domains&#x20;require&#x20;complex&#x20;passwords&#x20;of&#x20;at&#x20;least&#x20;seven&#x20;characters.&#x20;However,&#x20;if&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;create&#x20;new&#x20;accounts&#x20;bypass&#x20;your&#x20;domain-based&#x20;password&#x20;policies,&#x20;they&#x20;could&#x20;create&#x20;accounts&#x20;with&#x20;blank&#x20;passwords.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;could&#x20;build&#x20;a&#x20;stand-alone&#x20;computer,&#x20;create&#x20;one&#x20;or&#x20;more&#x20;accounts&#x20;with&#x20;blank&#x20;passwords,&#x20;and&#x20;then&#x20;join&#x20;the&#x20;computer&#x20;to&#x20;the&#x20;domain.&#x20;The&#x20;local&#x20;accounts&#x20;with&#x20;blank&#x20;passwords&#x20;would&#x20;still&#x20;function.&#x20;Anyone&#x20;who&#x20;knows&#x20;the&#x20;name&#x20;of&#x20;one&#x20;of&#x20;these&#x20;unprotected&#x20;accounts&#x20;could&#x20;then&#x20;use&#x20;it&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only','[{\"cis\": [\"2.3.1.4\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15513,'Configure&#x20;&#039;Accounts:&#x20;Rename&#x20;administrator&#x20;account&#039;.','The&#x20;built-in&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;a&#x20;well-known&#x20;account&#x20;name&#x20;that&#x20;attackers&#x20;will&#x20;target.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;choose&#x20;another&#x20;name&#x20;for&#x20;this&#x20;account,&#x20;and&#x20;to&#x20;avoid&#x20;names&#x20;that&#x20;denote&#x20;administrative&#x20;or&#x20;elevated&#x20;access&#x20;accounts.&#x20;Be&#x20;sure&#x20;to&#x20;also&#x20;change&#x20;the&#x20;default&#x20;description&#x20;for&#x20;the&#x20;local&#x20;administrator&#x20;&#40;through&#x20;the&#x20;Computer&#x20;Management&#x20;console&#41;.','The&#x20;Administrator&#x20;account&#x20;exists&#x20;on&#x20;all&#x20;computers&#x20;that&#x20;run&#x20;the&#x20;Windows&#x20;2000&#x20;or&#x20;newer&#x20;operating&#x20;systems.&#x20;If&#x20;you&#x20;rename&#x20;this&#x20;account,&#x20;it&#x20;is&#x20;slightly&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;guess&#x20;this&#x20;privileged&#x20;user&#x20;name&#x20;and&#x20;password&#x20;combination.&#x20;The&#x20;built-in&#x20;Administrator&#x20;account&#x20;cannot&#x20;be&#x20;locked&#x20;out,&#x20;regardless&#x20;of&#x20;how&#x20;many&#x20;times&#x20;an&#x20;attacker&#x20;might&#x20;use&#x20;a&#x20;bad&#x20;password.&#x20;This&#x20;capability&#x20;makes&#x20;the&#x20;Administrator&#x20;account&#x20;a&#x20;popular&#x20;target&#x20;for&#x20;brute&#x20;force&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;guess&#x20;passwords.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;lessened&#x20;because&#x20;this&#x20;account&#x20;has&#x20;a&#x20;well-known&#x20;SID,&#x20;and&#x20;there&#x20;are&#x20;third-party&#x20;tools&#x20;that&#x20;allow&#x20;authentication&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;rather&#x20;than&#x20;the&#x20;account&#x20;name.&#x20;Therefore,&#x20;even&#x20;if&#x20;you&#x20;rename&#x20;the&#x20;Administrator&#x20;account,&#x20;an&#x20;attacker&#x20;could&#x20;launch&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Rename&#x20;administrator&#x20;account','[{\"cis\": [\"2.3.1.5\"]}, {\"cis_csc\": [\"4.7\"]}]'),(15514,'Configure&#x20;&#039;Accounts:&#x20;Rename&#x20;guest&#x20;account&#039;.','The&#x20;built-in&#x20;local&#x20;guest&#x20;account&#x20;is&#x20;another&#x20;well-known&#x20;name&#x20;to&#x20;attackers.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;rename&#x20;this&#x20;account&#x20;to&#x20;something&#x20;that&#x20;does&#x20;not&#x20;indicate&#x20;its&#x20;purpose.&#x20;Even&#x20;if&#x20;you&#x20;disable&#x20;this&#x20;account,&#x20;which&#x20;is&#x20;recommended,&#x20;ensure&#x20;that&#x20;you&#x20;rename&#x20;it&#x20;for&#x20;added&#x20;security.','The&#x20;Guest&#x20;account&#x20;exists&#x20;on&#x20;all&#x20;computers&#x20;that&#x20;run&#x20;the&#x20;Windows&#x20;2000&#x20;or&#x20;newer&#x20;operating&#x20;systems.&#x20;If&#x20;you&#x20;rename&#x20;this&#x20;account,&#x20;it&#x20;is&#x20;slightly&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;guess&#x20;this&#x20;privileged&#x20;user&#x20;name&#x20;and&#x20;password&#x20;combination.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Rename&#x20;guest&#x20;account','[{\"cis\": [\"2.3.1.6\"]}, {\"cis_csc\": [\"4.7\"]}]'),(15515,'Ensure&#x20;&#039;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#0','This&#x20;policy&#x20;setting&#x20;allows&#x20;administrators&#x20;to&#x20;enable&#x20;the&#x20;more&#x20;precise&#x20;auditing&#x20;capabilities&#x20;present&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;Audit&#x20;Policy&#x20;settings&#x20;available&#x20;in&#x20;Windows&#x20;Server&#x20;2003&#x20;Active&#x20;Directory&#x20;do&#x20;not&#x20;yet&#x20;contain&#x20;settings&#x20;for&#x20;managing&#x20;the&#x20;new&#x20;auditing&#x20;subcategories.&#x20;To&#x20;properly&#x20;apply&#x20;the&#x20;auditing&#x20;policies&#x20;prescribed&#x20;in&#x20;this&#x20;baseline,&#x20;the&#x20;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#x20;setting&#x20;needs&#x20;to&#x20;be&#x20;configured&#x20;to&#x20;Enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Important:&#x20;Be&#x20;very&#x20;cautious&#x20;about&#x20;audit&#x20;settings&#x20;that&#x20;can&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;traffic.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;enable&#x20;either&#x20;success&#x20;or&#x20;failure&#x20;auditing&#x20;for&#x20;all&#x20;of&#x20;the&#x20;Privilege&#x20;Use&#x20;subcategories,&#x20;the&#x20;high&#x20;volume&#x20;of&#x20;audit&#x20;events&#x20;generated&#x20;can&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;find&#x20;other&#x20;types&#x20;of&#x20;entries&#x20;in&#x20;the&#x20;Security&#x20;log.&#x20;Such&#x20;a&#x20;configuration&#x20;could&#x20;also&#x20;have&#x20;a&#x20;significant&#x20;impact&#x20;on&#x20;system&#x20;performance.','Prior&#x20;to&#x20;the&#x20;introduction&#x20;of&#x20;auditing&#x20;subcategories&#x20;in&#x20;Windows&#x20;Vista,&#x20;it&#x20;was&#x20;difficult&#x20;to&#x20;track&#x20;events&#x20;at&#x20;a&#x20;per-system&#x20;or&#x20;per-user&#x20;level.&#x20;The&#x20;larger&#x20;event&#x20;categories&#x20;created&#x20;too&#x20;many&#x20;events&#x20;and&#x20;the&#x20;key&#x20;information&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;audited&#x20;was&#x20;difficult&#x20;to&#x20;find.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc\": [\"8.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15516,'Ensure&#x20;&#039;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;system&#x20;shuts&#x20;down&#x20;if&#x20;it&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;Security&#x20;events.&#x20;It&#x20;is&#x20;a&#x20;requirement&#x20;for&#x20;Trusted&#x20;Computer&#x20;System&#x20;Evaluation&#x20;Criteria&#x20;&#40;TCSEC&#41;-C2&#x20;and&#x20;Common&#x20;Criteria&#x20;certification&#x20;to&#x20;prevent&#x20;auditable&#x20;events&#x20;from&#x20;occurring&#x20;if&#x20;the&#x20;audit&#x20;system&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;them.&#x20;Microsoft&#x20;has&#x20;chosen&#x20;to&#x20;meet&#x20;this&#x20;requirement&#x20;by&#x20;halting&#x20;the&#x20;system&#x20;and&#x20;displaying&#x20;a&#x20;stop&#x20;message&#x20;if&#x20;the&#x20;auditing&#x20;system&#x20;experiences&#x20;a&#x20;failure.&#x20;When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;system&#x20;will&#x20;be&#x20;shut&#x20;down&#x20;if&#x20;a&#x20;security&#x20;audit&#x20;cannot&#x20;be&#x20;logged&#x20;for&#x20;any&#x20;reason.&#x20;If&#x20;the&#x20;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#x20;setting&#x20;is&#x20;enabled,&#x20;unplanned&#x20;system&#x20;failures&#x20;can&#x20;occur.&#x20;The&#x20;administrative&#x20;burden&#x20;can&#x20;be&#x20;significant,&#x20;especially&#x20;if&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Retention&#x20;method&#x20;for&#x20;the&#x20;Security&#x20;log&#x20;to&#x20;Do&#x20;not&#x20;overwrite&#x20;events&#x20;&#40;clear&#x20;log&#x20;manually&#41;.&#x20;This&#x20;configuration&#x20;causes&#x20;a&#x20;repudiation&#x20;threat&#x20;&#40;a&#x20;backup&#x20;operator&#x20;could&#x20;deny&#x20;that&#x20;they&#x20;backed&#x20;up&#x20;or&#x20;restored&#x20;data&#41;&#x20;to&#x20;become&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;vulnerability,&#x20;because&#x20;a&#x20;server&#x20;could&#x20;be&#x20;forced&#x20;to&#x20;shut&#x20;down&#x20;if&#x20;it&#x20;is&#x20;overwhelmed&#x20;with&#x20;logon&#x20;events&#x20;and&#x20;other&#x20;security&#x20;events&#x20;that&#x20;are&#x20;written&#x20;to&#x20;the&#x20;Security&#x20;log.&#x20;Also,&#x20;because&#x20;the&#x20;shutdown&#x20;is&#x20;not&#x20;graceful,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;irreparable&#x20;damage&#x20;to&#x20;the&#x20;operating&#x20;system,&#x20;applications,&#x20;or&#x20;data&#x20;could&#x20;result.&#x20;Although&#x20;the&#x20;NTFS&#x20;file&#x20;system&#x20;guarantees&#x20;its&#x20;integrity&#x20;when&#x20;an&#x20;ungraceful&#x20;computer&#x20;shutdown&#x20;occurs,&#x20;it&#x20;cannot&#x20;guarantee&#x20;that&#x20;every&#x20;data&#x20;file&#x20;for&#x20;every&#x20;application&#x20;will&#x20;still&#x20;be&#x20;in&#x20;a&#x20;usable&#x20;form&#x20;when&#x20;the&#x20;computer&#x20;restarts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;the&#x20;computer&#x20;is&#x20;unable&#x20;to&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;critical&#x20;evidence&#x20;or&#x20;important&#x20;troubleshooting&#x20;information&#x20;may&#x20;not&#x20;be&#x20;available&#x20;for&#x20;review&#x20;after&#x20;a&#x20;security&#x20;incident.&#x20;Also,&#x20;an&#x20;attacker&#x20;could&#x20;potentially&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;Security&#x20;log&#x20;events&#x20;to&#x20;purposely&#x20;force&#x20;a&#x20;computer&#x20;shutdown.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(15517,'Ensure&#x20;&#039;Devices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators&#x20;and&#x20;Interactive&#x20;Users&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;NTFS&#x20;media.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;unauthorized&#x20;users&#x20;from&#x20;removing&#x20;data&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;access&#x20;it&#x20;on&#x20;another&#x20;computer&#x20;on&#x20;which&#x20;they&#x20;have&#x20;local&#x20;administrator&#x20;privileges.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users.','Users&#x20;may&#x20;be&#x20;able&#x20;to&#x20;move&#x20;data&#x20;on&#x20;removable&#x20;disks&#x20;to&#x20;a&#x20;different&#x20;computer&#x20;where&#x20;they&#x20;have&#x20;administrative&#x20;privileges.&#x20;The&#x20;user&#x20;could&#x20;then&#x20;take&#x20;ownership&#x20;of&#x20;any&#x20;file,&#x20;grant&#x20;themselves&#x20;full&#x20;control,&#x20;and&#x20;view&#x20;or&#x20;modify&#x20;any&#x20;file.&#x20;The&#x20;fact&#x20;that&#x20;most&#x20;removable&#x20;storage&#x20;devices&#x20;will&#x20;eject&#x20;media&#x20;by&#x20;pressing&#x20;a&#x20;mechanical&#x20;button&#x20;diminishes&#x20;the&#x20;advantage&#x20;of&#x20;this&#x20;policy&#x20;setting.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media','[{\"cis\": [\"2.3.4.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15518,'Ensure&#x20;&#039;Devices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','For&#x20;a&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;a&#x20;shared&#x20;printer,&#x20;the&#x20;driver&#x20;for&#x20;that&#x20;shared&#x20;printer&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;This&#x20;security&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;install&#x20;a&#x20;printer&#x20;driver&#x20;as&#x20;part&#x20;of&#x20;connecting&#x20;to&#x20;a&#x20;shared&#x20;printer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;ability&#x20;to&#x20;add&#x20;a&#x20;local&#x20;printer.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;Administrators.','It&#x20;may&#x20;be&#x20;appropriate&#x20;in&#x20;some&#x20;organizations&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;install&#x20;printer&#x20;drivers&#x20;on&#x20;their&#x20;own&#x20;workstations.&#x20;However,&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;you&#x20;should&#x20;allow&#x20;only&#x20;Administrators,&#x20;not&#x20;users,&#x20;to&#x20;do&#x20;this,&#x20;because&#x20;printer&#x20;driver&#x20;installation&#x20;may&#x20;unintentionally&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;become&#x20;less&#x20;stable.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;install&#x20;inappropriate&#x20;printer&#x20;drivers&#x20;in&#x20;a&#x20;deliberate&#x20;attempt&#x20;to&#x20;damage&#x20;the&#x20;computer,&#x20;or&#x20;a&#x20;user&#x20;might&#x20;accidentally&#x20;install&#x20;malicious&#x20;software&#x20;that&#x20;masquerades&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;It&#x20;is&#x20;feasible&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;disguise&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;The&#x20;program&#x20;may&#x20;appear&#x20;to&#x20;users&#x20;as&#x20;if&#x20;they&#x20;must&#x20;use&#x20;it&#x20;to&#x20;print,&#x20;but&#x20;such&#x20;a&#x20;program&#x20;could&#x20;unleash&#x20;malicious&#x20;code&#x20;on&#x20;your&#x20;computer&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers','[{\"cis\": [\"2.3.4.2\"]}, {\"pci_dss\": [\"2.2.4\", \"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\", \"CC5.2\"]}]'),(15519,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;is&#x20;initiated&#x20;by&#x20;the&#x20;domain&#x20;member&#x20;must&#x20;be&#x20;signed&#x20;or&#x20;encrypted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.6.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15520,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;encryption&#x20;for&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;','[{\"cis\": [\"2.3.6.2\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15521,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates&#x20;must&#x20;be&#x20;digitally&#x20;signed.&#x20;Digital&#x20;signatures&#x20;protect&#x20;the&#x20;traffic&#x20;from&#x20;being&#x20;modified&#x20;by&#x20;anyone&#x20;who&#x20;captures&#x20;the&#x20;data&#x20;as&#x20;it&#x20;traverses&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;','[{\"cis\": [\"2.3.6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15522,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;can&#x20;periodically&#x20;change&#x20;its&#x20;computer&#x20;account&#x20;password.&#x20;Computers&#x20;that&#x20;cannot&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;passwords&#x20;are&#x20;potentially&#x20;vulnerable,&#x20;because&#x20;an&#x20;attacker&#x20;might&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;system&#039;s&#x20;domain&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','The&#x20;default&#x20;configuration&#x20;for&#x20;Windows&#x20;Server&#x20;2003-based&#x20;computers&#x20;that&#x20;belong&#x20;to&#x20;a&#x20;domain&#x20;is&#x20;that&#x20;they&#x20;are&#x20;automatically&#x20;required&#x20;to&#x20;change&#x20;the&#x20;passwords&#x20;for&#x20;their&#x20;accounts&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;computers&#x20;that&#x20;run&#x20;Windows&#x20;Server&#x20;2003&#x20;will&#x20;retain&#x20;the&#x20;same&#x20;passwords&#x20;as&#x20;their&#x20;computer&#x20;accounts.&#x20;Computers&#x20;that&#x20;are&#x20;no&#x20;longer&#x20;able&#x20;to&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;password&#x20;are&#x20;at&#x20;risk&#x20;from&#x20;an&#x20;attacker&#x20;who&#x20;could&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;computer&#039;s&#x20;domain&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes','[{\"cis\": [\"2.3.6.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15523,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Maximum&#x20;machine&#x20;account&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;maximum&#x20;allowable&#x20;age&#x20;for&#x20;a&#x20;computer&#x20;account&#x20;password.&#x20;By&#x20;default,&#x20;domain&#x20;members&#x20;automatically&#x20;change&#x20;their&#x20;domain&#x20;passwords&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;increase&#x20;this&#x20;interval&#x20;significantly&#x20;so&#x20;that&#x20;the&#x20;computers&#x20;no&#x20;longer&#x20;change&#x20;their&#x20;passwords,&#x20;an&#x20;attacker&#x20;would&#x20;have&#x20;more&#x20;time&#x20;to&#x20;undertake&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;against&#x20;one&#x20;of&#x20;the&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;maximum&#x20;password&#x20;age.&#x20;Note&#x20;#2:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','In&#x20;Active&#x20;Directory-based&#x20;domains,&#x20;each&#x20;computer&#x20;has&#x20;an&#x20;account&#x20;and&#x20;password&#x20;just&#x20;like&#x20;every&#x20;user.&#x20;By&#x20;default,&#x20;the&#x20;domain&#x20;members&#x20;automatically&#x20;change&#x20;their&#x20;domain&#x20;password&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;increase&#x20;this&#x20;interval&#x20;significantly,&#x20;or&#x20;set&#x20;it&#x20;to&#x20;0&#x20;so&#x20;that&#x20;the&#x20;computers&#x20;no&#x20;longer&#x20;change&#x20;their&#x20;passwords,&#x20;an&#x20;attacker&#x20;will&#x20;have&#x20;more&#x20;time&#x20;to&#x20;undertake&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;guess&#x20;the&#x20;password&#x20;of&#x20;one&#x20;or&#x20;more&#x20;computer&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Maximum&#x20;machine&#x20;account&#x20;password&#x20;age','[{\"cis\": [\"2.3.6.5\"]}]'),(15524,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;secure&#x20;channel&#x20;can&#x20;only&#x20;be&#x20;established&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;encrypting&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;&#40;128-bit&#41;&#x20;session&#x20;key.&#x20;To&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;the&#x20;domain&#x20;must&#x20;be&#x20;able&#x20;to&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;key,&#x20;which&#x20;means&#x20;all&#x20;Domain&#x20;Controllers&#x20;must&#x20;be&#x20;running&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;or&#x20;newer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;keys&#x20;that&#x20;are&#x20;used&#x20;to&#x20;establish&#x20;secure&#x20;channel&#x20;communications&#x20;between&#x20;Domain&#x20;Controllers&#x20;and&#x20;member&#x20;computers&#x20;are&#x20;much&#x20;stronger&#x20;in&#x20;Windows&#x20;2000&#x20;than&#x20;they&#x20;were&#x20;in&#x20;previous&#x20;Microsoft&#x20;operating&#x20;systems.&#x20;Whenever&#x20;possible,&#x20;you&#x20;should&#x20;take&#x20;advantage&#x20;of&#x20;these&#x20;stronger&#x20;session&#x20;keys&#x20;to&#x20;help&#x20;protect&#x20;secure&#x20;channel&#x20;communications&#x20;from&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;hijack&#x20;network&#x20;sessions&#x20;and&#x20;eavesdropping.&#x20;&#40;Eavesdropping&#x20;is&#x20;a&#x20;form&#x20;of&#x20;hacking&#x20;in&#x20;which&#x20;network&#x20;data&#x20;is&#x20;read&#x20;or&#x20;altered&#x20;in&#x20;transit.&#x20;The&#x20;data&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;hide&#x20;or&#x20;change&#x20;the&#x20;sender,&#x20;or&#x20;be&#x20;redirected.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key','[{\"cis\": [\"2.3.6.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15525,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;must&#x20;press&#x20;CTRL+ALT+DEL&#x20;before&#x20;they&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Microsoft&#x20;developed&#x20;this&#x20;feature&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;users&#x20;with&#x20;certain&#x20;types&#x20;of&#x20;physical&#x20;impairments&#x20;to&#x20;log&#x20;on&#x20;to&#x20;computers&#x20;that&#x20;run&#x20;Windows.&#x20;If&#x20;users&#x20;are&#x20;not&#x20;required&#x20;to&#x20;press&#x20;CTRL+ALT+DEL,&#x20;they&#x20;are&#x20;susceptible&#x20;to&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;intercept&#x20;their&#x20;passwords.&#x20;If&#x20;CTRL+ALT+DEL&#x20;is&#x20;required&#x20;before&#x20;logon,&#x20;user&#x20;passwords&#x20;are&#x20;communicated&#x20;by&#x20;means&#x20;of&#x20;a&#x20;trusted&#x20;path.&#x20;An&#x20;attacker&#x20;could&#x20;install&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;that&#x20;looks&#x20;like&#x20;the&#x20;standard&#x20;Windows&#x20;logon&#x20;dialog&#x20;box&#x20;and&#x20;capture&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;attacker&#x20;would&#x20;then&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;compromised&#x20;account&#x20;with&#x20;whatever&#x20;level&#x20;of&#x20;privilege&#x20;that&#x20;user&#x20;has.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL','[{\"cis\": [\"2.3.7.1\"]}]'),(15526,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;account&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;client&#x20;computers&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;be&#x20;displayed&#x20;in&#x20;each&#x20;computer&#039;s&#x20;respective&#x20;Windows&#x20;logon&#x20;screen.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;intruders&#x20;from&#x20;collecting&#x20;account&#x20;names&#x20;visually&#x20;from&#x20;the&#x20;screens&#x20;of&#x20;desktop&#x20;or&#x20;laptop&#x20;computers&#x20;in&#x20;your&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in.&#x20;Note:&#x20;In&#x20;older&#x20;versions&#x20;of&#x20;Microsoft&#x20;Windows,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;Windows&#x20;10&#x20;Release&#x20;1703.','[{\"cis\": [\"2.3.7.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15527,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;account&#x20;lockout&#x20;threshold&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;10&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempts,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;security&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;that&#x20;causes&#x20;the&#x20;machine&#x20;to&#x20;be&#x20;locked&#x20;out.&#x20;Failed&#x20;password&#x20;attempts&#x20;against&#x20;workstations&#x20;or&#x20;member&#x20;servers&#x20;that&#x20;have&#x20;been&#x20;locked&#x20;using&#x20;either&#x20;CTRL+ALT+DELETE&#x20;or&#x20;password&#x20;protected&#x20;screen&#x20;savers&#x20;counts&#x20;as&#x20;failed&#x20;logon&#x20;attempts.&#x20;The&#x20;machine&#x20;lockout&#x20;policy&#x20;is&#x20;enforced&#x20;only&#x20;on&#x20;those&#x20;machines&#x20;that&#x20;have&#x20;BitLocker&#x20;enabled&#x20;for&#x20;protecting&#x20;OS&#x20;volumes.&#x20;Please&#x20;ensure&#x20;that&#x20;appropriate&#x20;recovery&#x20;password&#x20;backup&#x20;policies&#x20;are&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;10&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempts,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;account&#x20;lockout&#x20;threshold.&#x20;Values&#x20;from&#x20;1&#x20;to&#x20;3&#x20;will&#x20;be&#x20;interpreted&#x20;as&#x20;4.','If&#x20;a&#x20;machine&#x20;is&#x20;lost&#x20;or&#x20;stolen,&#x20;or&#x20;if&#x20;an&#x20;insider&#x20;threat&#x20;attempts&#x20;a&#x20;brute&#x20;force&#x20;password&#x20;attack&#x20;against&#x20;the&#x20;computer,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;BitLocker&#x20;will&#x20;lock&#x20;the&#x20;computer&#x20;and&#x20;therefore&#x20;prevent&#x20;a&#x20;successful&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;10&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempts,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;account&#x20;lockout&#x20;threshold','[{\"cis\": [\"2.3.7.3\"]}, {\"cis_csc\": [\"4.10\"]}]'),(15528,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;.','Windows&#x20;notices&#x20;inactivity&#x20;of&#x20;a&#x20;logon&#x20;session,&#x20;and&#x20;if&#x20;the&#x20;amount&#x20;of&#x20;inactive&#x20;time&#x20;exceeds&#x20;the&#x20;inactivity&#x20;limit,&#x20;then&#x20;the&#x20;screen&#x20;saver&#x20;will&#x20;run,&#x20;locking&#x20;the&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;inactivity&#x20;limit.','If&#x20;a&#x20;user&#x20;forgets&#x20;to&#x20;lock&#x20;their&#x20;computer&#x20;when&#x20;they&#x20;walk&#x20;away&#x20;it&#039;s&#x20;possible&#x20;that&#x20;a&#x20;passerby&#x20;will&#x20;hijack&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;900&#x20;or&#x20;fewer&#x20;seconds,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit','[{\"cis\": [\"2.3.7.4\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15529,'Configure&#x20;&#039;Interactive&#x20;logon:&#x20;Message&#x20;text&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;a&#x20;text&#x20;message&#x20;that&#x20;displays&#x20;to&#x20;users&#x20;when&#x20;they&#x20;log&#x20;on.&#x20;Set&#x20;the&#x20;following&#x20;group&#x20;policy&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization.','Displaying&#x20;a&#x20;warning&#x20;message&#x20;before&#x20;logon&#x20;may&#x20;help&#x20;prevent&#x20;an&#x20;attack&#x20;by&#x20;warning&#x20;the&#x20;attacker&#x20;about&#x20;the&#x20;consequences&#x20;of&#x20;their&#x20;misconduct&#x20;before&#x20;it&#x20;happens.&#x20;It&#x20;may&#x20;also&#x20;help&#x20;to&#x20;reinforce&#x20;corporate&#x20;policy&#x20;by&#x20;notifying&#x20;employees&#x20;of&#x20;the&#x20;appropriate&#x20;policy&#x20;during&#x20;the&#x20;logon&#x20;process.&#x20;This&#x20;text&#x20;is&#x20;often&#x20;used&#x20;for&#x20;legal&#x20;reasons&mdash;for&#x20;example,&#x20;to&#x20;warn&#x20;users&#x20;about&#x20;the&#x20;ramifications&#x20;of&#x20;misusing&#x20;company&#x20;information&#x20;or&#x20;to&#x20;warn&#x20;them&#x20;that&#x20;their&#x20;actions&#x20;may&#x20;be&#x20;audited.&#x20;Note:&#x20;Any&#x20;warning&#x20;that&#x20;you&#x20;display&#x20;should&#x20;first&#x20;be&#x20;approved&#x20;by&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;and&#x20;human&#x20;resources&#x20;representatives.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Message&#x20;text&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.7.5\"]}]'),(15530,'Configure&#x20;&#039;Interactive&#x20;logon:&#x20;Message&#x20;title&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;text&#x20;displayed&#x20;in&#x20;the&#x20;title&#x20;bar&#x20;of&#x20;the&#x20;window&#x20;that&#x20;users&#x20;see&#x20;when&#x20;they&#x20;log&#x20;on&#x20;to&#x20;the&#x20;system.&#x20;Configure&#x20;this&#x20;setting&#x20;in&#x20;a&#x20;manner&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization.','Displaying&#x20;a&#x20;warning&#x20;message&#x20;before&#x20;logon&#x20;may&#x20;help&#x20;prevent&#x20;an&#x20;attack&#x20;by&#x20;warning&#x20;the&#x20;attacker&#x20;about&#x20;the&#x20;consequences&#x20;of&#x20;their&#x20;misconduct&#x20;before&#x20;it&#x20;happens.&#x20;It&#x20;may&#x20;also&#x20;help&#x20;to&#x20;reinforce&#x20;corporate&#x20;policy&#x20;by&#x20;notifying&#x20;employees&#x20;of&#x20;the&#x20;appropriate&#x20;policy&#x20;during&#x20;the&#x20;logon&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Message&#x20;title&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.7.6\"]}]'),(15531,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;4&#x20;or&#x20;few','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;user&#x20;can&#x20;log&#x20;on&#x20;to&#x20;a&#x20;Windows&#x20;domain&#x20;using&#x20;cached&#x20;account&#x20;information.&#x20;Logon&#x20;information&#x20;for&#x20;domain&#x20;accounts&#x20;can&#x20;be&#x20;cached&#x20;locally&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;log&#x20;on&#x20;even&#x20;if&#x20;a&#x20;Domain&#x20;Controller&#x20;cannot&#x20;be&#x20;contacted.&#x20;This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;unique&#x20;users&#x20;for&#x20;whom&#x20;logon&#x20;information&#x20;is&#x20;cached&#x20;locally.&#x20;If&#x20;this&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;the&#x20;logon&#x20;cache&#x20;feature&#x20;is&#x20;disabled.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;server&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;.','The&#x20;number&#x20;that&#x20;is&#x20;assigned&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;indicates&#x20;the&#x20;number&#x20;of&#x20;users&#x20;whose&#x20;logon&#x20;information&#x20;the&#x20;computer&#x20;will&#x20;cache&#x20;locally.&#x20;If&#x20;the&#x20;number&#x20;is&#x20;set&#x20;to&#x20;4,&#x20;then&#x20;the&#x20;computer&#x20;caches&#x20;logon&#x20;information&#x20;for&#x20;4&#x20;users.&#x20;When&#x20;a&#x20;5th&#x20;user&#x20;logs&#x20;on&#x20;to&#x20;the&#x20;computer,&#x20;the&#x20;server&#x20;overwrites&#x20;the&#x20;oldest&#x20;cached&#x20;logon&#x20;session.&#x20;Users&#x20;who&#x20;access&#x20;the&#x20;computer&#x20;console&#x20;will&#x20;have&#x20;their&#x20;logon&#x20;credentials&#x20;cached&#x20;on&#x20;that&#x20;computer.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;computer&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;attempt&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;To&#x20;mitigate&#x20;this&#x20;type&#x20;of&#x20;attack,&#x20;Windows&#x20;encrypts&#x20;the&#x20;information&#x20;and&#x20;obscures&#x20;its&#x20;physical&#x20;location.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;','[{\"cis\": [\"2.3.7.7\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15532,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;between&#x20;5&#x20;and&#x20;14&#x20;days&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;far&#x20;in&#x20;advance&#x20;users&#x20;are&#x20;warned&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;at&#x20;least&#x20;5&#x20;days&#x20;but&#x20;no&#x20;more&#x20;than&#x20;14&#x20;days&#x20;to&#x20;sufficiently&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;passwords&#x20;will&#x20;expire.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days.','Users&#x20;will&#x20;need&#x20;to&#x20;be&#x20;warned&#x20;that&#x20;their&#x20;passwords&#x20;are&#x20;going&#x20;to&#x20;expire,&#x20;or&#x20;they&#x20;may&#x20;inadvertently&#x20;be&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;computer&#x20;when&#x20;their&#x20;passwords&#x20;expire.&#x20;This&#x20;condition&#x20;could&#x20;lead&#x20;to&#x20;confusion&#x20;for&#x20;users&#x20;who&#x20;access&#x20;the&#x20;network&#x20;locally,&#x20;or&#x20;make&#x20;it&#x20;impossible&#x20;for&#x20;users&#x20;to&#x20;access&#x20;your&#x20;organization&#039;s&#x20;network&#x20;through&#x20;dial-up&#x20;or&#x20;virtual&#x20;private&#x20;network&#x20;&#40;VPN&#41;&#x20;connections.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration','[{\"cis\": [\"2.3.7.8\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15533,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Lock&#x20;Workstation&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;happens&#x20;when&#x20;the&#x20;smart&#x20;card&#x20;for&#x20;a&#x20;logged-on&#x20;user&#x20;is&#x20;removed&#x20;from&#x20;the&#x20;smart&#x20;card&#x20;reader.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Lock&#x20;Workstation.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Users&#x20;sometimes&#x20;forget&#x20;to&#x20;lock&#x20;their&#x20;workstations&#x20;when&#x20;they&#x20;are&#x20;away&#x20;from&#x20;them,&#x20;allowing&#x20;the&#x20;possibility&#x20;for&#x20;malicious&#x20;users&#x20;to&#x20;access&#x20;their&#x20;computers.&#x20;If&#x20;smart&#x20;cards&#x20;are&#x20;used&#x20;for&#x20;authentication,&#x20;the&#x20;computer&#x20;should&#x20;automatically&#x20;lock&#x20;itself&#x20;when&#x20;the&#x20;card&#x20;is&#x20;removed&#x20;to&#x20;ensure&#x20;that&#x20;only&#x20;the&#x20;user&#x20;with&#x20;the&#x20;smart&#x20;card&#x20;is&#x20;accessing&#x20;resources&#x20;using&#x20;those&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Lock&#x20;Workstation&#x20;&#40;or,&#x20;if&#x20;applicable&#x20;for&#x20;your&#x20;environment,&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior','[{\"cis\": [\"2.3.7.9\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15534,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;client&#x20;component.&#x20;Note:&#x20;When&#x20;Windows&#x20;Vista-based&#x20;computers&#x20;have&#x20;this&#x20;policy&#x20;setting&#x20;enabled&#x20;and&#x20;they&#x20;connect&#x20;to&#x20;file&#x20;or&#x20;print&#x20;shares&#x20;on&#x20;remote&#x20;servers,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;setting&#x20;is&#x20;synchronized&#x20;with&#x20;its&#x20;companion&#x20;setting,&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;,&#x20;on&#x20;those&#x20;servers.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;these&#x20;settings,&#x20;see&#x20;the&#x20;&quot;Microsoft&#x20;network&#x20;client&#x20;and&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;four&#x20;related&#x20;settings&#41;&quot;&#x20;section&#x20;in&#x20;Chapter&#x20;5&#x20;of&#x20;the&#x20;Threats&#x20;and&#x20;Countermeasures&#x20;guide.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.8.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15535,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;attempt&#x20;to&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing.&#x20;Note:&#x20;Enabling&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;makes&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;','[{\"cis\": [\"2.3.8.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15536,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;redirector&#x20;will&#x20;send&#x20;plaintext&#x20;passwords&#x20;during&#x20;authentication&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#x20;that&#x20;do&#x20;not&#x20;support&#x20;password&#x20;encryption.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;strong&#x20;business&#x20;case&#x20;to&#x20;enable&#x20;it.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;unencrypted&#x20;passwords&#x20;will&#x20;be&#x20;allowed&#x20;across&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;the&#x20;server&#x20;can&#x20;transmit&#x20;passwords&#x20;in&#x20;plaintext&#x20;across&#x20;the&#x20;network&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;offer&#x20;SMB&#x20;services,&#x20;which&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;risk.&#x20;These&#x20;other&#x20;computers&#x20;may&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;SMB&#x20;security&#x20;mechanisms&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;Server&#x20;2003.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers','[{\"cis\": [\"2.3.8.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15537,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;amount&#x20;of&#x20;continuous&#x20;idle&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;in&#x20;an&#x20;SMB&#x20;session&#x20;before&#x20;the&#x20;session&#x20;is&#x20;suspended&#x20;because&#x20;of&#x20;inactivity.&#x20;Administrators&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;control&#x20;when&#x20;a&#x20;computer&#x20;suspends&#x20;an&#x20;inactive&#x20;SMB&#x20;session.&#x20;If&#x20;client&#x20;activity&#x20;resumes,&#x20;the&#x20;session&#x20;is&#x20;automatically&#x20;reestablished.&#x20;The&#x20;maximum&#x20;value&#x20;is&#x20;99999,&#x20;which&#x20;is&#x20;over&#x20;69&#x20;days;&#x20;in&#x20;effect,&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;.','Each&#x20;SMB&#x20;session&#x20;consumes&#x20;server&#x20;resources,&#x20;and&#x20;numerous&#x20;null&#x20;sessions&#x20;will&#x20;slow&#x20;the&#x20;server&#x20;or&#x20;possibly&#x20;cause&#x20;it&#x20;to&#x20;fail.&#x20;An&#x20;attacker&#x20;could&#x20;repeatedly&#x20;establish&#x20;SMB&#x20;sessions&#x20;until&#x20;the&#x20;server&#039;s&#x20;SMB&#x20;services&#x20;become&#x20;slow&#x20;or&#x20;unresponsive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session','[{\"cis\": [\"2.3.9.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15538,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;server&#x20;component.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;in&#x20;a&#x20;mixed&#x20;environment&#x20;to&#x20;prevent&#x20;downstream&#x20;clients&#x20;from&#x20;using&#x20;the&#x20;workstation&#x20;as&#x20;a&#x20;network&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15539,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;server&#x20;will&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing&#x20;with&#x20;clients&#x20;that&#x20;request&#x20;it.&#x20;If&#x20;no&#x20;signing&#x20;request&#x20;comes&#x20;from&#x20;the&#x20;client,&#x20;a&#x20;connection&#x20;will&#x20;be&#x20;allowed&#x20;without&#x20;a&#x20;signature&#x20;if&#x20;the&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#x20;setting&#x20;is&#x20;not&#x20;enabled.&#x20;Note:&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;to&#x20;make&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;','[{\"cis\": [\"2.3.9.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15540,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.11.6&#41;.&#x20;If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;necessary&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;effective.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;then&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting.&#x20;Otherwise,&#x20;users&#x20;who&#x20;should&#x20;not&#x20;have&#x20;access&#x20;to&#x20;network&#x20;resources&#x20;outside&#x20;of&#x20;their&#x20;logon&#x20;hours&#x20;may&#x20;actually&#x20;be&#x20;able&#x20;to&#x20;continue&#x20;to&#x20;use&#x20;those&#x20;resources&#x20;with&#x20;sessions&#x20;that&#x20;were&#x20;established&#x20;during&#x20;allowed&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire','[{\"cis\": [\"2.3.9.4\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15541,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;level&#x20;of&#x20;validation&#x20;a&#x20;computer&#x20;with&#x20;shared&#x20;folders&#x20;or&#x20;printers&#x20;&#40;the&#x20;server&#41;&#x20;performs&#x20;on&#x20;the&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;that&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;client&#x20;computer&#x20;when&#x20;it&#x20;establishes&#x20;a&#x20;session&#x20;using&#x20;the&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;The&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;provides&#x20;the&#x20;basis&#x20;for&#x20;file&#x20;and&#x20;print&#x20;sharing&#x20;and&#x20;other&#x20;networking&#x20;operations,&#x20;such&#x20;as&#x20;remote&#x20;Windows&#x20;administration.&#x20;The&#x20;SMB&#x20;protocol&#x20;supports&#x20;validating&#x20;the&#x20;SMB&#x20;server&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;within&#x20;the&#x20;authentication&#x20;blob&#x20;provided&#x20;by&#x20;a&#x20;SMB&#x20;client&#x20;to&#x20;prevent&#x20;a&#x20;class&#x20;of&#x20;attacks&#x20;against&#x20;SMB&#x20;servers&#x20;referred&#x20;to&#x20;as&#x20;SMB&#x20;relay&#x20;attacks.&#x20;This&#x20;setting&#x20;will&#x20;affect&#x20;both&#x20;SMB1&#x20;and&#x20;SMB2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','The&#x20;identity&#x20;of&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;spoofed&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;network&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;&#40;configuring&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level','[{\"cis\": [\"2.3.9.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15542,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Allow&#x20;anonymous&#x20;SID/Name&#x20;translation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;an&#x20;anonymous&#x20;user&#x20;can&#x20;request&#x20;security&#x20;identifier&#x20;&#40;SID&#41;&#x20;attributes&#x20;for&#x20;another&#x20;user,&#x20;or&#x20;use&#x20;a&#x20;SID&#x20;to&#x20;obtain&#x20;its&#x20;corresponding&#x20;user&#x20;name.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;user&#x20;with&#x20;local&#x20;access&#x20;could&#x20;use&#x20;the&#x20;well-known&#x20;Administrator&#039;s&#x20;SID&#x20;to&#x20;learn&#x20;the&#x20;real&#x20;name&#x20;of&#x20;the&#x20;built-in&#x20;Administrator&#x20;account,&#x20;even&#x20;if&#x20;it&#x20;has&#x20;been&#x20;renamed.&#x20;That&#x20;person&#x20;could&#x20;then&#x20;use&#x20;the&#x20;account&#x20;name&#x20;to&#x20;initiate&#x20;a&#x20;password&#x20;guessing&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Allow&#x20;anonymous&#x20;SID/Name&#x20;translation','[{\"cis\": [\"2.3.10.1\"]}]'),(15543,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;the&#x20;accounts&#x20;in&#x20;the&#x20;Security&#x20;Accounts&#x20;Manager&#x20;&#40;SAM&#41;.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;with&#x20;anonymous&#x20;connections&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;allows&#x20;additional&#x20;restrictions&#x20;on&#x20;anonymous&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts','[{\"cis\": [\"2.3.10.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15544,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;SAM&#x20;accounts&#x20;as&#x20;well&#x20;as&#x20;shares.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;anonymous&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;and&#x20;network&#x20;share&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares','[{\"cis\": [\"2.3.10.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15545,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Credential&#x20;Manager&#x20;&#40;formerly&#x20;called&#x20;Stored&#x20;User&#x20;Names&#x20;and&#x20;Passwords&#41;&#x20;saves&#x20;passwords&#x20;or&#x20;credentials&#x20;for&#x20;later&#x20;use&#x20;when&#x20;it&#x20;gains&#x20;domain&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Changes&#x20;to&#x20;this&#x20;setting&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;Windows&#x20;is&#x20;restarted.','Passwords&#x20;that&#x20;are&#x20;cached&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;the&#x20;user&#x20;when&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;computer.&#x20;Although&#x20;this&#x20;information&#x20;may&#x20;sound&#x20;obvious,&#x20;a&#x20;problem&#x20;can&#x20;arise&#x20;if&#x20;the&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;reads&#x20;the&#x20;passwords&#x20;and&#x20;forwards&#x20;them&#x20;to&#x20;another,&#x20;unauthorized&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication','[{\"cis\": [\"2.3.10.4\"]}, {\"pci_dss\": [\"3.1\"]}]'),(15546,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;additional&#x20;permissions&#x20;are&#x20;assigned&#x20;for&#x20;anonymous&#x20;connections&#x20;to&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords,&#x20;perform&#x20;social&#x20;engineering&#x20;attacks,&#x20;or&#x20;launch&#x20;DoS&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users','[{\"cis\": [\"2.3.10.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15547,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15548,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;There&#x20;was&#x20;a&#x20;setting&#x20;with&#x20;that&#x20;name&#x20;in&#x20;Windows&#x20;XP,&#x20;but&#x20;it&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;&#x20;in&#x20;Windows&#x20;Server&#x20;2003,&#x20;Windows&#x20;Vista,&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;SystemCurrentControlSetControlProductOptions&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion','The&#x20;registry&#x20;is&#x20;a&#x20;database&#x20;that&#x20;contains&#x20;computer&#x20;configuration&#x20;information,&#x20;and&#x20;much&#x20;of&#x20;the&#x20;information&#x20;is&#x20;sensitive.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;information&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack,&#x20;suitable&#x20;ACLs&#x20;are&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;to&#x20;help&#x20;protect&#x20;it&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlProductOptions&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;SOFTWAREMicrosoftWindows&#x20;NTCurrentVersion&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths','[{\"cis\": [\"2.3.10.7\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15549,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;In&#x20;Windows&#x20;XP&#x20;this&#x20;setting&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths,&#039;&#x20;the&#x20;setting&#x20;with&#x20;that&#x20;same&#x20;name&#x20;in&#x20;Windows&#x20;Vista,&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;and&#x20;Windows&#x20;Server&#x20;2003&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;SystemCurrentControlSetServicesSysmonLog','The&#x20;registry&#x20;contains&#x20;sensitive&#x20;computer&#x20;configuration&#x20;information&#x20;that&#x20;could&#x20;be&#x20;used&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;The&#x20;fact&#x20;that&#x20;the&#x20;default&#x20;ACLs&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;are&#x20;fairly&#x20;restrictive&#x20;and&#x20;help&#x20;to&#x20;protect&#x20;the&#x20;registry&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;SystemCurrentControlSetServicesEventlog&#x20;SOFTWAREMicrosoftOLAP&#x20;Server&#x20;SOFTWAREMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SOFTWAREMicrosoftWindows&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;SOFTWAREMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;SystemCurrentControlSetServicesSysmonLog&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths','[{\"cis\": [\"2.3.10.8\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15550,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;enabled,&#x20;this&#x20;policy&#x20;setting&#x20;restricts&#x20;anonymous&#x20;access&#x20;to&#x20;only&#x20;those&#x20;shares&#x20;and&#x20;pipes&#x20;that&#x20;are&#x20;named&#x20;in&#x20;the&#x20;Network&#x20;access:&#x20;Named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;and&#x20;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;settings.&#x20;This&#x20;policy&#x20;setting&#x20;controls&#x20;null&#x20;session&#x20;access&#x20;to&#x20;shares&#x20;on&#x20;your&#x20;computers&#x20;by&#x20;adding&#x20;RestrictNullSessAccess&#x20;with&#x20;the&#x20;value&#x20;1&#x20;in&#x20;the&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanManServerParameters&#x20;registry&#x20;key.&#x20;This&#x20;registry&#x20;value&#x20;toggles&#x20;null&#x20;session&#x20;shares&#x20;on&#x20;or&#x20;off&#x20;to&#x20;control&#x20;whether&#x20;the&#x20;server&#x20;service&#x20;restricts&#x20;unauthenticated&#x20;clients&#039;&#x20;access&#x20;to&#x20;named&#x20;resources.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Null&#x20;sessions&#x20;are&#x20;a&#x20;weakness&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;through&#x20;shares&#x20;&#40;including&#x20;the&#x20;default&#x20;shares&#41;&#x20;on&#x20;computers&#x20;in&#x20;your&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares','[{\"cis\": [\"2.3.10.9\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15551,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;remote&#x20;RPC&#x20;connections&#x20;to&#x20;SAM.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow.&#x20;Note:&#x20;A&#x20;Windows&#x20;10&#x20;R1607,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.&#x20;Note&#x20;#2:&#x20;If&#x20;your&#x20;organization&#x20;is&#x20;using&#x20;Azure&#x20;Advanced&#x20;Threat&#x20;Protection&#x20;&#40;APT&#41;,&#x20;the&#x20;service&#x20;account,&#x20;&quot;AATP&#x20;Service&quot;&#x20;will&#x20;need&#x20;to&#x20;be&#x20;added&#x20;to&#x20;the&#x20;recommendation&#x20;configuration.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;adding&#x20;the&#x20;&quot;AATP&#x20;Service&quot;&#x20;account&#x20;please&#x20;see&#x20;Configure&#x20;SAM-R&#x20;to&#x20;enable&#x20;lateral&#x20;movement&#x20;path&#x20;detection&#x20;in&#x20;Microsoft&#x20;Defender&#x20;for&#x20;Identity&#x20;|&#x20;Microsoft&#x20;Docs.','To&#x20;ensure&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;cannot&#x20;anonymously&#x20;list&#x20;local&#x20;account&#x20;names&#x20;or&#x20;groups&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM','[{\"cis\": [\"2.3.10.10\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15552,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;network&#x20;shares&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;anonymous&#x20;users.&#x20;The&#x20;default&#x20;configuration&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;has&#x20;little&#x20;effect&#x20;because&#x20;all&#x20;users&#x20;have&#x20;to&#x20;be&#x20;authenticated&#x20;before&#x20;they&#x20;can&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;.','It&#x20;is&#x20;very&#x20;dangerous&#x20;to&#x20;allow&#x20;any&#x20;values&#x20;in&#x20;this&#x20;setting.&#x20;Any&#x20;shares&#x20;that&#x20;are&#x20;listed&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;any&#x20;network&#x20;user,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.11\"]}, {\"cis_csc\": [\"3.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15553,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;network&#x20;logons&#x20;that&#x20;use&#x20;local&#x20;accounts&#x20;are&#x20;authenticated.&#x20;The&#x20;Classic&#x20;option&#x20;allows&#x20;precise&#x20;control&#x20;over&#x20;access&#x20;to&#x20;resources,&#x20;including&#x20;the&#x20;ability&#x20;to&#x20;assign&#x20;different&#x20;types&#x20;of&#x20;access&#x20;to&#x20;different&#x20;users&#x20;for&#x20;the&#x20;same&#x20;resource.&#x20;The&#x20;Guest&#x20;only&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;treat&#x20;all&#x20;users&#x20;equally.&#x20;In&#x20;this&#x20;context,&#x20;all&#x20;users&#x20;authenticate&#x20;as&#x20;Guest&#x20;only&#x20;to&#x20;receive&#x20;the&#x20;same&#x20;access&#x20;level&#x20;to&#x20;a&#x20;given&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;interactive&#x20;logons&#x20;that&#x20;are&#x20;performed&#x20;remotely&#x20;by&#x20;using&#x20;such&#x20;services&#x20;as&#x20;Telnet&#x20;or&#x20;Remote&#x20;Desktop&#x20;Services&#x20;&#40;formerly&#x20;called&#x20;Terminal&#x20;Services&#41;.','With&#x20;the&#x20;Guest&#x20;only&#x20;model,&#x20;any&#x20;user&#x20;who&#x20;can&#x20;authenticate&#x20;to&#x20;your&#x20;computer&#x20;over&#x20;the&#x20;network&#x20;does&#x20;so&#x20;with&#x20;guest&#x20;privileges,&#x20;which&#x20;probably&#x20;means&#x20;that&#x20;they&#x20;will&#x20;not&#x20;have&#x20;write&#x20;access&#x20;to&#x20;shared&#x20;resources&#x20;on&#x20;that&#x20;computer.&#x20;Although&#x20;this&#x20;restriction&#x20;does&#x20;increase&#x20;security,&#x20;it&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;authorized&#x20;users&#x20;to&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;those&#x20;computers&#x20;because&#x20;ACLs&#x20;on&#x20;those&#x20;resources&#x20;must&#x20;include&#x20;access&#x20;control&#x20;entries&#x20;&#40;ACEs&#41;&#x20;for&#x20;the&#x20;Guest&#x20;account.&#x20;With&#x20;the&#x20;Classic&#x20;model,&#x20;local&#x20;accounts&#x20;should&#x20;be&#x20;password&#x20;protected.&#x20;Otherwise,&#x20;if&#x20;Guest&#x20;access&#x20;is&#x20;enabled,&#x20;anyone&#x20;can&#x20;use&#x20;those&#x20;user&#x20;accounts&#x20;to&#x20;access&#x20;shared&#x20;system&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts','[{\"cis\": [\"2.3.10.12\"]}, {\"pci_dss\": [\"7.1.3\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15554,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Local&#x20;System&#x20;services&#x20;that&#x20;use&#x20;Negotiate&#x20;when&#x20;reverting&#x20;to&#x20;NTLM&#x20;authentication&#x20;can&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;This&#x20;policy&#x20;is&#x20;supported&#x20;on&#x20;at&#x20;least&#x20;Windows&#x20;7&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;R2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;connecting&#x20;to&#x20;computers&#x20;running&#x20;versions&#x20;of&#x20;Windows&#x20;earlier&#x20;than&#x20;Windows&#x20;Vista&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;services&#x20;running&#x20;as&#x20;Local&#x20;System&#x20;and&#x20;using&#x20;SPNEGO&#x20;&#40;Negotiate&#41;&#x20;that&#x20;revert&#x20;to&#x20;NTLM&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;In&#x20;Windows&#x20;7,&#x20;if&#x20;you&#x20;are&#x20;connecting&#x20;to&#x20;a&#x20;computer&#x20;running&#x20;Windows&#x20;Server&#x20;2008&#x20;or&#x20;Windows&#x20;Vista,&#x20;then&#x20;a&#x20;system&#x20;service&#x20;uses&#x20;either&#x20;the&#x20;computer&#x20;identity&#x20;or&#x20;a&#x20;NULL&#x20;session.&#x20;When&#x20;connecting&#x20;with&#x20;a&#x20;NULL&#x20;session,&#x20;a&#x20;system-generated&#x20;session&#x20;key&#x20;is&#x20;created,&#x20;which&#x20;provides&#x20;no&#x20;protection&#x20;but&#x20;allows&#x20;applications&#x20;to&#x20;sign&#x20;and&#x20;encrypt&#x20;data&#x20;without&#x20;errors.&#x20;When&#x20;connecting&#x20;with&#x20;the&#x20;computer&#x20;identity,&#x20;both&#x20;signing&#x20;and&#x20;encryption&#x20;is&#x20;supported&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;data&#x20;protection.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM','[{\"cis\": [\"2.3.11.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15555,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;NTLM&#x20;is&#x20;allowed&#x20;to&#x20;fall&#x20;back&#x20;to&#x20;a&#x20;NULL&#x20;session&#x20;when&#x20;used&#x20;with&#x20;LocalSystem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','NULL&#x20;sessions&#x20;are&#x20;less&#x20;secure&#x20;because&#x20;by&#x20;definition&#x20;they&#x20;are&#x20;unauthenticated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback','[{\"cis\": [\"2.3.11.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15556,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;determines&#x20;if&#x20;online&#x20;identities&#x20;are&#x20;able&#x20;to&#x20;authenticate&#x20;to&#x20;this&#x20;computer.&#x20;The&#x20;Public&#x20;Key&#x20;Cryptography&#x20;Based&#x20;User-to-User&#x20;&#40;PKU2U&#41;&#x20;protocol&#x20;introduced&#x20;in&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;R2&#x20;is&#x20;implemented&#x20;as&#x20;a&#x20;security&#x20;support&#x20;provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;enables&#x20;peer-to-peer&#x20;authentication,&#x20;particularly&#x20;through&#x20;the&#x20;Windows&#x20;7&#x20;media&#x20;and&#x20;file&#x20;sharing&#x20;feature&#x20;called&#x20;HomeGroup,&#x20;which&#x20;permits&#x20;sharing&#x20;between&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;members&#x20;of&#x20;a&#x20;domain.&#x20;With&#x20;PKU2U,&#x20;a&#x20;new&#x20;extension&#x20;was&#x20;introduced&#x20;to&#x20;the&#x20;Negotiate&#x20;authentication&#x20;package,&#x20;Spnego.dll.&#x20;In&#x20;previous&#x20;versions&#x20;of&#x20;Windows,&#x20;Negotiate&#x20;decided&#x20;whether&#x20;to&#x20;use&#x20;Kerberos&#x20;or&#x20;NTLM&#x20;for&#x20;authentication.&#x20;The&#x20;extension&#x20;SSP&#x20;for&#x20;Negotiate,&#x20;Negoexts.dll,&#x20;which&#x20;is&#x20;treated&#x20;as&#x20;an&#x20;authentication&#x20;protocol&#x20;by&#x20;Windows,&#x20;supports&#x20;Microsoft&#x20;SSPs&#x20;including&#x20;PKU2U.&#x20;When&#x20;computers&#x20;are&#x20;configured&#x20;to&#x20;accept&#x20;authentication&#x20;requests&#x20;by&#x20;using&#x20;online&#x20;IDs,&#x20;Negoexts.dll&#x20;calls&#x20;the&#x20;PKU2U&#x20;SSP&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;PKU2U&#x20;SSP&#x20;obtains&#x20;a&#x20;local&#x20;certificate&#x20;and&#x20;exchanges&#x20;the&#x20;policy&#x20;between&#x20;the&#x20;peer&#x20;computers.&#x20;When&#x20;validated&#x20;on&#x20;the&#x20;peer&#x20;computer,&#x20;the&#x20;certificate&#x20;within&#x20;the&#x20;metadata&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;logon&#x20;peer&#x20;for&#x20;validation&#x20;and&#x20;associates&#x20;the&#x20;user&#039;s&#x20;certificate&#x20;to&#x20;a&#x20;security&#x20;token&#x20;and&#x20;the&#x20;logon&#x20;process&#x20;completes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;PKU2U&#x20;protocol&#x20;is&#x20;a&#x20;peer-to-peer&#x20;authentication&#x20;protocol&#x20;-&#x20;authentication&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;in&#x20;most&#x20;managed&#x20;networks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities','[{\"cis\": [\"2.3.11.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15557,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;encryption&#x20;types&#x20;that&#x20;Kerberos&#x20;is&#x20;allowed&#x20;to&#x20;use.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types.&#x20;Note:&#x20;Some&#x20;legacy&#x20;applications&#x20;and&#x20;OSes&#x20;may&#x20;still&#x20;require&#x20;RC4_HMAC_MD5&#x20;-&#x20;we&#x20;recommend&#x20;you&#x20;test&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;verify&#x20;whether&#x20;you&#x20;can&#x20;safely&#x20;remove&#x20;it.','The&#x20;strength&#x20;of&#x20;each&#x20;encryption&#x20;algorithm&#x20;varies&#x20;from&#x20;one&#x20;to&#x20;the&#x20;next,&#x20;choosing&#x20;stronger&#x20;algorithms&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;compromise&#x20;however&#x20;doing&#x20;so&#x20;may&#x20;cause&#x20;issues&#x20;when&#x20;the&#x20;computer&#x20;attempts&#x20;to&#x20;authenticate&#x20;with&#x20;systems&#x20;that&#x20;do&#x20;not&#x20;support&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos','[{\"cis\": [\"2.3.11.4\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15558,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;hash&#x20;value&#x20;for&#x20;the&#x20;new&#x20;password&#x20;is&#x20;stored&#x20;when&#x20;the&#x20;password&#x20;is&#x20;changed.&#x20;The&#x20;LM&#x20;hash&#x20;is&#x20;relatively&#x20;weak&#x20;and&#x20;prone&#x20;to&#x20;attack&#x20;compared&#x20;to&#x20;the&#x20;cryptographically&#x20;stronger&#x20;Microsoft&#x20;Windows&#x20;NT&#x20;hash.&#x20;Since&#x20;LM&#x20;hashes&#x20;are&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;in&#x20;the&#x20;security&#x20;database,&#x20;passwords&#x20;can&#x20;then&#x20;be&#x20;easily&#x20;compromised&#x20;if&#x20;the&#x20;database&#x20;is&#x20;attacked.&#x20;Note:&#x20;Older&#x20;operating&#x20;systems&#x20;and&#x20;some&#x20;third-party&#x20;applications&#x20;may&#x20;fail&#x20;when&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled.&#x20;Also,&#x20;note&#x20;that&#x20;the&#x20;password&#x20;will&#x20;need&#x20;to&#x20;be&#x20;changed&#x20;on&#x20;all&#x20;accounts&#x20;after&#x20;you&#x20;enable&#x20;this&#x20;setting&#x20;to&#x20;gain&#x20;the&#x20;proper&#x20;benefit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;SAM&#x20;file&#x20;can&#x20;be&#x20;targeted&#x20;by&#x20;attackers&#x20;who&#x20;seek&#x20;access&#x20;to&#x20;username&#x20;and&#x20;password&#x20;hashes.&#x20;Such&#x20;attacks&#x20;use&#x20;special&#x20;tools&#x20;to&#x20;crack&#x20;passwords,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;users&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;resources&#x20;on&#x20;your&#x20;network.&#x20;These&#x20;types&#x20;of&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;prevented&#x20;if&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;but&#x20;it&#x20;will&#x20;be&#x20;much&#x20;more&#x20;difficult&#x20;for&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;to&#x20;succeed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change','[{\"cis\": [\"2.3.11.5\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15559,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.9.4&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;a&#x20;user&#x20;could&#x20;remain&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;outside&#x20;of&#x20;their&#x20;allotted&#x20;logon&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire','[{\"cis\": [\"2.3.11.6\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15560,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM&#039;.','LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;was&#x20;a&#x20;family&#x20;of&#x20;early&#x20;Microsoft&#x20;client/server&#x20;software&#x20;&#40;predating&#x20;Windows&#x20;NT&#41;&#x20;that&#x20;allowed&#x20;users&#x20;to&#x20;link&#x20;personal&#x20;computers&#x20;together&#x20;on&#x20;a&#x20;single&#x20;network.&#x20;LM&#x20;network&#x20;capabilities&#x20;included&#x20;transparent&#x20;file&#x20;and&#x20;print&#x20;sharing,&#x20;user&#x20;security&#x20;features,&#x20;and&#x20;network&#x20;administration&#x20;tools.&#x20;In&#x20;Active&#x20;Directory&#x20;domains,&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;the&#x20;default&#x20;authentication&#x20;protocol.&#x20;However,&#x20;if&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;not&#x20;negotiated&#x20;for&#x20;some&#x20;reason,&#x20;Active&#x20;Directory&#x20;will&#x20;use&#x20;LM,&#x20;NTLM,&#x20;or&#x20;NTLMv2.&#x20;LAN&#x20;Manager&#x20;authentication&#x20;includes&#x20;the&#x20;LM,&#x20;NTLM,&#x20;and&#x20;NTLM&#x20;version&#x20;2&#x20;&#40;NTLMv2&#41;&#x20;variants,&#x20;and&#x20;is&#x20;the&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;to&#x20;authenticate&#x20;all&#x20;Windows&#x20;clients&#x20;when&#x20;they&#x20;perform&#x20;the&#x20;following&#x20;operations:&#x20;-Join&#x20;a&#x20;domain&#x20;-Authenticate&#x20;between&#x20;Active&#x20;Directory&#x20;forests&#x20;-Authenticate&#x20;to&#x20;down-level&#x20;domains&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;do&#x20;not&#x20;run&#x20;Windows&#x20;2000,&#x20;Windows&#x20;Server&#x20;2003,&#x20;or&#x20;Windows&#x20;XP&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;in&#x20;the&#x20;domain.&#x20;The&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#x20;setting&#x20;determines&#x20;which&#x20;challenge/response&#x20;authentication&#x20;protocol&#x20;is&#x20;used&#x20;for&#x20;network&#x20;logons.&#x20;This&#x20;choice&#x20;affects&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;protocol&#x20;used&#x20;by&#x20;clients,&#x20;the&#x20;level&#x20;of&#x20;session&#x20;security&#x20;negotiated,&#x20;and&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;accepted&#x20;by&#x20;servers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM.','Windows&#x20;2000&#x20;and&#x20;Windows&#x20;XP&#x20;clients&#x20;were&#x20;configured&#x20;by&#x20;default&#x20;to&#x20;send&#x20;LM&#x20;and&#x20;NTLM&#x20;authentication&#x20;responses&#x20;&#40;Windows&#x20;95-based&#x20;and&#x20;Windows&#x20;98-based&#x20;clients&#x20;only&#x20;send&#x20;LM&#41;.&#x20;The&#x20;default&#x20;settings&#x20;in&#x20;OSes&#x20;predating&#x20;Windows&#x20;Vista&#x20;/&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-&#x20;R2&#41;&#x20;allowed&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;with&#x20;servers&#x20;and&#x20;use&#x20;their&#x20;resources.&#x20;However,&#x20;this&#x20;meant&#x20;that&#x20;LM&#x20;responses&#x20;-&#x20;the&#x20;weakest&#x20;form&#x20;of&#x20;authentication&#x20;response&#x20;-&#x20;were&#x20;sent&#x20;over&#x20;the&#x20;network,&#x20;and&#x20;it&#x20;was&#x20;potentially&#x20;possible&#x20;for&#x20;attackers&#x20;to&#x20;sniff&#x20;that&#x20;traffic&#x20;to&#x20;more&#x20;easily&#x20;reproduce&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;operating&#x20;systems&#x20;cannot&#x20;use&#x20;the&#x20;Kerberos&#x20;version&#x20;5&#x20;protocol&#x20;for&#x20;authentication.&#x20;For&#x20;this&#x20;reason,&#x20;in&#x20;a&#x20;Windows&#x20;Server&#x20;2003&#x20;domain,&#x20;these&#x20;computers&#x20;authenticate&#x20;by&#x20;default&#x20;with&#x20;both&#x20;the&#x20;LM&#x20;and&#x20;NTLM&#x20;protocols&#x20;for&#x20;network&#x20;authentication.&#x20;You&#x20;can&#x20;enforce&#x20;a&#x20;more&#x20;secure&#x20;authentication&#x20;protocol&#x20;for&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;by&#x20;using&#x20;NTLMv2.&#x20;For&#x20;the&#x20;logon&#x20;process,&#x20;NTLMv2&#x20;uses&#x20;a&#x20;secure&#x20;channel&#x20;to&#x20;protect&#x20;the&#x20;authentication&#x20;process.&#x20;Even&#x20;if&#x20;you&#x20;use&#x20;NTLMv2&#x20;for&#x20;older&#x20;clients&#x20;and&#x20;servers,&#x20;Windows-based&#x20;clients&#x20;and&#x20;servers&#x20;that&#x20;are&#x20;members&#x20;of&#x20;the&#x20;domain&#x20;will&#x20;use&#x20;the&#x20;Kerberos&#x20;authentication&#x20;protocol&#x20;to&#x20;authenticate&#x20;with&#x20;Windows&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;Domain&#x20;Controllers.&#x20;For&#x20;these&#x20;reasons,&#x20;it&#x20;is&#x20;strongly&#x20;preferred&#x20;to&#x20;restrict&#x20;the&#x20;use&#x20;of&#x20;LM&#x20;&amp;&#x20;NTLM&#x20;&#40;non-v2&#41;&#x20;as&#x20;much&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level','[{\"cis\": [\"2.3.11.7\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15561,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Negotiate&#x20;signing&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;data&#x20;signing&#x20;that&#x20;is&#x20;requested&#x20;on&#x20;behalf&#x20;of&#x20;clients&#x20;that&#x20;issue&#x20;LDAP&#x20;BIND&#x20;requests.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;ldap_simple_bind&#x20;or&#x20;ldap_simple_bind_s&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Negotiate&#x20;signing.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x20;in&#x20;which&#x20;an&#x20;intruder&#x20;captures&#x20;the&#x20;packets&#x20;between&#x20;the&#x20;client&#x20;and&#x20;server,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;server.&#x20;For&#x20;an&#x20;LDAP&#x20;server,&#x20;this&#x20;susceptibility&#x20;means&#x20;that&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;server&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;or&#x20;altered&#x20;data&#x20;from&#x20;the&#x20;LDAP&#x20;queries.&#x20;To&#x20;lower&#x20;this&#x20;risk&#x20;in&#x20;your&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;can&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult&#x20;if&#x20;you&#x20;require&#x20;digital&#x20;signatures&#x20;on&#x20;all&#x20;network&#x20;packets&#x20;by&#x20;means&#x20;of&#x20;IPsec&#x20;authentication&#x20;headers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Negotiate&#x20;signing&#x20;&#40;configuring&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements','[{\"cis\": [\"2.3.11.8\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15562,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;clients&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;both&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;In&#x20;other&#x20;words,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients','[{\"cis\": [\"2.3.11.9\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15563,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;servers&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;all&#x20;of&#x20;the&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;That&#x20;is,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers','[{\"cis\": [\"2.3.11.10\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15564,'Ensure&#x20;&#039;System&#x20;cryptography:&#x20;Force&#x20;strong&#x20;key&#x20;protection&#x20;for&#x20;user&#x20;keys&#x20;stored&#x20;on&#x20;the&#x20;computer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;User&#x20;is&#x20;prompted&#x20;when&#x20;the&#x2','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#039;&#x20;private&#x20;keys&#x20;&#40;such&#x20;as&#x20;their&#x20;S-MIME&#x20;keys&#41;&#x20;require&#x20;a&#x20;password&#x20;to&#x20;be&#x20;used.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;User&#x20;is&#x20;prompted&#x20;when&#x20;the&#x20;key&#x20;is&#x20;first&#x20;used.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;User&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;each&#x20;time&#x20;they&#x20;use&#x20;a&#x20;key&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','If&#x20;a&#x20;user&#039;s&#x20;account&#x20;is&#x20;compromised&#x20;or&#x20;their&#x20;computer&#x20;is&#x20;inadvertently&#x20;left&#x20;unsecured&#x20;the&#x20;malicious&#x20;user&#x20;can&#x20;use&#x20;the&#x20;keys&#x20;stored&#x20;for&#x20;the&#x20;user&#x20;to&#x20;access&#x20;protected&#x20;resources.&#x20;You&#x20;can&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;so&#x20;that&#x20;users&#x20;must&#x20;provide&#x20;a&#x20;password&#x20;that&#x20;is&#x20;distinct&#x20;from&#x20;their&#x20;domain&#x20;password&#x20;every&#x20;time&#x20;they&#x20;use&#x20;a&#x20;key.&#x20;This&#x20;configuration&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;access&#x20;locally&#x20;stored&#x20;user&#x20;keys,&#x20;even&#x20;if&#x20;the&#x20;attacker&#x20;takes&#x20;control&#x20;of&#x20;the&#x20;user&#039;s&#x20;computer&#x20;and&#x20;determines&#x20;their&#x20;logon&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;User&#x20;is&#x20;prompted&#x20;when&#x20;the&#x20;key&#x20;is&#x20;first&#x20;used&#x20;&#40;configuring&#x20;to&#x20;User&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;each&#x20;time&#x20;they&#x20;use&#x20;a&#x20;key&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;cryptography:&#x20;Force&#x20;strong&#x20;key&#x20;protection&#x20;for&#x20;user&#x20;keys&#x20;stored&#x20;on&#x20;the&#x20;computer','[{\"cis\": [\"2.3.14.1\"]}, {\"cis_csc\": [\"3.11\"]}]'),(15565,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;case&#x20;insensitivity&#x20;is&#x20;enforced&#x20;for&#x20;all&#x20;subsystems.&#x20;The&#x20;Microsoft&#x20;Win32&#x20;subsystem&#x20;is&#x20;case&#x20;insensitive.&#x20;However,&#x20;the&#x20;kernel&#x20;supports&#x20;case&#x20;sensitivity&#x20;for&#x20;other&#x20;subsystems,&#x20;such&#x20;as&#x20;the&#x20;Portable&#x20;Operating&#x20;System&#x20;Interface&#x20;for&#x20;UNIX&#x20;&#40;POSIX&#41;.&#x20;Because&#x20;Windows&#x20;is&#x20;case&#x20;insensitive&#x20;&#40;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity&#41;,&#x20;failure&#x20;to&#x20;enforce&#x20;this&#x20;policy&#x20;setting&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;the&#x20;POSIX&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;by&#x20;using&#x20;mixed&#x20;case&#x20;to&#x20;label&#x20;it.&#x20;Such&#x20;a&#x20;situation&#x20;can&#x20;block&#x20;access&#x20;to&#x20;these&#x20;files&#x20;by&#x20;another&#x20;user&#x20;who&#x20;uses&#x20;typical&#x20;Win32&#x20;tools,&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Because&#x20;Windows&#x20;is&#x20;case-insensitive&#x20;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity,&#x20;failure&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;would&#x20;make&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;that&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;but&#x20;with&#x20;a&#x20;different&#x20;mix&#x20;of&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letters.&#x20;Such&#x20;a&#x20;situation&#x20;could&#x20;potentially&#x20;confuse&#x20;users&#x20;when&#x20;they&#x20;try&#x20;to&#x20;access&#x20;such&#x20;files&#x20;from&#x20;normal&#x20;Win32&#x20;tools&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems','[{\"cis\": [\"2.3.15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15566,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;discretionary&#x20;access&#x20;control&#x20;list&#x20;&#40;DACL&#41;&#x20;for&#x20;objects.&#x20;Active&#x20;Directory&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;system&#x20;resources,&#x20;such&#x20;as&#x20;DOS&#x20;device&#x20;names,&#x20;mutexes,&#x20;and&#x20;semaphores.&#x20;In&#x20;this&#x20;way,&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;what&#x20;permissions&#x20;are&#x20;granted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;DACL&#x20;for&#x20;objects.&#x20;Windows&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;computer&#x20;resources&#x20;so&#x20;that&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;with&#x20;what&#x20;permissions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;','[{\"cis\": [\"2.3.15.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15567,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;built-in&#x20;Administrator&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;An&#x20;attack&#x20;vector&#x20;for&#x20;these&#x20;programs&#x20;was&#x20;to&#x20;discover&#x20;the&#x20;password&#x20;of&#x20;the&#x20;account&#x20;named&#x20;&#039;Administrator&#039;&#x20;because&#x20;that&#x20;user&#x20;account&#x20;was&#x20;created&#x20;for&#x20;all&#x20;installations&#x20;of&#x20;Windows.&#x20;To&#x20;address&#x20;this&#x20;risk,&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;newer,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;is&#x20;now&#x20;disabled&#x20;by&#x20;default.&#x20;In&#x20;a&#x20;default&#x20;installation&#x20;of&#x20;a&#x20;new&#x20;computer,&#x20;accounts&#x20;with&#x20;administrative&#x20;control&#x20;over&#x20;the&#x20;computer&#x20;are&#x20;initially&#x20;set&#x20;up&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;not&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;the&#x20;first&#x20;user&#x20;account&#x20;you&#x20;create&#x20;has&#x20;the&#x20;equivalent&#x20;permissions&#x20;as&#x20;a&#x20;local&#x20;administrator.&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;no&#x20;local&#x20;administrator&#x20;accounts&#x20;are&#x20;created.&#x20;The&#x20;Enterprise&#x20;or&#x20;Domain&#x20;Administrator&#x20;must&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;and&#x20;create&#x20;one&#x20;if&#x20;a&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;warranted.&#x20;Once&#x20;Windows&#x20;is&#x20;installed,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;may&#x20;be&#x20;manually&#x20;enabled,&#x20;but&#x20;we&#x20;strongly&#x20;recommend&#x20;that&#x20;this&#x20;account&#x20;remain&#x20;disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account','[{\"cis\": [\"2.3.17.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15568,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Prompt&#x20;for&#x20;consent&#x20','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;administrator&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;permits&#x20;the&#x20;administrator&#x20;to&#x20;prevent&#x20;a&#x20;malicious&#x20;program&#x20;from&#x20;elevating&#x20;its&#x20;privilege&#x20;when&#x20;the&#x20;program&#x20;attempts&#x20;to&#x20;do&#x20;so.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode','[{\"cis\": [\"2.3.17.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15569,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Automatically&#x20;deny&#x20;elevation&#x20;requests&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;programs&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;their&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;user&#x20;that&#x20;a&#x20;program&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;requires&#x20;that&#x20;the&#x20;user&#x20;be&#x20;able&#x20;to&#x20;supply&#x20;administrative&#x20;credentials&#x20;in&#x20;order&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users','[{\"cis\": [\"2.3.17.3\"]}, {\"pci_dss\": [\"7.1.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15570,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;application&#x20;installation&#x20;detection&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Some&#x20;malicious&#x20;software&#x20;will&#x20;attempt&#x20;to&#x20;install&#x20;itself&#x20;after&#x20;being&#x20;given&#x20;permission&#x20;to&#x20;run.&#x20;For&#x20;example,&#x20;malicious&#x20;software&#x20;with&#x20;a&#x20;trusted&#x20;application&#x20;shell.&#x20;The&#x20;user&#x20;may&#x20;have&#x20;given&#x20;permission&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run&#x20;because&#x20;the&#x20;program&#x20;is&#x20;trusted,&#x20;but&#x20;if&#x20;they&#x20;are&#x20;then&#x20;prompted&#x20;for&#x20;installation&#x20;of&#x20;an&#x20;unknown&#x20;component&#x20;this&#x20;provides&#x20;another&#x20;way&#x20;of&#x20;trapping&#x20;the&#x20;software&#x20;before&#x20;it&#x20;can&#x20;do&#x20;damage','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation','[{\"cis\": [\"2.3.17.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15571,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;applications&#x20;that&#x20;request&#x20;to&#x20;run&#x20;with&#x20;a&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#41;&#x20;integrity&#x20;level&#x20;must&#x20;reside&#x20;in&#x20;a&#x20;secure&#x20;location&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;Secure&#x20;locations&#x20;are&#x20;limited&#x20;to&#x20;the&#x20;following:&#x20;-&#x20;...Program&#x20;Files,&#x20;including&#x20;subfolders&#x20;&#x20;-&#x20;...Windowssystem32;&#x20;-&#x20;...Program&#x20;Files&#x20;&#40;x86&#41;,&#x20;including&#x20;subfolders&#x20;&#40;for&#x20;64-bit&#x20;versions&#x20;of&#x20;Windows&#41;.&#x20;Note:&#x20;Windows&#x20;enforces&#x20;a&#x20;public&#x20;key&#x20;infrastructure&#x20;&#40;PKI&#41;&#x20;signature&#x20;check&#x20;on&#x20;any&#x20;interactive&#x20;application&#x20;that&#x20;requests&#x20;to&#x20;run&#x20;with&#x20;a&#x20;UIAccess&#x20;integrity&#x20;level&#x20;regardless&#x20;of&#x20;the&#x20;state&#x20;of&#x20;this&#x20;security&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','UIAccess&#x20;Integrity&#x20;allows&#x20;an&#x20;application&#x20;to&#x20;bypass&#x20;User&#x20;Interface&#x20;Privilege&#x20;Isolation&#x20;&#40;UIPI&#41;&#x20;restrictions&#x20;when&#x20;an&#x20;application&#x20;is&#x20;elevated&#x20;in&#x20;privilege&#x20;from&#x20;a&#x20;standard&#x20;user&#x20;to&#x20;an&#x20;administrator.&#x20;This&#x20;is&#x20;required&#x20;to&#x20;support&#x20;accessibility&#x20;features&#x20;such&#x20;as&#x20;screen&#x20;readers&#x20;that&#x20;are&#x20;transmitting&#x20;user&#x20;interfaces&#x20;to&#x20;alternative&#x20;forms.&#x20;A&#x20;process&#x20;that&#x20;is&#x20;started&#x20;with&#x20;UIAccess&#x20;rights&#x20;has&#x20;the&#x20;following&#x20;abilities:&#x20;-&#x20;To&#x20;set&#x20;the&#x20;foreground&#x20;window.&#x20;-&#x20;To&#x20;drive&#x20;any&#x20;application&#x20;window&#x20;using&#x20;SendInput&#x20;function.&#x20;-&#x20;To&#x20;use&#x20;read&#x20;input&#x20;for&#x20;all&#x20;integrity&#x20;levels&#x20;using&#x20;low-level&#x20;hooks,&#x20;raw&#x20;input,&#x20;GetKeyState,&#x20;GetAsyncKeyState,&#x20;and&#x20;GetKeyboardInput.&#x20;-&#x20;To&#x20;set&#x20;journal&#x20;hooks.&#x20;-&#x20;To&#x20;uses&#x20;AttachThreadInput&#x20;to&#x20;attach&#x20;a&#x20;thread&#x20;to&#x20;a&#x20;higher&#x20;integrity&#x20;input&#x20;queue.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations','[{\"cis\": [\"2.3.17.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15572,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;all&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;policy&#x20;settings&#x20;for&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;change&#x20;this&#x20;policy&#x20;setting,&#x20;you&#x20;must&#x20;restart&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;Security&#x20;Center&#x20;notifies&#x20;you&#x20;that&#x20;the&#x20;overall&#x20;security&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;reduced.','This&#x20;is&#x20;the&#x20;setting&#x20;that&#x20;turns&#x20;on&#x20;or&#x20;off&#x20;UAC.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;used&#x20;and&#x20;any&#x20;security&#x20;benefits&#x20;and&#x20;risk&#x20;mitigations&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;present&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode','[{\"cis\": [\"2.3.17.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15573,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;elevation&#x20;request&#x20;prompt&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;interactive&#x20;user&#039;s&#x20;desktop&#x20;or&#x20;the&#x20;secure&#x20;desktop.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Standard&#x20;elevation&#x20;prompt&#x20;dialog&#x20;boxes&#x20;can&#x20;be&#x20;spoofed,&#x20;which&#x20;may&#x20;cause&#x20;users&#x20;to&#x20;disclose&#x20;their&#x20;passwords&#x20;to&#x20;malicious&#x20;software.&#x20;The&#x20;secure&#x20;desktop&#x20;presents&#x20;a&#x20;very&#x20;distinct&#x20;appearance&#x20;when&#x20;prompting&#x20;for&#x20;elevation,&#x20;where&#x20;the&#x20;user&#x20;desktop&#x20;dims,&#x20;and&#x20;the&#x20;elevation&#x20;prompt&#x20;UI&#x20;is&#x20;more&#x20;prominent.&#x20;This&#x20;increases&#x20;the&#x20;likelihood&#x20;that&#x20;users&#x20;who&#x20;become&#x20;accustomed&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;will&#x20;recognize&#x20;a&#x20;spoofed&#x20;elevation&#x20;prompt&#x20;dialog&#x20;box&#x20;and&#x20;not&#x20;fall&#x20;for&#x20;the&#x20;trick.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation','[{\"cis\": [\"2.3.17.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15574,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;application&#x20;write&#x20;failures&#x20;are&#x20;redirected&#x20;to&#x20;defined&#x20;registry&#x20;and&#x20;file&#x20;system&#x20;locations.&#x20;This&#x20;policy&#x20;setting&#x20;mitigates&#x20;applications&#x20;that&#x20;run&#x20;as&#x20;administrator&#x20;and&#x20;write&#x20;run-time&#x20;application&#x20;data&#x20;to:&#x20;-&#x20;%ProgramFiles%&#x20;-&#x20;%windir%&#x20;-&#x20;%windir%System32&#x20;-&#x20;HKEY_LOCAL_MACHINESOFTWARE.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;reduces&#x20;vulnerabilities&#x20;by&#x20;ensuring&#x20;that&#x20;legacy&#x20;applications&#x20;only&#x20;write&#x20;data&#x20;to&#x20;permitted&#x20;locations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations','[{\"cis\": [\"2.3.17.8\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15575,'Ensure&#x20;&#039;Bluetooth&#x20;Audio&#x20;Gateway&#x20;Service&#x20;&#40;BTAGService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Service&#x20;supporting&#x20;the&#x20;audio&#x20;gateway&#x20;role&#x20;of&#x20;the&#x20;Bluetooth&#x20;Handsfree&#x20;Profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Bluetooth&#x20;technology&#x20;has&#x20;inherent&#x20;security&#x20;risks&#x20;-&#x20;especially&#x20;prior&#x20;to&#x20;the&#x20;v2.1&#x20;standard.&#x20;Wireless&#x20;Bluetooth&#x20;traffic&#x20;is&#x20;not&#x20;well&#x20;encrypted&#x20;&#40;if&#x20;at&#x20;all&#41;,&#x20;so&#x20;in&#x20;a&#x20;high-security&#x20;environment,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;permitted,&#x20;in&#x20;spite&#x20;of&#x20;the&#x20;added&#x20;inconvenience&#x20;of&#x20;not&#x20;being&#x20;able&#x20;to&#x20;use&#x20;Bluetooth&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesBluetooth&#x20;Audio&#x20;Gateway&#x20;Service.&#x20;Note:&#x20;This&#x20;service&#x20;was&#x20;first&#x20;introduced&#x20;in&#x20;Windows&#x20;10&#x20;Release&#x20;1803.&#x20;It&#x20;appears&#x20;to&#x20;have&#x20;replaced&#x20;the&#x20;older&#x20;Bluetooth&#x20;Handsfree&#x20;Service&#x20;&#40;BthHFSrv&#41;,&#x20;which&#x20;was&#x20;removed&#x20;from&#x20;Windows&#x20;in&#x20;that&#x20;release&#x20;&#40;it&#x20;is&#x20;not&#x20;simply&#x20;a&#x20;rename,&#x20;but&#x20;a&#x20;different&#x20;service&#41;.','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15576,'Ensure&#x20;&#039;Bluetooth&#x20;Support&#x20;Service&#x20;&#40;bthserv&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','The&#x20;Bluetooth&#x20;service&#x20;supports&#x20;discovery&#x20;and&#x20;association&#x20;of&#x20;remote&#x20;Bluetooth&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Bluetooth&#x20;technology&#x20;has&#x20;inherent&#x20;security&#x20;risks&#x20;-&#x20;especially&#x20;prior&#x20;to&#x20;the&#x20;v2.1&#x20;standard.&#x20;Wireless&#x20;Bluetooth&#x20;traffic&#x20;is&#x20;not&#x20;well&#x20;encrypted&#x20;&#40;if&#x20;at&#x20;all&#41;,&#x20;so&#x20;in&#x20;a&#x20;high-security&#x20;environment,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;permitted,&#x20;in&#x20;spite&#x20;of&#x20;the&#x20;added&#x20;inconvenience&#x20;of&#x20;not&#x20;being&#x20;able&#x20;to&#x20;use&#x20;Bluetooth&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesBluetooth&#x20;Support&#x20;Service','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15577,'Ensure&#x20;&#039;Downloaded&#x20;Maps&#x20;Manager&#x20;&#40;MapsBroker&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Windows&#x20;service&#x20;for&#x20;application&#x20;access&#x20;to&#x20;downloaded&#x20;maps.&#x20;This&#x20;service&#x20;is&#x20;started&#x20;on-demand&#x20;by&#x20;application&#x20;accessing&#x20;downloaded&#x20;maps.','Mapping&#x20;technologies&#x20;can&#x20;unwillingly&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;attackers&#x20;and&#x20;other&#x20;software&#x20;that&#x20;picks&#x20;up&#x20;the&#x20;information.&#x20;In&#x20;addition,&#x20;automatic&#x20;downloads&#x20;of&#x20;data&#x20;from&#x20;3rd-party&#x20;sources&#x20;should&#x20;be&#x20;minimized&#x20;when&#x20;not&#x20;needed.&#x20;Therefore&#x20;this&#x20;service&#x20;should&#x20;not&#x20;be&#x20;needed&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesDownloaded&#x20;Maps&#x20;Manager','[{\"cis\": [\"5.4\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15578,'Ensure&#x20;&#039;Geolocation&#x20;Service&#x20;&#40;lfsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;monitors&#x20;the&#x20;current&#x20;location&#x20;of&#x20;the&#x20;system&#x20;and&#x20;manages&#x20;geofences&#x20;&#40;a&#x20;geographical&#x20;location&#x20;with&#x20;associated&#x20;events&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&rsquo;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesGeolocation&#x20;Service','[{\"cis\": [\"5.5\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15579,'Ensure&#x20;&#039;IIS&#x20;Admin&#x20;Service&#x20;&#40;IISADMIN&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Enables&#x20;the&#x20;server&#x20;to&#x20;administer&#x20;the&#x20;IIS&#x20;metabase.&#x20;The&#x20;IIS&#x20;metabase&#x20;stores&#x20;configuration&#x20;for&#x20;the&#x20;SMTP&#x20;and&#x20;FTP&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#41;.&#x20;Note&#x20;#2:&#x20;An&#x20;organization&#x20;may&#x20;choose&#x20;to&#x20;selectively&#x20;grant&#x20;exceptions&#x20;to&#x20;web&#x20;developers&#x20;to&#x20;allow&#x20;IIS&#x20;&#40;or&#x20;another&#x20;web&#x20;server&#41;&#x20;on&#x20;their&#x20;workstation,&#x20;in&#x20;order&#x20;for&#x20;them&#x20;to&#x20;locally&#x20;test&#x20;&amp;&#x20;develop&#x20;web&#x20;pages.&#x20;However,&#x20;the&#x20;organization&#x20;should&#x20;track&#x20;those&#x20;machines&#x20;and&#x20;ensure&#x20;the&#x20;security&#x20;controls&#x20;and&#x20;mitigations&#x20;are&#x20;kept&#x20;up&#x20;to&#x20;date,&#x20;to&#x20;reduce&#x20;risk&#x20;of&#x20;compromise.','Hosting&#x20;a&#x20;website&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;If&#x20;proper&#x20;security&#x20;mitigations&#x20;are&#x20;not&#x20;followed,&#x20;the&#x20;chance&#x20;of&#x20;successful&#x20;attack&#x20;increases&#x20;significantly.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;web&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;IIS.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesIIS&#x20;Admin&#x20;Service','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15580,'Ensure&#x20;&#039;Infrared&#x20;monitor&#x20;service&#x20;&#40;irmon&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Detects&#x20;other&#x20;Infrared&#x20;devices&#x20;that&#x20;are&#x20;in&#x20;range&#x20;and&#x20;launches&#x20;the&#x20;file&#x20;transfer&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.','Infrared&#x20;connections&#x20;can&#x20;potentially&#x20;be&#x20;a&#x20;source&#x20;of&#x20;data&#x20;compromise&#x20;-&#x20;especially&#x20;via&#x20;the&#x20;automatic&#x20;&#039;file&#x20;transfer&#x20;application&#039;&#x20;functionality.&#x20;Enterprise-managed&#x20;systems&#x20;should&#x20;utilize&#x20;a&#x20;more&#x20;secure&#x20;method&#x20;of&#x20;connection&#x20;than&#x20;infrared.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesInfrared&#x20;monitor&#x20;service','[{\"cis\": [\"5.7\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15581,'Ensure&#x20;&#039;Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;&#40;SharedAccess&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;network&#x20;access&#x20;translation,&#x20;addressing,&#x20;name&#x20;resolution&#x20;and/or&#x20;intrusion&#x20;prevention&#x20;services&#x20;for&#x20;a&#x20;home&#x20;or&#x20;small&#x20;office&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;is&#x20;a&#x20;feature&#x20;that&#x20;allows&#x20;someone&#x20;to&#x20;&#039;share&#039;&#x20;their&#x20;Internet&#x20;connection&#x20;with&#x20;other&#x20;machines&#x20;on&#x20;the&#x20;network&#x20;-&#x20;it&#x20;was&#x20;designed&#x20;for&#x20;home&#x20;or&#x20;small&#x20;office&#x20;environments&#x20;where&#x20;only&#x20;one&#x20;machine&#x20;has&#x20;Internet&#x20;access&#x20;-&#x20;it&#x20;effectively&#x20;turns&#x20;that&#x20;machine&#x20;into&#x20;an&#x20;Internet&#x20;router.&#x20;This&#x20;feature&#x20;causes&#x20;the&#x20;bridging&#x20;of&#x20;networks&#x20;and&#x20;likely&#x20;bypassing&#x20;other,&#x20;more&#x20;secure&#x20;pathways.&#x20;It&#x20;should&#x20;not&#x20;be&#x20;used&#x20;on&#x20;any&#x20;enterprise-managed&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesInternet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;','[{\"cis\": [\"5.8\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15582,'Ensure&#x20;&#039;Link-Layer&#x20;Topology&#x20;Discovery&#x20;Mapper&#x20;&#40;lltdsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Creates&#x20;a&#x20;Network&#x20;Map,&#x20;consisting&#x20;of&#x20;PC&#x20;and&#x20;device&#x20;topology&#x20;&#40;connectivity&#41;&#x20;information,&#x20;and&#x20;metadata&#x20;describing&#x20;each&#x20;PC&#x20;and&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;feature&#x20;that&#x20;this&#x20;service&#x20;enables&#x20;could&#x20;potentially&#x20;be&#x20;used&#x20;for&#x20;unauthorized&#x20;discovery&#x20;and&#x20;connection&#x20;to&#x20;network&#x20;devices.&#x20;Disabling&#x20;the&#x20;service&#x20;helps&#x20;to&#x20;prevent&#x20;responses&#x20;to&#x20;requests&#x20;for&#x20;network&#x20;topology&#x20;discovery&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesLink-Layer&#x20;Topology&#x20;Discovery&#x20;Mapper','[{\"cis\": [\"5.9\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15583,'Ensure&#x20;&#039;LxssManager&#x20;&#40;LxssManager&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','The&#x20;LXSS&#x20;Manager&#x20;service&#x20;supports&#x20;running&#x20;native&#x20;ELF&#x20;binaries.&#x20;The&#x20;service&#x20;provides&#x20;the&#x20;infrastructure&#x20;necessary&#x20;for&#x20;ELF&#x20;binaries&#x20;to&#x20;run&#x20;on&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Windows&#x20;Subsystem&#x20;for&#x20;Linux&#41;.','The&#x20;Linux&#x20;Subsystem&#x20;&#40;LXSS&#41;&#x20;Manager&#x20;allows&#x20;full&#x20;system&#x20;access&#x20;to&#x20;Linux&#x20;applications&#x20;on&#x20;Windows,&#x20;including&#x20;the&#x20;file&#x20;system.&#x20;While&#x20;this&#x20;can&#x20;certainly&#x20;have&#x20;some&#x20;functionality&#x20;and&#x20;performance&#x20;benefits&#x20;for&#x20;running&#x20;those&#x20;applications,&#x20;it&#x20;also&#x20;creates&#x20;new&#x20;security&#x20;risks&#x20;in&#x20;the&#x20;event&#x20;that&#x20;a&#x20;hacker&#x20;injects&#x20;malicious&#x20;code&#x20;into&#x20;a&#x20;Linux&#x20;application.&#x20;For&#x20;best&#x20;security,&#x20;it&#x20;is&#x20;preferred&#x20;to&#x20;run&#x20;Linux&#x20;applications&#x20;on&#x20;Linux,&#x20;and&#x20;Windows&#x20;applications&#x20;on&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesLxssManager','[{\"cis\": [\"5.10\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15584,'Ensure&#x20;&#039;Microsoft&#x20;FTP&#x20;Service&#x20;&#40;FTPSVC&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Enables&#x20;the&#x20;server&#x20;to&#x20;be&#x20;a&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#x20;-&#x20;FTP&#x20;Server&#41;.','Hosting&#x20;an&#x20;FTP&#x20;server&#x20;&#40;especially&#x20;a&#x20;non-secure&#x20;FTP&#x20;server&#41;&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;FTP&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;IIS.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesMicrosoft&#x20;FTP&#x20;Service','[{\"cis\": [\"5.11\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15585,'Ensure&#x20;&#039;Microsoft&#x20;iSCSI&#x20;Initiator&#x20;Service&#x20;&#40;MSiSCSI&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Manages&#x20;Internet&#x20;SCSI&#x20;&#40;iSCSI&#41;&#x20;sessions&#x20;from&#x20;this&#x20;computer&#x20;to&#x20;remote&#x20;target&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;service&#x20;is&#x20;critically&#x20;necessary&#x20;in&#x20;order&#x20;to&#x20;directly&#x20;attach&#x20;to&#x20;an&#x20;iSCSI&#x20;device.&#x20;However,&#x20;iSCSI&#x20;itself&#x20;uses&#x20;a&#x20;very&#x20;weak&#x20;authentication&#x20;protocol&#x20;&#40;CHAP&#41;,&#x20;which&#x20;means&#x20;that&#x20;the&#x20;passwords&#x20;for&#x20;iSCSI&#x20;communication&#x20;are&#x20;easily&#x20;exposed,&#x20;unless&#x20;all&#x20;of&#x20;the&#x20;traffic&#x20;is&#x20;isolated&#x20;and/or&#x20;encrypted&#x20;using&#x20;another&#x20;technology&#x20;like&#x20;IPsec.&#x20;This&#x20;service&#x20;is&#x20;generally&#x20;more&#x20;appropriate&#x20;for&#x20;servers&#x20;in&#x20;a&#x20;controlled&#x20;environment&#x20;then&#x20;on&#x20;workstations&#x20;requiring&#x20;high&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesMicrosoft&#x20;iSCSI&#x20;Initiator&#x20;Service','[{\"cis\": [\"5.12\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15586,'Ensure&#x20;&#039;OpenSSH&#x20;SSH&#x20;Server&#x20;&#40;sshd&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','SSH&#x20;protocol&#x20;based&#x20;service&#x20;to&#x20;provide&#x20;secure&#x20;encrypted&#x20;communications&#x20;between&#x20;two&#x20;untrusted&#x20;hosts&#x20;over&#x20;an&#x20;insecure&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;it&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;OpenSSH&#x20;Server&#41;.','Hosting&#x20;an&#x20;SSH&#x20;server&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;SSH&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;the&#x20;one&#x20;supplied&#x20;with&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesOpenSSH&#x20;SSH&#x20;Server','[{\"cis\": [\"5.13\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15587,'Ensure&#x20;&#039;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRPsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Enables&#x20;serverless&#x20;peer&#x20;name&#x20;resolution&#x20;over&#x20;the&#x20;Internet&#x20;using&#x20;the&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPeer&#x20;Name&#x20;Resolution&#x20;Protocol','[{\"cis\": [\"5.14\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15588,'Ensure&#x20;&#039;Peer&#x20;Networking&#x20;Grouping&#x20;&#40;p2psvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Enables&#x20;multi-party&#x20;communication&#x20;using&#x20;Peer-to-Peer&#x20;Grouping.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPeer&#x20;Networking&#x20;Grouping','[{\"cis\": [\"5.15\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15589,'Ensure&#x20;&#039;Peer&#x20;Networking&#x20;Identity&#x20;Manager&#x20;&#40;p2pimsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;identity&#x20;services&#x20;for&#x20;the&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;and&#x20;Peer-to-Peer&#x20;Grouping&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPeer&#x20;Networking&#x20;Identity&#x20;Manager','[{\"cis\": [\"5.16\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15590,'Ensure&#x20;&#039;PNRP&#x20;Machine&#x20;Name&#x20;Publication&#x20;Service&#x20;&#40;PNRPAutoReg&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;publishes&#x20;a&#x20;machine&#x20;name&#x20;using&#x20;the&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol.&#x20;Configuration&#x20;is&#x20;managed&#x20;via&#x20;the&#x20;netsh&#x20;context&#x20;&lsquo;p2p&#x20;pnrp&#x20;peer&rsquo;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPNRP&#x20;Machine&#x20;Name&#x20;Publication&#x20;Service','[{\"cis\": [\"5.17\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15591,'Ensure&#x20;&#039;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;spools&#x20;print&#x20;jobs&#x20;and&#x20;handles&#x20;interaction&#x20;with&#x20;printers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;unnecessary&#x20;services&#x20;especially&#x20;those&#x20;with&#x20;known&#x20;vulnerabilities&#x20;should&#x20;be&#x20;disabled.&#x20;Disabling&#x20;the&#x20;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#x20;service&#x20;mitigates&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;attacks&#x20;against&#x20;the&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPrint&#x20;Spooler','[{\"cis\": [\"5.18\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15592,'Ensure&#x20;&#039;Problem&#x20;Reports&#x20;and&#x20;Solutions&#x20;Control&#x20;Panel&#x20;Support&#x20;&#40;wercplsupport&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;provides&#x20;support&#x20;for&#x20;viewing,&#x20;sending&#x20;and&#x20;deletion&#x20;of&#x20;system-level&#x20;problem&#x20;reports&#x20;for&#x20;the&#x20;Problem&#x20;Reports&#x20;and&#x20;Solutions&#x20;control&#x20;panel.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;service&#x20;is&#x20;involved&#x20;in&#x20;the&#x20;process&#x20;of&#x20;displaying/reporting&#x20;issues&#x20;&amp;&#x20;solutions&#x20;to/from&#x20;Microsoft.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;for&#x20;sensitive&#x20;corporate&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesProblem&#x20;Reports&#x20;and&#x20;Solutions&#x20;Control&#x20;Panel&#x20;Support','[{\"cis\": [\"5.19\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15593,'Ensure&#x20;&#039;Remote&#x20;Access&#x20;Auto&#x20;Connection&#x20;Manager&#x20;&#40;RasAuto&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Creates&#x20;a&#x20;connection&#x20;to&#x20;a&#x20;remote&#x20;network&#x20;whenever&#x20;a&#x20;program&#x20;references&#x20;a&#x20;remote&#x20;DNS&#x20;or&#x20;NetBIOS&#x20;name&#x20;or&#x20;address.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;function&#x20;of&#x20;this&#x20;service&#x20;is&#x20;to&#x20;provide&#x20;a&#x20;&#039;demand&#x20;dial&#039;&#x20;type&#x20;of&#x20;functionality.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;preferred&#x20;that&#x20;any&#x20;remote&#x20;&#039;dial&#039;&#x20;connections&#x20;&#40;whether&#x20;they&#x20;be&#x20;legacy&#x20;dial-in&#x20;POTS&#x20;or&#x20;VPN&#41;&#x20;are&#x20;initiated&#x20;by&#x20;the&#x20;user,&#x20;not&#x20;automatically&#x20;by&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Access&#x20;Auto&#x20;Connection&#x20;Manager','[{\"cis\": [\"5.20\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15594,'Ensure&#x20;&#039;Remote&#x20;Desktop&#x20;Configuration&#x20;&#40;SessionEnv&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Remote&#x20;Desktop&#x20;Configuration&#x20;service&#x20;&#40;RDCS&#41;&#x20;is&#x20;responsible&#x20;for&#x20;all&#x20;Remote&#x20;Desktop&#x20;related&#x20;configuration&#x20;and&#x20;session&#x20;maintenance&#x20;activities&#x20;that&#x20;require&#x20;SYSTEM&#x20;context.&#x20;These&#x20;include&#x20;per-session&#x20;temporary&#x20;folders,&#x20;RD&#x20;themes,&#x20;and&#x20;RD&#x20;certificates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;Remote&#x20;Desktop&#x20;access&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk.&#x20;For&#x20;these&#x20;environments,&#x20;only&#x20;local&#x20;console&#x20;access&#x20;should&#x20;be&#x20;permitted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Desktop&#x20;Configuration','[{\"cis\": [\"5.21\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15595,'Ensure&#x20;&#039;Remote&#x20;Desktop&#x20;Services&#x20;&#40;TermService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;users&#x20;to&#x20;connect&#x20;interactively&#x20;to&#x20;a&#x20;remote&#x20;computer.&#x20;Remote&#x20;Desktop&#x20;and&#x20;Remote&#x20;Desktop&#x20;Session&#x20;Host&#x20;Server&#x20;depend&#x20;on&#x20;this&#x20;service.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;Remote&#x20;Desktop&#x20;access&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk.&#x20;For&#x20;these&#x20;environments,&#x20;only&#x20;local&#x20;console&#x20;access&#x20;should&#x20;be&#x20;permitted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Desktop&#x20;Services','[{\"cis\": [\"5.22\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15596,'Ensure&#x20;&#039;Remote&#x20;Desktop&#x20;Services&#x20;UserMode&#x20;Port&#x20;Redirector&#x20;&#40;UmRdpService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;the&#x20;redirection&#x20;of&#x20;Printers/Drives/Ports&#x20;for&#x20;RDP&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface&#x20;-&#x20;preventing&#x20;the&#x20;redirection&#x20;of&#x20;COM,&#x20;LPT&#x20;and&#x20;PnP&#x20;ports&#x20;will&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer&#x20;within&#x20;an&#x20;RDP&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Desktop&#x20;Services&#x20;UserMode&#x20;Port&#x20;Redirector','[{\"cis\": [\"5.23\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15597,'Ensure&#x20;&#039;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;Locator&#x20;&#40;RpcLocator&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','In&#x20;Windows&#x20;2003&#x20;and&#x20;older&#x20;versions&#x20;of&#x20;Windows,&#x20;the&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;Locator&#x20;service&#x20;manages&#x20;the&#x20;RPC&#x20;name&#x20;service&#x20;database.&#x20;In&#x20;Windows&#x20;Vista&#x20;and&#x20;newer&#x20;versions&#x20;of&#x20;Windows,&#x20;this&#x20;service&#x20;does&#x20;not&#x20;provide&#x20;any&#x20;functionality&#x20;and&#x20;is&#x20;present&#x20;for&#x20;application&#x20;compatibility.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;is&#x20;a&#x20;legacy&#x20;service&#x20;that&#x20;has&#x20;no&#x20;value&#x20;or&#x20;purpose&#x20;other&#x20;than&#x20;application&#x20;compatibility&#x20;for&#x20;very&#x20;old&#x20;software.&#x20;It&#x20;should&#x20;be&#x20;disabled&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;old&#x20;application&#x20;still&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;that&#x20;requires&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;Locator','[{\"cis\": [\"5.24\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15598,'Ensure&#x20;&#039;Remote&#x20;Registry&#x20;&#40;RemoteRegistry&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Enables&#x20;remote&#x20;users&#x20;to&#x20;view&#x20;and&#x20;modify&#x20;registry&#x20;settings&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;exposing&#x20;the&#x20;registry&#x20;to&#x20;remote&#x20;access&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Registry','[{\"cis\": [\"5.25\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15599,'Ensure&#x20;&#039;Routing&#x20;and&#x20;Remote&#x20;Access&#x20;&#40;RemoteAccess&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Offers&#x20;routing&#x20;services&#x20;to&#x20;businesses&#x20;in&#x20;local&#x20;area&#x20;and&#x20;wide&#x20;area&#x20;network&#x20;environments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;service&#039;s&#x20;main&#x20;purpose&#x20;is&#x20;to&#x20;provide&#x20;Windows&#x20;router&#x20;functionality&#x20;-&#x20;this&#x20;is&#x20;not&#x20;an&#x20;appropriate&#x20;use&#x20;of&#x20;workstations&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRouting&#x20;and&#x20;Remote&#x20;Access','[{\"cis\": [\"5.26\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15600,'Ensure&#x20;&#039;Server&#x20;&#40;LanmanServer&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Supports&#x20;file,&#x20;print,&#x20;and&#x20;named-pipe&#x20;sharing&#x20;over&#x20;the&#x20;network&#x20;for&#x20;this&#x20;computer.&#x20;If&#x20;this&#x20;service&#x20;is&#x20;stopped,&#x20;these&#x20;functions&#x20;will&#x20;be&#x20;unavailable.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;a&#x20;secure&#x20;workstation&#x20;should&#x20;only&#x20;be&#x20;a&#x20;client,&#x20;not&#x20;a&#x20;server.&#x20;Sharing&#x20;workstation&#x20;resources&#x20;for&#x20;remote&#x20;access&#x20;increases&#x20;security&#x20;risk&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;is&#x20;notably&#x20;higher.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesServer','[{\"cis\": [\"5.27\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15601,'Ensure&#x20;&#039;Simple&#x20;TCP/IP&#x20;Services&#x20;&#40;simptcp&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Supports&#x20;the&#x20;following&#x20;TCP/IP&#x20;services:&#x20;Character&#x20;Generator,&#x20;Daytime,&#x20;Discard,&#x20;Echo,&#x20;and&#x20;Quote&#x20;of&#x20;the&#x20;Day.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Simple&#x20;TCPIP&#x20;services&#x20;&#40;i.e.&#x20;echo,&#x20;daytime&#x20;etc&#41;&#41;.','The&#x20;Simple&#x20;TCP/IP&#x20;Services&#x20;have&#x20;very&#x20;little&#x20;purpose&#x20;in&#x20;a&#x20;modern&#x20;enterprise&#x20;environment&#x20;-&#x20;allowing&#x20;them&#x20;might&#x20;increase&#x20;exposure&#x20;and&#x20;risk&#x20;for&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSimple&#x20;TCP/IP&#x20;Services','[{\"cis\": [\"5.28\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15602,'Ensure&#x20;&#039;SNMP&#x20;Service&#x20;&#40;SNMP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Enables&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;requests&#x20;to&#x20;be&#x20;processed&#x20;by&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#41;.','Features&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;increase&#x20;the&#x20;attack&#x20;surface.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;management&#x20;of&#x20;secure&#x20;workstations&#x20;should&#x20;be&#x20;handled&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSNMP&#x20;Service','[{\"cis\": [\"5.29\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15603,'Ensure&#x20;&#039;Special&#x20;Administration&#x20;Console&#x20;Helper&#x20;&#40;sacsvr&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','This&#x20;service&#x20;allows&#x20;administrators&#x20;to&#x20;remotely&#x20;access&#x20;a&#x20;command&#x20;prompt&#x20;using&#x20;Emergency&#x20;Management&#x20;Services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;it&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;capability&#x20;&#40;Windows&#x20;Emergency&#x20;Management&#x20;Services&#x20;and&#x20;Serial&#x20;Console&#41;.','Allowing&#x20;the&#x20;use&#x20;of&#x20;a&#x20;remotely&#x20;accessible&#x20;command&#x20;prompt&#x20;that&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;perform&#x20;remote&#x20;management&#x20;tasks&#x20;on&#x20;a&#x20;computer&#x20;is&#x20;a&#x20;security&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSpecial&#x20;Administration&#x20;Console&#x20;Helper','[{\"cis\": [\"5.30\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15604,'Ensure&#x20;&#039;SSDP&#x20;Discovery&#x20;&#40;SSDPSRV&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Discovers&#x20;networked&#x20;devices&#x20;and&#x20;services&#x20;that&#x20;use&#x20;the&#x20;SSDP&#x20;discovery&#x20;protocol,&#x20;such&#x20;as&#x20;UPnP&#x20;devices.&#x20;Also&#x20;announces&#x20;SSDP&#x20;devices&#x20;and&#x20;services&#x20;running&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Universal&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;UPnP&#41;&#x20;is&#x20;a&#x20;real&#x20;security&#x20;risk&#x20;-&#x20;it&#x20;allows&#x20;automatic&#x20;discovery&#x20;and&#x20;attachment&#x20;to&#x20;network&#x20;devices.&#x20;Note&#x20;that&#x20;UPnP&#x20;is&#x20;different&#x20;than&#x20;regular&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;PnP&#41;.&#x20;Workstations&#x20;should&#x20;not&#x20;be&#x20;advertising&#x20;their&#x20;services&#x20;&#40;or&#x20;automatically&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;networked&#x20;services&#41;&#x20;in&#x20;a&#x20;security-conscious&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSSDP&#x20;Discovery','[{\"cis\": [\"5.31\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15605,'Ensure&#x20;&#039;UPnP&#x20;Device&#x20;Host&#x20;&#40;upnphost&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;UPnP&#x20;devices&#x20;to&#x20;be&#x20;hosted&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Universal&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;UPnP&#41;&#x20;is&#x20;a&#x20;real&#x20;security&#x20;risk&#x20;-&#x20;it&#x20;allows&#x20;automatic&#x20;discovery&#x20;and&#x20;attachment&#x20;to&#x20;network&#x20;devices.&#x20;Notes&#x20;that&#x20;UPnP&#x20;is&#x20;different&#x20;than&#x20;regular&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;PnP&#41;.&#x20;Workstations&#x20;should&#x20;not&#x20;be&#x20;advertising&#x20;their&#x20;services&#x20;&#40;or&#x20;automatically&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;networked&#x20;services&#41;&#x20;in&#x20;a&#x20;security-conscious&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesUPnP&#x20;Device&#x20;Host','[{\"cis\": [\"5.32\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15606,'Ensure&#x20;&#039;Web&#x20;Management&#x20;Service&#x20;&#40;WMSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','The&#x20;Web&#x20;Management&#x20;Service&#x20;enables&#x20;remote&#x20;and&#x20;delegated&#x20;management&#x20;capabilities&#x20;for&#x20;administrators&#x20;to&#x20;manage&#x20;for&#x20;the&#x20;Web&#x20;server,&#x20;sites&#x20;and&#x20;applications&#x20;present&#x20;on&#x20;the&#x20;machine.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#x20;-&#x20;Web&#x20;Management&#x20;Tools&#x20;-&#x20;IIS&#x20;Management&#x20;Service&#41;.','Remote&#x20;web&#x20;administration&#x20;of&#x20;IIS&#x20;on&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;If&#x20;proper&#x20;security&#x20;mitigations&#x20;are&#x20;not&#x20;followed,&#x20;the&#x20;chance&#x20;of&#x20;successful&#x20;attack&#x20;increases&#x20;significantly.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWeb&#x20;Management&#x20;Service','[{\"cis\": [\"5.33\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15607,'Ensure&#x20;&#039;Windows&#x20;Error&#x20;Reporting&#x20;Service&#x20;&#40;WerSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;errors&#x20;to&#x20;be&#x20;reported&#x20;when&#x20;programs&#x20;stop&#x20;working&#x20;or&#x20;responding&#x20;and&#x20;allows&#x20;existing&#x20;solutions&#x20;to&#x20;be&#x20;delivered.&#x20;Also&#x20;allows&#x20;logs&#x20;to&#x20;be&#x20;generated&#x20;for&#x20;diagnostic&#x20;and&#x20;repair&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Error&#x20;Reporting&#x20;Service','[{\"cis\": [\"5.34\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15608,'Ensure&#x20;&#039;Windows&#x20;Event&#x20;Collector&#x20;&#40;Wecsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;manages&#x20;persistent&#x20;subscriptions&#x20;to&#x20;events&#x20;from&#x20;remote&#x20;sources&#x20;that&#x20;support&#x20;WS-Management&#x20;protocol.&#x20;This&#x20;includes&#x20;Windows&#x20;Vista&#x20;event&#x20;logs,&#x20;hardware&#x20;and&#x20;IPMI-enabled&#x20;event&#x20;sources.&#x20;The&#x20;service&#x20;stores&#x20;forwarded&#x20;events&#x20;in&#x20;a&#x20;local&#x20;Event&#x20;Log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;remote&#x20;connections&#x20;to&#x20;secure&#x20;workstations&#x20;should&#x20;be&#x20;minimized,&#x20;and&#x20;management&#x20;functions&#x20;should&#x20;be&#x20;done&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Event&#x20;Collector','[{\"cis\": [\"5.35\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15609,'Ensure&#x20;&#039;Windows&#x20;Media&#x20;Player&#x20;Network&#x20;Sharing&#x20;Service&#x20;&#40;WMPNetworkSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Shares&#x20;Windows&#x20;Media&#x20;Player&#x20;libraries&#x20;to&#x20;other&#x20;networked&#x20;players&#x20;and&#x20;media&#x20;devices&#x20;using&#x20;Universal&#x20;Plug&#x20;and&#x20;Play.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.','Network&#x20;sharing&#x20;of&#x20;media&#x20;from&#x20;Media&#x20;Player&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Media&#x20;Player&#x20;Network&#x20;Sharing&#x20;Service','[{\"cis\": [\"5.36\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15610,'Ensure&#x20;&#039;Windows&#x20;Mobile&#x20;Hotspot&#x20;Service&#x20;&#40;icssvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;the&#x20;ability&#x20;to&#x20;share&#x20;a&#x20;cellular&#x20;data&#x20;connection&#x20;with&#x20;another&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;capability&#x20;to&#x20;run&#x20;a&#x20;mobile&#x20;hotspot&#x20;from&#x20;a&#x20;domain-connected&#x20;computer&#x20;could&#x20;easily&#x20;expose&#x20;the&#x20;internal&#x20;network&#x20;to&#x20;wardrivers&#x20;or&#x20;other&#x20;hackers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Mobile&#x20;Hotspot&#x20;Service','[{\"cis\": [\"5.37\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15611,'Ensure&#x20;&#039;Windows&#x20;Push&#x20;Notifications&#x20;System&#x20;Service&#x20;&#40;WpnService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;runs&#x20;in&#x20;session&#x20;0&#x20;and&#x20;hosts&#x20;the&#x20;notification&#x20;platform&#x20;and&#x20;connection&#x20;provider&#x20;which&#x20;handles&#x20;the&#x20;connection&#x20;between&#x20;the&#x20;device&#x20;and&#x20;WNS&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;the&#x20;first&#x20;two&#x20;releases&#x20;of&#x20;Windows&#x20;10&#x20;&#40;R1507&#x20;&amp;&#x20;R1511&#41;,&#x20;the&#x20;display&#x20;name&#x20;of&#x20;this&#x20;service&#x20;was&#x20;initially&#x20;named&#x20;Windows&#x20;Push&#x20;Notifications&#x20;Service&#x20;-&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Windows&#x20;Push&#x20;Notifications&#x20;System&#x20;Service&#x20;starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607.','Windows&#x20;Push&#x20;Notification&#x20;Services&#x20;&#40;WNS&#41;&#x20;is&#x20;a&#x20;mechanism&#x20;to&#x20;receive&#x20;3rd-party&#x20;notifications&#x20;and&#x20;updates&#x20;from&#x20;the&#x20;cloud/Internet.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;external&#x20;systems,&#x20;especially&#x20;those&#x20;hosted&#x20;outside&#x20;the&#x20;organization,&#x20;should&#x20;be&#x20;prevented&#x20;from&#x20;having&#x20;an&#x20;impact&#x20;on&#x20;the&#x20;secure&#x20;workstations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Push&#x20;Notifications&#x20;System&#x20;Service','[{\"cis\": [\"5.38\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15612,'Ensure&#x20;&#039;Windows&#x20;PushToInstall&#x20;Service&#x20;&#40;PushToInstall&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;manages&#x20;Apps&#x20;that&#x20;are&#x20;pushed&#x20;to&#x20;the&#x20;device&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;App&#x20;running&#x20;on&#x20;other&#x20;devices&#x20;or&#x20;the&#x20;web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;PushToInstall&#x20;Service&#x20;&#40;PushToInstall&#41;','[{\"cis\": [\"5.39\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15613,'Ensure&#x20;&#039;Windows&#x20;Remote&#x20;Management&#x20;&#40;WS-Management&#41;&#x20;&#40;WinRM&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;implements&#x20;the&#x20;WS-Management&#x20;protocol&#x20;for&#x20;remote&#x20;management.&#x20;WS-Management&#x20;is&#x20;a&#x20;standard&#x20;web&#x20;services&#x20;protocol&#x20;used&#x20;for&#x20;remote&#x20;software&#x20;and&#x20;hardware&#x20;management.&#x20;The&#x20;WinRM&#x20;service&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;WS-Management&#x20;requests&#x20;and&#x20;processes&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Features&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;increase&#x20;the&#x20;attack&#x20;surface.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;management&#x20;of&#x20;secure&#x20;workstations&#x20;should&#x20;be&#x20;handled&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Remote&#x20;Management&#x20;&#40;WS-Management&#41;','[{\"cis\": [\"5.40\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15614,'Ensure&#x20;&#039;World&#x20;Wide&#x20;Web&#x20;Publishing&#x20;Service&#x20;&#40;W3SVC&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Provides&#x20;Web&#x20;connectivity&#x20;and&#x20;administration&#x20;through&#x20;the&#x20;Internet&#x20;Information&#x20;Services&#x20;Manager.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#x20;-&#x20;World&#x20;Wide&#x20;Web&#x20;Services&#41;.&#x20;Note&#x20;#2:&#x20;An&#x20;organization&#x20;may&#x20;choose&#x20;to&#x20;selectively&#x20;grant&#x20;exceptions&#x20;to&#x20;web&#x20;developers&#x20;to&#x20;allow&#x20;IIS&#x20;&#40;or&#x20;another&#x20;web&#x20;server&#41;&#x20;on&#x20;their&#x20;workstation,&#x20;in&#x20;order&#x20;for&#x20;them&#x20;to&#x20;locally&#x20;test&#x20;&amp;&#x20;develop&#x20;web&#x20;pages.&#x20;However,&#x20;the&#x20;organization&#x20;should&#x20;track&#x20;those&#x20;machines&#x20;and&#x20;ensure&#x20;the&#x20;security&#x20;controls&#x20;and&#x20;mitigations&#x20;are&#x20;kept&#x20;up&#x20;to&#x20;date,&#x20;to&#x20;reduce&#x20;risk&#x20;of&#x20;compromise.','Hosting&#x20;a&#x20;website&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;If&#x20;proper&#x20;security&#x20;mitigations&#x20;are&#x20;not&#x20;followed,&#x20;the&#x20;chance&#x20;of&#x20;successful&#x20;attack&#x20;increases&#x20;significantly.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;web&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;IIS.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWorld&#x20;Wide&#x20;Web&#x20;Publishing&#x20;Service','[{\"cis\": [\"5.41\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15615,'Ensure&#x20;&#039;Xbox&#x20;Accessory&#x20;Management&#x20;Service&#x20;&#40;XboxGipSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;manages&#x20;connected&#x20;Xbox&#x20;Accessories.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Accessory&#x20;Management&#x20;Service','[{\"cis\": [\"5.42\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15616,'Ensure&#x20;&#039;Xbox&#x20;Live&#x20;Auth&#x20;Manager&#x20;&#40;XblAuthManager&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;authentication&#x20;and&#x20;authorization&#x20;services&#x20;for&#x20;interacting&#x20;with&#x20;Xbox&#x20;Live.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Live&#x20;Auth&#x20;Manager','[{\"cis\": [\"5.43\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15617,'Ensure&#x20;&#039;Xbox&#x20;Live&#x20;Game&#x20;Save&#x20;&#40;XblGameSave&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;syncs&#x20;save&#x20;data&#x20;for&#x20;Xbox&#x20;Live&#x20;save&#x20;enabled&#x20;games.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Live&#x20;Game&#x20;Save','[{\"cis\": [\"5.44\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15618,'Ensure&#x20;&#039;Xbox&#x20;Live&#x20;Networking&#x20;Service&#x20;&#40;XboxNetApiSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;supports&#x20;the&#x20;Windows.Networking.XboxLive&#x20;application&#x20;programming&#x20;interface.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Live&#x20;Networking&#x20;Service','[{\"cis\": [\"5.45\"]}, {\"cis_csc\": [\"4.8\"]}]'),(15619,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.1.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15620,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.1.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15621,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.1.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15622,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.1.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15623,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewalldomainfw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewalldomainfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewalldomainfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.1.5\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15624,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.1.6\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15625,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.1.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15626,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.1.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15627,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.2.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15628,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.2.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15629,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.2.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15630,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.2.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15631,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewallprivatefw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewallprivatefw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewallprivatefw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.2.5\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15632,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.2.6\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15633,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.2.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15634,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.2.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15635,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.3.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15636,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15637,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.3.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15638,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;avoid&#x20;alarming&#x20;users&#x20;when&#x20;firewall&#x20;rules&#x20;block&#x20;certain&#x20;types&#x20;of&#x20;network&#x20;activity.&#x20;However,&#x20;notifications&#x20;can&#x20;be&#x20;helpful&#x20;when&#x20;troubleshooting&#x20;network&#x20;issues&#x20;involving&#x20;the&#x20;firewall.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;No&#039;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.3.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15639,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;local&#x20;firewall&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;firewall&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','When&#x20;in&#x20;the&#x20;Public&#x20;profile,&#x20;there&#x20;should&#x20;be&#x20;no&#x20;special&#x20;local&#x20;firewall&#x20;exceptions&#x20;per&#x20;computer.&#x20;These&#x20;settings&#x20;should&#x20;be&#x20;managed&#x20;by&#x20;a&#x20;centralized&#x20;policy.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;firewall&#x20;rules','[{\"cis\": [\"9.3.5\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15640,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;connection&#x20;security&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;connection&#x20;security&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;connection&#x20;security&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Users&#x20;with&#x20;administrative&#x20;privileges&#x20;might&#x20;create&#x20;firewall&#x20;rules&#x20;that&#x20;expose&#x20;the&#x20;system&#x20;to&#x20;remote&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;connection&#x20;security&#x20;rules','[{\"cis\": [\"9.3.6\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15641,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewallpublicfw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewallpublicfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewallpublicfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.3.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15642,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.3.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15643,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.3.9\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15644,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.3.10\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15645,'Ensure&#x20;&#039;Audit&#x20;Credential&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;results&#x20;of&#x20;validation&#x20;tests&#x20;on&#x20;credentials&#x20;submitted&#x20;for&#x20;a&#x20;user&#x20;account&#x20;logon&#x20;request.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;authoritative&#x20;for&#x20;the&#x20;credentials.&#x20;For&#x20;domain&#x20;accounts,&#x20;the&#x20;Domain&#x20;Controller&#x20;is&#x20;authoritative,&#x20;whereas&#x20;for&#x20;local&#x20;accounts,&#x20;the&#x20;local&#x20;computer&#x20;is&#x20;authoritative.&#x20;In&#x20;domain&#x20;environments,&#x20;most&#x20;of&#x20;the&#x20;Account&#x20;Logon&#x20;events&#x20;occur&#x20;in&#x20;the&#x20;Security&#x20;log&#x20;of&#x20;the&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;authoritative&#x20;for&#x20;the&#x20;domain&#x20;accounts.&#x20;However,&#x20;these&#x20;events&#x20;can&#x20;occur&#x20;on&#x20;other&#x20;computers&#x20;in&#x20;the&#x20;organization&#x20;when&#x20;local&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4774:&#x20;An&#x20;account&#x20;was&#x20;mapped&#x20;for&#x20;logon.&#x20;-&#x20;&#x20;4775:&#x20;An&#x20;account&#x20;could&#x20;not&#x20;be&#x20;mapped&#x20;for&#x20;logon.&#x20;-&#x20;4776:&#x20;The&#x20;Domain&#x20;Controller&#x20;attempted&#x20;to&#x20;validate&#x20;the&#x20;credentials&#x20;for&#x20;an&#x20;account.&#x20;-&#x20;4777:&#x20;The&#x20;Domain&#x20;Controller&#x20;failed&#x20;to&#x20;validate&#x20;the&#x20;credentials&#x20;for&#x20;an&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;LogonAudit&#x20;Credential&#x20;Validation','[{\"cis\": [\"17.1.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15646,'Ensure&#x20;&#039;Audit&#x20;Application&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;events&#x20;generated&#x20;by&#x20;changes&#x20;to&#x20;application&#x20;groups&#x20;such&#x20;as&#x20;the&#x20;following:&#x20;-&#x20;Application&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted.&#x20;-&#x20;Member&#x20;is&#x20;added&#x20;or&#x20;removed&#x20;from&#x20;an&#x20;application&#x20;group.&#x20;Application&#x20;groups&#x20;are&#x20;utilized&#x20;by&#x20;Windows&#x20;Authorization&#x20;Manager,&#x20;which&#x20;is&#x20;a&#x20;flexible&#x20;framework&#x20;created&#x20;by&#x20;Microsoft&#x20;for&#x20;integrating&#x20;role-based&#x20;access&#x20;control&#x20;&#40;RBAC&#41;&#x20;into&#x20;applications.&#x20;More&#x20;information&#x20;on&#x20;Windows&#x20;Authorization&#x20;Manager&#x20;is&#x20;available&#x20;at&#x20;MSDN&#x20;-&#x20;Windows&#x20;Authorization&#x20;Manager.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;events&#x20;in&#x20;this&#x20;category&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Application&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15647,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;security&#x20;group&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;security&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted&#x20;or&#x20;when&#x20;a&#x20;member&#x20;is&#x20;added&#x20;to&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;security&#x20;group.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;security&#x20;group&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4727:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;created.&#x20;-&#x20;4728:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;global&#x20;group.&#x20;-&#x20;4729:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;global&#x20;group.&#x20;-&#x20;4730:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;deleted.&#x20;-&#x20;4731:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;created.&#x20;-&#x20;4732:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;local&#x20;group.&#x20;-&#x20;4733:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;local&#x20;group.&#x20;-&#x20;4734:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;deleted.&#x20;-&#x20;4735:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;changed.&#x20;-&#x20;4737:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;changed.&#x20;-&#x20;4754:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;created.&#x20;-&#x20;4755:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;changed.&#x20;-&#x20;4756:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;universal&#x20;group.&#x20;-&#x20;4757:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;universal&#x20;group.&#x20;-&#x20;4758:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;deleted.&#x20;-&#x20;4764:&#x20;A&#x20;group&#039;s&#x20;type&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Security&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15648,'Ensure&#x20;&#039;Audit&#x20;User&#x20;Account&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;user&#x20;account&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;user&#x20;account&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted;&#x20;a&#x20;user&#x20;account&#x20;is&#x20;renamed,&#x20;disabled,&#x20;or&#x20;enabled;&#x20;or&#x20;a&#x20;password&#x20;is&#x20;set&#x20;or&#x20;changed.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;user&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4720:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;created.&#x20;-&#x20;4722:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;enabled.&#x20;-&#x20;4723:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;change&#x20;an&#x20;account&#039;s&#x20;password.&#x20;-&#x20;4724:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;reset&#x20;an&#x20;account&#039;s&#x20;password.&#x20;-&#x20;4725:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;disabled.&#x20;-&#x20;4726:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;deleted.&#x20;-&#x20;4738:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;changed.&#x20;-&#x20;4740:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;locked&#x20;out.&#x20;-&#x20;4765:&#x20;SID&#x20;History&#x20;was&#x20;added&#x20;to&#x20;an&#x20;account.&#x20;-&#x20;4766:&#x20;An&#x20;attempt&#x20;to&#x20;add&#x20;SID&#x20;History&#x20;to&#x20;an&#x20;account&#x20;failed.&#x20;-&#x20;4767:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;unlocked.&#x20;-&#x20;4780:&#x20;The&#x20;ACL&#x20;was&#x20;set&#x20;on&#x20;accounts&#x20;which&#x20;are&#x20;members&#x20;of&#x20;administrators&#x20;groups.&#x20;-&#x20;4781:&#x20;The&#x20;name&#x20;of&#x20;an&#x20;account&#x20;was&#x20;changed:&#x20;-&#x20;4794:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;set&#x20;the&#x20;Directory&#x20;Services&#x20;Restore&#x20;Mode.&#x20;-&#x20;5376:&#x20;Credential&#x20;Manager&#x20;credentials&#x20;were&#x20;backed&#x20;up.&#x20;-&#x20;5377:&#x20;Credential&#x20;Manager&#x20;credentials&#x20;were&#x20;restored&#x20;from&#x20;a&#x20;backup.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;User&#x20;Account&#x20;Management','[{\"cis\": [\"17.2.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15649,'Ensure&#x20;&#039;Audit&#x20;PNP&#x20;Activity&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;when&#x20;plug&#x20;and&#x20;play&#x20;detects&#x20;an&#x20;external&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.&#x20;Note:&#x20;A&#x20;Windows&#x20;10,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Enabling&#x20;this&#x20;setting&#x20;will&#x20;allow&#x20;a&#x20;user&#x20;to&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;device&#x20;is&#x20;plugged&#x20;into&#x20;a&#x20;system.&#x20;This&#x20;can&#x20;help&#x20;alert&#x20;IT&#x20;staff&#x20;if&#x20;unapproved&#x20;devices&#x20;are&#x20;plugged&#x20;in.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDetailed&#x20;TrackingAudit&#x20;PNP&#x20;Activity','[{\"cis\": [\"17.3.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15650,'Ensure&#x20;&#039;Audit&#x20;Process&#x20;Creation&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;process&#x20;and&#x20;the&#x20;name&#x20;of&#x20;the&#x20;program&#x20;or&#x20;user&#x20;that&#x20;created&#x20;it.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4688:&#x20;A&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;-&#x20;4696:&#x20;A&#x20;primary&#x20;token&#x20;was&#x20;assigned&#x20;to&#x20;process.&#x20;Refer&#x20;to&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;947226:&#x20;Description&#x20;of&#x20;security&#x20;events&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2008&#x20;for&#x20;the&#x20;most&#x20;recent&#x20;information&#x20;about&#x20;this&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDetailed&#x20;TrackingAudit&#x20;Process&#x20;Creation','[{\"cis\": [\"17.3.2\"]}, {\"cis_csc\": [\"8.5\"]}]');
INSERT INTO `tsca` VALUES (15651,'Ensure&#x20;&#039;Audit&#x20;Account&#x20;Lockout&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#039;s&#x20;account&#x20;is&#x20;locked&#x20;out&#x20;as&#x20;a&#x20;result&#x20;of&#x20;too&#x20;many&#x20;failed&#x20;logon&#x20;attempts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4625:&#x20;An&#x20;account&#x20;failed&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Account&#x20;Lockout','[{\"cis\": [\"17.5.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15652,'Ensure&#x20;&#039;Audit&#x20;Group&#x20;Membership&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;policy&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;the&#x20;group&#x20;membership&#x20;information&#x20;in&#x20;the&#x20;user&rsquo;s&#x20;logon&#x20;token.&#x20;Events&#x20;in&#x20;this&#x20;subcategory&#x20;are&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;on&#x20;which&#x20;a&#x20;logon&#x20;session&#x20;is&#x20;created.&#x20;For&#x20;an&#x20;interactive&#x20;logon,&#x20;the&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;the&#x20;user&#x20;logged&#x20;on&#x20;to.&#x20;For&#x20;a&#x20;network&#x20;logon,&#x20;such&#x20;as&#x20;accessing&#x20;a&#x20;shared&#x20;folder&#x20;on&#x20;the&#x20;network,&#x20;the&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;hosting&#x20;the&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.&#x20;Note:&#x20;A&#x20;Windows&#x20;10,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Group&#x20;Membership','[{\"cis\": [\"17.5.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15653,'Ensure&#x20;&#039;Audit&#x20;Logoff&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;the&#x20;system.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;accessed&#x20;computer.&#x20;For&#x20;interactive&#x20;logons,&#x20;the&#x20;generation&#x20;of&#x20;these&#x20;events&#x20;occurs&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;logged&#x20;on&#x20;to.&#x20;If&#x20;a&#x20;network&#x20;logon&#x20;takes&#x20;place&#x20;to&#x20;access&#x20;a&#x20;share,&#x20;these&#x20;events&#x20;generate&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;hosts&#x20;the&#x20;accessed&#x20;resource.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;No&#x20;auditing,&#x20;it&#x20;is&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;which&#x20;user&#x20;has&#x20;accessed&#x20;or&#x20;attempted&#x20;to&#x20;access&#x20;organization&#x20;computers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4634:&#x20;An&#x20;account&#x20;was&#x20;logged&#x20;off.&#x20;-&#x20;4647:&#x20;User&#x20;initiated&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Logoff','[{\"cis\": [\"17.5.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15654,'Ensure&#x20;&#039;Audit&#x20;Logon&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;system.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;accessed&#x20;computer.&#x20;For&#x20;interactive&#x20;logons,&#x20;the&#x20;generation&#x20;of&#x20;these&#x20;events&#x20;occurs&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;logged&#x20;on&#x20;to.&#x20;If&#x20;a&#x20;network&#x20;logon&#x20;takes&#x20;place&#x20;to&#x20;access&#x20;a&#x20;share,&#x20;these&#x20;events&#x20;generate&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;hosts&#x20;the&#x20;accessed&#x20;resource.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;No&#x20;auditing,&#x20;it&#x20;is&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;which&#x20;user&#x20;has&#x20;accessed&#x20;or&#x20;attempted&#x20;to&#x20;access&#x20;organization&#x20;computers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4624:&#x20;An&#x20;account&#x20;was&#x20;successfully&#x20;logged&#x20;on.&#x20;-&#x20;4625:&#x20;An&#x20;account&#x20;failed&#x20;to&#x20;log&#x20;on.&#x20;-&#x20;4648:&#x20;A&#x20;logon&#x20;was&#x20;attempted&#x20;using&#x20;explicit&#x20;credentials.&#x20;-&#x20;4675:&#x20;SIDs&#x20;were&#x20;filtered.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Logon','[{\"cis\": [\"17.5.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15655,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Logon/Logoff&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;other&#x20;logon/logoff-related&#x20;events,&#x20;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;disconnects&#x20;and&#x20;reconnects,&#x20;using&#x20;RunAs&#x20;to&#x20;run&#x20;processes&#x20;under&#x20;a&#x20;different&#x20;account,&#x20;and&#x20;locking&#x20;and&#x20;unlocking&#x20;a&#x20;workstation.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4649:&#x20;A&#x20;replay&#x20;attack&#x20;was&#x20;detected.&#x20;-&#x20;4778:&#x20;A&#x20;session&#x20;was&#x20;reconnected&#x20;to&#x20;a&#x20;Window&#x20;Station.&#x20;-&#x20;4779:&#x20;A&#x20;session&#x20;was&#x20;disconnected&#x20;from&#x20;a&#x20;Window&#x20;Station.&#x20;-&#x20;4800:&#x20;The&#x20;workstation&#x20;was&#x20;locked.&#x20;-&#x20;4801:&#x20;The&#x20;workstation&#x20;was&#x20;unlocked.&#x20;-&#x20;4802:&#x20;The&#x20;screen&#x20;saver&#x20;was&#x20;invoked.&#x20;-&#x20;4803:&#x20;The&#x20;screen&#x20;saver&#x20;was&#x20;dismissed.&#x20;-&#x20;5378:&#x20;The&#x20;requested&#x20;credentials&#x20;delegation&#x20;was&#x20;disallowed&#x20;by&#x20;policy.&#x20;-&#x20;5632:&#x20;A&#x20;request&#x20;was&#x20;made&#x20;to&#x20;authenticate&#x20;to&#x20;a&#x20;wireless&#x20;network.&#x20;-&#x20;5633:&#x20;A&#x20;request&#x20;was&#x20;made&#x20;to&#x20;authenticate&#x20;to&#x20;a&#x20;wired&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Other&#x20;Logon/Logoff&#x20;Events','[{\"cis\": [\"17.5.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15656,'Ensure&#x20;&#039;Audit&#x20;Special&#x20;Logon&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;special&#x20;logon&#x20;is&#x20;used.&#x20;A&#x20;special&#x20;logon&#x20;is&#x20;a&#x20;logon&#x20;that&#x20;has&#x20;administrator-equivalent&#x20;privileges&#x20;and&#x20;can&#x20;be&#x20;used&#x20;to&#x20;elevate&#x20;a&#x20;process&#x20;to&#x20;a&#x20;higher&#x20;level.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4964&#x20;:&#x20;Special&#x20;groups&#x20;have&#x20;been&#x20;assigned&#x20;to&#x20;a&#x20;new&#x20;logon.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Special&#x20;Logon','[{\"cis\": [\"17.5.6\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15657,'Ensure&#x20;&#039;Audit&#x20;Detailed&#x20;File&#x20;Share&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;attempts&#x20;to&#x20;access&#x20;files&#x20;and&#x20;folders&#x20;on&#x20;a&#x20;shared&#x20;folder.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;5145:&#x20;network&#x20;share&#x20;object&#x20;was&#x20;checked&#x20;to&#x20;see&#x20;whether&#x20;client&#x20;can&#x20;be&#x20;granted&#x20;desired&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','Auditing&#x20;the&#x20;Failures&#x20;will&#x20;log&#x20;which&#x20;unauthorized&#x20;users&#x20;attempted&#x20;&#40;and&#x20;failed&#41;&#x20;to&#x20;get&#x20;access&#x20;to&#x20;a&#x20;file&#x20;or&#x20;folder&#x20;on&#x20;a&#x20;network&#x20;share&#x20;on&#x20;this&#x20;computer,&#x20;which&#x20;could&#x20;possibly&#x20;be&#x20;an&#x20;indication&#x20;of&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Detailed&#x20;File&#x20;Share','[{\"cis\": [\"17.6.1\"]}, {\"cis_csc\": [\"3.3\", \"8.5\"]}]'),(15658,'Ensure&#x20;&#039;Audit&#x20;File&#x20;Share&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;attempts&#x20;to&#x20;access&#x20;a&#x20;shared&#x20;folder.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.&#x20;Note:&#x20;There&#x20;are&#x20;no&#x20;system&#x20;access&#x20;control&#x20;lists&#x20;&#40;SACLs&#41;&#x20;for&#x20;shared&#x20;folders.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;access&#x20;to&#x20;all&#x20;shared&#x20;folders&#x20;on&#x20;the&#x20;system&#x20;is&#x20;audited.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;workstations&#x20;should&#x20;have&#x20;limited&#x20;file&#x20;sharing&#x20;activity,&#x20;as&#x20;file&#x20;servers&#x20;would&#x20;normally&#x20;handle&#x20;the&#x20;overall&#x20;burden&#x20;of&#x20;file&#x20;sharing&#x20;activities.&#x20;Any&#x20;unusual&#x20;file&#x20;sharing&#x20;activity&#x20;on&#x20;workstations&#x20;may&#x20;therefore&#x20;be&#x20;useful&#x20;in&#x20;an&#x20;investigation&#x20;of&#x20;potentially&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;File&#x20;Share','[{\"cis\": [\"17.6.2\"]}, {\"cis_csc\": [\"3.3\", \"8.5\"]}]'),(15659,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Object&#x20;Access&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;events&#x20;generated&#x20;by&#x20;the&#x20;management&#x20;of&#x20;task&#x20;scheduler&#x20;jobs&#x20;or&#x20;COM+&#x20;objects.&#x20;For&#x20;scheduler&#x20;jobs,&#x20;the&#x20;following&#x20;are&#x20;audited:&#x20;-&#x20;Job&#x20;created.&#x20;-&#x20;Job&#x20;deleted.&#x20;-&#x20;Job&#x20;enabled.&#x20;-&#x20;Job&#x20;disabled.&#x20;-&#x20;Job&#x20;updated.&#x20;For&#x20;COM+&#x20;objects,&#x20;the&#x20;following&#x20;are&#x20;audited:&#x20;-&#x20;Catalog&#x20;object&#x20;added.&#x20;-&#x20;Catalog&#x20;object&#x20;updated.&#x20;-&#x20;Catalog&#x20;object&#x20;deleted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','The&#x20;unexpected&#x20;creation&#x20;of&#x20;scheduled&#x20;tasks&#x20;and&#x20;COM+&#x20;objects&#x20;could&#x20;potentially&#x20;be&#x20;an&#x20;indication&#x20;of&#x20;malicious&#x20;activity.&#x20;Since&#x20;these&#x20;types&#x20;of&#x20;actions&#x20;are&#x20;generally&#x20;low&#x20;volume,&#x20;it&#x20;may&#x20;be&#x20;useful&#x20;to&#x20;capture&#x20;them&#x20;in&#x20;the&#x20;audit&#x20;logs&#x20;for&#x20;use&#x20;during&#x20;an&#x20;investigation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Other&#x20;Object&#x20;Access&#x20;Events','[{\"cis\": [\"17.6.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15660,'Ensure&#x20;&#039;Audit&#x20;Removable&#x20;Storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;user&#x20;attempts&#x20;to&#x20;access&#x20;file&#x20;system&#x20;objects&#x20;on&#x20;a&#x20;removable&#x20;storage&#x20;device.&#x20;A&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;only&#x20;for&#x20;all&#x20;objects&#x20;for&#x20;all&#x20;types&#x20;of&#x20;access&#x20;requested.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting,&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;each&#x20;time&#x20;an&#x20;account&#x20;accesses&#x20;a&#x20;file&#x20;system&#x20;object&#x20;on&#x20;a&#x20;removable&#x20;storage.&#x20;Success&#x20;audits&#x20;record&#x20;successful&#x20;attempts&#x20;and&#x20;Failure&#x20;audits&#x20;record&#x20;unsuccessful&#x20;attempts.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;configure&#x20;this&#x20;policy&#x20;setting,&#x20;no&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;when&#x20;an&#x20;account&#x20;accesses&#x20;a&#x20;file&#x20;system&#x20;object&#x20;on&#x20;a&#x20;removable&#x20;storage.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.&#x20;Note:&#x20;A&#x20;Windows&#x20;8.0,&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Auditing&#x20;removable&#x20;storage&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.&#x20;For&#x20;example,&#x20;if&#x20;an&#x20;individual&#x20;is&#x20;suspected&#x20;of&#x20;copying&#x20;sensitive&#x20;information&#x20;onto&#x20;a&#x20;USB&#x20;drive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Removable&#x20;Storage','[{\"cis\": [\"17.6.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15661,'Ensure&#x20;&#039;Audit&#x20;Audit&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;audit&#x20;policy&#x20;including&#x20;SACL&#x20;changes.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4715:&#x20;The&#x20;audit&#x20;policy&#x20;&#40;SACL&#41;&#x20;on&#x20;an&#x20;object&#x20;was&#x20;changed.&#x20;-&#x20;4719:&#x20;System&#x20;audit&#x20;policy&#x20;was&#x20;changed.&#x20;-&#x20;4902:&#x20;The&#x20;Per-user&#x20;audit&#x20;policy&#x20;table&#x20;was&#x20;created.&#x20;-&#x20;4904:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;register&#x20;a&#x20;security&#x20;event&#x20;source.&#x20;-&#x20;4905:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;unregister&#x20;a&#x20;security&#x20;event&#x20;source.&#x20;-&#x20;4906:&#x20;The&#x20;CrashOnAuditFail&#x20;value&#x20;has&#x20;changed.&#x20;-&#x20;4907:&#x20;Auditing&#x20;settings&#x20;on&#x20;object&#x20;were&#x20;changed.&#x20;-&#x20;4908:&#x20;Special&#x20;Groups&#x20;Logon&#x20;table&#x20;modified.&#x20;-&#x20;4912:&#x20;Per&#x20;User&#x20;Audit&#x20;Policy&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Audit&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15662,'Ensure&#x20;&#039;Audit&#x20;Authentication&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;authentication&#x20;policy.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include&#x20;-&#x20;4706:&#x20;A&#x20;new&#x20;trust&#x20;was&#x20;created&#x20;to&#x20;a&#x20;domain.&#x20;-&#x20;4707:&#x20;A&#x20;trust&#x20;to&#x20;a&#x20;domain&#x20;was&#x20;removed.&#x20;-&#x20;4713:&#x20;Kerberos&#x20;policy&#x20;was&#x20;changed.&#x20;-&#x20;4716:&#x20;Trusted&#x20;domain&#x20;information&#x20;was&#x20;modified.&#x20;-&#x20;4717:&#x20;System&#x20;security&#x20;access&#x20;was&#x20;granted&#x20;to&#x20;an&#x20;account.&#x20;-&#x20;4718:&#x20;System&#x20;security&#x20;access&#x20;was&#x20;removed&#x20;from&#x20;an&#x20;account.&#x20;-&#x20;4739:&#x20;Domain&#x20;Policy&#x20;was&#x20;changed.&#x20;-&#x20;4864:&#x20;A&#x20;namespace&#x20;collision&#x20;was&#x20;detected.&#x20;-&#x20;4865:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;added.&#x20;-&#x20;4866:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;removed.&#x20;&#x20;-&#x20;4867:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;modified.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Authentication&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15663,'Ensure&#x20;&#039;Audit&#x20;Authorization&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;authorization&#x20;policy.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4704:&#x20;A&#x20;user&#x20;right&#x20;was&#x20;assigned.&#x20;-&#x20;4705:&#x20;A&#x20;user&#x20;right&#x20;was&#x20;removed.&#x20;-&#x20;4706:&#x20;A&#x20;new&#x20;trust&#x20;was&#x20;created&#x20;to&#x20;a&#x20;domain.&#x20;-&#x20;4707:&#x20;A&#x20;trust&#x20;to&#x20;a&#x20;domain&#x20;was&#x20;removed.&#x20;-&#x20;4714:&#x20;Encrypted&#x20;data&#x20;recovery&#x20;policy&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Authorization&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15664,'Ensure&#x20;&#039;Audit&#x20;MPSSVC&#x20;Rule-Level&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;determines&#x20;whether&#x20;the&#x20;operating&#x20;system&#x20;generates&#x20;audit&#x20;events&#x20;when&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;policy&#x20;rules&#x20;for&#x20;the&#x20;Microsoft&#x20;Protection&#x20;Service&#x20;&#40;MPSSVC.exe&#41;.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4944:&#x20;The&#x20;following&#x20;policy&#x20;was&#x20;active&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;started.&#x20;-&#x20;4945:&#x20;A&#x20;rule&#x20;was&#x20;listed&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;started.&#x20;-&#x20;4946:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;added.&#x20;-&#x20;4947:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;modified.&#x20;-&#x20;4948:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;deleted.&#x20;-&#x20;4949:&#x20;Windows&#x20;Firewall&#x20;settings&#x20;were&#x20;restored&#x20;to&#x20;the&#x20;default&#x20;values.&#x20;-&#x20;4950:&#x20;A&#x20;Windows&#x20;Firewall&#x20;setting&#x20;has&#x20;changed.&#x20;-&#x20;4951:&#x20;A&#x20;rule&#x20;has&#x20;been&#x20;ignored&#x20;because&#x20;its&#x20;major&#x20;version&#x20;number&#x20;was&#x20;not&#x20;recognized&#x20;by&#x20;Windows&#x20;Firewall.&#x20;-&#x20;4952:&#x20;Parts&#x20;of&#x20;a&#x20;rule&#x20;have&#x20;been&#x20;ignored&#x20;because&#x20;its&#x20;minor&#x20;version&#x20;number&#x20;was&#x20;not&#x20;recognized&#x20;by&#x20;Windows&#x20;Firewall.&#x20;The&#x20;other&#x20;parts&#x20;of&#x20;the&#x20;rule&#x20;will&#x20;be&#x20;enforced.&#x20;-&#x20;4953:&#x20;A&#x20;rule&#x20;has&#x20;been&#x20;ignored&#x20;by&#x20;Windows&#x20;Firewall&#x20;because&#x20;it&#x20;could&#x20;not&#x20;parse&#x20;the&#x20;rule.&#x20;-&#x20;4954:&#x20;Windows&#x20;Firewall&#x20;Group&#x20;Policy&#x20;settings&#x20;have&#x20;changed.&#x20;The&#x20;new&#x20;settings&#x20;have&#x20;been&#x20;applied.&#x20;-&#x20;4956:&#x20;Windows&#x20;Firewall&#x20;has&#x20;changed&#x20;the&#x20;active&#x20;profile.&#x20;-&#x20;4957:&#x20;Windows&#x20;Firewall&#x20;did&#x20;not&#x20;apply&#x20;the&#x20;following&#x20;rule.&#x20;-&#x20;4958:&#x20;Windows&#x20;Firewall&#x20;did&#x20;not&#x20;apply&#x20;the&#x20;following&#x20;rule&#x20;because&#x20;the&#x20;rule&#x20;referred&#x20;to&#x20;items&#x20;not&#x20;configured&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;:&#x20;Success&#x20;and&#x20;Failure','Changes&#x20;to&#x20;firewall&#x20;rules&#x20;are&#x20;important&#x20;for&#x20;understanding&#x20;the&#x20;security&#x20;state&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;how&#x20;well&#x20;it&#x20;is&#x20;protected&#x20;against&#x20;network&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;MPSSVC&#x20;Rule-Level&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15665,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Policy&#x20;Change&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;contains&#x20;events&#x20;about&#x20;EFS&#x20;Data&#x20;Recovery&#x20;Agent&#x20;policy&#x20;changes,&#x20;changes&#x20;in&#x20;Windows&#x20;Filtering&#x20;Platform&#x20;filter,&#x20;status&#x20;on&#x20;Security&#x20;policy&#x20;settings&#x20;updates&#x20;for&#x20;local&#x20;Group&#x20;Policy&#x20;settings,&#x20;Central&#x20;Access&#x20;Policy&#x20;changes,&#x20;and&#x20;detailed&#x20;troubleshooting&#x20;events&#x20;for&#x20;Cryptographic&#x20;Next&#x20;Generation&#x20;&#40;CNG&#41;&#x20;operations.&#x20;-&#x20;5063:&#x20;A&#x20;cryptographic&#x20;provider&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5064:&#x20;A&#x20;cryptographic&#x20;context&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5065:&#x20;A&#x20;cryptographic&#x20;context&#x20;modification&#x20;was&#x20;attempted.&#x20;-&#x20;5066:&#x20;A&#x20;cryptographic&#x20;function&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5067:&#x20;A&#x20;cryptographic&#x20;function&#x20;modification&#x20;was&#x20;attempted.&#x20;-&#x20;5068:&#x20;A&#x20;cryptographic&#x20;function&#x20;provider&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5069:&#x20;A&#x20;cryptographic&#x20;function&#x20;property&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5070:&#x20;A&#x20;cryptographic&#x20;function&#x20;property&#x20;modification&#x20;was&#x20;attempted.&#x20;-&#x20;6145:&#x20;One&#x20;or&#x20;more&#x20;errors&#x20;occurred&#x20;while&#x20;processing&#x20;security&#x20;policy&#x20;in&#x20;the&#x20;group&#x20;policy&#x20;objects.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','This&#x20;setting&#x20;can&#x20;help&#x20;detect&#x20;errors&#x20;in&#x20;applied&#x20;Security&#x20;settings&#x20;which&#x20;came&#x20;from&#x20;Group&#x20;Policy,&#x20;and&#x20;failure&#x20;events&#x20;related&#x20;to&#x20;Cryptographic&#x20;Next&#x20;Generation&#x20;&#40;CNG&#41;&#x20;functions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Other&#x20;Policy&#x20;Change&#x20;Events','[{\"cis\": [\"17.7.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15666,'Ensure&#x20;&#039;Audit&#x20;Sensitive&#x20;Privilege&#x20;Use&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;account&#x20;or&#x20;service&#x20;uses&#x20;a&#x20;sensitive&#x20;privilege.&#x20;A&#x20;sensitive&#x20;privilege&#x20;includes&#x20;the&#x20;following&#x20;user&#x20;rights:&#x20;-&#x20;Act&#x20;as&#x20;part&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;-&#x20;Back&#x20;up&#x20;files&#x20;and&#x20;directories&#x20;-&#x20;Create&#x20;a&#x20;token&#x20;object&#x20;-&#x20;Debug&#x20;programs&#x20;-&#x20;Enable&#x20;computer&#x20;and&#x20;user&#x20;accounts&#x20;to&#x20;be&#x20;trusted&#x20;for&#x20;delegation&#x20;-&#x20;Generate&#x20;security&#x20;audits&#x20;-&#x20;Impersonate&#x20;a&#x20;client&#x20;after&#x20;authentication&#x20;-&#x20;Load&#x20;and&#x20;unload&#x20;device&#x20;drivers&#x20;-&#x20;Manage&#x20;auditing&#x20;and&#x20;security&#x20;log&#x20;-&#x20;Modify&#x20;firmware&#x20;environment&#x20;values&#x20;-&#x20;Replace&#x20;a&#x20;process-level&#x20;token&#x20;-&#x20;Restore&#x20;files&#x20;and&#x20;directories&#x20;-&#x20;Take&#x20;ownership&#x20;of&#x20;files&#x20;or&#x20;other&#x20;objects&#x20;Auditing&#x20;this&#x20;subcategory&#x20;will&#x20;create&#x20;a&#x20;high&#x20;volume&#x20;of&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4672:&#x20;Special&#x20;privileges&#x20;assigned&#x20;to&#x20;new&#x20;logon.&#x20;-&#x20;4673:&#x20;A&#x20;privileged&#x20;service&#x20;was&#x20;called.&#x20;-&#x20;4674:&#x20;An&#x20;operation&#x20;was&#x20;attempted&#x20;on&#x20;a&#x20;privileged&#x20;object.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPrivilege&#x20;UseAudit&#x20;Sensitive&#x20;Privilege&#x20;Use','[{\"cis\": [\"17.8.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15667,'Ensure&#x20;&#039;Audit&#x20;IPsec&#x20;Driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;the&#x20;activities&#x20;of&#x20;the&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;driver.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4960:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;an&#x20;integrity&#x20;check.&#x20;If&#x20;this&#x20;problem&#x20;persists,&#x20;it&#x20;could&#x20;indicate&#x20;a&#x20;network&#x20;issue&#x20;or&#x20;that&#x20;packets&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;transit&#x20;to&#x20;this&#x20;computer.&#x20;Verify&#x20;that&#x20;the&#x20;packets&#x20;sent&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;are&#x20;the&#x20;same&#x20;as&#x20;those&#x20;received&#x20;by&#x20;this&#x20;computer.&#x20;This&#x20;error&#x20;might&#x20;also&#x20;indicate&#x20;interoperability&#x20;problems&#x20;with&#x20;other&#x20;IPsec&#x20;implementations.&#x20;-&#x20;4961:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;a&#x20;replay&#x20;check.&#x20;If&#x20;this&#x20;problem&#x20;persists,&#x20;it&#x20;could&#x20;indicate&#x20;a&#x20;replay&#x20;attack&#x20;against&#x20;this&#x20;computer.&#x20;-&#x20;4962:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;a&#x20;replay&#x20;check.&#x20;The&#x20;inbound&#x20;packet&#x20;had&#x20;too&#x20;low&#x20;a&#x20;sequence&#x20;number&#x20;to&#x20;ensure&#x20;it&#x20;was&#x20;not&#x20;a&#x20;replay.&#x20;-&#x20;4963:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;clear&#x20;text&#x20;packet&#x20;that&#x20;should&#x20;have&#x20;been&#x20;secured.&#x20;This&#x20;is&#x20;usually&#x20;due&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;changing&#x20;its&#x20;IPsec&#x20;policy&#x20;without&#x20;informing&#x20;this&#x20;computer.&#x20;This&#x20;could&#x20;also&#x20;be&#x20;a&#x20;spoofing&#x20;attack&#x20;attempt.&#x20;-&#x20;4965:&#x20;IPsec&#x20;received&#x20;a&#x20;packet&#x20;from&#x20;a&#x20;remote&#x20;computer&#x20;with&#x20;an&#x20;incorrect&#x20;Security&#x20;Parameter&#x20;Index&#x20;&#40;SPI&#41;.&#x20;This&#x20;is&#x20;usually&#x20;caused&#x20;by&#x20;malfunctioning&#x20;hardware&#x20;that&#x20;is&#x20;corrupting&#x20;packets.&#x20;If&#x20;these&#x20;errors&#x20;persist,&#x20;verify&#x20;that&#x20;the&#x20;packets&#x20;sent&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;are&#x20;the&#x20;same&#x20;as&#x20;those&#x20;received&#x20;by&#x20;this&#x20;computer.&#x20;This&#x20;error&#x20;may&#x20;also&#x20;indicate&#x20;interoperability&#x20;problems&#x20;with&#x20;other&#x20;IPsec&#x20;implementations.&#x20;In&#x20;that&#x20;case,&#x20;if&#x20;connectivity&#x20;is&#x20;not&#x20;impeded,&#x20;then&#x20;these&#x20;events&#x20;can&#x20;be&#x20;ignored.&#x20;-&#x20;5478:&#x20;IPsec&#x20;Services&#x20;has&#x20;started&#x20;successfully.&#x20;-&#x20;5479:&#x20;IPsec&#x20;Services&#x20;has&#x20;been&#x20;shut&#x20;down&#x20;successfully.&#x20;The&#x20;shutdown&#x20;of&#x20;IPsec&#x20;Services&#x20;can&#x20;put&#x20;the&#x20;computer&#x20;at&#x20;greater&#x20;risk&#x20;of&#x20;network&#x20;attack&#x20;or&#x20;expose&#x20;the&#x20;computer&#x20;to&#x20;potential&#x20;security&#x20;risks.&#x20;-&#x20;5480:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;get&#x20;the&#x20;complete&#x20;list&#x20;of&#x20;network&#x20;interfaces&#x20;on&#x20;the&#x20;computer.&#x20;This&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;because&#x20;some&#x20;of&#x20;the&#x20;network&#x20;interfaces&#x20;may&#x20;not&#x20;get&#x20;the&#x20;protection&#x20;provided&#x20;by&#x20;the&#x20;applied&#x20;IPsec&#x20;filters.&#x20;Use&#x20;the&#x20;IP&#x20;Security&#x20;Monitor&#x20;snap-in&#x20;to&#x20;diagnose&#x20;the&#x20;problem.&#x20;-&#x20;5483:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;initialize&#x20;RPC&#x20;server.&#x20;IPsec&#x20;Services&#x20;could&#x20;not&#x20;be&#x20;started.-&#x20;5484:&#x20;IPsec&#x20;Services&#x20;has&#x20;experienced&#x20;a&#x20;critical&#x20;failure&#x20;and&#x20;has&#x20;been&#x20;shut&#x20;down.&#x20;The&#x20;shutdown&#x20;of&#x20;IPsec&#x20;Services&#x20;can&#x20;put&#x20;the&#x20;computer&#x20;at&#x20;greater&#x20;risk&#x20;of&#x20;network&#x20;attack&#x20;or&#x20;expose&#x20;the&#x20;computer&#x20;to&#x20;potential&#x20;security&#x20;risks.&#x20;-&#x20;5485:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;process&#x20;some&#x20;IPsec&#x20;filters&#x20;on&#x20;a&#x20;plug-and-play&#x20;event&#x20;for&#x20;network&#x20;interfaces.&#x20;This&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;because&#x20;some&#x20;of&#x20;the&#x20;network&#x20;interfaces&#x20;may&#x20;not&#x20;get&#x20;the&#x20;protection&#x20;provided&#x20;by&#x20;the&#x20;applied&#x20;IPsec&#x20;filters.&#x20;Use&#x20;the&#x20;IP&#x20;Security&#x20;Monitor&#x20;snap-in&#x20;to&#x20;diagnose&#x20;the&#x20;problem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;IPsec&#x20;Driver','[{\"cis\": [\"17.9.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15668,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;System&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;other&#x20;system&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;5024&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;has&#x20;started&#x20;successfully.&#x20;-&#x20;5025&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;has&#x20;been&#x20;stopped.&#x20;-&#x20;5027&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;was&#x20;unable&#x20;to&#x20;retrieve&#x20;the&#x20;security&#x20;policy&#x20;from&#x20;the&#x20;local&#x20;storage.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;enforcing&#x20;the&#x20;current&#x20;policy.&#x20;-&#x20;5028&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;was&#x20;unable&#x20;to&#x20;parse&#x20;the&#x20;new&#x20;security&#x20;policy.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;with&#x20;currently&#x20;enforced&#x20;policy.&#x20;-&#x20;5029:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;failed&#x20;to&#x20;initialize&#x20;the&#x20;driver.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;to&#x20;enforce&#x20;the&#x20;current&#x20;policy.&#x20;-&#x20;5030:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;failed&#x20;to&#x20;start.&#x20;-&#x20;5032:&#x20;Windows&#x20;Firewall&#x20;was&#x20;unable&#x20;to&#x20;notify&#x20;the&#x20;user&#x20;that&#x20;it&#x20;blocked&#x20;an&#x20;application&#x20;from&#x20;accepting&#x20;incoming&#x20;connections&#x20;on&#x20;the&#x20;network.&#x20;-&#x20;5033&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;has&#x20;started&#x20;successfully.&#x20;-&#x20;5034&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;has&#x20;been&#x20;stopped.&#x20;-&#x20;5035&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;failed&#x20;to&#x20;start.&#x20;-&#x20;5037&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;detected&#x20;critical&#x20;runtime&#x20;error.&#x20;Terminating.&#x20;-&#x20;5058:&#x20;Key&#x20;file&#x20;operation.&#x20;-&#x20;5059:&#x20;Key&#x20;migration&#x20;operation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Capturing&#x20;these&#x20;audit&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;for&#x20;identifying&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;is&#x20;not&#x20;performing&#x20;as&#x20;expected.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Other&#x20;System&#x20;Events','[{\"cis\": [\"17.9.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15669,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;State&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;security&#x20;state&#x20;of&#x20;the&#x20;system,&#x20;such&#x20;as&#x20;when&#x20;the&#x20;security&#x20;subsystem&#x20;starts&#x20;and&#x20;stops.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4608:&#x20;Windows&#x20;is&#x20;starting&#x20;up.&#x20;-&#x20;4609:&#x20;Windows&#x20;is&#x20;shutting&#x20;down.&#x20;-&#x20;4616:&#x20;The&#x20;system&#x20;time&#x20;was&#x20;changed.&#x20;-&#x20;4621:&#x20;Administrator&#x20;recovered&#x20;system&#x20;from&#x20;CrashOnAuditFail.&#x20;Users&#x20;who&#x20;are&#x20;not&#x20;administrators&#x20;will&#x20;now&#x20;be&#x20;allowed&#x20;to&#x20;log&#x20;on.&#x20;Some&#x20;audit-able&#x20;activity&#x20;might&#x20;not&#x20;have&#x20;been&#x20;recorded.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Security&#x20;State&#x20;Change','[{\"cis\": [\"17.9.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15670,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;System&#x20;Extension&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;loading&#x20;of&#x20;extension&#x20;code&#x20;such&#x20;as&#x20;authentication&#x20;packages&#x20;by&#x20;the&#x20;security&#x20;subsystem.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4610:&#x20;An&#x20;authentication&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;-&#x20;4611:&#x20;A&#x20;trusted&#x20;logon&#x20;process&#x20;has&#x20;been&#x20;registered&#x20;with&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;-&#x20;4614:&#x20;A&#x20;notification&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Security&#x20;Account&#x20;Manager.&#x20;-&#x20;4622:&#x20;A&#x20;security&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;-&#x20;4697:&#x20;A&#x20;service&#x20;was&#x20;installed&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Security&#x20;System&#x20;Extension','[{\"cis\": [\"17.9.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15671,'Ensure&#x20;&#039;Audit&#x20;System&#x20;Integrity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;violations&#x20;of&#x20;integrity&#x20;of&#x20;the&#x20;security&#x20;subsystem.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4612&#x20;:&#x20;Internal&#x20;resources&#x20;allocated&#x20;for&#x20;the&#x20;queuing&#x20;of&#x20;audit&#x20;messages&#x20;have&#x20;been&#x20;exhausted,&#x20;leading&#x20;to&#x20;the&#x20;loss&#x20;of&#x20;some&#x20;audits.&#x20;-&#x20;4615&#x20;:&#x20;Invalid&#x20;use&#x20;of&#x20;LPC&#x20;port.&#x20;-&#x20;4618&#x20;:&#x20;A&#x20;monitored&#x20;security&#x20;event&#x20;pattern&#x20;has&#x20;occurred.&#x20;-&#x20;4816&#x20;:&#x20;RPC&#x20;detected&#x20;an&#x20;integrity&#x20;violation&#x20;while&#x20;decrypting&#x20;an&#x20;incoming&#x20;message.&#x20;-&#x20;5038&#x20;:&#x20;Code&#x20;integrity&#x20;determined&#x20;that&#x20;the&#x20;image&#x20;hash&#x20;of&#x20;a&#x20;file&#x20;is&#x20;not&#x20;valid.&#x20;The&#x20;file&#x20;could&#x20;be&#x20;corrupt&#x20;due&#x20;to&#x20;unauthorized&#x20;modification&#x20;or&#x20;the&#x20;invalid&#x20;hash&#x20;could&#x20;indicate&#x20;a&#x20;potential&#x20;disk&#x20;device&#x20;error.&#x20;-&#x20;5056:&#x20;A&#x20;cryptographic&#x20;self&#x20;test&#x20;was&#x20;performed.&#x20;-&#x20;5057:&#x20;A&#x20;cryptographic&#x20;primitive&#x20;operation&#x20;failed.&#x20;-&#x20;5060:&#x20;Verification&#x20;operation&#x20;failed.&#x20;-&#x20;5061:&#x20;Cryptographic&#x20;operation.&#x20;-&#x20;5062:&#x20;A&#x20;kernel-mode&#x20;cryptographic&#x20;self&#x20;test&#x20;was&#x20;performed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;System&#x20;Integrity','[{\"cis\": [\"17.9.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15672,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Disables&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;toggle&#x20;switch&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;camera&#x20;from&#x20;being&#x20;invoked&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;camera&#x20;features.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15673,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Disables&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;settings&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;slide&#x20;show&#x20;from&#x20;playing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;slide&#x20;show&#x20;contents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15674,'Ensure&#x20;&#039;Allow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;enables&#x20;the&#x20;automatic&#x20;learning&#x20;component&#x20;of&#x20;input&#x20;personalization&#x20;that&#x20;includes&#x20;speech,&#x20;inking,&#x20;and&#x20;typing.&#x20;Automatic&#x20;learning&#x20;enables&#x20;the&#x20;collection&#x20;of&#x20;speech&#x20;and&#x20;handwriting&#x20;patterns,&#x20;typing&#x20;history,&#x20;contacts,&#x20;and&#x20;recent&#x20;calendar&#x20;information.&#x20;It&#x20;is&#x20;required&#x20;for&#x20;the&#x20;use&#x20;of&#x20;Cortana.&#x20;Some&#x20;of&#x20;this&#x20;collected&#x20;information&#x20;may&#x20;be&#x20;stored&#x20;on&#x20;the&#x20;user&#039;s&#x20;OneDrive,&#x20;in&#x20;the&#x20;case&#x20;of&#x20;inking&#x20;and&#x20;typing;&#x20;some&#x20;of&#x20;the&#x20;information&#x20;will&#x20;be&#x20;uploaded&#x20;to&#x20;Microsoft&#x20;to&#x20;personalize&#x20;speech.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;Enabled&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;stored&#x20;in&#x20;the&#x20;cloud&#x20;or&#x20;sent&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelRegional&#x20;and&#x20;Language&#x20;OptionsAllow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;input&#x20;personalization,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;R1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.1.2.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15675,'Ensure&#x20;&#039;Allow&#x20;Online&#x20;Tips&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;the&#x20;retrieval&#x20;of&#x20;online&#x20;tips&#x20;and&#x20;help&#x20;for&#x20;the&#x20;Settings&#x20;app.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelAllow&#x20;Online&#x20;Tips.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanel.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.3\"]}, {\"pci_dss\": [\"1.3.4\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15676,'Ensure&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;is&#x20;installed.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','In&#x20;order&#x20;to&#x20;utilize&#x20;LAPS,&#x20;a&#x20;minor&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;is&#x20;required,&#x20;and&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;each&#x20;managed&#x20;computer.&#x20;When&#x20;LAPS&#x20;is&#x20;installed,&#x20;the&#x20;file&#x20;AdmPwd.dll&#x20;must&#x20;be&#x20;present&#x20;in&#x20;the&#x20;following&#x20;location&#x20;and&#x20;registered&#x20;in&#x20;Windows&#x20;&#40;the&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;installation&#x20;does&#x20;this&#x20;for&#x20;you&#41;:&#x20;C:Program&#x20;FilesLAPSCSEAdmPwd.dll','[{\"cis\": [\"18.2.1\"]}, {\"cis_csc\": [\"5.2\", \"5.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15677,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSDo&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.2\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15678,'Ensure&#x20;&#039;Enable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSEnable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.3\"]}, {\"cis_csc\": [\"5.2\", \"5.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15679,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Complexity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Complexity&#x20;option&#x20;to&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.4\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15680,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;or&#x20;more&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;or&#x20;more.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Length&#x20;option&#x20;to&#x20;15&#x20;or&#x20;more:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.5\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15681,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;30&#x20;or&#x20;fewer&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;30&#x20;or&#x20;fewer.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#x20;option&#x20;to&#x20;30&#x20;or&#x20;fewer:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.6\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15682,'Ensure&#x20;&#039;Apply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;accounts&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;administration&#x20;via&#x20;network&#x20;logon&#x20;&#40;e.g.,&#x20;NET&#x20;USE,&#x20;connecting&#x20;to&#x20;C$,&#x20;etc.&#41;.&#x20;Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Enabling&#x20;this&#x20;policy&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.&#x20;Enabled:&#x20;Applies&#x20;UAC&#x20;token-filtering&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Membership&#x20;in&#x20;powerful&#x20;group&#x20;such&#x20;as&#x20;Administrators&#x20;is&#x20;disabled&#x20;and&#x20;powerful&#x20;privileges&#x20;are&#x20;removed&#x20;from&#x20;the&#x20;resulting&#x20;access&#x20;token.&#x20;This&#x20;configures&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;0.&#x20;This&#x20;is&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Windows.&#x20;Disabled:&#x20;Allows&#x20;local&#x20;accounts&#x20;to&#x20;have&#x20;full&#x20;administrative&#x20;rights&#x20;when&#x20;authenticating&#x20;via&#x20;network&#x20;logon,&#x20;by&#x20;configuring&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;1.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;LocalAccountTokenFilterPolicy,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;951016:&#x20;Description&#x20;of&#x20;User&#x20;Account&#x20;Control&#x20;and&#x20;remote&#x20;restrictions&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Ensuring&#x20;this&#x20;policy&#x20;is&#x20;Enabled&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideApply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.1\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15683,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;driver&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;start&#x20;type&#x20;for&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;client&#x20;driver&#x20;service&#x20;&#40;MRxSmb10&#41;,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;disabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;.&#x20;Note:&#x20;Do&#x20;not,&#x20;under&#x20;any&#x20;circumstances,&#x20;configure&#x20;this&#x20;overall&#x20;setting&#x20;as&#x20;Disabled,&#x20;as&#x20;doing&#x20;so&#x20;will&#x20;delete&#x20;the&#x20;underlying&#x20;registry&#x20;entry&#x20;altogether,&#x20;which&#x20;will&#x20;cause&#x20;serious&#x20;problems.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;client&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15684,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;server-side&#x20;processing&#x20;of&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;protocol.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;server.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15685,'Ensure&#x20;&#039;Enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Windows&#x20;includes&#x20;support&#x20;for&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;We&#x20;recommend&#x20;enabling&#x20;this&#x20;feature&#x20;to&#x20;improve&#x20;the&#x20;security&#x20;profile&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;block&#x20;exploits&#x20;that&#x20;use&#x20;the&#x20;Structured&#x20;Exception&#x20;Handler&#x20;&#40;SEH&#41;&#x20;overwrite&#x20;technique.&#x20;This&#x20;protection&#x20;mechanism&#x20;is&#x20;provided&#x20;at&#x20;run-time.&#x20;Therefore,&#x20;it&#x20;helps&#x20;protect&#x20;applications&#x20;regardless&#x20;of&#x20;whether&#x20;they&#x20;have&#x20;been&#x20;compiled&#x20;with&#x20;the&#x20;latest&#x20;improvements,&#x20;such&#x20;as&#x20;the&#x20;/SAFESEH&#x20;option.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideEnable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.4\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(15686,'Ensure&#x20;&#039;Limits&#x20;print&#x20;driver&#x20;installation&#x20;to&#x20;Administrators&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;that&#x20;aren&#039;t&#x20;Administrators&#x20;can&#x20;install&#x20;print&#x20;drivers&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.','Restricting&#x20;the&#x20;installation&#x20;of&#x20;print&#x20;drives&#x20;to&#x20;Administrators&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideLimits&#x20;print&#x20;driver&#x20;installation&#x20;to&#x20;Administrators.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;SecGuide.admx/adml&#x20;is&#x20;required.','[{\"cis\": [\"18.3.5\"]}]'),(15687,'Ensure&#x20;&#039;NetBT&#x20;NodeType&#x20;configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;P-node&#039;.','This&#x20;setting&#x20;determines&#x20;which&#x20;method&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;NetBT&#41;&#x20;uses&#x20;to&#x20;register&#x20;and&#x20;resolve&#x20;names.&#x20;The&#x20;available&#x20;methods&#x20;are:&#x20;The&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;method&#x20;only&#x20;uses&#x20;broadcasts.&#x20;The&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;method&#x20;only&#x20;uses&#x20;name&#x20;queries&#x20;to&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;.&#x20;The&#x20;M-node&#x20;&#40;mixed&#41;&#x20;method&#x20;broadcasts&#x20;first,&#x20;then&#x20;queries&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;if&#x20;broadcast&#x20;failed.&#x20;The&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;method&#x20;queries&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;first,&#x20;then&#x20;broadcasts&#x20;if&#x20;the&#x20;query&#x20;failed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;P-node&#x20;&#40;recommended&#41;&#x20;&#40;point-to-&#x20;point&#41;.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Note:&#x20;Resolution&#x20;through&#x20;LMHOSTS&#x20;or&#x20;DNS&#x20;follows&#x20;these&#x20;methods.&#x20;If&#x20;the&#x20;NodeType&#x20;registry&#x20;value&#x20;is&#x20;present,&#x20;it&#x20;overrides&#x20;any&#x20;DhcpNodeType&#x20;registry&#x20;value.&#x20;If&#x20;neither&#x20;NodeType&#x20;nor&#x20;DhcpNodeType&#x20;is&#x20;present,&#x20;the&#x20;computer&#x20;uses&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;if&#x20;there&#x20;are&#x20;no&#x20;WINS&#x20;servers&#x20;configured&#x20;for&#x20;the&#x20;network,&#x20;or&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;if&#x20;there&#x20;is&#x20;at&#x20;least&#x20;one&#x20;WINS&#x20;server&#x20;configured.','In&#x20;order&#x20;to&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;NetBIOS&#x20;Name&#x20;Service&#x20;&#40;NBT-NS&#41;&#x20;poisoning&#x20;attacks,&#x20;setting&#x20;the&#x20;node&#x20;type&#x20;to&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;will&#x20;prevent&#x20;the&#x20;system&#x20;from&#x20;sending&#x20;out&#x20;NetBIOS&#x20;broadcasts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;P-node&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideNetBT&#x20;NodeType&#x20;configuration.&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.6\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15688,'Ensure&#x20;&#039;WDigest&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','When&#x20;WDigest&#x20;authentication&#x20;is&#x20;enabled,&#x20;Lsass.exe&#x20;retains&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;user&#039;s&#x20;plaintext&#x20;password&#x20;in&#x20;memory,&#x20;where&#x20;it&#x20;can&#x20;be&#x20;at&#x20;risk&#x20;of&#x20;theft.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured,&#x20;WDigest&#x20;authentication&#x20;is&#x20;disabled&#x20;in&#x20;Windows&#x20;8.1&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;R2;&#x20;it&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;in&#x20;earlier&#x20;versions&#x20;of&#x20;Windows&#x20;and&#x20;Windows&#x20;Server.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;UseLogonCredential,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;2871997:&#x20;Microsoft&#x20;Security&#x20;Advisory&#x20;Update&#x20;to&#x20;improve&#x20;credentials&#x20;protection&#x20;and&#x20;management&#x20;May&#x20;13,&#x20;2014.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideWDigest&#x20;Authentication&#x20;&#40;disabling&#x20;may&#x20;require&#x20;KB2871997&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.7\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15689,'Ensure&#x20;&#039;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;is&#x20;separate&#x20;from&#x20;the&#x20;Welcome&#x20;screen&#x20;feature&#x20;in&#x20;Windows&#x20;XP&#x20;and&#x20;Windows&#x20;Vista;&#x20;if&#x20;that&#x20;feature&#x20;is&#x20;disabled,&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;disabled.&#x20;If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;to&#x20;which&#x20;the&#x20;computer&#x20;is&#x20;connected.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext,&#x20;and&#x20;the&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;value&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;For&#x20;additional&#x20;information,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;324737:&#x20;How&#x20;to&#x20;turn&#x20;on&#x20;automatic&#x20;logon&#x20;in&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;that&#x20;the&#x20;computer&#x20;is&#x20;connected&#x20;to.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext.&#x20;The&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;setting&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;As&#x20;a&#x20;result,&#x20;this&#x20;entry&#x20;is&#x20;appropriate&#x20;only&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;physically&#x20;secured&#x20;and&#x20;if&#x20;you&#x20;ensure&#x20;that&#x20;untrusted&#x20;users&#x20;cannot&#x20;remotely&#x20;see&#x20;the&#x20;registry.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.1\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15690,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highe','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;follow&#x20;through&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15691,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highest&#x20;pr','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;take&#x20;through&#x20;the&#x20;network.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;Not&#x20;Defined&#x20;for&#x20;enterprise&#x20;environments&#x20;and&#x20;to&#x20;Highest&#x20;Protection&#x20;for&#x20;high&#x20;security&#x20;environments&#x20;to&#x20;completely&#x20;disable&#x20;source&#x20;routing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15692,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableSavePassword&#41;&#x20;Prevent&#x20;the&#x20;dial-up&#x20;password&#x20;from&#x20;being&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;you&#x20;dial&#x20;a&#x20;phonebook&#x20;or&#x20;VPN&#x20;entry&#x20;in&#x20;Dial-Up&#x20;Networking,&#x20;you&#x20;can&#x20;use&#x20;the&#x20;&quot;Save&#x20;Password&quot;&#x20;option&#x20;so&#x20;that&#x20;your&#x20;Dial-Up&#x20;Networking&#x20;password&#x20;is&#x20;cached&#x20;and&#x20;you&#x20;will&#x20;not&#x20;need&#x20;to&#x20;enter&#x20;it&#x20;on&#x20;successive&#x20;dial&#x20;attempts.&#x20;For&#x20;security,&#x20;administrators&#x20;may&#x20;want&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;caching&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;who&#x20;steals&#x20;a&#x20;mobile&#x20;user&#039;s&#x20;computer&#x20;could&#x20;automatically&#x20;connect&#x20;to&#x20;the&#x20;organization&#039;s&#x20;network&#x20;if&#x20;the&#x20;Save&#x20;This&#x20;Password&#x20;check&#x20;box&#x20;is&#x20;selected&#x20;for&#x20;the&#x20;dial-up&#x20;or&#x20;VPN&#x20;networking&#x20;entry&#x20;used&#x20;to&#x20;connect&#x20;to&#x20;your&#x20;organization&#039;s&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;DisableSavePassword&#41;&#x20;Prevent&#x20;the&#x20;dial-up&#x20;password&#x20;from&#x20;being&#x20;saved.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15693,'Ensure&#x20;&#039;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Internet&#x20;Control&#x20;Message&#x20;Protocol&#x20;&#40;ICMP&#41;&#x20;redirects&#x20;cause&#x20;the&#x20;IPv4&#x20;stack&#x20;to&#x20;plumb&#x20;host&#x20;routes.&#x20;These&#x20;routes&#x20;override&#x20;the&#x20;Open&#x20;Shortest&#x20;Path&#x20;First&#x20;&#40;OSPF&#41;&#x20;generated&#x20;routes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;behavior&#x20;is&#x20;expected.&#x20;The&#x20;problem&#x20;is&#x20;that&#x20;the&#x20;10&#x20;minute&#x20;time-out&#x20;period&#x20;for&#x20;the&#x20;ICMP&#x20;redirect-plumbed&#x20;routes&#x20;temporarily&#x20;creates&#x20;a&#x20;network&#x20;situation&#x20;in&#x20;which&#x20;traffic&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;routed&#x20;properly&#x20;for&#x20;the&#x20;affected&#x20;host.&#x20;Ignoring&#x20;such&#x20;ICMP&#x20;redirects&#x20;will&#x20;limit&#x20;the&#x20;system&#039;s&#x20;exposure&#x20;to&#x20;attacks&#x20;that&#x20;will&#x20;impact&#x20;its&#x20;ability&#x20;to&#x20;participate&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.5\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(15694,'Ensure&#x20;&#039;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recomme','This&#x20;value&#x20;controls&#x20;how&#x20;often&#x20;TCP&#x20;attempts&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;idle&#x20;connection&#x20;is&#x20;still&#x20;intact&#x20;by&#x20;sending&#x20;a&#x20;keep-alive&#x20;packet.&#x20;If&#x20;the&#x20;remote&#x20;computer&#x20;is&#x20;still&#x20;reachable,&#x20;it&#x20;acknowledges&#x20;the&#x20;keep-alive&#x20;packet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;.','An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;network&#x20;applications&#x20;could&#x20;establish&#x20;numerous&#x20;connections&#x20;to&#x20;cause&#x20;a&#x20;DoS&#x20;condition.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.6\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15695,'Ensure&#x20;&#039;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enab','NetBIOS&#x20;over&#x20;TCP/IP&#x20;is&#x20;a&#x20;network&#x20;protocol&#x20;that&#x20;among&#x20;other&#x20;things&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;easily&#x20;resolve&#x20;NetBIOS&#x20;names&#x20;that&#x20;are&#x20;registered&#x20;on&#x20;Windows-based&#x20;systems&#x20;to&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;configured&#x20;on&#x20;those&#x20;systems.&#x20;This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;computer&#x20;releases&#x20;its&#x20;NetBIOS&#x20;name&#x20;when&#x20;it&#x20;receives&#x20;a&#x20;name-release&#x20;request.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;NetBT&#x20;protocol&#x20;is&#x20;designed&#x20;not&#x20;to&#x20;use&#x20;authentication,&#x20;and&#x20;is&#x20;therefore&#x20;vulnerable&#x20;to&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;exploit&#x20;the&#x20;unauthenticated&#x20;nature&#x20;of&#x20;the&#x20;protocol&#x20;to&#x20;send&#x20;a&#x20;name-conflict&#x20;datagram&#x20;to&#x20;a&#x20;target&#x20;computer,&#x20;which&#x20;would&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;relinquish&#x20;its&#x20;name&#x20;and&#x20;not&#x20;respond&#x20;to&#x20;queries.&#x20;An&#x20;attacker&#x20;could&#x20;send&#x20;a&#x20;request&#x20;over&#x20;the&#x20;network&#x20;and&#x20;query&#x20;a&#x20;computer&#x20;to&#x20;release&#x20;its&#x20;NetBIOS&#x20;name.&#x20;As&#x20;with&#x20;any&#x20;change&#x20;that&#x20;could&#x20;affect&#x20;applications,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;test&#x20;this&#x20;change&#x20;in&#x20;a&#x20;non-production&#x20;environment&#x20;before&#x20;you&#x20;change&#x20;the&#x20;production&#x20;environment.&#x20;The&#x20;result&#x20;of&#x20;such&#x20;an&#x20;attack&#x20;could&#x20;be&#x20;to&#x20;cause&#x20;intermittent&#x20;connectivity&#x20;issues&#x20;on&#x20;the&#x20;target&#x20;computer,&#x20;or&#x20;even&#x20;to&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;Network&#x20;Neighborhood,&#x20;domain&#x20;logons,&#x20;the&#x20;NET&#x20;SEND&#x20;command,&#x20;or&#x20;additional&#x20;NetBIOS&#x20;name&#x20;resolution.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.7\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15696,'Ensure&#x20;&#039;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','This&#x20;setting&#x20;is&#x20;used&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;the&#x20;Internet&#x20;Router&#x20;Discovery&#x20;Protocol&#x20;&#40;IRDP&#41;,&#x20;which&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;default&#x20;gateway&#x20;addresses&#x20;automatically&#x20;as&#x20;described&#x20;in&#x20;RFC&#x20;1256&#x20;on&#x20;a&#x20;per-interface&#x20;basis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;control&#x20;of&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;network&#x20;segment&#x20;could&#x20;configure&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;network&#x20;to&#x20;impersonate&#x20;a&#x20;router.&#x20;Other&#x20;computers&#x20;with&#x20;IRDP&#x20;enabled&#x20;would&#x20;then&#x20;attempt&#x20;to&#x20;route&#x20;their&#x20;traffic&#x20;through&#x20;the&#x20;already&#x20;compromised&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.8\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15697,'Ensure&#x20;&#039;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;DLL&#x20;search&#x20;order&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;that&#x20;are&#x20;requested&#x20;by&#x20;running&#x20;processes&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;Search&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;-&#x20;Search&#x20;current&#x20;working&#x20;folder&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;When&#x20;enabled,&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;1.&#x20;With&#x20;a&#x20;setting&#x20;of&#x20;1,&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;When&#x20;disabled&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0&#x20;and&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;Applications&#x20;will&#x20;be&#x20;forced&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first.&#x20;For&#x20;applications&#x20;that&#x20;require&#x20;unique&#x20;versions&#x20;of&#x20;these&#x20;DLLs&#x20;that&#x20;are&#x20;included&#x20;with&#x20;the&#x20;application,&#x20;this&#x20;entry&#x20;could&#x20;cause&#x20;performance&#x20;or&#x20;stability&#x20;problems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;More&#x20;information&#x20;on&#x20;how&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;works&#x20;is&#x20;available&#x20;at&#x20;this&#x20;link:&#x20;Dynamic-Link&#x20;Library&#x20;Search&#x20;Order&#x20;-&#x20;Windows&#x20;applications&#x20;|&#x20;Microsoft&#x20;Docs','If&#x20;a&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;was&#x20;packaged&#x20;with&#x20;additional&#x20;files&#x20;that&#x20;include&#x20;modified&#x20;versions&#x20;of&#x20;system&#x20;DLLs,&#x20;the&#x20;hostile&#x20;code&#x20;could&#x20;load&#x20;its&#x20;own&#x20;versions&#x20;of&#x20;those&#x20;DLLs&#x20;and&#x20;potentially&#x20;increase&#x20;the&#x20;type&#x20;and&#x20;degree&#x20;of&#x20;damage&#x20;the&#x20;code&#x20;can&#x20;render.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.9\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15698,'Ensure&#x20;&#039;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','Windows&#x20;includes&#x20;a&#x20;grace&#x20;period&#x20;between&#x20;when&#x20;the&#x20;screen&#x20;saver&#x20;is&#x20;launched&#x20;and&#x20;when&#x20;the&#x20;console&#x20;is&#x20;actually&#x20;locked&#x20;automatically&#x20;when&#x20;screen&#x20;saver&#x20;locking&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds.','The&#x20;default&#x20;grace&#x20;period&#x20;that&#x20;is&#x20;allowed&#x20;for&#x20;user&#x20;movement&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;lock&#x20;takes&#x20;effect&#x20;is&#x20;five&#x20;seconds.&#x20;If&#x20;you&#x20;leave&#x20;the&#x20;default&#x20;grace&#x20;period&#x20;configuration,&#x20;your&#x20;computer&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;potential&#x20;attack&#x20;from&#x20;someone&#x20;who&#x20;could&#x20;approach&#x20;the&#x20;console&#x20;and&#x20;attempt&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;before&#x20;the&#x20;lock&#x20;takes&#x20;effect.&#x20;An&#x20;entry&#x20;to&#x20;the&#x20;registry&#x20;can&#x20;be&#x20;made&#x20;to&#x20;adjust&#x20;the&#x20;length&#x20;of&#x20;the&#x20;grace&#x20;period.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15699,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;.','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.11\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15700,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;.','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.12\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(15701,'Ensure&#x20;&#039;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#039;&#x20;is&#x20;set&#x20;to&#x20;&','This&#x20;setting&#x20;can&#x20;generate&#x20;a&#x20;security&#x20;audit&#x20;in&#x20;the&#x20;Security&#x20;event&#x20;log&#x20;when&#x20;the&#x20;log&#x20;reaches&#x20;a&#x20;user-defined&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;90%&#x20;or&#x20;less.&#x20;Note:&#x20;If&#x20;log&#x20;settings&#x20;are&#x20;configured&#x20;to&#x20;Overwrite&#x20;events&#x20;as&#x20;needed&#x20;or&#x20;Overwrite&#x20;events&#x20;older&#x20;than&#x20;x&#x20;days,&#x20;this&#x20;event&#x20;will&#x20;not&#x20;be&#x20;generated.','If&#x20;the&#x20;Security&#x20;log&#x20;reaches&#x20;90&#x20;percent&#x20;of&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;not&#x20;been&#x20;configured&#x20;to&#x20;overwrite&#x20;events&#x20;as&#x20;needed,&#x20;more&#x20;recent&#x20;events&#x20;will&#x20;not&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.&#x20;If&#x20;the&#x20;log&#x20;reaches&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;shut&#x20;down&#x20;when&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;the&#x20;computer&#x20;will&#x20;shut&#x20;down&#x20;and&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;available&#x20;to&#x20;provide&#x20;network&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;90%&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.13\"]}, {\"pci_dss\": [\"10.7\"]}]'),(15702,'Ensure&#x20;&#039;Configure&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Allow&#x20;DoH&#039;&#x20;or&#x20;higher.','This&#x20;setting&#x20;determines&#x20;if&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;is&#x20;used&#x20;by&#x20;the&#x20;system.&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;is&#x20;a&#x20;protocol&#x20;for&#x20;performing&#x20;remote&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;resolution&#x20;over&#x20;the&#x20;Hypertext&#x20;Transfer&#x20;Protocol&#x20;Secure&#x20;&#40;HTTPS&#41;.&#x20;For&#x20;additional&#x20;information&#x20;on&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;,&#x20;visit:&#x20;Secure&#x20;DNS&#x20;Client&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;on&#x20;Windows&#x20;Server&#x20;2022&#x20;|&#x20;Microsoft&#x20;Docs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Allow&#x20;DoH.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Enabled:&#x20;Require&#x20;DoH&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;helps&#x20;protect&#x20;against&#x20;DNS&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;It&#x20;can&#x20;also&#x20;help&#x20;prevent&#x20;man-in-the-middle&#x20;&#40;MitM&#41;&#x20;attacks&#x20;because&#x20;the&#x20;session&#x20;in-between&#x20;is&#x20;encrypted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Allow&#x20;DoH&#x20;&#40;configuring&#x20;to&#x20;Enabled:&#x20;Require&#x20;DoH&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientConfigure&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;name&#x20;resolution.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.1\"]}, {\"cis_csc\": [\"3.10\"]}]'),(15703,'Ensure&#x20;&#039;Turn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','LLMNR&#x20;is&#x20;a&#x20;secondary&#x20;name&#x20;resolution&#x20;protocol.&#x20;With&#x20;LLMNR,&#x20;queries&#x20;are&#x20;sent&#x20;using&#x20;multicast&#x20;over&#x20;a&#x20;local&#x20;network&#x20;link&#x20;on&#x20;a&#x20;single&#x20;subnet&#x20;from&#x20;a&#x20;client&#x20;computer&#x20;to&#x20;another&#x20;client&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;subnet&#x20;that&#x20;also&#x20;has&#x20;LLMNR&#x20;enabled.&#x20;LLMNR&#x20;does&#x20;not&#x20;require&#x20;a&#x20;DNS&#x20;server&#x20;or&#x20;DNS&#x20;client&#x20;configuration,&#x20;and&#x20;provides&#x20;name&#x20;resolution&#x20;in&#x20;scenarios&#x20;in&#x20;which&#x20;conventional&#x20;DNS&#x20;name&#x20;resolution&#x20;is&#x20;not&#x20;possible.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;can&#x20;listen&#x20;on&#x20;a&#x20;network&#x20;for&#x20;these&#x20;LLMNR&#x20;&#40;UDP/5355&#41;&#x20;or&#x20;NBT-NS&#x20;&#40;UDP/137&#41;&#x20;broadcasts&#x20;and&#x20;respond&#x20;to&#x20;them,&#x20;tricking&#x20;the&#x20;host&#x20;into&#x20;thinking&#x20;that&#x20;it&#x20;knows&#x20;the&#x20;location&#x20;of&#x20;the&#x20;requested&#x20;system.&#x20;Note:&#x20;To&#x20;completely&#x20;mitigate&#x20;local&#x20;name&#x20;resolution&#x20;poisoning,&#x20;in&#x20;addition&#x20;to&#x20;this&#x20;setting,&#x20;the&#x20;properties&#x20;of&#x20;each&#x20;installed&#x20;NIC&#x20;should&#x20;also&#x20;be&#x20;set&#x20;to&#x20;Disable&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;on&#x20;the&#x20;WINS&#x20;tab&#x20;in&#x20;the&#x20;NIC&#x20;properties&#41;.&#x20;Unfortunately,&#x20;there&#x20;is&#x20;no&#x20;global&#x20;setting&#x20;to&#x20;achieve&#x20;this&#x20;that&#x20;automatically&#x20;applies&#x20;to&#x20;all&#x20;NICs&#x20;-&#x20;it&#x20;is&#x20;a&#x20;per-NIC&#x20;setting&#x20;that&#x20;varies&#x20;with&#x20;different&#x20;NIC&#x20;hardware&#x20;installations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientTurn&#x20;off&#x20;multicast&#x20;name&#x20;resolution.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15704,'Ensure&#x20;&#039;Enable&#x20;Font&#x20;Providers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;is&#x20;allowed&#x20;to&#x20;download&#x20;fonts&#x20;and&#x20;font&#x20;catalog&#x20;data&#x20;from&#x20;an&#x20;online&#x20;font&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;configuration,&#x20;to&#x20;ensure&#x20;all&#x20;changes&#x20;are&#x20;tested&#x20;and&#x20;approved.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkFontsEnable&#x20;Font&#x20;Providers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.5.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15705,'Ensure&#x20;&#039;Enable&#x20;insecure&#x20;guest&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;if&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;allow&#x20;insecure&#x20;guest&#x20;logons&#x20;to&#x20;an&#x20;SMB&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Insecure&#x20;guest&#x20;logons&#x20;are&#x20;used&#x20;by&#x20;file&#x20;servers&#x20;to&#x20;allow&#x20;unauthenticated&#x20;access&#x20;to&#x20;shared&#x20;folders.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLanman&#x20;WorkstationEnable&#x20;insecure&#x20;guest&#x20;logons.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LanmanWorkstation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.8.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15706,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Mapper&#x20;I/O&#x20;network&#x20;protocol&#x20;driver.&#x20;LLTDIO&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;discover&#x20;the&#x20;topology&#x20;of&#x20;a&#x20;network&#x20;it&#039;s&#x20;connected&#x20;to.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;initiate&#x20;Quality-of-Service&#x20;requests&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15707,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Responder&#x20;network&#x20;protocol&#x20;driver.&#x20;The&#x20;Responder&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Link&#x20;Layer&#x20;Topology&#x20;Discovery&#x20;requests&#x20;so&#x20;that&#x20;it&#x20;can&#x20;be&#x20;discovered&#x20;and&#x20;located&#x20;on&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Quality-of-Service&#x20;activities&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.2\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15708,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;allows&#x20;for&#x20;distributed&#x20;resolution&#x20;of&#x20;a&#x20;name&#x20;to&#x20;an&#x20;IPv6&#x20;address&#x20;and&#x20;port&#x20;number.&#x20;The&#x20;protocol&#x20;operates&#x20;in&#x20;the&#x20;context&#x20;of&#x20;clouds.&#x20;A&#x20;cloud&#x20;is&#x20;a&#x20;set&#x20;of&#x20;peer&#x20;computers&#x20;that&#x20;can&#x20;communicate&#x20;with&#x20;each&#x20;other&#x20;by&#x20;using&#x20;the&#x20;same&#x20;IPv6&#x20;scope.&#x20;Peer-to-Peer&#x20;protocols&#x20;allow&#x20;for&#x20;applications&#x20;in&#x20;the&#x20;areas&#x20;of&#x20;RTC,&#x20;collaboration,&#x20;content&#x20;distribution&#x20;and&#x20;distributed&#x20;processing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;peer-to-peer&#x20;networking.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkMicrosoft&#x20;Peer-to-Peer&#x20;Networking&#x20;ServicesTurn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;P2P-&#x20;pnrp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.10.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15709,'Ensure&#x20;&#039;Prohibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','You&#x20;can&#x20;use&#x20;this&#x20;procedure&#x20;to&#x20;control&#x20;a&#x20;user&#039;s&#x20;ability&#x20;to&#x20;install&#x20;and&#x20;configure&#x20;a&#x20;Network&#x20;Bridge.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Network&#x20;Bridge&#x20;setting,&#x20;if&#x20;enabled,&#x20;allows&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Layer&#x20;2&#x20;Media&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;bridge,&#x20;enabling&#x20;them&#x20;to&#x20;connect&#x20;two&#x20;or&#x20;more&#x20;physical&#x20;network&#x20;segments&#x20;together.&#x20;A&#x20;Network&#x20;Bridge&#x20;thus&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;has&#x20;connections&#x20;to&#x20;two&#x20;different&#x20;networks&#x20;to&#x20;share&#x20;data&#x20;between&#x20;those&#x20;networks.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;where&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;control&#x20;network&#x20;traffic&#x20;to&#x20;only&#x20;authorized&#x20;paths,&#x20;allowing&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Network&#x20;Bridge&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface&#x20;from&#x20;the&#x20;bridged&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.2\"]}, {\"cis_csc\": [\"12.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(15710,'Ensure&#x20;&#039;Prohibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Although&#x20;this&#x20;&#039;legacy&#039;&#x20;setting&#x20;traditionally&#x20;applied&#x20;to&#x20;the&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;in&#x20;Windows&#x20;2000,&#x20;Windows&#x20;XP&#x20;&amp;&#x20;Server&#x20;2003,&#x20;this&#x20;setting&#x20;now&#x20;freshly&#x20;applies&#x20;to&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;in&#x20;Windows&#x20;10&#x20;&amp;&#x20;Server&#x20;2016.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Non-administrators&#x20;should&#x20;not&#x20;be&#x20;able&#x20;to&#x20;turn&#x20;on&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;and&#x20;open&#x20;their&#x20;Internet&#x20;connectivity&#x20;up&#x20;to&#x20;nearby&#x20;mobile&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.3\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15711,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.4\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(15712,'Ensure&#x20;&#039;Hardened&#x20;UNC&#x20;Paths&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&','This&#x20;policy&#x20;setting&#x20;configures&#x20;secure&#x20;access&#x20;to&#x20;UNC&#x20;paths.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled,&#x20;with&#x20;Require&#x20;Mutual&#x20;Authentication&#x20;and&#x20;Require&#x20;Integrity&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&#x20;and&#x20;SYSVOL&#x20;shares.&#x20;Note:&#x20;If&#x20;the&#x20;environment&#x20;exclusively&#x20;contains&#x20;Windows&#x20;8.0&#x20;/&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;systems,&#x20;then&#x20;the&#x20;&quot;Privacy&quot;&#x20;setting&#x20;may&#x20;&#40;optionally&#41;&#x20;also&#x20;be&#x20;set&#x20;to&#x20;enable&#x20;SMB&#x20;encryption.&#x20;However,&#x20;using&#x20;SMB&#x20;encryption&#x20;will&#x20;render&#x20;the&#x20;targeted&#x20;share&#x20;paths&#x20;completely&#x20;inaccessible&#x20;by&#x20;older&#x20;OSes,&#x20;so&#x20;only&#x20;use&#x20;this&#x20;additional&#x20;option&#x20;with&#x20;caution&#x20;and&#x20;thorough&#x20;testing.','In&#x20;February&#x20;2015,&#x20;Microsoft&#x20;released&#x20;a&#x20;new&#x20;control&#x20;mechanism&#x20;to&#x20;mitigate&#x20;a&#x20;security&#x20;risk&#x20;in&#x20;Group&#x20;Policy&#x20;as&#x20;part&#x20;of&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update.&#x20;This&#x20;mechanism&#x20;requires&#x20;both&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;new&#x20;security&#x20;update&#x20;and&#x20;also&#x20;the&#x20;deployment&#x20;of&#x20;specific&#x20;group&#x20;policy&#x20;settings&#x20;to&#x20;all&#x20;computers&#x20;on&#x20;the&#x20;domain&#x20;from&#x20;Windows&#x20;Vista&#x20;/&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;&#40;the&#x20;associated&#x20;security&#x20;patch&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;was&#x20;not&#x20;released&#x20;for&#x20;Server&#x20;2003&#41;.&#x20;A&#x20;new&#x20;group&#x20;policy&#x20;template&#x20;&#40;NetworkProvider.admx/adml&#41;&#x20;was&#x20;also&#x20;provided&#x20;with&#x20;the&#x20;security&#x20;update.&#x20;Once&#x20;the&#x20;new&#x20;GPO&#x20;template&#x20;is&#x20;in&#x20;place,&#x20;the&#x20;following&#x20;are&#x20;the&#x20;minimum&#x20;requirements&#x20;to&#x20;remediate&#x20;the&#x20;Group&#x20;Policy&#x20;security&#x20;risk:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Note:&#x20;A&#x20;reboot&#x20;may&#x20;be&#x20;required&#x20;after&#x20;the&#x20;setting&#x20;is&#x20;applied&#x20;to&#x20;a&#x20;client&#x20;machine&#x20;to&#x20;access&#x20;the&#x20;above&#x20;paths.&#x20;Additional&#x20;guidance&#x20;on&#x20;the&#x20;deployment&#x20;of&#x20;this&#x20;security&#x20;setting&#x20;is&#x20;available&#x20;from&#x20;the&#x20;Microsoft&#x20;Premier&#x20;Field&#x20;Engineering&#x20;&#40;PFE&#41;&#x20;Platforms&#x20;TechNet&#x20;Blog&#x20;here:&#x20;Guidance&#x20;on&#x20;Deployment&#x20;of&#x20;MS15-011&#x20;and&#x20;MS15-014.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;the&#x20;following&#x20;paths&#x20;configured,&#x20;at&#x20;a&#x20;minimum:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ProviderHardened&#x20;UNC&#x20;Paths.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;NetworkProvider.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.5.14.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15713,'Disable&#x20;IPv6&#x20;&#40;Ensure&#x20;TCPIP6&#x20;Parameter&#x20;&#039;DisabledComponents&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0xff&#x20;&#40;255&#41;&#039;&#41;.','Internet&#x20;Protocol&#x20;version&#x20;6&#x20;&#40;IPv6&#41;&#x20;is&#x20;a&#x20;set&#x20;of&#x20;protocols&#x20;that&#x20;computers&#x20;use&#x20;to&#x20;exchange&#x20;information&#x20;over&#x20;the&#x20;Internet&#x20;and&#x20;over&#x20;home&#x20;and&#x20;business&#x20;networks.&#x20;IPv6&#x20;allows&#x20;for&#x20;many&#x20;more&#x20;IP&#x20;addresses&#x20;to&#x20;be&#x20;assigned&#x20;than&#x20;IPv4&#x20;did.&#x20;Older&#x20;networking,&#x20;hosts&#x20;and&#x20;operating&#x20;systems&#x20;may&#x20;not&#x20;support&#x20;IPv6&#x20;natively.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;DisabledComponents&#x20;-&#x20;0xff&#x20;&#40;255&#41;','Since&#x20;the&#x20;vast&#x20;majority&#x20;of&#x20;private&#x20;enterprise&#x20;managed&#x20;networks&#x20;have&#x20;no&#x20;need&#x20;to&#x20;utilize&#x20;IPv6&#x20;&#40;because&#x20;they&#x20;have&#x20;access&#x20;to&#x20;private&#x20;IPv4&#x20;addressing&#41;,&#x20;disabling&#x20;IPv6&#x20;components&#x20;removes&#x20;a&#x20;possible&#x20;attack&#x20;surface&#x20;that&#x20;is&#x20;also&#x20;harder&#x20;to&#x20;monitor&#x20;the&#x20;traffic&#x20;on.&#x20;As&#x20;a&#x20;result,&#x20;we&#x20;recommend&#x20;configuring&#x20;IPv6&#x20;to&#x20;a&#x20;Disabled&#x20;state&#x20;when&#x20;it&#x20;is&#x20;not&#x20;needed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0xff&#x20;&#40;255&#41;&#x20;&#40;DWORD&#41;:&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTCPIP6Parameters:DisabledComponents.&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;Although&#x20;Microsoft&#x20;does&#x20;not&#x20;provide&#x20;an&#x20;ADMX&#x20;template&#x20;to&#x20;configure&#x20;this&#x20;registry&#x20;value,&#x20;a&#x20;custom&#x20;.ADM&#x20;template&#x20;&#40;Disable-IPv6-Components-KB929852.adm&#41;&#x20;is&#x20;provided&#x20;in&#x20;the&#x20;CIS&#x20;Benchmark&#x20;Remediation&#x20;Kit&#x20;to&#x20;facilitate&#x20;its&#x20;configuration.&#x20;Be&#x20;aware&#x20;though&#x20;that&#x20;simply&#x20;turning&#x20;off&#x20;the&#x20;group&#x20;policy&#x20;setting&#x20;in&#x20;the&#x20;.ADM&#x20;template&#x20;will&#x20;not&#x20;&quot;undo&quot;&#x20;the&#x20;change&#x20;once&#x20;applied.&#x20;Instead,&#x20;the&#x20;opposite&#x20;setting&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;change&#x20;the&#x20;registry&#x20;value&#x20;to&#x20;the&#x20;opposite&#x20;state.','[{\"cis\": [\"18.5.19.2.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15714,'Ensure&#x20;&#039;Configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;the&#x20;configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;.&#x20;The&#x20;WCN&#x20;Registrar&#x20;enables&#x20;the&#x20;discovery&#x20;and&#x20;configuration&#x20;of&#x20;devices&#x20;over&#x20;Ethernet&#x20;&#40;UPnP&#41;&#x20;over&#x20;in-band&#x20;802.11&#x20;Wi-Fi&#x20;through&#x20;the&#x20;Windows&#x20;Portable&#x20;Device&#x20;API&#x20;&#40;WPD&#41;&#x20;and&#x20;via&#x20;USB&#x20;Flash&#x20;drives.&#x20;Additional&#x20;options&#x20;are&#x20;available&#x20;to&#x20;allow&#x20;discovery&#x20;and&#x20;configuration&#x20;over&#x20;a&#x20;specific&#x20;medium.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;user&#x20;configuration&#x20;of&#x20;wireless&#x20;settings.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowConfiguration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.20.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15715,'Ensure&#x20;&#039;Prohibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prohibits&#x20;access&#x20;to&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;standard&#x20;users&#x20;to&#x20;access&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizard&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowProhibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.20.2\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15716,'Ensure&#x20;&#039;Minimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;establishing&#x20;multiple&#x20;simultaneous&#x20;connections&#x20;to&#x20;either&#x20;the&#x20;Internet&#x20;or&#x20;to&#x20;a&#x20;Windows&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20;when&#x20;on&#x20;Ethernet.','Preventing&#x20;bridged&#x20;network&#x20;connections&#x20;can&#x20;help&#x20;prevent&#x20;a&#x20;user&#x20;unknowingly&#x20;allowing&#x20;traffic&#x20;to&#x20;route&#x20;between&#x20;internal&#x20;and&#x20;external&#x20;networks,&#x20;which&#x20;risks&#x20;exposure&#x20;to&#x20;sensitive&#x20;internal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20;when&#x20;on&#x20;Ethernet:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerMinimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;updated&#x20;with&#x20;a&#x20;new&#x20;Minimize&#x20;Policy&#x20;Options&#x20;sub-setting&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.21.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15717,'Ensure&#x20;&#039;Prohibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;potential&#x20;concern&#x20;is&#x20;that&#x20;a&#x20;user&#x20;would&#x20;unknowingly&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;insecure&#x20;public&#x20;network&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerProhibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.21.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15718,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots,&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;contacts,&#x20;and&#x20;to&#x20;hotspots&#x20;offering&#x20;paid&#x20;services&#039','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;enable&#x20;the&#x20;following&#x20;WLAN&#x20;settings:&#x20;Connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots,&#x20;Connect&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;my&#x20;contacts,&#x20;and&#x20;Enable&#x20;paid&#x20;services.&#x20;-&#x20;Connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots&#x20;enables&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;users&#x20;to&#x20;open&#x20;hotspots&#x20;it&#x20;knows&#x20;about&#x20;by&#x20;crowdsourcing&#x20;networks&#x20;that&#x20;other&#x20;people&#x20;using&#x20;Windows&#x20;have&#x20;connected&#x20;to.&#x20;-&#x20;Connect&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;my&#x20;contacts&#x20;enables&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;to&#x20;networks&#x20;that&#x20;the&#x20;user&#039;s&#x20;contacts&#x20;have&#x20;shared&#x20;with&#x20;them,&#x20;and&#x20;enables&#x20;users&#x20;on&#x20;this&#x20;device&#x20;to&#x20;share&#x20;networks&#x20;with&#x20;their&#x20;contacts.&#x20;-&#x20;Enable&#x20;paid&#x20;services&#x20;enables&#x20;Windows&#x20;to&#x20;temporarily&#x20;connect&#x20;to&#x20;open&#x20;hotspots&#x20;to&#x20;determine&#x20;if&#x20;paid&#x20;services&#x20;are&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;These&#x20;features&#x20;are&#x20;also&#x20;known&#x20;by&#x20;the&#x20;name&#x20;&quot;Wi-Fi&#x20;Sense&quot;.','Automatically&#x20;connecting&#x20;to&#x20;an&#x20;open&#x20;hotspot&#x20;or&#x20;network&#x20;can&#x20;introduce&#x20;the&#x20;system&#x20;to&#x20;a&#x20;rogue&#x20;network&#x20;with&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWLAN&#x20;ServiceWLAN&#x20;SettingsAllow&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots,&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;contacts,&#x20;and&#x20;to&#x20;hotspots&#x20;offering&#x20;paid&#x20;services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;wlansvc.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.23.2.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15719,'Ensure&#x20;&#039;Allow&#x20;Print&#x20;Spooler&#x20;to&#x20;accept&#x20;client&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Print&#x20;Spooler&#x20;service&#x20;will&#x20;accept&#x20;client&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Print&#x20;Spooler&#x20;service&#x20;must&#x20;be&#x20;restarted&#x20;for&#x20;changes&#x20;to&#x20;this&#x20;policy&#x20;to&#x20;take&#x20;effect.','Disabling&#x20;the&#x20;ability&#x20;for&#x20;the&#x20;Print&#x20;Spooler&#x20;service&#x20;to&#x20;accept&#x20;client&#x20;connections&#x20;mitigates&#x20;remote&#x20;attacks&#x20;against&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;remote&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;However,&#x20;this&#x20;recommendation&#x20;does&#x20;not&#x20;mitigate&#x20;against&#x20;local&#x20;attacks&#x20;on&#x20;the&#x20;Print&#x20;Spooler&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersAllow&#x20;Print&#x20;Spooler&#x20;to&#x20;accept&#x20;client&#x20;connections.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;printing2.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.1\"]}]'),(15720,'Ensure&#x20;&#039;Point&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;installing&#x20;drivers&#x20;for&#x20;a&#x20;new&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt&#0','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;computers&#x20;will&#x20;show&#x20;a&#x20;warning&#x20;and&#x20;a&#x20;security&#x20;elevation&#x20;prompt&#x20;when&#x20;users&#x20;create&#x20;a&#x20;new&#x20;printer&#x20;connection&#x20;using&#x20;Point&#x20;and&#x20;Print.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.&#x20;This&#x20;change&#x20;overrides&#x20;all&#x20;Point&#x20;and&#x20;Print&#x20;Group&#x20;Policy&#x20;settings&#x20;and&#x20;ensures&#x20;that&#x20;only&#x20;Administrators&#x20;can&#x20;install&#x20;printer&#x20;drivers&#x20;from&#x20;a&#x20;print&#x20;server&#x20;using&#x20;Point&#x20;and&#x20;Print.','Enabling&#x20;Windows&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;for&#x20;the&#x20;installation&#x20;of&#x20;new&#x20;print&#x20;drivers&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;Although&#x20;the&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;overrides&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;configure&#x20;this&#x20;as&#x20;a&#x20;backstop&#x20;in&#x20;the&#x20;event&#x20;that&#x20;behavior&#x20;is&#x20;reversed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersPoint&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;installing&#x20;drivers&#x20;for&#x20;a&#x20;new&#x20;connection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.2\"]}]'),(15721,'Ensure&#x20;&#039;Point&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;promp','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;computers&#x20;will&#x20;show&#x20;a&#x20;warning&#x20;and&#x20;a&#x20;security&#x20;elevation&#x20;prompt&#x20;when&#x20;users&#x20;are&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#x20;using&#x20;Point&#x20;and&#x20;Print.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.&#x20;This&#x20;change&#x20;overrides&#x20;all&#x20;Point&#x20;and&#x20;Print&#x20;Group&#x20;Policy&#x20;settings&#x20;and&#x20;ensures&#x20;that&#x20;only&#x20;Administrators&#x20;can&#x20;install&#x20;printer&#x20;drivers&#x20;from&#x20;a&#x20;print&#x20;server&#x20;using&#x20;Point&#x20;and&#x20;Print.','Enabling&#x20;Windows&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;for&#x20;updating&#x20;existing&#x20;print&#x20;drivers&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;Although&#x20;the&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;overrides&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;configure&#x20;this&#x20;as&#x20;a&#x20;backstop&#x20;in&#x20;the&#x20;event&#x20;that&#x20;behavior&#x20;is&#x20;reversed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersPoint&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.3\"]}]'),(15722,'Ensure&#x20;&#039;Turn&#x20;off&#x20;notifications&#x20;network&#x20;usage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;blocks&#x20;applications&#x20;from&#x20;using&#x20;the&#x20;network&#x20;to&#x20;send&#x20;notifications&#x20;to&#x20;update&#x20;tiles,&#x20;tile&#x20;badges,&#x20;toast,&#x20;or&#x20;raw&#x20;notifications.&#x20;This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;connection&#x20;between&#x20;Windows&#x20;and&#x20;the&#x20;Windows&#x20;Push&#x20;Notification&#x20;Service&#x20;&#40;WNS&#41;.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;stops&#x20;applications&#x20;from&#x20;being&#x20;able&#x20;to&#x20;poll&#x20;application&#x20;services&#x20;to&#x20;update&#x20;tiles.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Windows&#x20;Push&#x20;Notification&#x20;Services&#x20;&#40;WNS&#41;&#x20;is&#x20;a&#x20;mechanism&#x20;to&#x20;receive&#x20;3rd-party&#x20;notifications&#x20;and&#x20;updates&#x20;from&#x20;the&#x20;cloud/Internet.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;external&#x20;systems,&#x20;especially&#x20;those&#x20;hosted&#x20;outside&#x20;the&#x20;organization,&#x20;should&#x20;be&#x20;prevented&#x20;from&#x20;having&#x20;an&#x20;impact&#x20;on&#x20;the&#x20;secure&#x20;workstations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesStart&#x20;Menu&#x20;and&#x20;TaskbarTurn&#x20;off&#x20;notifications&#x20;network&#x20;usage.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WPN.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.7.1.1\"]}]'),(15723,'Ensure&#x20;&#039;Include&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;process&#x20;creation&#x20;command&#x20;line&#x20;text&#x20;is&#x20;logged&#x20;in&#x20;security&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;feature&#x20;that&#x20;this&#x20;setting&#x20;controls&#x20;was&#x20;not&#x20;originally&#x20;supported&#x20;in&#x20;workstation&#x20;OSes&#x20;older&#x20;than&#x20;Windows&#x20;8.1.&#x20;However,&#x20;in&#x20;February&#x20;2015&#x20;Microsoft&#x20;added&#x20;support&#x20;for&#x20;the&#x20;feature&#x20;to&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;8.0&#x20;via&#x20;an&#x20;update&#x20;-&#x20;KB3004375.&#x20;Therefore,&#x20;this&#x20;setting&#x20;is&#x20;also&#x20;important&#x20;to&#x20;set&#x20;on&#x20;those&#x20;older&#x20;OSes.','Capturing&#x20;process&#x20;command&#x20;line&#x20;information&#x20;in&#x20;event&#x20;logs&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;when&#x20;performing&#x20;forensic&#x20;investigations&#x20;of&#x20;attack&#x20;incidents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemAudit&#x20;Process&#x20;CreationInclude&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AuditSettings.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.3.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15724,'Ensure&#x20;&#039;Encryption&#x20;Oracle&#x20;Remediation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Force&#x20;Updated&#x20;Clients&#039;.','Some&#x20;versions&#x20;of&#x20;the&#x20;CredSSP&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;by&#x20;some&#x20;applications&#x20;&#40;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Connection&#41;&#x20;are&#x20;vulnerable&#x20;to&#x20;an&#x20;encryption&#x20;oracle&#x20;attack&#x20;against&#x20;the&#x20;client.&#x20;This&#x20;policy&#x20;controls&#x20;compatibility&#x20;with&#x20;vulnerable&#x20;clients&#x20;and&#x20;servers&#x20;and&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;level&#x20;of&#x20;protection&#x20;desired&#x20;for&#x20;the&#x20;encryption&#x20;oracle&#x20;vulnerability.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients.','This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;mitigate&#x20;the&#x20;CredSSP&#x20;encryption&#x20;oracle&#x20;vulnerability,&#x20;for&#x20;which&#x20;information&#x20;was&#x20;published&#x20;by&#x20;Microsoft&#x20;on&#x20;03/13/2018&#x20;in&#x20;CVE-2018-0886&#x20;|&#x20;CredSSP&#x20;Remote&#x20;Code&#x20;Execution&#x20;Vulnerability.&#x20;All&#x20;versions&#x20;of&#x20;Windows&#x20;from&#x20;Windows&#x20;Vista&#x20;onwards&#x20;are&#x20;affected&#x20;by&#x20;this&#x20;vulnerability,&#x20;and&#x20;will&#x20;be&#x20;compatible&#x20;with&#x20;this&#x20;recommendation&#x20;provided&#x20;that&#x20;they&#x20;have&#x20;been&#x20;patched&#x20;at&#x20;least&#x20;through&#x20;May&#x20;2018&#x20;&#40;or&#x20;later&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationEncryption&#x20;Oracle&#x20;Remediation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.1\"]}, {\"cis_csc\": [\"7.3\"]}]'),(15725,'Ensure&#x20;&#039;Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;When&#x20;using&#x20;credential&#x20;delegation,&#x20;devices&#x20;provide&#x20;an&#x20;exportable&#x20;version&#x20;of&#x20;credentials&#x20;to&#x20;the&#x20;remote&#x20;host.&#x20;This&#x20;exposes&#x20;users&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;credential&#x20;theft&#x20;from&#x20;attackers&#x20;on&#x20;the&#x20;remote&#x20;host.&#x20;The&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;and&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;features&#x20;are&#x20;two&#x20;options&#x20;to&#x20;help&#x20;protect&#x20;against&#x20;this&#x20;risk.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;More&#x20;detailed&#x20;information&#x20;on&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;and&#x20;how&#x20;it&#x20;compares&#x20;to&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;can&#x20;be&#x20;found&#x20;at&#x20;this&#x20;link:&#x20;Protect&#x20;Remote&#x20;Desktop&#x20;credentials&#x20;with&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs','Restricted&#x20;Admin&#x20;Mode&#x20;was&#x20;designed&#x20;to&#x20;help&#x20;protect&#x20;administrator&#x20;accounts&#x20;by&#x20;ensuring&#x20;that&#x20;reusable&#x20;credentials&#x20;are&#x20;not&#x20;stored&#x20;in&#x20;memory&#x20;on&#x20;remote&#x20;devices&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;compromised.&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;helps&#x20;you&#x20;protect&#x20;your&#x20;credentials&#x20;over&#x20;a&#x20;Remote&#x20;Desktop&#x20;connection&#x20;by&#x20;redirecting&#x20;Kerberos&#x20;requests&#x20;back&#x20;to&#x20;the&#x20;device&#x20;that&#x20;is&#x20;requesting&#x20;the&#x20;connection.&#x20;Both&#x20;features&#x20;should&#x20;be&#x20;enabled&#x20;and&#x20;supported,&#x20;as&#x20;they&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationRemote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15726,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Virtualization&#x20;Based&#x20;Security&#x20;is&#x20;enabled.&#x20;Virtualization&#x20;Based&#x20;Security&#x20;uses&#x20;the&#x20;Windows&#x20;Hypervisor&#x20;to&#x20;provide&#x20;support&#x20;for&#x20;security&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Kerberos,&#x20;NTLM,&#x20;and&#x20;Credential&#x20;manager&#x20;isolate&#x20;secrets&#x20;by&#x20;using&#x20;virtualization-based&#x20;security.&#x20;Previous&#x20;versions&#x20;of&#x20;Windows&#x20;stored&#x20;secrets&#x20;in&#x20;the&#x20;Local&#x20;Security&#x20;Authority&#x20;&#40;LSA&#41;.&#x20;Prior&#x20;to&#x20;Windows&#x20;10,&#x20;the&#x20;LSA&#x20;stored&#x20;secrets&#x20;used&#x20;by&#x20;the&#x20;operating&#x20;system&#x20;in&#x20;its&#x20;process&#x20;memory.&#x20;With&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;enabled,&#x20;the&#x20;LSA&#x20;process&#x20;in&#x20;the&#x20;operating&#x20;system&#x20;talks&#x20;to&#x20;a&#x20;new&#x20;component&#x20;called&#x20;the&#x20;isolated&#x20;LSA&#x20;process&#x20;that&#x20;stores&#x20;and&#x20;protects&#x20;those&#x20;secrets.&#x20;Data&#x20;stored&#x20;by&#x20;the&#x20;isolated&#x20;LSA&#x20;process&#x20;is&#x20;protected&#x20;using&#x20;virtualization-based&#x20;security&#x20;and&#x20;is&#x20;not&#x20;accessible&#x20;to&#x20;the&#x20;rest&#x20;of&#x20;the&#x20;operating&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.1\"]}, {\"cis_csc\": [\"10.5\"]}]'),(15727,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Select&#x20;Platform&#x20;Security&#x20;Level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Virtualization&#x20;Based&#x20;Security&#x20;is&#x20;enabled.&#x20;Virtualization&#x20;Based&#x20;Security&#x20;uses&#x20;the&#x20;Windows&#x20;Hypervisor&#x20;to&#x20;provide&#x20;support&#x20;for&#x20;security&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Secure&#x20;Boot&#x20;can&#x20;help&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;bootloader&#x20;attacks&#x20;and&#x20;in&#x20;conjunction&#x20;with&#x20;DMA&#x20;protections&#x20;to&#x20;help&#x20;protect&#x20;data&#x20;from&#x20;being&#x20;scraped&#x20;from&#x20;memory.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Select&#x20;Platform&#x20;Security&#x20;Level.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.2\"]}, {\"cis_csc\": [\"10.5\"]}]'),(15728,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#x20;with&#x20;UEFI&#x20;lock&#039;.','This&#x20;setting&#x20;enables&#x20;virtualization&#x20;based&#x20;protection&#x20;of&#x20;Kernel&#x20;Mode&#x20;Code&#x20;Integrity.&#x20;When&#x20;this&#x20;is&#x20;enabled,&#x20;kernel&#x20;mode&#x20;memory&#x20;protections&#x20;are&#x20;enforced&#x20;and&#x20;the&#x20;Code&#x20;Integrity&#x20;validation&#x20;path&#x20;is&#x20;protected&#x20;by&#x20;the&#x20;Virtualization&#x20;Based&#x20;Security&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','The&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;option&#x20;ensures&#x20;that&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(15729,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Require&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;True&#x20;&#40;checked&#41;&#039;.','This&#x20;option&#x20;will&#x20;only&#x20;enable&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;on&#x20;devices&#x20;with&#x20;UEFI&#x20;firmware&#x20;support&#x20;for&#x20;the&#x20;Memory&#x20;Attributes&#x20;Table.&#x20;Devices&#x20;without&#x20;the&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#x20;may&#x20;have&#x20;firmware&#x20;that&#x20;is&#x20;incompatible&#x20;with&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;which&#x20;in&#x20;some&#x20;cases&#x20;can&#x20;lead&#x20;to&#x20;crashes&#x20;or&#x20;data&#x20;loss&#x20;or&#x20;incompatibility&#x20;with&#x20;certain&#x20;plug-in&#x20;cards.&#x20;If&#x20;not&#x20;setting&#x20;this&#x20;option&#x20;the&#x20;targeted&#x20;devices&#x20;should&#x20;be&#x20;tested&#x20;to&#x20;ensure&#x20;compatibility.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;True&#x20;&#40;checked&#41;.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','This&#x20;setting&#x20;will&#x20;help&#x20;protect&#x20;this&#x20;control&#x20;from&#x20;being&#x20;enabled&#x20;on&#x20;a&#x20;system&#x20;that&#x20;is&#x20;not&#x20;compatible&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;a&#x20;crash&#x20;or&#x20;data&#x20;loss.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;TRUE:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Require&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.4\"]}, {\"cis_csc\": [\"10.5\"]}]'),(15730,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#x20;with&#x20;UEFI&#x20;lock&#039;.','This&#x20;setting&#x20;lets&#x20;users&#x20;turn&#x20;on&#x20;Credential&#x20;Guard&#x20;with&#x20;virtualization-based&#x20;security&#x20;to&#x20;help&#x20;protect&#x20;credentials.&#x20;The&#x20;&quot;Enabled&#x20;with&#x20;UEFI&#x20;lock&quot;&#x20;option&#x20;ensures&#x20;that&#x20;Credential&#x20;Guard&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.&#x20;In&#x20;order&#x20;to&#x20;disable&#x20;the&#x20;feature,&#x20;you&#x20;must&#x20;set&#x20;the&#x20;Group&#x20;Policy&#x20;to&#x20;&quot;Disabled&quot;&#x20;as&#x20;well&#x20;as&#x20;remove&#x20;the&#x20;security&#x20;functionality&#x20;from&#x20;each&#x20;computer,&#x20;with&#x20;a&#x20;physically&#x20;present&#x20;user,&#x20;in&#x20;order&#x20;to&#x20;clear&#x20;configuration&#x20;persisted&#x20;in&#x20;UEFI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','The&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;option&#x20;ensures&#x20;that&#x20;Credential&#x20;Guard&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.5\"]}, {\"cis_csc\": [\"10.5\"]}]'),(15731,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Secure&#x20;Launch&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Secure&#x20;Launch&#x20;protects&#x20;the&#x20;Virtualization&#x20;Based&#x20;Security&#x20;environment&#x20;from&#x20;exploited&#x20;vulnerabilities&#x20;in&#x20;device&#x20;firmware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Secure&#x20;Launch&#x20;changes&#x20;the&#x20;way&#x20;Windows&#x20;boots&#x20;to&#x20;use&#x20;Intel&#x20;Trusted&#x20;Execution&#x20;Technology&#x20;&#40;TXT&#41;&#x20;and&#x20;Runtime&#x20;BIOS&#x20;Resilience&#x20;features&#x20;to&#x20;prevent&#x20;firmware&#x20;exploits&#x20;from&#x20;being&#x20;able&#x20;to&#x20;impact&#x20;the&#x20;security&#x20;of&#x20;the&#x20;Windows&#x20;Virtualization&#x20;Based&#x20;Security&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Secure&#x20;Launch&#x20;Configuration.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.6\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15732,'Ensure&#x20;&#039;Prevent&#x20;device&#x20;metadata&#x20;retrieval&#x20;from&#x20;the&#x20;Internet&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;Windows&#x20;from&#x20;retrieving&#x20;device&#x20;metadata&#x20;from&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;will&#x20;not&#x20;prevent&#x20;the&#x20;installation&#x20;of&#x20;basic&#x20;hardware&#x20;drivers,&#x20;but&#x20;does&#x20;prevent&#x20;associated&#x20;3rd-party&#x20;utility&#x20;software&#x20;from&#x20;automatically&#x20;being&#x20;installed&#x20;under&#x20;the&#x20;context&#x20;of&#x20;the&#x20;SYSTEM&#x20;account.','Installation&#x20;of&#x20;software&#x20;should&#x20;be&#x20;conducted&#x20;by&#x20;an&#x20;authorized&#x20;system&#x20;administrator&#x20;and&#x20;not&#x20;a&#x20;standard&#x20;user.&#x20;Allowing&#x20;automatic&#x20;3rd-party&#x20;software&#x20;installations&#x20;under&#x20;the&#x20;context&#x20;of&#x20;the&#x20;SYSTEM&#x20;account&#x20;has&#x20;potential&#x20;for&#x20;allowing&#x20;unauthorized&#x20;access&#x20;via&#x20;backdoors&#x20;or&#x20;installation&#x20;software&#x20;bugs.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;InstallationPrevent&#x20;device&#x20;metadata&#x20;retrieval&#x20;from&#x20;the&#x20;Internet.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceInstallation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;with&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceSetup.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.7.2\"]}]'),(15733,'Ensure&#x20;&#039;Boot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;which&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized&#x20;based&#x20;on&#x20;a&#x20;classification&#x20;determined&#x20;by&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;The&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;can&#x20;return&#x20;the&#x20;following&#x20;classifications&#x20;for&#x20;each&#x20;boot-start&#x20;driver:&#x20;-&#x20;Good:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;signed&#x20;and&#x20;has&#x20;not&#x20;been&#x20;tampered&#x20;with.&#x20;-&#x20;Bad:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;allow&#x20;known&#x20;bad&#x20;drivers&#x20;to&#x20;be&#x20;initialized.&#x20;-&#x20;Bad,&#x20;but&#x20;required&#x20;for&#x20;boot:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware,&#x20;but&#x20;the&#x20;computer&#x20;cannot&#x20;successfully&#x20;boot&#x20;without&#x20;loading&#x20;this&#x20;driver.&#x20;-&#x20;Unknown:&#x20;This&#x20;driver&#x20;has&#x20;not&#x20;been&#x20;attested&#x20;to&#x20;by&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;and&#x20;has&#x20;not&#x20;been&#x20;classified&#x20;by&#x20;the&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;choose&#x20;which&#x20;boot-start&#x20;drivers&#x20;to&#x20;initialize&#x20;the&#x20;next&#x20;time&#x20;the&#x20;computer&#x20;is&#x20;started.&#x20;If&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;does&#x20;not&#x20;include&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;bootstart&#x20;driver&#x20;or&#x20;if&#x20;your&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;has&#x20;been&#x20;disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;and&#x20;all&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical.','This&#x20;policy&#x20;setting&#x20;helps&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;malware&#x20;that&#x20;has&#x20;already&#x20;infected&#x20;your&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemEarly&#x20;Launch&#x20;AntimalwareBoot-Start&#x20;Driver&#x20;Initialization&#x20;Policy.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EarlyLaunchAM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.14.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"5.1.1\"]}, {\"nist_800_53\": [\"SI.3\"]}, {\"tsc\": [\"CC6.8\"]}]'),(15734,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;FALSE&#039;.','The&#x20;&quot;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&quot;&#x20;option&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;updating&#x20;affected&#x20;policies&#x20;in&#x20;the&#x20;background&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;When&#x20;background&#x20;updates&#x20;are&#x20;disabled,&#x20;policy&#x20;changes&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;FALSE&#x20;&#40;unchecked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;false&#x20;&#40;unchecked&#41;&#x20;will&#x20;ensure&#x20;that&#x20;domain&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#x20;option&#x20;to&#x20;FALSE&#x20;&#40;unchecked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15735,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;TRUE&#039;.','The&#x20;&quot;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&quot;&#x20;option&#x20;updates&#x20;and&#x20;reapplies&#x20;policies&#x20;even&#x20;if&#x20;the&#x20;policies&#x20;have&#x20;not&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;TRUE&#x20;&#40;checked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;true&#x20;&#40;checked&#41;&#x20;will&#x20;ensure&#x20;unauthorized&#x20;changes&#x20;that&#x20;might&#x20;have&#x20;been&#x20;configured&#x20;locally&#x20;are&#x20;forced&#x20;to&#x20;match&#x20;the&#x20;domain-based&#x20;Group&#x20;Policy&#x20;settings&#x20;again.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#x20;option&#x20;to&#x20;TRUE&#x20;&#40;checked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.3\"]}, {\"pci_dss\": [\"11.5.1\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(15736,'Ensure&#x20;&#039;Continue&#x20;experiences&#x20;on&#x20;this&#x20;device&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Windows&#x20;device&#x20;is&#x20;allowed&#x20;to&#x20;participate&#x20;in&#x20;cross-device&#x20;experiences&#x20;&#40;continue&#x20;experiences&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;cross-device&#x20;experience&#x20;is&#x20;when&#x20;a&#x20;system&#x20;can&#x20;access&#x20;app&#x20;and&#x20;send&#x20;messages&#x20;to&#x20;other&#x20;devices.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;only&#x20;trusted&#x20;systems&#x20;should&#x20;be&#x20;communicating&#x20;within&#x20;the&#x20;network.&#x20;Access&#x20;to&#x20;any&#x20;other&#x20;system&#x20;should&#x20;be&#x20;prohibited.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyContinue&#x20;experiences&#x20;on&#x20;this&#x20;device.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15737,'Ensure&#x20;&#039;Turn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;Group&#x20;Policy&#x20;from&#x20;being&#x20;updated&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;to&#x20;Group&#x20;Policy&#x20;for&#x20;computers,&#x20;users&#x20;and&#x20;Domain&#x20;Controllers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;group&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyTurn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.21.5\"]}]'),(15738,'Ensure&#x20;&#039;Turn&#x20;off&#x20;access&#x20;to&#x20;the&#x20;Store&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;use&#x20;the&#x20;Store&#x20;service&#x20;for&#x20;finding&#x20;an&#x20;application&#x20;to&#x20;open&#x20;a&#x20;file&#x20;with&#x20;an&#x20;unhandled&#x20;file&#x20;type&#x20;or&#x20;protocol&#x20;association.&#x20;When&#x20;a&#x20;user&#x20;opens&#x20;a&#x20;file&#x20;type&#x20;or&#x20;protocol&#x20;that&#x20;is&#x20;not&#x20;associated&#x20;with&#x20;any&#x20;applications&#x20;on&#x20;the&#x20;computer,&#x20;the&#x20;user&#x20;is&#x20;given&#x20;the&#x20;choice&#x20;to&#x20;select&#x20;a&#x20;local&#x20;application&#x20;or&#x20;use&#x20;the&#x20;Store&#x20;service&#x20;to&#x20;find&#x20;an&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Store&#x20;service&#x20;is&#x20;a&#x20;retail&#x20;outlet&#x20;built&#x20;into&#x20;Windows,&#x20;primarily&#x20;for&#x20;consumer&#x20;use.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;installation&#x20;of&#x20;all&#x20;applications&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;installation&#x20;of&#x20;vulnerable&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;access&#x20;to&#x20;the&#x20;Store.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15739,'Ensure&#x20;&#039;Turn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;computer&#x20;can&#x20;download&#x20;print&#x20;driver&#x20;packages&#x20;over&#x20;HTTP.&#x20;To&#x20;set&#x20;up&#x20;HTTP&#x20;printing,&#x20;printer&#x20;drivers&#x20;that&#x20;are&#x20;not&#x20;available&#x20;in&#x20;the&#x20;standard&#x20;operating&#x20;system&#x20;installation&#x20;might&#x20;need&#x20;to&#x20;be&#x20;downloaded&#x20;over&#x20;HTTP.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;might&#x20;download&#x20;drivers&#x20;that&#x20;include&#x20;malicious&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.2\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15740,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;turns&#x20;off&#x20;data&#x20;sharing&#x20;from&#x20;the&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool&#x20;enables&#x20;Tablet&#x20;PC&#x20;users&#x20;to&#x20;adapt&#x20;handwriting&#x20;recognition&#x20;to&#x20;their&#x20;own&#x20;writing&#x20;style&#x20;by&#x20;providing&#x20;writing&#x20;samples.&#x20;The&#x20;tool&#x20;can&#x20;optionally&#x20;share&#x20;user&#x20;writing&#x20;samples&#x20;with&#x20;Microsoft&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;tool&#x20;generates&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ShapeCollector.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.3\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15741,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Turns&#x20;off&#x20;the&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool&#x20;enables&#x20;users&#x20;to&#x20;report&#x20;errors&#x20;encountered&#x20;in&#x20;Tablet&#x20;PC&#x20;Input&#x20;Panel.&#x20;The&#x20;tool&#x20;generates&#x20;error&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;Microsoft&#x20;uses&#x20;these&#x20;error&#x20;reports&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InkWatson.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15742,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;can&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;Internet&#x20;Service&#x20;Providers&#x20;&#40;ISPs&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15743,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;will&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;for&#x20;the&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Although&#x20;the&#x20;risk&#x20;is&#x20;minimal,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;downloading&#x20;malicious&#x20;content&#x20;through&#x20;this&#x20;feature.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.6\"]}]'),(15744,'Ensure&#x20;&#039;Turn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;disable&#x20;the&#x20;client&#x20;computer&#039;s&#x20;ability&#x20;to&#x20;print&#x20;over&#x20;HTTP,&#x20;which&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;printers&#x20;on&#x20;the&#x20;intranet&#x20;as&#x20;well&#x20;as&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;control&#x20;affects&#x20;printing&#x20;over&#x20;both&#x20;HTTP&#x20;and&#x20;HTTPS.','Information&#x20;that&#x20;is&#x20;transmitted&#x20;over&#x20;HTTP&#x20;through&#x20;this&#x20;capability&#x20;is&#x20;not&#x20;protected&#x20;and&#x20;can&#x20;be&#x20;intercepted&#x20;by&#x20;malicious&#x20;users.&#x20;For&#x20;this&#x20;reason,&#x20;it&#x20;is&#x20;not&#x20;often&#x20;used&#x20;in&#x20;enterprise&#x20;managed&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;printing&#x20;over&#x20;HTTP.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15745,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Registration&#x20;Wizard&#x20;connects&#x20;to&#x20;Microsoft.com&#x20;for&#x20;online&#x20;registration.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;should&#x20;not&#x20;be&#x20;registering&#x20;their&#x20;own&#x20;copies&#x20;of&#x20;Windows,&#x20;providing&#x20;their&#x20;own&#x20;PII&#x20;in&#x20;the&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15746,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Search&#x20;Companion&#x20;should&#x20;automatically&#x20;download&#x20;content&#x20;updates&#x20;during&#x20;local&#x20;and&#x20;Internet&#x20;searches.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;users&#x20;will&#x20;unknowingly&#x20;reveal&#x20;sensitive&#x20;information&#x20;because&#x20;of&#x20;the&#x20;topics&#x20;they&#x20;are&#x20;searching&#x20;for.&#x20;This&#x20;risk&#x20;is&#x20;very&#x20;low&#x20;because&#x20;even&#x20;if&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;users&#x20;still&#x20;must&#x20;submit&#x20;search&#x20;queries&#x20;to&#x20;the&#x20;desired&#x20;search&#x20;engine&#x20;in&#x20;order&#x20;to&#x20;perform&#x20;searches.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15747,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;&quot;Order&#x20;Prints&#x20;Online&quot;&#x20;task&#x20;is&#x20;available&#x20;from&#x20;Picture&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Order&#x20;Prints&#x20;Online&#x20;Wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;order&#x20;prints&#x20;online.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.10\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15748,'Ensure&#039;Turn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;tasks&#x20;Publish&#x20;this&#x20;file&#x20;to&#x20;the&#x20;Web,&#x20;Publish&#x20;this&#x20;folder&#x20;to&#x20;the&#x20;Web,&#x20;and&#x20;Publish&#x20;the&#x20;selected&#x20;items&#x20;to&#x20;the&#x20;Web&#x20;are&#x20;available&#x20;from&#x20;File&#x20;and&#x20;Folder&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Web&#x20;Publishing&#x20;wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;publish&#x20;content&#x20;to&#x20;the&#x20;Web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;may&#x20;publish&#x20;confidential&#x20;or&#x20;sensitive&#x20;information&#x20;to&#x20;a&#x20;public&#x20;service&#x20;outside&#x20;of&#x20;the&#x20;control&#x20;of&#x20;the&#x20;organization.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.11\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15749,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;Windows&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;improve&#x20;features&#x20;that&#x20;are&#x20;most&#x20;used&#x20;and&#x20;to&#x20;detect&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly.&#x20;Enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.12\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15750,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15751,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;errors&#x20;are&#x20;reported&#x20;to&#x20;Microsoft.&#x20;Error&#x20;Reporting&#x20;is&#x20;used&#x20;to&#x20;report&#x20;information&#x20;about&#x20;a&#x20;system&#x20;or&#x20;application&#x20;that&#x20;has&#x20;failed&#x20;or&#x20;has&#x20;stopped&#x20;responding&#x20;and&#x20;is&#x20;used&#x20;to&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;the&#x20;product.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.14\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15752,'Ensure&#x20;&#039;Support&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Automatic&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;support&#x20;for&#x20;Kerberos&#x20;to&#x20;attempt&#x20;authentication&#x20;using&#x20;the&#x20;certificate&#x20;for&#x20;the&#x20;device&#x20;to&#x20;the&#x20;domain.&#x20;Support&#x20;for&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;will&#x20;require&#x20;connectivity&#x20;to&#x20;a&#x20;DC&#x20;in&#x20;the&#x20;device&#x20;account&#x20;domain&#x20;which&#x20;supports&#x20;certificate&#x20;authentication&#x20;for&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Automatic.','Having&#x20;stronger&#x20;device&#x20;authentication&#x20;with&#x20;the&#x20;use&#x20;of&#x20;certificates&#x20;is&#x20;strongly&#x20;encouraged&#x20;over&#x20;standard&#x20;username&#x20;and&#x20;password&#x20;authentication.&#x20;Having&#x20;this&#x20;set&#x20;to&#x20;Automatic&#x20;will&#x20;allow&#x20;certificate&#x20;based&#x20;authentication&#x20;to&#x20;be&#x20;used&#x20;whenever&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Automatic:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKerberosSupport&#x20;device&#x20;authentication&#x20;using&#x20;certificate.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Kerberos.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.25.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15753,'Ensure&#x20;&#039;Enumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#x20;All&#039;.','This&#x20;policy&#x20;is&#x20;intended&#x20;to&#x20;provide&#x20;additional&#x20;security&#x20;against&#x20;external&#x20;DMA-capable&#x20;devices.&#x20;It&#x20;allows&#x20;for&#x20;more&#x20;control&#x20;over&#x20;the&#x20;enumeration&#x20;of&#x20;external&#x20;DMA-capable&#x20;devices&#x20;that&#x20;are&#x20;not&#x20;compatible&#x20;with&#x20;DMA&#x20;Remapping/device&#x20;memory&#x20;isolation&#x20;and&#x20;sandboxing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;All.&#x20;Note:&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;1394,&#x20;PCMCIA&#x20;or&#x20;ExpressCard&#x20;devices.&#x20;The&#x20;protection&#x20;also&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;R1803&#x20;or&#x20;higher,&#x20;and&#x20;also&#x20;requires&#x20;a&#x20;UEFI&#x20;BIOS&#x20;to&#x20;function.&#x20;Note&#x20;#2:&#x20;More&#x20;information&#x20;on&#x20;this&#x20;feature&#x20;is&#x20;available&#x20;at&#x20;this&#x20;link:&#x20;Kernel&#x20;DMA&#x20;Protection&#x20;for&#x20;Thunderbolt&trade;&#x20;3&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs.','Device&#x20;memory&#x20;sandboxing&#x20;allows&#x20;the&#x20;OS&#x20;to&#x20;leverage&#x20;the&#x20;I/O&#x20;Memory&#x20;Management&#x20;Unit&#x20;&#40;IOMMU&#41;&#x20;of&#x20;a&#x20;device&#x20;to&#x20;block&#x20;unpermitted&#x20;I/O,&#x20;or&#x20;memory&#x20;access,&#x20;by&#x20;the&#x20;peripheral.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;All:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKernel&#x20;DMA&#x20;ProtectionEnumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DmaGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15754,'Ensure&#x20;&#039;Disallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;prevents&#x20;automatic&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;use&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;user&#x20;is&#x20;restricted&#x20;to&#x20;the&#x20;set&#x20;of&#x20;input&#x20;methods&#x20;that&#x20;are&#x20;enabled&#x20;in&#x20;the&#x20;system&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;way&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLocale&#x20;ServicesDisallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15755,'Ensure&#x20;&#039;Block&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;&#40;email&#x20;address&#x20;or&#x20;user&#x20;name&#41;&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;workstation&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonBlock&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15756,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;anyone&#x20;can&#x20;interact&#x20;with&#x20;available&#x20;networks&#x20;UI&#x20;on&#x20;the&#x20;logon&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;disconnect&#x20;the&#x20;PC&#x20;from&#x20;the&#x20;network&#x20;or&#x20;can&#x20;connect&#x20;the&#x20;PC&#x20;to&#x20;other&#x20;available&#x20;networks&#x20;without&#x20;signing&#x20;into&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15757,'Ensure&#x20;&#039;Do&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;connected&#x20;users&#x20;from&#x20;being&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.3\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15758,'Ensure&#x20;&#039;Enumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;local&#x20;users&#x20;to&#x20;be&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonEnumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15759,'Ensure&#x20;&#039;Turn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;app&#x20;notifications&#x20;from&#x20;appearing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','App&#x20;notifications&#x20;might&#x20;display&#x20;sensitive&#x20;business&#x20;or&#x20;personal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15760,'Ensure&#x20;&#039;Turn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;picture&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;the&#x20;picture&#x20;password&#x20;feature&#x20;is&#x20;permitted,&#x20;the&#x20;user&#039;s&#x20;domain&#x20;password&#x20;is&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;it.','Picture&#x20;passwords&#x20;bypass&#x20;the&#x20;requirement&#x20;for&#x20;a&#x20;typed&#x20;complex&#x20;password.&#x20;In&#x20;a&#x20;shared&#x20;work&#x20;environment,&#x20;a&#x20;simple&#x20;shoulder&#x20;surf&#x20;where&#x20;someone&#x20;observed&#x20;the&#x20;on-screen&#x20;gestures&#x20;would&#x20;allow&#x20;that&#x20;person&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;the&#x20;need&#x20;to&#x20;know&#x20;the&#x20;complex&#x20;password.&#x20;Vertical&#x20;monitor&#x20;screens&#x20;with&#x20;an&#x20;image&#x20;are&#x20;much&#x20;more&#x20;visible&#x20;at&#x20;a&#x20;distance&#x20;than&#x20;horizontal&#x20;key&#x20;strokes,&#x20;increasing&#x20;the&#x20;likelihood&#x20;of&#x20;a&#x20;successful&#x20;observation&#x20;of&#x20;the&#x20;mouse&#x20;gestures.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;picture&#x20;password&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15761,'Ensure&#x20;&#039;Turn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;convenience&#x20;PIN.&#x20;In&#x20;Windows&#x20;10,&#x20;convenience&#x20;PIN&#x20;was&#x20;replaced&#x20;with&#x20;Passport,&#x20;which&#x20;has&#x20;stronger&#x20;security&#x20;properties.&#x20;To&#x20;configure&#x20;Passport&#x20;for&#x20;domain&#x20;users,&#x20;use&#x20;the&#x20;policies&#x20;under&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Passport&#x20;for&#x20;Work.&#x20;Note:&#x20;The&#x20;user&#039;s&#x20;domain&#x20;password&#x20;will&#x20;be&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;this&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;PIN&#x20;is&#x20;created&#x20;from&#x20;a&#x20;much&#x20;smaller&#x20;selection&#x20;of&#x20;characters&#x20;than&#x20;a&#x20;password,&#x20;so&#x20;in&#x20;most&#x20;cases&#x20;a&#x20;PIN&#x20;will&#x20;be&#x20;much&#x20;less&#x20;robust&#x20;than&#x20;a&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;on&#x20;PIN&#x20;sign-in,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.28.7\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15762,'Ensure&#x20;&#039;Allow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;Clipboard&#x20;contents&#x20;can&#x20;be&#x20;synchronized&#x20;across&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;high&#x20;security&#x20;environments,&#x20;clipboard&#x20;data&#x20;should&#x20;stay&#x20;local&#x20;to&#x20;the&#x20;system&#x20;and&#x20;not&#x20;synced&#x20;across&#x20;devices,&#x20;as&#x20;it&#x20;may&#x20;contain&#x20;very&#x20;sensitive&#x20;information&#x20;that&#x20;must&#x20;be&#x20;contained&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;OSPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.31.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15763,'Ensure&#x20;&#039;Allow&#x20;upload&#x20;of&#x20;User&#x20;Activities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;published&#x20;User&#x20;Activities&#x20;can&#x20;be&#x20;uploaded&#x20;to&#x20;the&#x20;cloud.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;upload&#x20;of&#x20;User&#x20;Activities.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;OSPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.31.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15764,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;on&#x20;battery&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15765,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;plugged&#x20;in&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.2\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15766,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.5\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15767,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.6\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15768,'Ensure&#x20;&#039;Configure&#x20;Offer&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Offer&#x20;&#40;Unsolicited&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;Help&#x20;desk&#x20;and&#x20;support&#x20;personnel&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;proactively&#x20;offer&#x20;assistance,&#x20;although&#x20;they&#x20;can&#x20;still&#x20;respond&#x20;to&#x20;user&#x20;assistance&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;user&#x20;might&#x20;be&#x20;tricked&#x20;and&#x20;accept&#x20;an&#x20;unsolicited&#x20;Remote&#x20;Assistance&#x20;offer&#x20;from&#x20;a&#x20;malicious&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Offer&#x20;Remote&#x20;Assistance.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15769,'Ensure&#x20;&#039;Configure&#x20;Solicited&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Solicited&#x20;&#40;Ask&#x20;for&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','There&#x20;is&#x20;slight&#x20;risk&#x20;that&#x20;a&#x20;rogue&#x20;administrator&#x20;will&#x20;gain&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;desktop&#x20;session,&#x20;however,&#x20;they&#x20;cannot&#x20;connect&#x20;to&#x20;a&#x20;user&#039;s&#x20;computer&#x20;unannounced&#x20;or&#x20;control&#x20;it&#x20;without&#x20;permission&#x20;from&#x20;the&#x20;user.&#x20;When&#x20;an&#x20;expert&#x20;tries&#x20;to&#x20;connect,&#x20;the&#x20;user&#x20;can&#x20;still&#x20;choose&#x20;to&#x20;deny&#x20;the&#x20;connection&#x20;or&#x20;give&#x20;the&#x20;expert&#x20;view-only&#x20;privileges.&#x20;The&#x20;user&#x20;must&#x20;explicitly&#x20;click&#x20;the&#x20;Yes&#x20;button&#x20;to&#x20;allow&#x20;the&#x20;expert&#x20;to&#x20;remotely&#x20;control&#x20;the&#x20;workstation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Solicited&#x20;Remote&#x20;Assistance.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15770,'Ensure&#x20;&#039;Enable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;RPC&#x20;clients&#x20;authenticate&#x20;with&#x20;the&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;when&#x20;the&#x20;call&#x20;they&#x20;are&#x20;making&#x20;contains&#x20;authentication&#x20;information.&#x20;The&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;on&#x20;computers&#x20;running&#x20;Windows&#x20;NT4&#x20;&#40;all&#x20;service&#x20;packs&#41;&#x20;cannot&#x20;process&#x20;authentication&#x20;information&#x20;supplied&#x20;in&#x20;this&#x20;manner.&#x20;This&#x20;policy&#x20;setting&#x20;can&#x20;cause&#x20;a&#x20;specific&#x20;issue&#x20;with&#x20;1-way&#x20;forest&#x20;trusts&#x20;if&#x20;it&#x20;is&#x20;applied&#x20;to&#x20;the&#x20;trusting&#x20;domain&#x20;DCs&#x20;&#40;see&#x20;Microsoft&#x20;KB3073942&#41;,&#x20;so&#x20;we&#x20;do&#x20;not&#x20;recommend&#x20;applying&#x20;it&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;This&#x20;policy&#x20;will&#x20;not&#x20;in&#x20;effect&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Anonymous&#x20;access&#x20;to&#x20;RPC&#x20;services&#x20;could&#x20;result&#x20;in&#x20;accidental&#x20;disclosure&#x20;of&#x20;information&#x20;to&#x20;unauthenticated&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallEnable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15771,'Ensure&#x20;&#039;Restrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Authenticated&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;how&#x20;the&#x20;RPC&#x20;server&#x20;runtime&#x20;handles&#x20;unauthenticated&#x20;RPC&#x20;clients&#x20;connecting&#x20;to&#x20;RPC&#x20;servers.&#x20;This&#x20;policy&#x20;setting&#x20;impacts&#x20;all&#x20;RPC&#x20;applications.&#x20;In&#x20;a&#x20;domain&#x20;environment&#x20;this&#x20;policy&#x20;setting&#x20;should&#x20;be&#x20;used&#x20;with&#x20;caution&#x20;as&#x20;it&#x20;can&#x20;impact&#x20;a&#x20;wide&#x20;range&#x20;of&#x20;functionality&#x20;including&#x20;group&#x20;policy&#x20;processing&#x20;itself.&#x20;Reverting&#x20;a&#x20;change&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;can&#x20;require&#x20;manual&#x20;intervention&#x20;on&#x20;each&#x20;affected&#x20;machine.&#x20;This&#x20;policy&#x20;setting&#x20;should&#x20;never&#x20;be&#x20;applied&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;A&#x20;client&#x20;will&#x20;be&#x20;considered&#x20;an&#x20;authenticated&#x20;client&#x20;if&#x20;it&#x20;uses&#x20;a&#x20;named&#x20;pipe&#x20;to&#x20;communicate&#x20;with&#x20;the&#x20;server&#x20;or&#x20;if&#x20;it&#x20;uses&#x20;RPC&#x20;Security.&#x20;RPC&#x20;Interfaces&#x20;that&#x20;have&#x20;specifically&#x20;requested&#x20;to&#x20;be&#x20;accessible&#x20;by&#x20;unauthenticated&#x20;clients&#x20;may&#x20;be&#x20;exempt&#x20;from&#x20;this&#x20;restriction,&#x20;depending&#x20;on&#x20;the&#x20;selected&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting.&#x20;--&#x20;&quot;None&quot;&#x20;allows&#x20;all&#x20;RPC&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;--&#x20;&quot;Authenticated&quot;&#x20;allows&#x20;only&#x20;authenticated&#x20;RPC&#x20;Clients&#x20;&#40;per&#x20;the&#x20;definition&#x20;above&#41;&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;Exemptions&#x20;are&#x20;granted&#x20;to&#x20;interfaces&#x20;that&#x20;have&#x20;requested&#x20;them.&#x20;--&#x20;&quot;Authenticated&#x20;without&#x20;exceptions&quot;&#x20;allows&#x20;only&#x20;authenticated&#x20;RPC&#x20;Clients&#x20;&#40;per&#x20;the&#x20;definition&#x20;above&#41;&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;No&#x20;exceptions&#x20;are&#x20;allowed.&#x20;This&#x20;value&#x20;has&#x20;the&#x20;potential&#x20;to&#x20;cause&#x20;serious&#x20;problems&#x20;and&#x20;is&#x20;not&#x20;recommended.&#039;&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;will&#x20;not&#x20;be&#x20;applied&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Authenticated.','Unauthenticated&#x20;RPC&#x20;communication&#x20;can&#x20;create&#x20;a&#x20;security&#x20;vulnerability.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Authenticated:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallRestrict&#x20;Unauthenticated&#x20;RPC&#x20;clients.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15772,'Ensure&#x20;&#039;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool&#x20;&#40;MSDT&#41;&#x20;interactive&#x20;communication&#x20;with&#x20;the&#x20;support&#x20;provider.&#x20;MSDT&#x20;gathers&#x20;diagnostic&#x20;data&#x20;for&#x20;analysis&#x20;by&#x20;support&#x20;professionals.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsMicrosoft&#x20;Support&#x20;Diagnostic&#x20;ToolMicrosoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSDT.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.48.5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15773,'Ensure&#x20;&#039;Enable/Disable&#x20;PerfTrack&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;tracking&#x20;of&#x20;responsiveness&#x20;events.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;enabled&#x20;the&#x20;aggregated&#x20;data&#x20;of&#x20;a&#x20;given&#x20;event&#x20;will&#x20;be&#x20;transmitted&#x20;to&#x20;Microsoft.&#x20;The&#x20;option&#x20;exists&#x20;to&#x20;restrict&#x20;this&#x20;feature&#x20;for&#x20;a&#x20;specific&#x20;user,&#x20;set&#x20;the&#x20;consent&#x20;level,&#x20;and&#x20;designate&#x20;specific&#x20;programs&#x20;for&#x20;which&#x20;error&#x20;reports&#x20;could&#x20;be&#x20;sent.&#x20;However,&#x20;centrally&#x20;restricting&#x20;the&#x20;ability&#x20;to&#x20;execute&#x20;PerfTrack&#x20;to&#x20;limit&#x20;the&#x20;potential&#x20;for&#x20;unauthorized&#x20;or&#x20;undesired&#x20;usage,&#x20;data&#x20;leakage,&#x20;or&#x20;unintentional&#x20;communications&#x20;is&#x20;highly&#x20;recommended.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsWindows&#x20;Performance&#x20;PerfTrackEnable/Disable&#x20;PerfTrack.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PerformancePerftrack.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.48.11.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15774,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;advertising&#x20;ID,&#x20;preventing&#x20;apps&#x20;from&#x20;using&#x20;the&#x20;ID&#x20;for&#x20;experiences&#x20;across&#x20;apps.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Tracking&#x20;user&#x20;activity&#x20;for&#x20;advertising&#x20;purposes,&#x20;even&#x20;anonymously,&#x20;may&#x20;be&#x20;a&#x20;privacy&#x20;concern.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;applications&#x20;should&#x20;not&#x20;need&#x20;or&#x20;require&#x20;tracking&#x20;for&#x20;targeted&#x20;advertising.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemUser&#x20;ProfilesTurn&#x20;off&#x20;the&#x20;advertising&#x20;ID.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;UserProfiles.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.50.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15775,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Client&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;is&#x20;enabled.&#x20;Enabling&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;allows&#x20;your&#x20;computer&#x20;to&#x20;synchronize&#x20;its&#x20;computer&#x20;clock&#x20;with&#x20;other&#x20;NTP&#x20;servers.&#x20;You&#x20;might&#x20;want&#x20;to&#x20;disable&#x20;this&#x20;service&#x20;if&#x20;you&#x20;decide&#x20;to&#x20;use&#x20;a&#x20;third-party&#x20;time&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;reliable&#x20;and&#x20;accurate&#x20;account&#x20;of&#x20;time&#x20;is&#x20;important&#x20;for&#x20;a&#x20;number&#x20;of&#x20;services&#x20;and&#x20;security&#x20;requirements,&#x20;including&#x20;but&#x20;not&#x20;limited&#x20;to&#x20;distributed&#x20;applications,&#x20;authentication&#x20;services,&#x20;multi-user&#x20;databases&#x20;and&#x20;logging&#x20;services.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;NTP&#x20;client&#x20;&#40;with&#x20;secure&#x20;operation&#41;&#x20;establishes&#x20;functional&#x20;accuracy&#x20;and&#x20;is&#x20;a&#x20;focal&#x20;point&#x20;when&#x20;reviewing&#x20;security&#x20;relevant&#x20;events.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Client.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.53.1.1\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(15776,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;configuration&#x20;of&#x20;proper&#x20;time&#x20;synchronization&#x20;is&#x20;critically&#x20;important&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;both&#x20;due&#x20;to&#x20;the&#x20;sensitivity&#x20;of&#x20;Kerberos&#x20;authentication&#x20;timestamps&#x20;and&#x20;also&#x20;to&#x20;ensure&#x20;accurate&#x20;security&#x20;logging.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Server.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.53.1.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(15777,'Ensure&#x20;&#039;Allow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Manages&#x20;a&#x20;Windows&#x20;app&#039;s&#x20;ability&#x20;to&#x20;share&#x20;data&#x20;between&#x20;users&#x20;who&#x20;have&#x20;installed&#x20;the&#x20;app.&#x20;Data&#x20;is&#x20;shared&#x20;through&#x20;the&#x20;SharedLocal&#x20;folder.&#x20;This&#x20;folder&#x20;is&#x20;available&#x20;through&#x20;the&#x20;Windows.Storage&#x20;API.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;of&#x20;a&#x20;system&#x20;could&#x20;accidentally&#x20;share&#x20;sensitive&#x20;data&#x20;with&#x20;other&#x20;users&#x20;on&#x20;the&#x20;same&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentAllow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.1\"]}, {\"cis_csc\": [\"3.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15778,'Ensure&#x20;&#039;Prevent&#x20;non-admin&#x20;users&#x20;from&#x20;installing&#x20;packaged&#x20;Windows&#x20;apps&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;manages&#x20;non-Administrator&#x20;users&#039;&#x20;ability&#x20;to&#x20;install&#x20;Windows&#x20;app&#x20;packages.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;corporate&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentPrevent&#x20;non-admin&#x20;users&#x20;from&#x20;installing&#x20;packaged&#x20;Windows&#x20;apps.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.2\"]}, {\"cis_csc\": [\"2.5\"]}]'),(15779,'Ensure&#x20;&#039;Let&#x20;Windows&#x20;apps&#x20;activate&#x20;with&#x20;voice&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Force&#x20;Deny&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;apps&#x20;can&#x20;be&#x20;activated&#x20;by&#x20;voice&#x20;&#40;apps&#x20;and&#x20;Cortana&#41;&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Force&#x20;Deny.','Access&#x20;to&#x20;any&#x20;computer&#x20;resource&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;when&#x20;the&#x20;device&#x20;is&#x20;locked.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Force&#x20;Deny:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;PrivacyLet&#x20;Windows&#x20;apps&#x20;activate&#x20;with&#x20;voice&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppPrivacy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.5.1\"]}]'),(15780,'Ensure&#x20;&#039;Allow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;control&#x20;whether&#x20;Microsoft&#x20;accounts&#x20;are&#x20;optional&#x20;for&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;require&#x20;an&#x20;account&#x20;to&#x20;sign&#x20;in.&#x20;This&#x20;policy&#x20;only&#x20;affects&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;use&#x20;their&#x20;enterprise&#x20;user&#x20;accounts&#x20;instead&#x20;of&#x20;using&#x20;their&#x20;Microsoft&#x20;accounts&#x20;when&#x20;accessing&#x20;Windows&#x20;store&#x20;apps.&#x20;This&#x20;provides&#x20;the&#x20;organization&#x20;with&#x20;greater&#x20;control&#x20;over&#x20;relevant&#x20;credentials.&#x20;Microsoft&#x20;accounts&#x20;cannot&#x20;be&#x20;centrally&#x20;managed&#x20;and&#x20;as&#x20;such&#x20;enterprise&#x20;credential&#x20;security&#x20;policies&#x20;cannot&#x20;be&#x20;applied&#x20;to&#x20;them,&#x20;which&#x20;could&#x20;put&#x20;any&#x20;information&#x20;accessed&#x20;by&#x20;using&#x20;Microsoft&#x20;accounts&#x20;at&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeAllow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.6.1\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15781,'Ensure&#x20;&#039;Block&#x20;launching&#x20;Universal&#x20;Windows&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;from&#x20;hosted&#x20;content.&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Microsoft&#x20;Store&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;directly&#x20;from&#x20;web&#x20;content&#x20;can&#x20;be&#x20;launched.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blocking&#x20;apps&#x20;from&#x20;the&#x20;web&#x20;with&#x20;direct&#x20;access&#x20;to&#x20;the&#x20;Windows&#x20;API&#x20;can&#x20;prevent&#x20;malicious&#x20;apps&#x20;from&#x20;being&#x20;run&#x20;on&#x20;a&#x20;system.&#x20;Only&#x20;system&#x20;administrators&#x20;should&#x20;be&#x20;installing&#x20;approved&#x20;applications.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeBlock&#x20;launching&#x20;Universal&#x20;Windows&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;from&#x20;hosted&#x20;content.&#x20;Note:&#x20;A&#x20;reboot&#x20;may&#x20;be&#x20;required&#x20;after&#x20;the&#x20;setting&#x20;is&#x20;applied.&#x20;Note&#x20;#2:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#3:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Block&#x20;launching&#x20;Windows&#x20;Store&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;from&#x20;hosted&#x20;content.,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates','[{\"cis\": [\"18.9.6.2\"]}, {\"cis_csc\": [\"2.5\"]}]'),(15782,'Ensure&#x20;&#039;Disallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;disallows&#x20;AutoPlay&#x20;for&#x20;MTP&#x20;devices&#x20;like&#x20;cameras&#x20;or&#x20;phones.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesDisallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.1\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15783,'Ensure&#x20;&#039;Set&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands&#039;.','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Autorun&#x20;commands.&#x20;Autorun&#x20;commands&#x20;are&#x20;generally&#x20;stored&#x20;in&#x20;autorun.inf&#x20;files.&#x20;They&#x20;often&#x20;launch&#x20;the&#x20;installation&#x20;program&#x20;or&#x20;other&#x20;routines.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands.','Prior&#x20;to&#x20;Windows&#x20;Vista,&#x20;when&#x20;media&#x20;containing&#x20;an&#x20;autorun&#x20;command&#x20;is&#x20;inserted,&#x20;the&#x20;system&#x20;will&#x20;automatically&#x20;execute&#x20;the&#x20;program&#x20;without&#x20;user&#x20;intervention.&#x20;This&#x20;creates&#x20;a&#x20;major&#x20;security&#x20;concern&#x20;as&#x20;code&#x20;may&#x20;be&#x20;executed&#x20;without&#x20;user&#039;s&#x20;knowledge.&#x20;The&#x20;default&#x20;behavior&#x20;starting&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;to&#x20;prompt&#x20;the&#x20;user&#x20;whether&#x20;autorun&#x20;command&#x20;is&#x20;to&#x20;be&#x20;run.&#x20;The&#x20;autorun&#x20;command&#x20;is&#x20;represented&#x20;as&#x20;a&#x20;handler&#x20;in&#x20;the&#x20;Autoplay&#x20;dialog.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesSet&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.2\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15784,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Autoplay&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;All&#x20;drives&#039;.','Autoplay&#x20;starts&#x20;to&#x20;read&#x20;from&#x20;a&#x20;drive&#x20;as&#x20;soon&#x20;as&#x20;you&#x20;insert&#x20;media&#x20;in&#x20;the&#x20;drive,&#x20;which&#x20;causes&#x20;the&#x20;setup&#x20;file&#x20;for&#x20;programs&#x20;or&#x20;audio&#x20;media&#x20;to&#x20;start&#x20;immediately.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;the&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.&#x20;Autoplay&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;on&#x20;some&#x20;removable&#x20;drive&#x20;types,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives,&#x20;but&#x20;not&#x20;on&#x20;CD-ROM&#x20;drives.&#x20;Note:&#x20;You&#x20;cannot&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enable&#x20;Autoplay&#x20;on&#x20;computer&#x20;drives&#x20;in&#x20;which&#x20;it&#x20;is&#x20;disabled&#x20;by&#x20;default,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;All&#x20;drives.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;All&#x20;drives:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesTurn&#x20;off&#x20;Autoplay.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.8.3\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15785,'Ensure&#x20;&#039;Configure&#x20;enhanced&#x20;anti-spoofing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;enhanced&#x20;anti-spoofing&#x20;is&#x20;configured&#x20;for&#x20;devices&#x20;which&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enterprise&#x20;managed&#x20;environments&#x20;are&#x20;now&#x20;supporting&#x20;a&#x20;wider&#x20;range&#x20;of&#x20;mobile&#x20;devices,&#x20;increasing&#x20;the&#x20;security&#x20;on&#x20;these&#x20;devices&#x20;will&#x20;help&#x20;protect&#x20;against&#x20;unauthorized&#x20;access&#x20;on&#x20;your&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsBiometricsFacial&#x20;FeaturesConfigure&#x20;enhanced&#x20;anti-spoofing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Biometrics.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;and&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Use&#x20;enhanced&#x20;anti-spoofing&#x20;when&#x20;available.&#x20;It&#x20;was&#x20;renamed&#x20;to&#x20;Configure&#x20;enhanced&#x20;anti-spoofing&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.10.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15786,'Ensure&#x20;&#039;Allow&#x20;Use&#x20;of&#x20;Camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;use&#x20;of&#x20;Camera&#x20;devices&#x20;on&#x20;the&#x20;machine&#x20;are&#x20;permitted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Cameras&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment&#x20;can&#x20;pose&#x20;serious&#x20;privacy&#x20;and&#x20;data&#x20;exfiltration&#x20;risks&#x20;-&#x20;they&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;help&#x20;mitigate&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCameraAllow&#x20;Use&#x20;of&#x20;Camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Camera.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.12.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15787,'Ensure&#x20;&#039;Turn&#x20;off&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#x20;is&#x20;allowed&#x20;in&#x20;all&#x20;Windows&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;use&#x20;of&#x20;consumer&#x20;accounts&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;as&#x20;it&#x20;could&#x20;lead&#x20;to&#x20;possible&#x20;data&#x20;leakage.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.1\"]}]'),(15788,'Ensure&#x20;&#039;Turn&#x20;off&#x20;cloud&#x20;optimized&#x20;content&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;cloud&#x20;optimized&#x20;content&#x20;in&#x20;all&#x20;Windows&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;cloud&#x20;optimized&#x20;content.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;20H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.2\"]}]'),(15789,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;experiences&#x20;that&#x20;help&#x20;consumers&#x20;make&#x20;the&#x20;most&#x20;of&#x20;their&#x20;devices&#x20;and&#x20;Microsoft&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet,&#x20;this&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.','Having&#x20;apps&#x20;silently&#x20;install&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;-&#x20;especially&#x20;if&#x20;the&#x20;apps&#x20;send&#x20;data&#x20;back&#x20;to&#x20;a&#x20;3rd&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15790,'Ensure&#x20;&#039;Require&#x20;pin&#x20;for&#x20;pairing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;First&#x20;Time&#039;&#x20;OR&#x20;&#039;Enabled:&#x20;Always&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;PIN&#x20;is&#x20;required&#x20;for&#x20;pairing&#x20;to&#x20;a&#x20;wireless&#x20;display&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;First&#x20;Time&#x20;OR&#x20;Enabled:&#x20;Always.','If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured&#x20;or&#x20;disabled&#x20;then&#x20;a&#x20;PIN&#x20;would&#x20;not&#x20;be&#x20;required&#x20;when&#x20;pairing&#x20;wireless&#x20;display&#x20;devices&#x20;to&#x20;the&#x20;system,&#x20;increasing&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;First&#x20;Time&#x20;OR&#x20;Enabled:&#x20;Always:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsConnectRequire&#x20;pin&#x20;for&#x20;pairing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WirelessDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;The&#x20;new&#x20;Choose&#x20;one&#x20;of&#x20;the&#x20;following&#x20;actions&#x20;sub-option&#x20;was&#x20;later&#x20;added&#x20;as&#x20;of&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;Administrative&#x20;Templates.&#x20;Choosing&#x20;Enabled&#x20;in&#x20;the&#x20;older&#x20;templates&#x20;is&#x20;the&#x20;equivalent&#x20;of&#x20;choosing&#x20;Enabled:&#x20;First&#x20;Time&#x20;in&#x20;the&#x20;newer&#x20;templates.','[{\"cis\": [\"18.9.15.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15791,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;display&#x20;of&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;in&#x20;password&#x20;entry&#x20;user&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;useful&#x20;feature&#x20;when&#x20;entering&#x20;a&#x20;long&#x20;and&#x20;complex&#x20;password,&#x20;especially&#x20;when&#x20;using&#x20;a&#x20;touchscreen.&#x20;The&#x20;potential&#x20;risk&#x20;is&#x20;that&#x20;someone&#x20;else&#x20;may&#x20;see&#x20;your&#x20;password&#x20;while&#x20;surreptitiously&#x20;observing&#x20;your&#x20;screen.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceDo&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15792,'Ensure&#x20;&#039;Enumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;administrator&#x20;accounts&#x20;are&#x20;displayed&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;elevate&#x20;a&#x20;running&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;could&#x20;see&#x20;the&#x20;list&#x20;of&#x20;administrator&#x20;accounts,&#x20;making&#x20;it&#x20;slightly&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;user&#x20;who&#x20;has&#x20;logged&#x20;onto&#x20;a&#x20;console&#x20;session&#x20;to&#x20;try&#x20;to&#x20;crack&#x20;the&#x20;passwords&#x20;of&#x20;those&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceEnumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.16.2\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15793,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;use&#x20;of&#x20;security&#x20;questions&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;security&#x20;questions&#x20;can&#x20;be&#x20;used&#x20;to&#x20;reset&#x20;local&#x20;account&#x20;passwords.&#x20;The&#x20;security&#x20;question&#x20;feature&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;domain&#x20;accounts,&#x20;only&#x20;local&#x20;accounts&#x20;on&#x20;the&#x20;workstation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;could&#x20;establish&#x20;security&#x20;questions&#x20;that&#x20;are&#x20;easily&#x20;guessed&#x20;or&#x20;sleuthed&#x20;by&#x20;observing&#x20;the&#x20;user&rsquo;s&#x20;social&#x20;media&#x20;accounts,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;actor&#x20;to&#x20;change&#x20;the&#x20;local&#x20;user&#x20;account&#x20;password&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;as&#x20;that&#x20;user&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfacePrevent&#x20;the&#x20;use&#x20;of&#x20;security&#x20;questions&#x20;for&#x20;local&#x20;accounts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.3\"]}]'),(15794,'Ensure&#x20;&#039;Allow&#x20;Diagnostic&#x20;Data&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;or&#x20;&#039;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;reported&#x20;to&#x20;Microsoft:&#x20;-&#x20;A&#x20;value&#x20;of&#x20;&#40;0&#41;&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;.&#x20;Using&#x20;this&#x20;value,&#x20;no&#x20;diagnostic&#x20;data&#x20;is&#x20;sent&#x20;from&#x20;the&#x20;device.&#x20;This&#x20;value&#x20;is&#x20;only&#x20;supported&#x20;on&#x20;Enterprise,&#x20;&#x20;Education,&#x20;and&#x20;Server&#x20;editions.&#x20;If&#x20;you&#x20;choose&#x20;this&#x20;setting,&#x20;devices&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;still&#x20;be&#x20;secure.&#x20;-&#x20;A&#x20;value&#x20;of&#x20;&#40;1&#41;&#x20;Send&#x20;required&#x20;diagnostic&#x20;data.&#x20;This&#x20;is&#x20;the&#x20;minimum&#x20;diagnostic&#x20;data&#x20;necessary&#x20;to&#x20;keep&#x20;Windows&#x20;secure,&#x20;up&#x20;to&#x20;date,&#x20;and&#x20;performing&#x20;as&#x20;expected.&#x20;Using&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;Optional&#x20;diagnostic&#x20;data&#x20;control&#x20;in&#x20;the&#x20;&#x20;Settings&#x20;app.&#x20;-&#x20;A&#x20;value&#x20;of&#x20;&#40;3&#41;Send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Additional&#x20;diagnostic&#x20;data&#x20;is&#x20;collected&#x20;that&#x20;helps&#x20;us&#x20;to&#x20;detect,&#x20;diagnose&#x20;and&#x20;fix&#x20;issues,&#x20;as&#x20;well&#x20;as&#x20;make&#x20;product&#x20;improvements.&#x20;Required&#x20;diagnostic&#x20;data&#x20;will&#x20;always&#x20;be&#x20;included&#x20;when&#x20;you&#x20;choose&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Optional&#x20;diagnostic&#x20;data&#x20;can&#x20;also&#x20;include&#x20;diagnostic&#x20;log&#x20;files&#x20;and&#x20;crash&#x20;dumps.&#x20;Use&#x20;the&#x20;Limit&#x20;Dump&#x20;Collection&#x20;and&#x20;the&#x20;Limit&#x20;&#x20;Diagnostic&#x20;Log&#x20;Collection&#x20;policies&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;of&#x20;what&#x20;optional&#x20;diagnostic&#x20;data&#x20;is&#x20;sent.&#x20;Windows&#x20;telemetry&#x20;settings&#x20;apply&#x20;to&#x20;the&#x20;Windows&#x20;operating&#x20;system&#x20;and&#x20;some&#x20;first&#x20;party&#x20;apps.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;third&#x20;party&#x20;apps&#x20;running&#x20;on&#x20;Windows&#x20;10/11.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data.&#x20;Note:&#x20;If&#x20;your&#x20;organization&#x20;relies&#x20;on&#x20;Windows&#x20;Update,&#x20;the&#x20;minimum&#x20;recommended&#x20;setting&#x20;is&#x20;Required&#x20;diagnostic&#x20;data.&#x20;Because&#x20;no&#x20;Windows&#x20;Update&#x20;information&#x20;is&#x20;collected&#x20;when&#x20;diagnostic&#x20;data&#x20;is&#x20;off,&#x20;important&#x20;information&#x20;about&#x20;update&#x20;failures&#x20;is&#x20;not&#x20;sent.&#x20;Microsoft&#x20;uses&#x20;this&#x20;information&#x20;to&#x20;fix&#x20;the&#x20;causes&#x20;of&#x20;those&#x20;failures&#x20;and&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;updates.&#x20;Note&#x20;#2:&#x20;The&#x20;Configure&#x20;diagnostic&#x20;data&#x20;opt-in&#x20;settings&#x20;user&#x20;interface&#x20;group&#x20;policy&#x20;can&#x20;be&#x20;used&#x20;to&#x20;prevent&#x20;end&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;data&#x20;collection&#x20;settings.&#x20;Note&#x20;#3:&#x20;Enhanced&#x20;diagnostic&#x20;data&#x20;setting&#x20;is&#x20;not&#x20;available&#x20;on&#x20;Windows&#x20;11&#x20;and&#x20;Windows&#x20;Server&#x20;2022&#x20;and&#x20;has&#x20;been&#x20;replaced&#x20;with&#x20;policies&#x20;that&#x20;can&#x20;control&#x20;the&#x20;amount&#x20;of&#x20;optional&#x20;diagnostic&#x20;data&#x20;that&#x20;is&#x20;sent.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;these&#x20;settings&#x20;visit&#x20;Manage&#x20;diagnostic&#x20;data&#x20;using&#x20;Group&#x20;Policy&#x20;and&#x20;MDM','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsAllow&#x20;Diagnostic&#x20;Data.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;11&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;Telemetry,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;11&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.17.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15795,'Ensure&#x20;&#039;Configure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Pr','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;can&#x20;automatically&#x20;use&#x20;an&#x20;authenticated&#x20;proxy&#x20;to&#x20;send&#x20;data&#x20;back&#x20;to&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsConfigure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15796,'Ensure&#x20;&#039;Disable&#x20;OneSettings&#x20;Downloads&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;attempts&#x20;to&#x20;connect&#x20;with&#x20;the&#x20;OneSettings&#x20;service&#x20;to&#x20;download&#x20;configuration&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as-needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDisable&#x20;OneSettings&#x20;Downloads.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.3\"]}]'),(15797,'Ensure&#x20;&#039;Do&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;prevent&#x20;its&#x20;devices&#x20;from&#x20;showing&#x20;feedback&#x20;questions&#x20;from&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;should&#x20;not&#x20;be&#x20;sending&#x20;any&#x20;feedback&#x20;to&#x20;3rd&#x20;party&#x20;vendors&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDo&#x20;not&#x20;show&#x20;feedback&#x20;notifications.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;FeedbackNotifications.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15798,'Ensure&#x20;&#039;Enable&#x20;OneSettings&#x20;Auditing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;records&#x20;attempts&#x20;to&#x20;connect&#x20;with&#x20;the&#x20;OneSettings&#x20;service&#x20;to&#x20;the&#x20;Operational&#x20;EventLog.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsEnable&#x20;OneSettings&#x20;Auditing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(15799,'Ensure&#x20;&#039;Limit&#x20;Diagnostic&#x20;Log&#x20;Collection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;additional&#x20;diagnostic&#x20;logs&#x20;are&#x20;collected&#x20;when&#x20;more&#x20;information&#x20;is&#x20;needed&#x20;to&#x20;troubleshoot&#x20;a&#x20;problem&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Diagnostic&#x20;logs&#x20;are&#x20;only&#x20;sent&#x20;when&#x20;the&#x20;device&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Diagnostic&#x20;data&#x20;is&#x20;limited&#x20;with&#x20;recommendation&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;is&#x20;set&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data&#x20;to&#x20;send&#x20;only&#x20;basic&#x20;information.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd-party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as-needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsLimit&#x20;Diagnostic&#x20;Log&#x20;Collection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.6\"]}]'),(15800,'Ensure&#x20;&#039;Limit&#x20;Dump&#x20;Collection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;limits&#x20;the&#x20;type&#x20;of&#x20;dumps&#x20;that&#x20;can&#x20;be&#x20;collected&#x20;when&#x20;more&#x20;information&#x20;is&#x20;needed&#x20;to&#x20;troubleshoot&#x20;a&#x20;problem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Dumps&#x20;are&#x20;only&#x20;sent&#x20;when&#x20;the&#x20;device&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Diagnostic&#x20;data&#x20;is&#x20;limited&#x20;with&#x20;recommendation&#x20;Ensure&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;is&#x20;set&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data&#x20;to&#x20;send&#x20;only&#x20;basic&#x20;information.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsLimit&#x20;Dump&#x20;Collection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.7\"]}]'),(15801,'Ensure&#x20;&#039;Toggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Insider&#x20;build&#x20;controls&#x20;in&#x20;the&#x20;Advanced&#x20;Options&#x20;for&#x20;Windows&#x20;Update.&#x20;These&#x20;controls&#x20;are&#x20;located&#x20;under&#x20;&quot;Get&#x20;Insider&#x20;builds,&quot;&#x20;and&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;Windows&#x20;preview&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;only&#x20;to&#x20;devices&#x20;running&#x20;Windows&#x20;10&#x20;Pro&#x20;or&#x20;Windows&#x20;10&#x20;Enterprise,&#x20;up&#x20;until&#x20;Release&#x20;1703.&#x20;For&#x20;Release&#x20;1709&#x20;or&#x20;newer,&#x20;Microsoft&#x20;encourages&#x20;using&#x20;the&#x20;Manage&#x20;preview&#x20;builds&#x20;setting&#x20;&#40;recommendation&#x20;title&#x20;&lsquo;Manage&#x20;preview&#x20;builds&rsquo;&#41;.&#x20;We&#x20;have&#x20;kept&#x20;this&#x20;setting&#x20;in&#x20;the&#x20;benchmark&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;older&#x20;builds&#x20;of&#x20;Windows&#x20;10&#x20;in&#x20;the&#x20;environment&#x20;are&#x20;still&#x20;enforced.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsToggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AllowBuildPreview.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.8\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15802,'Ensure&#x20;&#039;Download&#x20;Mode&#039;&#x20;is&#x20;NOT&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Internet&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;download&#x20;method&#x20;that&#x20;Delivery&#x20;Optimization&#x20;can&#x20;use&#x20;in&#x20;downloads&#x20;of&#x20;Windows&#x20;Updates,&#x20;Apps&#x20;and&#x20;App&#x20;updates.&#x20;The&#x20;following&#x20;methods&#x20;are&#x20;supported:&#x20;-&#x20;0&#x20;=&#x20;HTTP&#x20;only,&#x20;no&#x20;peering.&#x20;-&#x20;1&#x20;=&#x20;HTTP&#x20;blended&#x20;with&#x20;peering&#x20;behind&#x20;the&#x20;same&#x20;NAT.&#x20;-&#x20;2&#x20;=&#x20;HTTP&#x20;blended&#x20;with&#x20;peering&#x20;across&#x20;a&#x20;private&#x20;group.&#x20;Peering&#x20;occurs&#x20;on&#x20;devices&#x20;in&#x20;the&#x20;same&#x20;Active&#x20;Directory&#x20;Site&#x20;&#40;if&#x20;exist&#41;&#x20;or&#x20;the&#x20;same&#x20;domain&#x20;by&#x20;default.&#x20;When&#x20;this&#x20;option&#x20;is&#x20;selected,&#x20;peering&#x20;will&#x20;cross&#x20;NATs.&#x20;To&#x20;create&#x20;a&#x20;custom&#x20;group&#x20;use&#x20;Group&#x20;ID&#x20;in&#x20;combination&#x20;with&#x20;Mode&#x20;2.&#x20;-&#x20;3&#x20;=&#x20;HTTP&#x20;blended&#x20;with&#x20;Internet&#x20;Peering.&#x20;-&#x20;99&#x20;=&#x20;Simple&#x20;download&#x20;mode&#x20;with&#x20;no&#x20;peering.&#x20;Delivery&#x20;Optimization&#x20;downloads&#x20;using&#x20;HTTP&#x20;only&#x20;and&#x20;does&#x20;not&#x20;attempt&#x20;to&#x20;contact&#x20;the&#x20;Delivery&#x20;Optimization&#x20;cloud&#x20;services.&#x20;-&#x20;100&#x20;=&#x20;Bypass&#x20;mode.&#x20;Do&#x20;not&#x20;use&#x20;Delivery&#x20;Optimization&#x20;and&#x20;use&#x20;BITS&#x20;instead.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;any&#x20;value&#x20;EXCEPT:&#x20;Enabled:&#x20;Internet&#x20;&#40;3&#41;.&#x20;Note:&#x20;The&#x20;default&#x20;on&#x20;all&#x20;SKUs&#x20;other&#x20;than&#x20;Enterprise,&#x20;Enterprise&#x20;LTSB&#x20;or&#x20;Education&#x20;is&#x20;Enabled:&#x20;Internet&#x20;&#40;3&#41;,&#x20;so&#x20;on&#x20;other&#x20;SKUs,&#x20;be&#x20;sure&#x20;to&#x20;set&#x20;this&#x20;to&#x20;a&#x20;different&#x20;value.','Due&#x20;to&#x20;privacy&#x20;concerns&#x20;and&#x20;security&#x20;risks,&#x20;updates&#x20;should&#x20;only&#x20;be&#x20;downloaded&#x20;directly&#x20;from&#x20;Microsoft,&#x20;or&#x20;from&#x20;a&#x20;trusted&#x20;machine&#x20;on&#x20;the&#x20;internal&#x20;network&#x20;that&#x20;received&#x20;its&#x20;updates&#x20;from&#x20;a&#x20;trusted&#x20;source&#x20;and&#x20;approved&#x20;by&#x20;the&#x20;network&#x20;administrator.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;any&#x20;value&#x20;other&#x20;than&#x20;Enabled:&#x20;Internet&#x20;&#40;3&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsDelivery&#x20;OptimizationDownload&#x20;Mode.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeliveryOptimization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.18.1\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(15803,'Ensure&#x20;&#039;Application:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.1.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15804,'Ensure&#x20;&#039;Application:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.1.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15805,'Ensure&#x20;&#039;Security:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecurityControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.2.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15806,'Ensure&#x20;&#039;Security:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;196,608&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecuritySpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.2.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15807,'Ensure&#x20;&#039;Setup:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.3.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15808,'Ensure&#x20;&#039;Setup:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.3.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15809,'Ensure&#x20;&#039;System:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.4.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15810,'Ensure&#x20;&#039;System:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.4.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15811,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Disabling&#x20;Data&#x20;Execution&#x20;Prevention&#x20;can&#x20;allow&#x20;certain&#x20;legacy&#x20;plug-in&#x20;applications&#x20;to&#x20;function&#x20;without&#x20;terminating&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;legacy&#x20;plug-in&#x20;applications&#x20;and&#x20;other&#x20;software&#x20;may&#x20;not&#x20;function&#x20;with&#x20;Data&#x20;Execution&#x20;Prevention&#x20;and&#x20;will&#x20;require&#x20;an&#x20;exception&#x20;to&#x20;be&#x20;defined&#x20;for&#x20;that&#x20;specific&#x20;plug-&#x20;in/software.','Data&#x20;Execution&#x20;Prevention&#x20;is&#x20;an&#x20;important&#x20;security&#x20;feature&#x20;supported&#x20;by&#x20;Explorer&#x20;that&#x20;helps&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;of&#x20;certain&#x20;types&#x20;of&#x20;malware.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.31.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(15812,'Ensure&#x20;&#039;Turn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Without&#x20;heap&#x20;termination&#x20;on&#x20;corruption,&#x20;legacy&#x20;plug-in&#x20;applications&#x20;may&#x20;continue&#x20;to&#x20;function&#x20;when&#x20;a&#x20;File&#x20;Explorer&#x20;session&#x20;has&#x20;become&#x20;corrupt.&#x20;Ensuring&#x20;that&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#x20;is&#x20;active&#x20;will&#x20;prevent&#x20;this.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Allowing&#x20;an&#x20;application&#x20;to&#x20;function&#x20;after&#x20;its&#x20;session&#x20;has&#x20;become&#x20;corrupt&#x20;increases&#x20;the&#x20;risk&#x20;posture&#x20;to&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.31.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15813,'Ensure&#x20;&#039;Turn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.31.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15814,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;computer&#x20;from&#x20;joining&#x20;a&#x20;homegroup&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','By&#x20;default,&#x20;users&#x20;can&#x20;add&#x20;their&#x20;computer&#x20;to&#x20;a&#x20;HomeGroup&#x20;on&#x20;a&#x20;home&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;HomeGroup&#x20;feature&#x20;is&#x20;available&#x20;in&#x20;all&#x20;workstation&#x20;releases&#x20;of&#x20;Windows&#x20;from&#x20;Windows&#x20;7&#x20;through&#x20;Windows&#x20;10&#x20;Release&#x20;1709.&#x20;Microsoft&#x20;removed&#x20;the&#x20;feature&#x20;completely&#x20;starting&#x20;with&#x20;Windows&#x20;10&#x20;Release&#x20;1803.&#x20;However,&#x20;if&#x20;your&#x20;environment&#x20;still&#x20;contains&#x20;any&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;&#40;or&#x20;older&#41;&#x20;workstations,&#x20;then&#x20;this&#x20;setting&#x20;remains&#x20;important&#x20;to&#x20;disable&#x20;HomeGroup&#x20;on&#x20;those&#x20;systems.','While&#x20;resources&#x20;on&#x20;a&#x20;domain-joined&#x20;computer&#x20;cannot&#x20;be&#x20;shared&#x20;with&#x20;a&#x20;HomeGroup,&#x20;information&#x20;from&#x20;the&#x20;domain-joined&#x20;computer&#x20;can&#x20;be&#x20;leaked&#x20;to&#x20;other&#x20;computers&#x20;in&#x20;the&#x20;HomeGroup.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsHomeGroupPrevent&#x20;the&#x20;computer&#x20;from&#x20;joining&#x20;a&#x20;homegroup.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sharing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.36.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15815,'Ensure&#x20;&#039;Turn&#x20;off&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;location&#x20;feature&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&#039;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsTurn&#x20;off&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sensors.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.41.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15816,'Ensure&#x20;&#039;Allow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;backup&#x20;and&#x20;restore&#x20;of&#x20;cellular&#x20;text&#x20;messages&#x20;to&#x20;Microsoft&#039;s&#x20;cloud&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMessagingAllow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Messaging.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.45.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15817,'Ensure&#x20;&#039;Block&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;applications&#x20;and&#x20;services&#x20;on&#x20;the&#x20;device&#x20;can&#x20;utilize&#x20;new&#x20;consumer&#x20;Microsoft&#x20;account&#x20;authentication&#x20;via&#x20;the&#x20;Windows&#x20;OnlineID&#x20;and&#x20;WebAccountManager&#x20;APIs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;on&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;accountsBlock&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSAPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.46.1\"]}, {\"cis_csc\": [\"5.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15818,'Ensure&#x20;&#039;Configure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;a&#x20;local&#x20;override&#x20;for&#x20;the&#x20;configuration&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;and&#x20;then&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service.&#x20;This&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;set&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;decision&#x20;on&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;participate&#x20;in&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;for&#x20;malicious&#x20;software&#x20;reporting&#x20;should&#x20;be&#x20;made&#x20;centrally&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;so&#x20;that&#x20;all&#x20;computers&#x20;within&#x20;it&#x20;behave&#x20;consistently&#x20;in&#x20;that&#x20;regard.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Disabled&#x20;ensures&#x20;that&#x20;the&#x20;decision&#x20;remains&#x20;centrally&#x20;managed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMAPSConfigure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.4.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15819,'Ensure&#x20;&#039;Join&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;and&#x20;then&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service.&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;is&#x20;the&#x20;online&#x20;community&#x20;that&#x20;helps&#x20;you&#x20;choose&#x20;how&#x20;to&#x20;respond&#x20;to&#x20;potential&#x20;threats.&#x20;The&#x20;community&#x20;also&#x20;helps&#x20;stop&#x20;the&#x20;spread&#x20;of&#x20;new&#x20;malicious&#x20;software&#x20;infections.&#x20;You&#x20;can&#x20;choose&#x20;to&#x20;send&#x20;basic&#x20;or&#x20;additional&#x20;information&#x20;about&#x20;detected&#x20;software.&#x20;Additional&#x20;information&#x20;helps&#x20;Microsoft&#x20;create&#x20;new&#x20;definitions&#x20;and&#x20;help&#x20;it&#x20;to&#x20;protect&#x20;your&#x20;computer.&#x20;Possible&#x20;options&#x20;are:&#x20;-&#x20;&#40;0x0&#41;&#x20;Disabled&#x20;&#40;default&#41;&#x20;-&#x20;&#40;0x1&#41;&#x20;Basic&#x20;membership&#x20;-&#x20;&#40;0x2&#41;&#x20;Advanced&#x20;membership&#x20;Basic&#x20;membership&#x20;will&#x20;send&#x20;basic&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;software&#x20;that&#x20;has&#x20;been&#x20;detected&#x20;including&#x20;where&#x20;the&#x20;software&#x20;came&#x20;from&#x20;the&#x20;actions&#x20;that&#x20;you&#x20;apply&#x20;or&#x20;that&#x20;are&#x20;applied&#x20;automatically&#x20;and&#x20;whether&#x20;the&#x20;actions&#x20;were&#x20;successful.&#x20;Advanced&#x20;membership&#x20;in&#x20;addition&#x20;to&#x20;basic&#x20;information&#x20;will&#x20;send&#x20;more&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;malicious&#x20;software&#x20;spyware&#x20;and&#x20;potentially&#x20;unwanted&#x20;software&#x20;including&#x20;the&#x20;location&#x20;of&#x20;the&#x20;software&#x20;file&#x20;names&#x20;how&#x20;the&#x20;software&#x20;operates&#x20;and&#x20;how&#x20;it&#x20;has&#x20;impacted&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;information&#x20;that&#x20;would&#x20;be&#x20;sent&#x20;can&#x20;include&#x20;things&#x20;like&#x20;location&#x20;of&#x20;detected&#x20;items&#x20;on&#x20;your&#x20;computer&#x20;if&#x20;harmful&#x20;software&#x20;was&#x20;removed.&#x20;The&#x20;information&#x20;would&#x20;be&#x20;automatically&#x20;collected&#x20;and&#x20;sent.&#x20;In&#x20;some&#x20;instances&#x20;personal&#x20;information&#x20;might&#x20;unintentionally&#x20;be&#x20;sent&#x20;to&#x20;Microsoft.&#x20;However,&#x20;Microsoft&#x20;states&#x20;that&#x20;it&#x20;will&#x20;not&#x20;use&#x20;this&#x20;information&#x20;to&#x20;identify&#x20;you&#x20;or&#x20;contact&#x20;you.&#x20;For&#x20;privacy&#x20;reasons&#x20;in&#x20;high&#x20;security&#x20;environments,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;prevent&#x20;these&#x20;data&#x20;submissions&#x20;altogether.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMAPSJoin&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.4.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15820,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;state&#x20;for&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;&#40;ASR&#41;&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15821,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules:&#x20;Set&#x20;the&#x20;state&#x20;for&#x20;each&#x20;ASR&#x20;rule&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;26190899-1602-49e8-8b27-eb1d0a1ce869&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;communication&#x20;application&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;3b576869-a4ec-4529-8536-b80a7769e899&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;creating&#x20;executable&#x20;content&#41;&#x20;5beb7efe-fd9a-4556-801d-275e5ffc04cc&#x20;-&#x20;1&#x20;&#40;Block&#x20;execution&#x20;of&#x20;potentially&#x20;obfuscated&#x20;scripts&#41;&#x20;75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;injecting&#x20;code&#x20;into&#x20;other&#x20;processes&#41;&#x20;7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c&#x20;-&#x20;1&#x20;&#40;Block&#x20;Adobe&#x20;Reader&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b&#x20;-&#x20;1&#x20;&#40;Block&#x20;Win32&#x20;API&#x20;calls&#x20;from&#x20;Office&#x20;macro&#41;&#x20;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2&#x20;-&#x20;1&#x20;&#40;Block&#x20;credential&#x20;stealing&#x20;from&#x20;the&#x20;Windows&#x20;local&#x20;security&#x20;authority&#x20;subsystem&#x20;&#40;lsass.exe&#41;&#41;&#x20;b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4&#x20;-&#x20;1&#x20;&#40;Block&#x20;untrusted&#x20;and&#x20;unsigned&#x20;processes&#x20;that&#x20;run&#x20;from&#x20;USB&#41;&#x20;be9ba2d9-53ea-4cdc-84e5-9b1eeee46550&#x20;-&#x20;1&#x20;&#40;Block&#x20;executable&#x20;content&#x20;from&#x20;email&#x20;client&#x20;and&#x20;webmail&#41;&#x20;d3e037e1-3eb8-44c8-a917-57927947596d&#x20;-&#x20;1&#x20;&#40;Block&#x20;JavaScript&#x20;or&#x20;VBScript&#x20;from&#x20;launching&#x20;downloaded&#x20;executable&#x20;content&#41;&#x20;d4f940ab-401b-4efc-aadc-ad5f3c50688a&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;e6db77e5-3df2-4cf1-b95a-636979351e5b&#x20;-&#x20;1&#x20;&#40;Block&#x20;persistence&#x20;through&#x20;WMI&#x20;event&#x20;subscription&#41;&#x20;Note:&#x20;More&#x20;information&#x20;on&#x20;ASR&#x20;rules&#x20;can&#x20;be&#x20;found&#x20;at&#x20;the&#x20;following&#x20;link:&#x20;Use&#x20;Attack&#x20;surface&#x20;reduction&#x20;rules&#x20;to&#x20;prevent&#x20;malware&#x20;infection&#x20;|&#x20;Microsoft&#x20;Docs','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;so&#x20;that&#x20;26190899-1602-49e8-8b27-eb1d0a1ce869,&#x20;3b576869-a4ec-4529-8536-b80a7769e899,&#x20;5beb7efe-fd9a-4556-801d-275e5ffc04cc,&#x20;75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,&#x20;7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,&#x20;92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,&#x20;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,&#x20;b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,&#x20;be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,&#x20;d3e037e1-3eb8-44c8-a917-57927947596d,&#x20;d4f940ab-401b-4efc-aadc-ad5f3c50688a,&#x20;and&#x20;e6db77e5-3df2-4cf1-b95a-636979351e5b&#x20;are&#x20;each&#x20;set&#x20;to&#x20;a&#x20;value&#x20;of&#x20;1:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules:&#x20;Set&#x20;the&#x20;state&#x20;for&#x20;each&#x20;ASR&#x20;rule.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.1.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15822,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Microsoft&#x20;Defender&#x20;Exploit&#x20;Guard&#x20;network&#x20;protection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block.','This&#x20;setting&#x20;can&#x20;help&#x20;prevent&#x20;employees&#x20;from&#x20;using&#x20;any&#x20;application&#x20;to&#x20;access&#x20;dangerous&#x20;domains&#x20;that&#x20;may&#x20;host&#x20;phishing&#x20;scams,&#x20;exploit-hosting&#x20;sites,&#x20;and&#x20;other&#x20;malicious&#x20;content&#x20;on&#x20;the&#x20;Internet.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusWindows&#x20;Defender&#x20;Exploit&#x20;GuardNetwork&#x20;ProtectionPrevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.3.1\"]}, {\"cis_csc\": [\"9.3\", \"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15823,'Ensure&#x20;&#039;Enable&#x20;file&#x20;hash&#x20;computation&#x20;feature&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;hash&#x20;values&#x20;are&#x20;computed&#x20;for&#x20;files&#x20;scanned&#x20;by&#x20;Microsoft&#x20;Defender.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;monitor&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.&#x20;File&#x20;hashes&#x20;are&#x20;a&#x20;reliable&#x20;way&#x20;of&#x20;detecting&#x20;changes&#x20;to&#x20;files,&#x20;and&#x20;can&#x20;speed&#x20;up&#x20;the&#x20;scan&#x20;process&#x20;by&#x20;skipping&#x20;files&#x20;that&#x20;have&#x20;not&#x20;changed&#x20;since&#x20;they&#x20;were&#x20;last&#x20;scanned&#x20;and&#x20;determined&#x20;to&#x20;be&#x20;safe.&#x20;A&#x20;changed&#x20;file&#x20;hash&#x20;can&#x20;also&#x20;be&#x20;cause&#x20;for&#x20;additional&#x20;scrutiny.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMpEngineEnable&#x20;file&#x20;hash&#x20;computation&#x20;feature.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.6.1\"]}, {\"cis_csc\": [\"10.1\"]}]'),(15824,'Ensure&#x20;&#039;Scan&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;scanning&#x20;for&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionScan&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.1\"]}]'),(15825,'Ensure&#x20;&#039;Turn&#x20;off&#x20;real-time&#x20;protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;real-time&#x20;protection&#x20;prompts&#x20;for&#x20;known&#x20;malware&#x20;detection.&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;alerts&#x20;you&#x20;when&#x20;malware&#x20;or&#x20;potentially&#x20;unwanted&#x20;software&#x20;attempts&#x20;to&#x20;install&#x20;itself&#x20;or&#x20;to&#x20;run&#x20;on&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;off&#x20;real-time&#x20;protection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.2\"]}]'),(15826,'Ensure&#x20;&#039;Turn&#x20;on&#x20;behavior&#x20;monitoring&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;behavior&#x20;monitoring&#x20;for&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;behavior&#x20;monitoring.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.3\"]}, {\"cis_csc\": [\"10.7\"]}]'),(15827,'Ensure&#x20;&#039;Turn&#x20;on&#x20;script&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;script&#x20;scanning&#x20;to&#x20;be&#x20;turned&#x20;on/off.&#x20;Script&#x20;scanning&#x20;intercepts&#x20;scripts&#x20;then&#x20;scans&#x20;them&#x20;before&#x20;they&#x20;are&#x20;executed&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;script&#x20;scanning.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.4\"]}, {\"cis_csc\": [\"10.7\"]}]'),(15828,'Ensure&#x20;&#039;Configure&#x20;Watson&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;whether&#x20;or&#x20;not&#x20;Watson&#x20;events&#x20;are&#x20;sent.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Watson&#x20;events&#x20;are&#x20;the&#x20;reports&#x20;that&#x20;get&#x20;sent&#x20;to&#x20;Microsoft&#x20;when&#x20;a&#x20;program&#x20;or&#x20;service&#x20;crashes&#x20;or&#x20;fails,&#x20;including&#x20;the&#x20;possibility&#x20;of&#x20;automatic&#x20;submission.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReportingConfigure&#x20;Watson&#x20;events.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.11.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15829,'Ensure&#x20;&#039;Scan&#x20;removable&#x20;drives&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;scan&#x20;for&#x20;malicious&#x20;software&#x20;and&#x20;unwanted&#x20;software&#x20;in&#x20;the&#x20;contents&#x20;of&#x20;removable&#x20;drives,&#x20;such&#x20;as&#x20;USB&#x20;flash&#x20;drives,&#x20;when&#x20;running&#x20;a&#x20;full&#x20;scan.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;present&#x20;removable&#x20;drives&#x20;are&#x20;always&#x20;included&#x20;in&#x20;any&#x20;type&#x20;of&#x20;scan,&#x20;as&#x20;removable&#x20;drives&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;contain&#x20;malicious&#x20;software&#x20;brought&#x20;in&#x20;to&#x20;the&#x20;enterprise&#x20;managed&#x20;environment&#x20;from&#x20;an&#x20;external,&#x20;unmanaged&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusScanScan&#x20;removable&#x20;drives.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.12.1\"]}, {\"cis_csc\": [\"10.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15830,'Ensure&#x20;&#039;Turn&#x20;on&#x20;e-mail&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;e-mail&#x20;scanning.&#x20;When&#x20;e-mail&#x20;scanning&#x20;is&#x20;enabled,&#x20;the&#x20;engine&#x20;will&#x20;parse&#x20;the&#x20;mailbox&#x20;and&#x20;mail&#x20;files,&#x20;according&#x20;to&#x20;their&#x20;specific&#x20;format,&#x20;in&#x20;order&#x20;to&#x20;analyze&#x20;the&#x20;mail&#x20;bodies&#x20;and&#x20;attachments.&#x20;Several&#x20;e-mail&#x20;formats&#x20;are&#x20;currently&#x20;supported,&#x20;for&#x20;example:&#x20;pst&#x20;&#40;Outlook&#41;,&#x20;dbx,&#x20;mbx,&#x20;mime&#x20;&#40;Outlook&#x20;Express&#41;,&#x20;binhex&#x20;&#40;Mac&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Incoming&#x20;e-mails&#x20;should&#x20;be&#x20;scanned&#x20;by&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;as&#x20;email&#x20;attachments&#x20;are&#x20;a&#x20;commonly&#x20;used&#x20;attack&#x20;vector&#x20;to&#x20;infiltrate&#x20;computers&#x20;with&#x20;malicious&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusScanTurn&#x20;on&#x20;e-mail&#x20;scanning.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.12.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15831,'Ensure&#x20;&#039;Configure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;detection&#x20;and&#x20;action&#x20;for&#x20;Potentially&#x20;Unwanted&#x20;Applications&#x20;&#40;PUA&#41;,&#x20;which&#x20;are&#x20;sneaky&#x20;unwanted&#x20;application&#x20;bundlers&#x20;or&#x20;their&#x20;bundled&#x20;applications,&#x20;that&#x20;can&#x20;deliver&#x20;adware&#x20;or&#x20;malware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block.&#x20;For&#x20;more&#x20;information,&#x20;see&#x20;this&#x20;link:&#x20;Block&#x20;potentially&#x20;unwanted&#x20;applications&#x20;with&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;|&#x20;Microsoft&#x20;Docs','Potentially&#x20;unwanted&#x20;applications&#x20;can&#x20;increase&#x20;the&#x20;risk&#x20;of&#x20;your&#x20;network&#x20;being&#x20;infected&#x20;with&#x20;malware,&#x20;cause&#x20;malware&#x20;infections&#x20;to&#x20;be&#x20;harder&#x20;to&#x20;identify,&#x20;and&#x20;can&#x20;waste&#x20;IT&#x20;resources&#x20;in&#x20;cleaning&#x20;up&#x20;the&#x20;applications.&#x20;They&#x20;should&#x20;be&#x20;blocked&#x20;from&#x20;installation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusConfigure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.15\"]}, {\"cis_csc\": [\"2.5\", \"10.6\"]}]'),(15832,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;AntiVirus&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;If&#x20;the&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;Disabled,&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;runs&#x20;and&#x20;computers&#x20;are&#x20;scanned&#x20;for&#x20;malware&#x20;and&#x20;other&#x20;potentially&#x20;unwanted&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;current,&#x20;updated&#x20;antivirus&#x20;product&#x20;is&#x20;scanning&#x20;each&#x20;computer&#x20;for&#x20;malicious&#x20;file&#x20;activity.&#x20;Microsoft&#x20;provides&#x20;a&#x20;competent&#x20;solution&#x20;out&#x20;of&#x20;the&#x20;box&#x20;in&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;Organizations&#x20;that&#x20;choose&#x20;to&#x20;purchase&#x20;a&#x20;reputable&#x20;3rd-party&#x20;antivirus&#x20;solution&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;in&#x20;lieu&#x20;of&#x20;the&#x20;commercial&#x20;alternative.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusTurn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;AntiVirus.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;off&#x20;Windows&#x20;Defender,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;again&#x20;renamed&#x20;to&#x20;Turn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.47.16\"]}, {\"cis_csc\": [\"10.6\"]}]'),(15833,'Ensure&#x20;&#039;Enable&#x20;news&#x20;and&#x20;interests&#x20;on&#x20;the&#x20;taskbar&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;news&#x20;and&#x20;interests&#x20;feature&#x20;is&#x20;allowed&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;apps&#x20;and&#x20;features&#x20;such&#x20;as&#x20;news&#x20;and&#x20;interests&#x20;on&#x20;the&#x20;Windows&#x20;taskbar&#x20;should&#x20;be&#x20;treated&#x20;as&#x20;a&#x20;possible&#x20;security&#x20;risk&#x20;due&#x20;to&#x20;the&#x20;potential&#x20;of&#x20;data&#x20;being&#x20;sent&#x20;back&#x20;to&#x20;3rd&#x20;parties,&#x20;such&#x20;as&#x20;Microsoft.&#x20;In&#x20;addition,&#x20;the&#x20;app&#x20;may&#x20;display&#x20;inappropriate&#x20;news&#x20;and&#x20;interests&#x20;within&#x20;the&#x20;feed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsNews&#x20;and&#x20;interestsEnable&#x20;news&#x20;and&#x20;interests&#x20;on&#x20;the&#x20;taskbar.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Feeds.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H1&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.57.1\"]}]'),(15834,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;&#40;or&#x20;intentionally&#41;&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;cloud-based&#x20;file&#x20;storage&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;the&#x20;one&#x20;supplied&#x20;with&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;However,&#x20;we&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;the&#x20;version&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Prevent&#x20;the&#x20;usage&#x20;of&#x20;SkyDrive&#x20;for&#x20;file&#x20;storage,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15835,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Push&#x20;To&#x20;Install&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;can&#x20;push&#x20;Apps&#x20;to&#x20;the&#x20;device&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;App&#x20;running&#x20;on&#x20;other&#x20;devices&#x20;or&#x20;the&#x20;web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;high&#x20;security&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsPush&#x20;to&#x20;InstallTurn&#x20;off&#x20;Push&#x20;To&#x20;Install&#x20;service.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PushToInstall.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.64.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15836,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;helps&#x20;prevent&#x20;Remote&#x20;Desktop&#x20;clients&#x20;from&#x20;saving&#x20;passwords&#x20;on&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;was&#x20;previously&#x20;configured&#x20;as&#x20;Disabled&#x20;or&#x20;Not&#x20;configured,&#x20;any&#x20;previously&#x20;saved&#x20;passwords&#x20;will&#x20;be&#x20;deleted&#x20;the&#x20;first&#x20;time&#x20;a&#x20;Remote&#x20;Desktop&#x20;client&#x20;disconnects&#x20;from&#x20;any&#x20;server.','An&#x20;attacker&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;may&#x20;be&#x20;able&#x20;to&#x20;break&#x20;the&#x20;protection&#x20;guarding&#x20;saved&#x20;passwords.&#x20;An&#x20;attacker&#x20;who&#x20;compromises&#x20;a&#x20;user&#039;s&#x20;account&#x20;and&#x20;connects&#x20;to&#x20;their&#x20;computer&#x20;could&#x20;use&#x20;saved&#x20;passwords&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;additional&#x20;hosts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Connection&#x20;ClientDo&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.2.2\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15837,'Ensure&#x20;&#039;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;remote&#x20;access&#x20;to&#x20;computers&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;account&#x20;with&#x20;the&#x20;Allow&#x20;log&#x20;on&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#x20;user&#x20;right&#x20;can&#x20;log&#x20;on&#x20;to&#x20;the&#x20;remote&#x20;console&#x20;of&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;restrict&#x20;access&#x20;to&#x20;legitimate&#x20;users&#x20;who&#x20;need&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;console&#x20;of&#x20;the&#x20;computer,&#x20;unauthorized&#x20;users&#x20;could&#x20;download&#x20;and&#x20;execute&#x20;malicious&#x20;code&#x20;to&#x20;elevate&#x20;their&#x20;privileges.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostConnectionsAllow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;using&#x20;Terminal&#x20;Services,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services&#x20;in&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;finally&#x20;renamed&#x20;&#40;again&#41;&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.2.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15838,'Ensure&#x20;&#039;Allow&#x20;UI&#x20;Automation&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;User&#x20;Interface&#x20;&#40;UI&#41;&#x20;Automation&#x20;client&#x20;applications&#x20;running&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;can&#x20;access&#x20;UI&#x20;elements&#x20;on&#x20;the&#x20;server.&#x20;UI&#x20;Automation&#x20;gives&#x20;programs&#x20;access&#x20;to&#x20;most&#x20;UI&#x20;elements,&#x20;which&#x20;allows&#x20;use&#x20;of&#x20;assistive&#x20;technology&#x20;products&#x20;like&#x20;Magnifier&#x20;and&#x20;Narrator&#x20;that&#x20;need&#x20;to&#x20;interact&#x20;with&#x20;the&#x20;UI&#x20;in&#x20;order&#x20;to&#x20;work&#x20;properly.&#x20;UI&#x20;information&#x20;also&#x20;allows&#x20;automated&#x20;test&#x20;scripts&#x20;to&#x20;interact&#x20;with&#x20;the&#x20;UI.&#x20;For&#x20;example,&#x20;the&#x20;local&#x20;computers&#x20;Narrator&#x20;and&#x20;Magnifier&#x20;clients&#x20;can&#x20;be&#x20;used&#x20;to&#x20;interact&#x20;with&#x20;UI&#x20;on&#x20;a&#x20;web&#x20;page&#x20;opened&#x20;in&#x20;a&#x20;remote&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;dont&#x20;currently&#x20;support&#x20;UI&#x20;Automation&#x20;redirection.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;UI&#x20;Automation&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;rare,&#x20;and&#x20;not&#x20;supported&#x20;at&#x20;this&#x20;time,&#x20;but&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;malicious&#x20;activity&#x20;to&#x20;occur.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionAllow&#x20;UI&#x20;Automation&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.3.3.1\"]}]'),(15839,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;COM&#x20;ports&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;COM&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15840,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;sharing&#x20;the&#x20;local&#x20;drives&#x20;on&#x20;their&#x20;client&#x20;computers&#x20;to&#x20;Remote&#x20;Desktop&#x20;Servers&#x20;that&#x20;they&#x20;access.&#x20;Mapped&#x20;drives&#x20;appear&#x20;in&#x20;the&#x20;session&#x20;folder&#x20;tree&#x20;in&#x20;Windows&#x20;Explorer&#x20;in&#x20;the&#x20;following&#x20;format:&#x20;&#92;TSClient&lt;driveletter&gt;$&#x20;If&#x20;local&#x20;drives&#x20;are&#x20;shared&#x20;they&#x20;are&#x20;left&#x20;vulnerable&#x20;to&#x20;intruders&#x20;who&#x20;want&#x20;to&#x20;exploit&#x20;the&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Data&#x20;could&#x20;be&#x20;forwarded&#x20;from&#x20;the&#x20;user&#039;s&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;without&#x20;any&#x20;direct&#x20;user&#x20;interaction.&#x20;Malicious&#x20;software&#x20;already&#x20;present&#x20;on&#x20;a&#x20;compromised&#x20;server&#x20;would&#x20;have&#x20;direct&#x20;and&#x20;stealthy&#x20;disk&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;drive&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15841,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;location&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;redirection&#x20;of&#x20;location&#x20;data&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;location&#x20;data&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;rare,&#x20;so&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;malicious&#x20;activity&#x20;to&#x20;occur.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;location&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.3.3.4\"]}]'),(15842,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;LPT&#x20;ports&#x20;during&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;LPT&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15843,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;redirection&#x20;of&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;devices,&#x20;such&#x20;as&#x20;Windows&#x20;Portable&#x20;Devices,&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.6\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15844,'Ensure&#x20;&#039;Always&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;always&#x20;prompts&#x20;the&#x20;client&#x20;computer&#x20;for&#x20;a&#x20;password&#x20;upon&#x20;connection.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enforce&#x20;a&#x20;password&#x20;prompt&#x20;for&#x20;users&#x20;who&#x20;log&#x20;on&#x20;to&#x20;Remote&#x20;Desktop&#x20;Services,&#x20;even&#x20;if&#x20;they&#x20;already&#x20;provided&#x20;the&#x20;password&#x20;in&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;have&#x20;the&#x20;option&#x20;to&#x20;store&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;when&#x20;they&#x20;create&#x20;a&#x20;new&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut.&#x20;If&#x20;the&#x20;server&#x20;that&#x20;runs&#x20;Remote&#x20;Desktop&#x20;Services&#x20;allows&#x20;users&#x20;who&#x20;have&#x20;used&#x20;this&#x20;feature&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;server&#x20;but&#x20;not&#x20;enter&#x20;their&#x20;password,&#x20;then&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer&#x20;could&#x20;connect&#x20;to&#x20;a&#x20;Remote&#x20;Desktop&#x20;Server&#x20;through&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut,&#x20;even&#x20;though&#x20;they&#x20;may&#x20;not&#x20;know&#x20;the&#x20;user&#039;s&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityAlways&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Always&#x20;prompt&#x20;client&#x20;for&#x20;password&#x20;upon&#x20;connection,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15845,'Ensure&#x20;&#039;Require&#x20;secure&#x20;RPC&#x20;communication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;requires&#x20;secure&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;communication&#x20;with&#x20;all&#x20;clients&#x20;or&#x20;allows&#x20;unsecured&#x20;communication.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;strengthen&#x20;the&#x20;security&#x20;of&#x20;RPC&#x20;communication&#x20;with&#x20;clients&#x20;by&#x20;allowing&#x20;only&#x20;authenticated&#x20;and&#x20;encrypted&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;unsecure&#x20;RPC&#x20;communication&#x20;can&#x20;exposes&#x20;the&#x20;server&#x20;to&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks&#x20;and&#x20;data&#x20;disclosure&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;secure&#x20;RPC&#x20;communication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.2\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15846,'Ensure&#x20;&#039;Require&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;SSL&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;security&#x20;layer&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;SSL.&#x20;Note:&#x20;In&#x20;spite&#x20;of&#x20;this&#x20;setting&#x20;being&#x20;labeled&#x20;SSL,&#x20;it&#x20;is&#x20;actually&#x20;enforcing&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;version&#x20;1.0,&#x20;not&#x20;the&#x20;older&#x20;&#40;and&#x20;less&#x20;secure&#41;&#x20;SSL&#x20;protocol.','The&#x20;native&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;encryption&#x20;is&#x20;now&#x20;considered&#x20;a&#x20;weak&#x20;protocol,&#x20;so&#x20;enforcing&#x20;the&#x20;use&#x20;of&#x20;stronger&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;encryption&#x20;for&#x20;all&#x20;RDP&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;is&#x20;preferred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;SSL:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.3\"]}, {\"cis_csc\": [\"3.10\"]}]'),(15847,'Ensure&#x20;&#039;Require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;to&#x20;require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;to&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Requiring&#x20;that&#x20;user&#x20;authentication&#x20;occur&#x20;earlier&#x20;in&#x20;the&#x20;remote&#x20;connection&#x20;process&#x20;enhances&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Require&#x20;user&#x20;authentication&#x20;using&#x20;RDP&#x20;6.0&#x20;for&#x20;remote&#x20;connections,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.4\"]}, {\"cis_csc\": [\"3.10\"]}]'),(15848,'Ensure&#x20;&#039;Set&#x20;client&#x20;connection&#x20;encryption&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;High&#x20;Level&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;encryption&#x20;level&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;client&#x20;computers&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;This&#x20;policy&#x20;only&#x20;applies&#x20;when&#x20;you&#x20;are&#x20;using&#x20;native&#x20;RDP&#x20;encryption.&#x20;However,&#x20;native&#x20;RDP&#x20;encryption&#x20;&#40;as&#x20;opposed&#x20;to&#x20;SSL&#x20;encryption&#41;&#x20;is&#x20;not&#x20;recommended.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;SSL&#x20;encryption.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;High&#x20;Level.','If&#x20;Remote&#x20;Desktop&#x20;client&#x20;connections&#x20;that&#x20;use&#x20;low&#x20;level&#x20;encryption&#x20;are&#x20;allowed,&#x20;it&#x20;is&#x20;more&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;any&#x20;captured&#x20;Remote&#x20;Desktop&#x20;Services&#x20;network&#x20;traffic.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.5\"]}, {\"cis_csc\": [\"3.10\"]}]'),(15849,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;time&#x20;that&#x20;an&#x20;active&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;can&#x20;be&#x20;idle&#x20;&#40;without&#x20;user&#x20;input&#41;&#x20;before&#x20;it&#x20;is&#x20;automatically&#x20;disconnected.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never&#x20;&#40;0&#41;.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;inactive&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never&#x20;&#40;0&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Terminal&#x20;Services&#x20;sessions,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.10.1\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15850,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;1&#x20;minute&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;a&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;1&#x20;minute.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;disconnected&#x20;but&#x20;still&#x20;active&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.&#x20;This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;disconnected&#x20;session&#x20;is&#x20;properly&#x20;terminated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;1&#x20;minute:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.10.2\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15851,'Ensure&#x20;&#039;Do&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;retains&#x20;a&#x20;user&#039;s&#x20;per-session&#x20;temporary&#x20;folders&#x20;at&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;inside&#x20;the&#x20;temporary&#x20;folders&#x20;and&#x20;visible&#x20;to&#x20;other&#x20;administrators&#x20;that&#x20;log&#x20;into&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Do&#x20;not&#x20;delete&#x20;temp&#x20;folder&#x20;upon&#x20;exit,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.11.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15852,'Ensure&#x20;&#039;Prevent&#x20;downloading&#x20;of&#x20;enclosures&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;having&#x20;enclosures&#x20;&#40;file&#x20;attachments&#41;&#x20;downloaded&#x20;from&#x20;an&#x20;RSS&#x20;feed&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;attachments&#x20;to&#x20;be&#x20;downloaded&#x20;through&#x20;the&#x20;RSS&#x20;feed&#x20;can&#x20;introduce&#x20;files&#x20;that&#x20;could&#x20;have&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRSS&#x20;FeedsPrevent&#x20;downloading&#x20;of&#x20;enclosures.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InetRes.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Turn&#x20;off&#x20;downloading&#x20;of&#x20;enclosures,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.66.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15853,'Ensure&#x20;&#039;Allow&#x20;Cloud&#x20;Search&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;search&#x20;cloud&#x20;sources&#x20;like&#x20;OneDrive&#x20;and&#x20;SharePoint.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cloud&#x20;Search.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15854,'Ensure&#x20;&#039;Allow&#x20;Cortana&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Cortana&#x20;is&#x20;allowed&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;Cortana&#x20;is&#x20;enabled,&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;in&#x20;search&#x20;history&#x20;and&#x20;sent&#x20;out&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cortana.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.3\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15855,'Ensure&#x20;&#039;Allow&#x20;Cortana&#x20;above&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;can&#x20;interact&#x20;with&#x20;Cortana&#x20;using&#x20;speech&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Access&#x20;to&#x20;any&#x20;computer&#x20;resource&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;when&#x20;the&#x20;device&#x20;is&#x20;locked.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cortana&#x20;above&#x20;lock&#x20;screen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15856,'Ensure&#x20;&#039;Allow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;encrypted&#x20;items&#x20;are&#x20;allowed&#x20;to&#x20;be&#x20;indexed.&#x20;When&#x20;this&#x20;setting&#x20;is&#x20;changed,&#x20;the&#x20;index&#x20;is&#x20;rebuilt&#x20;completely.&#x20;Full&#x20;volume&#x20;encryption&#x20;&#40;such&#x20;as&#x20;BitLocker&#x20;Drive&#x20;Encryption&#x20;or&#x20;a&#x20;non-Microsoft&#x20;solution&#41;&#x20;must&#x20;be&#x20;used&#x20;for&#x20;the&#x20;location&#x20;of&#x20;the&#x20;index&#x20;to&#x20;maintain&#x20;security&#x20;for&#x20;encrypted&#x20;files.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Indexing&#x20;and&#x20;allowing&#x20;users&#x20;to&#x20;search&#x20;encrypted&#x20;files&#x20;could&#x20;potentially&#x20;reveal&#x20;confidential&#x20;data&#x20;stored&#x20;within&#x20;the&#x20;encrypted&#x20;files.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.67.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15857,'Ensure&#x20;&#039;Allow&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;use&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;search&#x20;and&#x20;Cortana&#x20;can&#x20;provide&#x20;location&#x20;aware&#x20;search&#x20;and&#x20;Cortana&#x20;results.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;allowing&#x20;Cortana&#x20;and&#x20;Search&#x20;to&#x20;have&#x20;access&#x20;to&#x20;location&#x20;data&#x20;is&#x20;unnecessary.&#x20;Organizations&#x20;likely&#x20;do&#x20;not&#x20;want&#x20;this&#x20;information&#x20;shared&#x20;out.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;use&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15858,'Ensure&#x20;&#039;Turn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;Key&#x20;Management&#x20;Service&#x20;&#40;KMS&#41;&#x20;is&#x20;a&#x20;Microsoft&#x20;license&#x20;activation&#x20;method&#x20;that&#x20;entails&#x20;setting&#x20;up&#x20;a&#x20;local&#x20;server&#x20;to&#x20;store&#x20;the&#x20;software&#x20;licenses.&#x20;The&#x20;KMS&#x20;server&#x20;itself&#x20;needs&#x20;to&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;activate&#x20;the&#x20;KMS&#x20;service,&#x20;but&#x20;subsequent&#x20;on-network&#x20;clients&#x20;can&#x20;activate&#x20;Microsoft&#x20;Windows&#x20;OS&#x20;and/or&#x20;their&#x20;Microsoft&#x20;Office&#x20;via&#x20;the&#x20;KMS&#x20;server&#x20;instead&#x20;of&#x20;connecting&#x20;directly&#x20;to&#x20;Microsoft.&#x20;This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;opt-out&#x20;of&#x20;sending&#x20;KMS&#x20;client&#x20;activation&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Even&#x20;though&#x20;the&#x20;KMS&#x20;licensing&#x20;method&#x20;does&#x20;not&#x20;require&#x20;KMS&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;Microsoft,&#x20;they&#x20;still&#x20;send&#x20;KMS&#x20;client&#x20;activation&#x20;state&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSoftware&#x20;Protection&#x20;PlatformTurn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AVSValidationGP.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.72.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15859,'Ensure&#x20;&#039;Disable&#x20;all&#x20;apps&#x20;from&#x20;Microsoft&#x20;Store&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;launch&#x20;of&#x20;all&#x20;apps&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;that&#x20;came&#x20;pre-&#x20;installed&#x20;or&#x20;were&#x20;downloaded.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.&#x20;Note&#x20;#2:&#x20;The&#x20;name&#x20;of&#x20;this&#x20;setting&#x20;and&#x20;the&#x20;Enabled/Disabled&#x20;values&#x20;are&#x20;incorrectly&#x20;worded&#x20;-&#x20;logically,&#x20;the&#x20;title&#x20;implies&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;disable&#x20;all&#x20;apps&#x20;from&#x20;the&#x20;Microsoft&#x20;Store,&#x20;and&#x20;configuring&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;enable&#x20;all&#x20;apps&#x20;from&#x20;the&#x20;Microsoft&#x20;Store.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;GPME&#x20;help&#x20;text&#41;.&#x20;This&#x20;is&#x20;a&#x20;logical&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','The&#x20;Store&#x20;service&#x20;is&#x20;a&#x20;retail&#x20;outlet&#x20;built&#x20;into&#x20;Windows,&#x20;primarily&#x20;for&#x20;consumer&#x20;use.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;installation&#x20;of&#x20;all&#x20;applications&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;installation&#x20;of&#x20;vulnerable&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreDisable&#x20;all&#x20;apps&#x20;from&#x20;Microsoft&#x20;Store.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;all&#x20;apps&#x20;from&#x20;Windows&#x20;Store,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.75.1\"]}, {\"cis_csc\": [\"2.5\"]}]'),(15860,'Ensure&#x20;&#039;Only&#x20;display&#x20;the&#x20;private&#x20;store&#x20;within&#x20;the&#x20;Microsoft&#x20;Store&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;denies&#x20;access&#x20;to&#x20;the&#x20;retail&#x20;catalog&#x20;in&#x20;the&#x20;Microsoft&#x20;Store,&#x20;but&#x20;displays&#x20;the&#x20;private&#x20;store.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;the&#x20;private&#x20;store&#x20;will&#x20;allow&#x20;an&#x20;organization&#x20;to&#x20;control&#x20;the&#x20;apps&#x20;that&#x20;users&#x20;have&#x20;access&#x20;to&#x20;add&#x20;to&#x20;a&#x20;system.&#x20;This&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;unapproved&#x20;malicious&#x20;apps&#x20;are&#x20;not&#x20;running&#x20;on&#x20;a&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreOnly&#x20;display&#x20;the&#x20;private&#x20;store&#x20;within&#x20;the&#x20;Microsoft&#x20;Store.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Only&#x20;display&#x20;the&#x20;private&#x20;store&#x20;within&#x20;the&#x20;Windows&#x20;Store&#x20;app,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.75.2\"]}, {\"cis_csc\": [\"2.5\"]}]'),(15861,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Automatic&#x20;Download&#x20;and&#x20;Install&#x20;of&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;automatic&#x20;download&#x20;and&#x20;installation&#x20;of&#x20;Microsoft&#x20;Store&#x20;app&#x20;updates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Keeping&#x20;your&#x20;system&#x20;properly&#x20;patched&#x20;can&#x20;help&#x20;protect&#x20;against&#x20;0&#x20;day&#x20;vulnerabilities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreTurn&#x20;off&#x20;Automatic&#x20;Download&#x20;and&#x20;Install&#x20;of&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinStoreUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.75.3\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15862,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;offer&#x20;to&#x20;update&#x20;to&#x20;the&#x20;latest&#x20;version&#x20;of&#x20;Windows&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Enables&#x20;or&#x20;disables&#x20;the&#x20;Microsoft&#x20;Store&#x20;offer&#x20;to&#x20;update&#x20;to&#x20;the&#x20;latest&#x20;version&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Unplanned&#x20;OS&#x20;upgrades&#x20;can&#x20;lead&#x20;to&#x20;more&#x20;preventable&#x20;support&#x20;calls.&#x20;The&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;and&#x20;approving&#x20;all&#x20;upgrades&#x20;and&#x20;updates.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreTurn&#x20;off&#x20;the&#x20;offer&#x20;to&#x20;update&#x20;to&#x20;the&#x20;latest&#x20;version&#x20;of&#x20;Windows.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinStoreUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.75.4\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15863,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Store&#x20;application&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;denies&#x20;or&#x20;allows&#x20;access&#x20;to&#x20;the&#x20;Store&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet&#x20;and&#x20;MSKB&#x20;3135657,&#x20;this&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;any&#x20;Windows&#x20;10&#x20;editions&#x20;other&#x20;than&#x20;Enterprise&#x20;and&#x20;Education.','Only&#x20;applications&#x20;approved&#x20;by&#x20;an&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;installed.&#x20;Allowing&#x20;users&#x20;to&#x20;install&#x20;3rd&#x20;party&#x20;applications&#x20;can&#x20;lead&#x20;to&#x20;missed&#x20;patches&#x20;and&#x20;potential&#x20;zero&#x20;day&#x20;vulnerabilities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreTurn&#x20;off&#x20;the&#x20;Store&#x20;application.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinStoreUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates,&#x20;or&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.75.5\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15864,'Ensure&#x20;&#039;Allow&#x20;widgets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;widgets&#x20;feature&#x20;is&#x20;allowed&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;widgets&#x20;feature&#x20;provides&#x20;information&#x20;such&#x20;as,&#x20;weather,&#x20;news,&#x20;sports,&#x20;stocks,&#x20;traffic,&#x20;and&#x20;entertainment&#x20;&#40;not&#x20;an&#x20;inclusive&#x20;list&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;apps&#x20;and&#x20;features&#x20;such&#x20;as&#x20;widgets&#x20;on&#x20;the&#x20;Windows&#x20;taskbar&#x20;should&#x20;be&#x20;treated&#x20;as&#x20;a&#x20;possible&#x20;security&#x20;risk&#x20;due&#x20;to&#x20;the&#x20;potential&#x20;of&#x20;data&#x20;being&#x20;sent&#x20;back&#x20;to&#x20;3rd&#x20;parties,&#x20;such&#x20;as&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWidgetsAllow&#x20;Widgets.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NewsAndInterests.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.81.1\"]}]'),(15865,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;the&#x20;behavior&#x20;of&#x20;Windows&#x20;Defender&#x20;SmartScreen.&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;Some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;with&#x20;this&#x20;feature&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass.','Windows&#x20;Defender&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;However,&#x20;due&#x20;to&#x20;the&#x20;fact&#x20;that&#x20;some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;disable&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenExplorerConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Configure&#x20;Windows&#x20;SmartScreen,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15866,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;lets&#x20;you&#x20;decide&#x20;whether&#x20;to&#x20;turn&#x20;on&#x20;SmartScreen&#x20;Filter.&#x20;SmartScreen&#x20;Filter&#x20;provides&#x20;warning&#x20;messages&#x20;to&#x20;help&#x20;protect&#x20;your&#x20;employees&#x20;from&#x20;potential&#x20;phishing&#x20;scams&#x20;and&#x20;malicious&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','SmartScreen&#x20;serves&#x20;an&#x20;important&#x20;purpose&#x20;as&#x20;it&#x20;helps&#x20;to&#x20;warn&#x20;users&#x20;of&#x20;possible&#x20;malicious&#x20;sites&#x20;and&#x20;files.&#x20;Allowing&#x20;users&#x20;to&#x20;turn&#x20;off&#x20;this&#x20;setting&#x20;can&#x20;make&#x20;the&#x20;browser&#x20;become&#x20;more&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenMicrosoft&#x20;EdgeConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MicrosoftEdge.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allows&#x20;you&#x20;to&#x20;configure&#x20;SmartScreen.&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates,&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Turn&#x20;off&#x20;the&#x20;SmartScreen&#x20;Filter.&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;it&#x20;was&#x20;renamed&#x20;&#40;again&#41;&#x20;to&#x20;Configure&#x20;SmartScreen&#x20;Filter.&#x20;Finally,&#x20;it&#x20;was&#x20;given&#x20;its&#x20;current&#x20;name&#x20;of&#x20;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15867,'Ensure&#x20;&#039;Prevent&#x20;bypassing&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;lets&#x20;you&#x20;decide&#x20;whether&#x20;employees&#x20;can&#x20;override&#x20;the&#x20;SmartScreen&#x20;Filter&#x20;warnings&#x20;about&#x20;potentially&#x20;malicious&#x20;websites.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','SmartScreen&#x20;will&#x20;warn&#x20;an&#x20;employee&#x20;if&#x20;a&#x20;website&#x20;is&#x20;potentially&#x20;malicious.&#x20;Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;these&#x20;warnings&#x20;from&#x20;being&#x20;bypassed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenMicrosoft&#x20;EdgePrevent&#x20;bypassing&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MicrosoftEdge.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Don&#039;t&#x20;allow&#x20;SmartScreen&#x20;Filter&#x20;warning&#x20;overrides.&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;renamed&#x20;to&#x20;Prevent&#x20;bypassing&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites.&#x20;Finally,&#x20;it&#x20;was&#x20;given&#x20;its&#x20;current&#x20;name&#x20;of&#x20;Prevent&#x20;bypassing&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(15868,'Ensure&#x20;&#039;Enables&#x20;or&#x20;disables&#x20;Windows&#x20;Game&#x20;Recording&#x20;and&#x20;Broadcasting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;Windows&#x20;Game&#x20;Recording&#x20;and&#x20;Broadcasting&#x20;features.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;allowed,&#x20;users&#x20;could&#x20;record&#x20;and&#x20;broadcast&#x20;session&#x20;info&#x20;to&#x20;external&#x20;sites,&#x20;which&#x20;is&#x20;both&#x20;a&#x20;risk&#x20;of&#x20;accidentally&#x20;exposing&#x20;sensitive&#x20;company&#x20;data&#x20;&#40;on-screen&#41;&#x20;outside&#x20;the&#x20;company&#x20;as&#x20;well&#x20;as&#x20;a&#x20;privacy&#x20;concern.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Game&#x20;Recording&#x20;and&#x20;BroadcastingEnables&#x20;or&#x20;disables&#x20;Windows&#x20;Game&#x20;Recording&#x20;and&#x20;Broadcasting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GameDVR.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.87.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15869,'Ensure&#x20;&#039;Allow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;are&#x20;allowed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;Microsoft&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;collect&#x20;data&#x20;and&#x20;suggest&#x20;apps&#x20;based&#x20;on&#x20;that&#x20;data&#x20;collected.&#x20;Disabling&#x20;this&#x20;setting&#x20;will&#x20;help&#x20;ensure&#x20;your&#x20;data&#x20;is&#x20;not&#x20;shared&#x20;with&#x20;any&#x20;third&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.89.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15870,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#039;&#x20;OR&#x20;&#039;Disabled&#039;&#x20;but&#x20;not&#x20;&#039;Enabled:&','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;Ink&#x20;items&#x20;are&#x20;allowed&#x20;above&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled.','Allowing&#x20;any&#x20;apps&#x20;to&#x20;be&#x20;accessed&#x20;while&#x20;system&#x20;is&#x20;locked&#x20;is&#x20;not&#x20;recommended.&#x20;If&#x20;this&#x20;feature&#x20;is&#x20;permitted,&#x20;it&#x20;should&#x20;only&#x20;be&#x20;accessible&#x20;once&#x20;a&#x20;user&#x20;authenticates&#x20;with&#x20;the&#x20;proper&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;Windows&#x20;Ink&#x20;Workspace.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.89.2\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15871,'Ensure&#x20;&#039;Allow&#x20;user&#x20;control&#x20;over&#x20;installs&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;are&#x20;permitted&#x20;to&#x20;change&#x20;installation&#x20;options&#x20;that&#x20;typically&#x20;are&#x20;available&#x20;only&#x20;to&#x20;system&#x20;administrators.&#x20;The&#x20;security&#x20;features&#x20;of&#x20;Windows&#x20;Installer&#x20;normally&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;installation&#x20;options&#x20;that&#x20;are&#x20;typically&#x20;reserved&#x20;for&#x20;system&#x20;administrators,&#x20;such&#x20;as&#x20;specifying&#x20;the&#x20;directory&#x20;to&#x20;which&#x20;files&#x20;are&#x20;installed.&#x20;If&#x20;Windows&#x20;Installer&#x20;detects&#x20;that&#x20;an&#x20;installation&#x20;package&#x20;has&#x20;permitted&#x20;the&#x20;user&#x20;to&#x20;change&#x20;a&#x20;protected&#x20;option,&#x20;it&#x20;stops&#x20;the&#x20;installation&#x20;and&#x20;displays&#x20;a&#x20;message.&#x20;These&#x20;security&#x20;features&#x20;operate&#x20;only&#x20;when&#x20;the&#x20;installation&#x20;program&#x20;is&#x20;running&#x20;in&#x20;a&#x20;privileged&#x20;security&#x20;context&#x20;in&#x20;which&#x20;it&#x20;has&#x20;access&#x20;to&#x20;directories&#x20;denied&#x20;to&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;only&#x20;IT&#x20;staff&#x20;with&#x20;administrative&#x20;rights&#x20;should&#x20;be&#x20;installing&#x20;or&#x20;changing&#x20;software&#x20;on&#x20;a&#x20;system.&#x20;Allowing&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;have&#x20;any&#x20;control&#x20;over&#x20;installs&#x20;can&#x20;risk&#x20;unapproved&#x20;software&#x20;from&#x20;being&#x20;installed&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;system,&#x20;which&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;become&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAllow&#x20;user&#x20;control&#x20;over&#x20;installs.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Enable&#x20;user&#x20;control&#x20;over&#x20;installs,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15872,'Ensure&#x20;&#039;Always&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;Windows&#x20;Installer&#x20;should&#x20;use&#x20;system&#x20;permissions&#x20;when&#x20;it&#x20;installs&#x20;any&#x20;program&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;This&#x20;setting&#x20;appears&#x20;both&#x20;in&#x20;the&#x20;Computer&#x20;Configuration&#x20;and&#x20;User&#x20;Configuration&#x20;folders.&#x20;To&#x20;make&#x20;this&#x20;setting&#x20;effective,&#x20;you&#x20;must&#x20;enable&#x20;the&#x20;setting&#x20;in&#x20;both&#x20;folders.&#x20;Caution:&#x20;If&#x20;enabled,&#x20;skilled&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;permissions&#x20;this&#x20;setting&#x20;grants&#x20;to&#x20;change&#x20;their&#x20;privileges&#x20;and&#x20;gain&#x20;permanent&#x20;access&#x20;to&#x20;restricted&#x20;files&#x20;and&#x20;folders.&#x20;Note&#x20;that&#x20;the&#x20;User&#x20;Configuration&#x20;version&#x20;of&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;guaranteed&#x20;to&#x20;be&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;with&#x20;limited&#x20;privileges&#x20;can&#x20;exploit&#x20;this&#x20;feature&#x20;by&#x20;creating&#x20;a&#x20;Windows&#x20;Installer&#x20;installation&#x20;package&#x20;that&#x20;creates&#x20;a&#x20;new&#x20;local&#x20;account&#x20;that&#x20;belongs&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;adds&#x20;their&#x20;current&#x20;account&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;installs&#x20;malicious&#x20;software,&#x20;or&#x20;performs&#x20;other&#x20;unauthorized&#x20;activities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAlways&#x20;install&#x20;with&#x20;elevated&#x20;privileges.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.2\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15873,'Ensure&#x20;&#039;Prevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Web-based&#x20;programs&#x20;are&#x20;allowed&#x20;to&#x20;install&#x20;software&#x20;on&#x20;the&#x20;computer&#x20;without&#x20;notifying&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Suppressing&#x20;the&#x20;system&#x20;warning&#x20;can&#x20;pose&#x20;a&#x20;security&#x20;risk&#x20;and&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerPrevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;IE&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.3\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(15874,'Ensure&#x20;&#039;Sign-in&#x20;and&#x20;lock&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;restart&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;a&#x20;device&#x20;will&#x20;automatically&#x20;sign-in&#x20;the&#x20;last&#x20;interactive&#x20;user&#x20;after&#x20;Windows&#x20;Update&#x20;restarts&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;feature&#x20;will&#x20;prevent&#x20;the&#x20;caching&#x20;of&#x20;user&#039;s&#x20;credentials&#x20;and&#x20;unauthorized&#x20;use&#x20;of&#x20;the&#x20;device,&#x20;and&#x20;also&#x20;ensure&#x20;the&#x20;user&#x20;is&#x20;aware&#x20;of&#x20;the&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Logon&#x20;OptionsSign-in&#x20;and&#x20;lock&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;restart.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinLogon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Sign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.91.1\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(15875,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;logging&#x20;of&#x20;all&#x20;PowerShell&#x20;script&#x20;input&#x20;to&#x20;the&#x20;Applications&#x20;and&#x20;Services&#x20;LogsMicrosoftWindowsPowerShellOperational&#x20;Event&#x20;Log&#x20;channel.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;logging&#x20;of&#x20;Script&#x20;Block&#x20;Invocation&#x20;Start/Stop&#x20;Events&#x20;is&#x20;enabled&#x20;&#40;option&#x20;box&#x20;checked&#41;,&#x20;PowerShell&#x20;will&#x20;log&#x20;additional&#x20;events&#x20;when&#x20;invocation&#x20;of&#x20;a&#x20;command,&#x20;script&#x20;block,&#x20;function,&#x20;or&#x20;script&#x20;starts&#x20;or&#x20;stops.&#x20;Enabling&#x20;this&#x20;option&#x20;generates&#x20;a&#x20;high&#x20;volume&#x20;of&#x20;event&#x20;logs.&#x20;CIS&#x20;has&#x20;intentionally&#x20;chosen&#x20;not&#x20;to&#x20;make&#x20;a&#x20;recommendation&#x20;for&#x20;this&#x20;option,&#x20;since&#x20;it&#x20;generates&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;events.&#x20;If&#x20;an&#x20;organization&#x20;chooses&#x20;to&#x20;enable&#x20;the&#x20;optional&#x20;setting&#x20;&#40;checked&#41;,&#x20;this&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Logs&#x20;of&#x20;PowerShell&#x20;script&#x20;input&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;when&#x20;performing&#x20;forensic&#x20;investigations&#x20;of&#x20;PowerShell&#x20;attack&#x20;incidents&#x20;to&#x20;determine&#x20;what&#x20;occurred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.100.1\"]}, {\"cis_csc\": [\"8.8\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15876,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Transcription&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;Policy&#x20;setting&#x20;lets&#x20;you&#x20;capture&#x20;the&#x20;input&#x20;and&#x20;output&#x20;of&#x20;Windows&#x20;PowerShell&#x20;commands&#x20;into&#x20;text-based&#x20;transcripts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;that&#x20;passwords&#x20;could&#x20;get&#x20;stored&#x20;in&#x20;plain&#x20;text&#x20;in&#x20;the&#x20;PowerShell_transcript&#x20;output&#x20;file.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Transcription.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.100.2\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15877,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;uses&#x20;Basic&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Clients&#x20;that&#x20;use&#x20;Microsoft&#039;s&#x20;Exchange&#x20;Online&#x20;service&#x20;&#40;Office&#x20;365&#41;&#x20;will&#x20;require&#x20;an&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;instead&#x20;have&#x20;this&#x20;setting&#x20;set&#x20;to&#x20;Enabled.&#x20;Exchange&#x20;Online&#x20;uses&#x20;Basic&#x20;authentication&#x20;over&#x20;HTTPS,&#x20;and&#x20;so&#x20;the&#x20;Exchange&#x20;Online&#x20;authentication&#x20;traffic&#x20;will&#x20;still&#x20;be&#x20;safely&#x20;encrypted.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;Basic&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15878,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;unencrypted&#x20;traffic.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.2\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15879,'Ensure&#x20;&#039;Disallow&#x20;Digest&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;will&#x20;not&#x20;use&#x20;Digest&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Digest&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM,&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientDisallow&#x20;Digest&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15880,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;accepts&#x20;Basic&#x20;authentication&#x20;from&#x20;a&#x20;remote&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;Basic&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15881,'Ensure&#x20;&#039;Allow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;automatically&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;requests&#x20;on&#x20;the&#x20;HTTP&#x20;transport&#x20;over&#x20;the&#x20;default&#x20;HTTP&#x20;port.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;automatic&#x20;configuration&#x20;of&#x20;listeners,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15882,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;unencrypted&#x20;traffic.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15883,'Ensure&#x20;&#039;Disallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;will&#x20;allow&#x20;RunAs&#x20;credentials&#x20;to&#x20;be&#x20;stored&#x20;for&#x20;any&#x20;plug-ins.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;you&#x20;enable&#x20;and&#x20;then&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;any&#x20;values&#x20;that&#x20;were&#x20;previously&#x20;configured&#x20;for&#x20;RunAsPassword&#x20;will&#x20;need&#x20;to&#x20;be&#x20;reset.','Although&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;RunAs&#x20;credentials&#x20;is&#x20;a&#x20;convenient&#x20;feature&#x20;it&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;account&#x20;compromise&#x20;slightly.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;forget&#x20;to&#x20;lock&#x20;your&#x20;desktop&#x20;before&#x20;leaving&#x20;it&#x20;unattended&#x20;for&#x20;a&#x20;few&#x20;minutes&#x20;another&#x20;person&#x20;could&#x20;access&#x20;not&#x20;only&#x20;the&#x20;desktop&#x20;of&#x20;your&#x20;computer&#x20;but&#x20;also&#x20;any&#x20;hosts&#x20;you&#x20;manage&#x20;via&#x20;WinRM&#x20;with&#x20;cached&#x20;RunAs&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceDisallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.102.2.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(15884,'Ensure&#x20;&#039;Allow&#x20;Remote&#x20;Shell&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;configuration&#x20;of&#x20;remote&#x20;access&#x20;to&#x20;all&#x20;supported&#x20;shells&#x20;to&#x20;execute&#x20;scripts&#x20;and&#x20;commands.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;GPME&#x20;help&#x20;text&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded,&#x20;implying&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;reject&#x20;new&#x20;Remote&#x20;Shell&#x20;connections,&#x20;and&#x20;setting&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;allow&#x20;Remote&#x20;Shell&#x20;connections.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;title&#x20;of&#x20;the&#x20;setting&#41;.&#x20;This&#x20;is&#x20;a&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Shell&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;ShellAllow&#x20;Remote&#x20;Shell&#x20;Access.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteShell.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.103.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15885,'Ensure&#x20;&#039;Allow&#x20;clipboard&#x20;sharing&#x20;with&#x20;Windows&#x20;Sandbox&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;clipboard&#x20;sharing&#x20;with&#x20;the&#x20;Windows&#x20;sandbox.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Windows&#x20;Sandbox&#x20;feature&#x20;was&#x20;first&#x20;introduced&#x20;in&#x20;Windows&#x20;10&#x20;R1903,&#x20;and&#x20;allows&#x20;a&#x20;temporary&#x20;&quot;clean&#x20;install&quot;&#x20;virtual&#x20;instance&#x20;of&#x20;Windows&#x20;to&#x20;be&#x20;run&#x20;inside&#x20;the&#x20;host,&#x20;for&#x20;the&#x20;ostensible&#x20;purpose&#x20;of&#x20;testing&#x20;applications&#x20;without&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;host.','Disabling&#x20;copy&#x20;and&#x20;paste&#x20;decreases&#x20;the&#x20;attack&#x20;surface&#x20;exposed&#x20;by&#x20;the&#x20;Windows&#x20;Sandbox&#x20;and&#x20;possible&#x20;exposure&#x20;of&#x20;untrusted&#x20;applications&#x20;to&#x20;the&#x20;internal&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SandboxAllow&#x20;clipboard&#x20;sharing&#x20;with&#x20;Windows&#x20;Sandbox.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsSandbox.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.104.1\"]}]'),(15886,'Ensure&#x20;&#039;Allow&#x20;networking&#x20;in&#x20;Windows&#x20;Sandbox&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;networking&#x20;in&#x20;the&#x20;Windows&#x20;Sandbox.&#x20;Networking&#x20;is&#x20;achieved&#x20;by&#x20;creating&#x20;a&#x20;virtual&#x20;switch&#x20;on&#x20;the&#x20;host,&#x20;and&#x20;connecting&#x20;the&#x20;Windows&#x20;Sandbox&#x20;to&#x20;it&#x20;via&#x20;a&#x20;virtual&#x20;Network&#x20;Interface&#x20;Card&#x20;&#40;NIC&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Windows&#x20;Sandbox&#x20;feature&#x20;was&#x20;first&#x20;introduced&#x20;in&#x20;Windows&#x20;10&#x20;R1903,&#x20;and&#x20;allows&#x20;a&#x20;temporary&#x20;&quot;clean&#x20;install&quot;&#x20;virtual&#x20;instance&#x20;of&#x20;Windows&#x20;to&#x20;be&#x20;run&#x20;inside&#x20;the&#x20;host,&#x20;for&#x20;the&#x20;ostensible&#x20;purpose&#x20;of&#x20;testing&#x20;applications&#x20;without&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;host.','Disabling&#x20;network&#x20;access&#x20;decreases&#x20;the&#x20;attack&#x20;surface&#x20;exposed&#x20;by&#x20;the&#x20;Windows&#x20;Sandbox&#x20;and&#x20;exposure&#x20;of&#x20;untrusted&#x20;applications&#x20;to&#x20;the&#x20;internal&#x20;network.&#x20;Note:&#x20;Per&#x20;Microsoft,&#x20;enabling&#x20;networking&#x20;in&#x20;the&#x20;Windows&#x20;Sandbox&#x20;can&#x20;expose&#x20;untrusted&#x20;applications&#x20;to&#x20;the&#x20;internal&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SandboxAllow&#x20;networking&#x20;in&#x20;Windows&#x20;Sandbox.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsSandbox.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.104.2\"]}]'),(15887,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevent&#x20;users&#x20;from&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;Exploit&#x20;protection&#x20;settings&#x20;area&#x20;in&#x20;the&#x20;Windows&#x20;Security&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Only&#x20;authorized&#x20;IT&#x20;staff&#x20;should&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;to&#x20;the&#x20;exploit&#x20;protection&#x20;settings&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;the&#x20;organizations&#x20;specific&#x20;configuration&#x20;is&#x20;not&#x20;modified.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SecurityApp&#x20;and&#x20;browser&#x20;protectionPrevent&#x20;users&#x20;from&#x20;modifying&#x20;settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefenderSecurityCenter.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.105.2.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(15888,'Ensure&#x20;&#039;No&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;that&#x20;Automatic&#x20;Updates&#x20;will&#x20;wait&#x20;for&#x20;computers&#x20;to&#x20;be&#x20;restarted&#x20;by&#x20;the&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;on&#x20;to&#x20;them&#x20;to&#x20;complete&#x20;a&#x20;scheduled&#x20;installation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;applies&#x20;only&#x20;when&#x20;you&#x20;configure&#x20;Automatic&#x20;Updates&#x20;to&#x20;perform&#x20;scheduled&#x20;update&#x20;installations.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;to&#x20;Disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect.','Some&#x20;security&#x20;updates&#x20;require&#x20;that&#x20;the&#x20;computer&#x20;be&#x20;restarted&#x20;to&#x20;complete&#x20;an&#x20;installation.&#x20;If&#x20;the&#x20;computer&#x20;cannot&#x20;restart&#x20;automatically,&#x20;then&#x20;the&#x20;most&#x20;recent&#x20;update&#x20;will&#x20;not&#x20;completely&#x20;install&#x20;and&#x20;no&#x20;new&#x20;updates&#x20;will&#x20;download&#x20;to&#x20;the&#x20;computer&#x20;until&#x20;it&#x20;is&#x20;restarted.&#x20;Without&#x20;the&#x20;auto-restart&#x20;functionality,&#x20;users&#x20;who&#x20;are&#x20;not&#x20;security-conscious&#x20;may&#x20;choose&#x20;to&#x20;indefinitely&#x20;delay&#x20;the&#x20;restart,&#x20;therefore&#x20;keeping&#x20;the&#x20;computer&#x20;in&#x20;a&#x20;less&#x20;secure&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateLegacy&#x20;PoliciesNo&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;No&#x20;auto-restart&#x20;for&#x20;scheduled&#x20;Automatic&#x20;Updates&#x20;installations,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.1.1\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(15889,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;recognize&#x20;when&#x20;a&#x20;network&#x20;connection&#x20;is&#x20;available&#x20;and&#x20;then&#x20;use&#x20;the&#x20;network&#x20;connection&#x20;to&#x20;search&#x20;Windows&#x20;Update&#x20;or&#x20;your&#x20;designated&#x20;intranet&#x20;site&#x20;for&#x20;updates&#x20;that&#x20;apply&#x20;to&#x20;them.&#x20;After&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;select&#x20;one&#x20;of&#x20;the&#x20;following&#x20;three&#x20;options&#x20;in&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;Properties&#x20;dialog&#x20;box&#x20;to&#x20;specify&#x20;how&#x20;the&#x20;service&#x20;will&#x20;work:&#x20;2&#x20;-&#x20;Notify&#x20;for&#x20;download&#x20;and&#x20;auto&#x20;install&#x20;&#40;Notify&#x20;before&#x20;downloading&#x20;any&#x20;updates&#41;&#x20;3&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;notify&#x20;for&#x20;install&#x20;&#40;Download&#x20;the&#x20;updates&#x20;automatically&#x20;and&#x20;notify&#x20;when&#x20;they&#x20;are&#x20;ready&#x20;to&#x20;be&#x20;installed.&#41;&#x20;&#40;Default&#x20;setting&#41;&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;&#40;Automatically&#x20;download&#x20;updates&#x20;and&#x20;install&#x20;them&#x20;on&#x20;the&#x20;schedule&#x20;specified&#x20;below.&#41;&#41;&#x20;5&#x20;-&#x20;Allow&#x20;local&#x20;admin&#x20;to&#x20;choose&#x20;setting&#x20;&#40;Leave&#x20;decision&#x20;on&#x20;above&#x20;choices&#x20;up&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;&#40;Not&#x20;Recommended&#41;&#41;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;sub-setting&#x20;&quot;Configure&#x20;automatic&#x20;updating:&quot;&#x20;has&#x20;4&#x20;possible&#x20;values&#x20;-&#x20;all&#x20;of&#x20;them&#x20;are&#x20;valid&#x20;depending&#x20;on&#x20;specific&#x20;organizational&#x20;needs,&#x20;however&#x20;if&#x20;feasible&#x20;we&#x20;suggest&#x20;using&#x20;a&#x20;value&#x20;of&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install.&#x20;This&#x20;suggestion&#x20;is&#x20;not&#x20;a&#x20;scored&#x20;requirement.&#x20;Note&#x20;#2:&#x20;Organizations&#x20;that&#x20;utilize&#x20;a&#x20;3rd-party&#x20;solution&#x20;for&#x20;patching&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation,&#x20;and&#x20;instead&#x20;configure&#x20;it&#x20;to&#x20;Disabled&#x20;so&#x20;that&#x20;the&#x20;native&#x20;Windows&#x20;Update&#x20;mechanism&#x20;does&#x20;not&#x20;interfere&#x20;with&#x20;the&#x20;3rd-party&#x20;patching&#x20;process.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceConfigure&#x20;Automatic&#x20;Updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.2.1\"]}, {\"cis_csc\": [\"7.3\"]}]'),(15890,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#x20;-&#x20;Every&#x20;day&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;when&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;0&#x20;-&#x20;Every&#x20;day.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;applicable&#x20;if&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;is&#x20;selected&#x20;in&#x20;recommendation&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;.&#x20;It&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;if&#x20;any&#x20;other&#x20;option&#x20;is&#x20;selected.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;0&#x20;-&#x20;Every&#x20;day:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceConfigure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.2.2\"]}, {\"cis_csc\": [\"7.3\"]}]'),(15891,'Ensure&#x20;&#039;Remove&#x20;access&#x20;to&#x20;&quot;Pause&#x20;updates&quot;&#x20;feature&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;removes&#x20;access&#x20;to&#x20;&quot;Pause&#x20;updates&quot;&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;order&#x20;to&#x20;ensure&#x20;security&#x20;and&#x20;system&#x20;updates&#x20;are&#x20;applied,&#x20;system&#x20;administrators&#x20;should&#x20;control&#x20;when&#x20;updates&#x20;are&#x20;applied&#x20;to&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceRemove&#x20;access&#x20;to&#x20;&quot;Pause&#x20;updates&quot;&#x20;feature.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.2.3\"]}, {\"cis_csc\": [\"7.3\"]}]'),(15892,'Ensure&#x20;&#039;Manage&#x20;preview&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;manage&#x20;which&#x20;updates&#x20;that&#x20;are&#x20;receive&#x20;prior&#x20;to&#x20;the&#x20;update&#x20;being&#x20;released.&#x20;Dev&#x20;Channel:&#x20;Ideal&#x20;for&#x20;highly&#x20;technical&#x20;users.&#x20;Insiders&#x20;in&#x20;the&#x20;Dev&#x20;Channel&#x20;will&#x20;receive&#x20;builds&#x20;from&#x20;our&#x20;active&#x20;development&#x20;branch&#x20;that&#x20;is&#x20;earliest&#x20;in&#x20;a&#x20;development&#x20;cycle.&#x20;These&#x20;builds&#x20;are&#x20;not&#x20;matched&#x20;to&#x20;a&#x20;specific&#x20;Windows&#x20;10&#x20;release.&#x20;Beta&#x20;Channel:&#x20;Ideal&#x20;for&#x20;feature&#x20;explorers&#x20;who&#x20;want&#x20;to&#x20;see&#x20;upcoming&#x20;Windows&#x20;10&#x20;features.&#x20;Your&#x20;feedback&#x20;will&#x20;be&#x20;especially&#x20;important&#x20;here&#x20;as&#x20;it&#x20;will&#x20;help&#x20;our&#x20;engineers&#x20;ensure&#x20;key&#x20;issues&#x20;are&#x20;fixed&#x20;before&#x20;a&#x20;major&#x20;release.&#x20;Release&#x20;Preview&#x20;Channel&#x20;&#40;default&#41;:&#x20;Insiders&#x20;in&#x20;the&#x20;Release&#x20;Preview&#x20;Channel&#x20;will&#x20;have&#x20;access&#x20;to&#x20;the&#x20;upcoming&#x20;release&#x20;of&#x20;Windows&#x20;10&#x20;prior&#x20;to&#x20;it&#x20;being&#x20;released&#x20;to&#x20;the&#x20;world.&#x20;These&#x20;builds&#x20;are&#x20;supported&#x20;by&#x20;Microsoft.&#x20;The&#x20;Release&#x20;Preview&#x20;Channel&#x20;is&#x20;where&#x20;we&#x20;recommend&#x20;companies&#x20;preview&#x20;and&#x20;validate&#x20;upcoming&#x20;Windows&#x20;10&#x20;releases&#x20;before&#x20;broad&#x20;deployment&#x20;within&#x20;their&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Preview&#x20;Build&#x20;enrollment&#x20;requires&#x20;a&#x20;telemetry&#x20;level&#x20;setting&#x20;of&#x20;2&#x20;or&#x20;higher&#x20;and&#x20;your&#x20;domain&#x20;registered&#x20;on&#x20;insider.windows.com.&#x20;For&#x20;additional&#x20;information&#x20;on&#x20;Preview&#x20;Builds,&#x20;see:&#x20;https://aka.ms/wipforbiz','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;updates&#x20;offered&#x20;from&#x20;Windows&#x20;UpdateManage&#x20;preview&#x20;builds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.4.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15893,'Ensure&#x20;&#039;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;180&#x20;or&#x20;more&#x20;days&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;when&#x20;Preview&#x20;Build&#x20;or&#x20;Feature&#x20;Updates&#x20;are&#x20;received.&#x20;Defer&#x20;Updates&#x20;This&#x20;enables&#x20;devices&#x20;to&#x20;defer&#x20;taking&#x20;the&#x20;next&#x20;Feature&#x20;Update&#x20;available&#x20;to&#x20;your&#x20;channel&#x20;for&#x20;up&#x20;to&#x20;14&#x20;days&#x20;for&#x20;all&#x20;the&#x20;pre-release&#x20;channels&#x20;and&#x20;up&#x20;to&#x20;365&#x20;days&#x20;for&#x20;the&#x20;Semi-Annual&#x20;Channel.&#x20;Or,&#x20;if&#x20;the&#x20;device&#x20;is&#x20;updating&#x20;from&#x20;the&#x20;Semi-Annual&#x20;Channel,&#x20;a&#x20;version&#x20;for&#x20;the&#x20;device&#x20;to&#x20;move&#x20;to&#x20;and/or&#x20;stay&#x20;on&#x20;until&#x20;the&#x20;policy&#x20;is&#x20;updated&#x20;or&#x20;the&#x20;device&#x20;reaches&#x20;end&#x20;of&#x20;service&#x20;can&#x20;be&#x20;specified.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;both&#x20;policies,&#x20;the&#x20;version&#x20;specified&#x20;will&#x20;take&#x20;precedence&#x20;and&#x20;the&#x20;deferrals&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect.&#x20;Please&#x20;see&#x20;the&#x20;Windows&#x20;Release&#x20;Information&#x20;page&#x20;for&#x20;OS&#x20;version&#x20;information.&#x20;Pause&#x20;Updates&#x20;To&#x20;prevent&#x20;Feature&#x20;Updates&#x20;from&#x20;being&#x20;received&#x20;on&#x20;their&#x20;scheduled&#x20;time,&#x20;you&#x20;can&#x20;temporarily&#x20;pause&#x20;Feature&#x20;Updates.&#x20;The&#x20;pause&#x20;will&#x20;remain&#x20;in&#x20;effect&#x20;for&#x20;35&#x20;days&#x20;from&#x20;the&#x20;specified&#x20;start&#x20;date&#x20;or&#x20;until&#x20;the&#x20;field&#x20;is&#x20;cleared&#x20;&#40;Quality&#x20;Updates&#x20;will&#x20;still&#x20;be&#x20;offered&#41;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Diagnostic&#x20;Data&quot;&#x20;&#40;formerly&#x20;&quot;Allow&#x20;Telemetry&quot;&#41;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;More&#x20;information&#x20;on&#x20;Dual&#x20;Scan&#x20;is&#x20;available&#x20;at&#x20;these&#x20;links:&#x20;-&#x20;Demystifying&#x20;&quot;Dual&#x20;Scan&quot;&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog&#x20;-&#x20;Improving&#x20;Dual&#x20;Scan&#x20;on&#x20;1607&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog&#x20;Note&#x20;#3:&#x20;Prior&#x20;to&#x20;Windows&#x20;10&#x20;R1703,&#x20;values&#x20;above&#x20;180&#x20;days&#x20;are&#x20;not&#x20;recognized&#x20;by&#x20;the&#x20;OS.&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1703,&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;days&#x20;you&#x20;can&#x20;defer&#x20;is&#x20;365&#x20;days.','In&#x20;a&#x20;production&#x20;environment,&#x20;it&#x20;is&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;software&#x20;and&#x20;features&#x20;that&#x20;are&#x20;publicly&#x20;available,&#x20;after&#x20;they&#x20;have&#x20;gone&#x20;through&#x20;rigorous&#x20;testing&#x20;in&#x20;beta.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;180&#x20;or&#x20;more&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;updates&#x20;offered&#x20;from&#x20;Windows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Select&#x20;when&#x20;Feature&#x20;Updates&#x20;are&#x20;received,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.4.2\"]}, {\"cis_csc\": [\"2.5\", \"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(15894,'Ensure&#x20;&#039;Select&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;days&#039;.','This&#x20;settings&#x20;controls&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;days.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Diagnostic&#x20;Data&quot;&#x20;&#40;formerly&#x20;&quot;Allow&#x20;Telemetry&quot;&#41;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;More&#x20;information&#x20;on&#x20;Dual&#x20;Scan&#x20;is&#x20;available&#x20;at&#x20;these&#x20;links:&#x20;-&#x20;Demystifying&#x20;&quot;Dual&#x20;Scan&quot;&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog&#x20;-&#x20;Improving&#x20;Dual&#x20;Scan&#x20;on&#x20;1607&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog','Quality&#x20;Updates&#x20;can&#x20;contain&#x20;important&#x20;bug&#x20;fixes&#x20;and/or&#x20;security&#x20;patches,&#x20;and&#x20;should&#x20;be&#x20;installed&#x20;as&#x20;soon&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:0&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;updated&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;WindowsUpdate.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.4.3\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16000,'Ensure&#x20;&#039;Maximum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;','This&#x20;policy&#x20;setting&#x20;defines&#x20;how&#x20;long&#x20;a&#x20;user&#x20;can&#x20;use&#x20;their&#x20;password&#x20;before&#x20;it&#x20;expires.&#x20;Values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;range&#x20;from&#x20;0&#x20;to&#x20;999&#x20;days.&#x20;If&#x20;you&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0,&#x20;the&#x20;password&#x20;will&#x20;never&#x20;expire.&#x20;Because&#x20;attackers&#x20;can&#x20;crack&#x20;passwords,&#x20;the&#x20;more&#x20;frequently&#x20;you&#x20;change&#x20;the&#x20;password&#x20;the&#x20;less&#x20;opportunity&#x20;an&#x20;attacker&#x20;has&#x20;to&#x20;use&#x20;a&#x20;cracked&#x20;password.&#x20;However,&#x20;the&#x20;lower&#x20;this&#x20;value&#x20;is&#x20;set,&#x20;the&#x20;higher&#x20;the&#x20;potential&#x20;for&#x20;an&#x20;increase&#x20;in&#x20;calls&#x20;to&#x20;help&#x20;desk&#x20;support&#x20;due&#x20;to&#x20;users&#x20;having&#x20;to&#x20;change&#x20;their&#x20;password&#x20;or&#x20;forgetting&#x20;which&#x20;password&#x20;is&#x20;current.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.','The&#x20;longer&#x20;a&#x20;password&#x20;exists&#x20;the&#x20;higher&#x20;the&#x20;likelihood&#x20;that&#x20;it&#x20;will&#x20;be&#x20;compromised&#x20;by&#x20;a&#x20;brute&#x20;force&#x20;attack,&#x20;by&#x20;an&#x20;attacker&#x20;gaining&#x20;general&#x20;knowledge&#x20;about&#x20;the&#x20;user,&#x20;or&#x20;by&#x20;the&#x20;user&#x20;sharing&#x20;the&#x20;password.&#x20;Configuring&#x20;the&#x20;Maximum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;0&#x20;so&#x20;that&#x20;users&#x20;are&#x20;never&#x20;required&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;is&#x20;a&#x20;major&#x20;security&#x20;risk&#x20;because&#x20;that&#x20;allows&#x20;a&#x20;compromised&#x20;password&#x20;to&#x20;be&#x20;used&#x20;by&#x20;the&#x20;malicious&#x20;user&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;valid&#x20;user&#x20;is&#x20;authorized&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMaximum&#x20;password&#x20;age.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16001,'Ensure&#x20;&#039;Accounts:&#x20;Block&#x20;Microsoft&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;adding&#x20;new&#x20;Microsoft&#x20;accounts&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;onto&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Block&#x20;Microsoft&#x20;accounts.','[{\"cis\": [\"2.3.1.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16002,'Ensure&#x20;&#039;Accounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;local&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;password&#x20;protected&#x20;can&#x20;be&#x20;used&#x20;to&#x20;log&#x20;on&#x20;from&#x20;locations&#x20;other&#x20;than&#x20;the&#x20;physical&#x20;computer&#x20;console.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;local&#x20;accounts&#x20;that&#x20;have&#x20;blank&#x20;passwords&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;network&#x20;from&#x20;remote&#x20;client&#x20;computers.&#x20;Such&#x20;accounts&#x20;will&#x20;only&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;at&#x20;the&#x20;keyboard&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blank&#x20;passwords&#x20;are&#x20;a&#x20;serious&#x20;threat&#x20;to&#x20;computer&#x20;security&#x20;and&#x20;should&#x20;be&#x20;forbidden&#x20;through&#x20;both&#x20;organizational&#x20;policy&#x20;and&#x20;suitable&#x20;technical&#x20;measures.&#x20;In&#x20;fact,&#x20;the&#x20;default&#x20;settings&#x20;for&#x20;Active&#x20;Directory&#x20;domains&#x20;require&#x20;complex&#x20;passwords&#x20;of&#x20;at&#x20;least&#x20;seven&#x20;characters.&#x20;However,&#x20;if&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;create&#x20;new&#x20;accounts&#x20;bypass&#x20;your&#x20;domainbased&#x20;password&#x20;policies,&#x20;they&#x20;could&#x20;create&#x20;accounts&#x20;with&#x20;blank&#x20;passwords.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;could&#x20;build&#x20;a&#x20;stand-alone&#x20;computer,&#x20;create&#x20;one&#x20;or&#x20;more&#x20;accounts&#x20;with&#x20;blank&#x20;passwords,&#x20;and&#x20;then&#x20;join&#x20;the&#x20;computer&#x20;to&#x20;the&#x20;domain.&#x20;The&#x20;local&#x20;accounts&#x20;with&#x20;blank&#x20;passwords&#x20;would&#x20;still&#x20;function.&#x20;Anyone&#x20;who&#x20;knows&#x20;the&#x20;name&#x20;of&#x20;one&#x20;of&#x20;these&#x20;unprotected&#x20;accounts&#x20;could&#x20;then&#x20;use&#x20;it&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only.','[{\"cis\": [\"2.3.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16003,'Ensure&#x20;&#039;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#0','This&#x20;policy&#x20;setting&#x20;allows&#x20;administrators&#x20;to&#x20;enable&#x20;the&#x20;more&#x20;precise&#x20;auditing&#x20;capabilities&#x20;present&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;Audit&#x20;Policy&#x20;settings&#x20;available&#x20;in&#x20;Windows&#x20;Server&#x20;2003&#x20;Active&#x20;Directory&#x20;do&#x20;not&#x20;yet&#x20;contain&#x20;settings&#x20;for&#x20;managing&#x20;the&#x20;new&#x20;auditing&#x20;subcategories.&#x20;To&#x20;properly&#x20;apply&#x20;the&#x20;auditing&#x20;policies&#x20;prescribed&#x20;in&#x20;this&#x20;baseline,&#x20;the&#x20;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#x20;setting&#x20;needs&#x20;to&#x20;be&#x20;configured&#x20;to&#x20;Enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;*Important*:&#x20;Be&#x20;very&#x20;cautious&#x20;about&#x20;audit&#x20;settings&#x20;that&#x20;can&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;traffic.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;enable&#x20;either&#x20;success&#x20;or&#x20;failure&#x20;auditing&#x20;for&#x20;all&#x20;of&#x20;the&#x20;Privilege&#x20;Use&#x20;subcategories,&#x20;the&#x20;high&#x20;volume&#x20;of&#x20;audit&#x20;events&#x20;generated&#x20;can&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;find&#x20;other&#x20;types&#x20;of&#x20;entries&#x20;in&#x20;the&#x20;Security&#x20;log.&#x20;Such&#x20;a&#x20;configuration&#x20;could&#x20;also&#x20;have&#x20;a&#x20;significant&#x20;impact&#x20;on&#x20;system&#x20;performance.','Prior&#x20;to&#x20;the&#x20;introduction&#x20;of&#x20;auditing&#x20;subcategories&#x20;in&#x20;Windows&#x20;Vista,&#x20;it&#x20;was&#x20;difficult&#x20;to&#x20;track&#x20;events&#x20;at&#x20;a&#x20;per-system&#x20;or&#x20;per-user&#x20;level.&#x20;The&#x20;larger&#x20;event&#x20;categories&#x20;created&#x20;too&#x20;many&#x20;events&#x20;and&#x20;the&#x20;key&#x20;information&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;audited&#x20;was&#x20;difficult&#x20;to&#x20;find.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings.','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16004,'Ensure&#x20;&#039;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;system&#x20;shuts&#x20;down&#x20;if&#x20;it&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;Security&#x20;events.&#x20;It&#x20;is&#x20;a&#x20;requirement&#x20;for&#x20;Trusted&#x20;Computer&#x20;System&#x20;Evaluation&#x20;Criteria&#x20;&#40;TCSEC&#41;-C2&#x20;and&#x20;Common&#x20;Criteria&#x20;certification&#x20;to&#x20;prevent&#x20;auditable&#x20;events&#x20;from&#x20;occurring&#x20;if&#x20;the&#x20;audit&#x20;system&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;them.&#x20;Microsoft&#x20;has&#x20;chosen&#x20;to&#x20;meet&#x20;this&#x20;requirement&#x20;by&#x20;halting&#x20;the&#x20;system&#x20;and&#x20;displaying&#x20;a&#x20;stop&#x20;message&#x20;if&#x20;the&#x20;auditing&#x20;system&#x20;experiences&#x20;a&#x20;failure.&#x20;When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;system&#x20;will&#x20;be&#x20;shut&#x20;down&#x20;if&#x20;a&#x20;security&#x20;audit&#x20;cannot&#x20;be&#x20;logged&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;the&#x20;computer&#x20;is&#x20;unable&#x20;to&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;critical&#x20;evidence&#x20;or&#x20;important&#x20;troubleshooting&#x20;information&#x20;may&#x20;not&#x20;be&#x20;available&#x20;for&#x20;review&#x20;after&#x20;a&#x20;security&#x20;incident.&#x20;Also,&#x20;an&#x20;attacker&#x20;could&#x20;potentially&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;Security&#x20;log&#x20;events&#x20;to&#x20;purposely&#x20;force&#x20;a&#x20;computer&#x20;shutdown.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits.','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"10.7\"]}]'),(16005,'Ensure&#x20;&#039;Devices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;NTFS&#x20;media.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;unauthorized&#x20;users&#x20;from&#x20;removing&#x20;data&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;access&#x20;it&#x20;on&#x20;another&#x20;computer&#x20;on&#x20;which&#x20;they&#x20;have&#x20;local&#x20;administrator&#x20;privileges.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators.','Users&#x20;may&#x20;be&#x20;able&#x20;to&#x20;move&#x20;data&#x20;on&#x20;removable&#x20;disks&#x20;to&#x20;a&#x20;different&#x20;computer&#x20;where&#x20;they&#x20;have&#x20;administrative&#x20;privileges.&#x20;The&#x20;user&#x20;could&#x20;then&#x20;take&#x20;ownership&#x20;of&#x20;any&#x20;file,&#x20;grant&#x20;themselves&#x20;full&#x20;control,&#x20;and&#x20;view&#x20;or&#x20;modify&#x20;any&#x20;file.&#x20;The&#x20;fact&#x20;that&#x20;most&#x20;removable&#x20;storage&#x20;devices&#x20;will&#x20;eject&#x20;media&#x20;by&#x20;pressing&#x20;a&#x20;mechanical&#x20;button&#x20;diminishes&#x20;the&#x20;advantage&#x20;of&#x20;this&#x20;policy&#x20;setting.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media.','[{\"cis\": [\"2.3.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16006,'Ensure&#x20;&#039;Devices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','For&#x20;a&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;a&#x20;shared&#x20;printer,&#x20;the&#x20;driver&#x20;for&#x20;that&#x20;shared&#x20;printer&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;This&#x20;security&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;install&#x20;a&#x20;printer&#x20;driver&#x20;as&#x20;part&#x20;of&#x20;connecting&#x20;to&#x20;a&#x20;shared&#x20;printer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;ability&#x20;to&#x20;add&#x20;a&#x20;local&#x20;printer.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;Administrators.','It&#x20;may&#x20;be&#x20;appropriate&#x20;in&#x20;some&#x20;organizations&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;install&#x20;printer&#x20;drivers&#x20;on&#x20;their&#x20;own&#x20;workstations.&#x20;However,&#x20;you&#x20;should&#x20;allow&#x20;only&#x20;Administrators,&#x20;not&#x20;users,&#x20;to&#x20;do&#x20;so&#x20;on&#x20;servers,&#x20;because&#x20;printer&#x20;driver&#x20;installation&#x20;on&#x20;a&#x20;server&#x20;may&#x20;unintentionally&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;become&#x20;less&#x20;stable.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;install&#x20;inappropriate&#x20;printer&#x20;drivers&#x20;in&#x20;a&#x20;deliberate&#x20;attempt&#x20;to&#x20;damage&#x20;the&#x20;computer,&#x20;or&#x20;a&#x20;user&#x20;might&#x20;accidentally&#x20;install&#x20;malicious&#x20;software&#x20;that&#x20;masquerades&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;It&#x20;is&#x20;feasible&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;disguise&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;The&#x20;program&#x20;may&#x20;appear&#x20;to&#x20;users&#x20;as&#x20;if&#x20;they&#x20;must&#x20;use&#x20;it&#x20;to&#x20;print,&#x20;but&#x20;such&#x20;a&#x20;program&#x20;could&#x20;unleash&#x20;malicious&#x20;code&#x20;on&#x20;your&#x20;computer&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers.','[{\"cis\": [\"2.3.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\", \"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\", \"CC5.2\"]}]'),(16007,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;members&#x20;of&#x20;the&#x20;Server&#x20;Operators&#x20;group&#x20;are&#x20;allowed&#x20;to&#x20;submit&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;schedule&#x20;facility.&#x20;The&#x20;impact&#x20;of&#x20;this&#x20;policy&#x20;setting&#x20;configuration&#x20;should&#x20;be&#x20;small&#x20;for&#x20;most&#x20;organizations.&#x20;Users,&#x20;including&#x20;those&#x20;in&#x20;the&#x20;Server&#x20;Operators&#x20;group,&#x20;will&#x20;still&#x20;be&#x20;able&#x20;to&#x20;create&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;Task&#x20;Scheduler&#x20;Wizard,&#x20;but&#x20;those&#x20;jobs&#x20;will&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;with&#x20;which&#x20;the&#x20;user&#x20;authenticates&#x20;when&#x20;they&#x20;set&#x20;up&#x20;the&#x20;job.&#x20;Note:&#x20;An&#x20;AT&#x20;Service&#x20;Account&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;select&#x20;a&#x20;different&#x20;account&#x20;rather&#x20;than&#x20;the&#x20;LOCAL&#x20;SYSTEM&#x20;account.&#x20;To&#x20;change&#x20;the&#x20;account,&#x20;open&#x20;System&#x20;Tools,&#x20;click&#x20;Scheduled&#x20;Tasks,&#x20;and&#x20;then&#x20;click&#x20;Accessories&#x20;folder.&#x20;Then&#x20;click&#x20;AT&#x20;Service&#x20;Account&#x20;on&#x20;the&#x20;Advanced&#x20;menu.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;jobs&#x20;that&#x20;are&#x20;created&#x20;by&#x20;server&#x20;operators&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;service&#x20;will&#x20;execute&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;that&#x20;runs&#x20;that&#x20;service.&#x20;By&#x20;default,&#x20;that&#x20;is&#x20;the&#x20;local&#x20;SYSTEM&#x20;account.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;server&#x20;operators&#x20;could&#x20;perform&#x20;tasks&#x20;that&#x20;SYSTEM&#x20;is&#x20;able&#x20;to&#x20;do&#x20;but&#x20;that&#x20;they&#x20;would&#x20;typically&#x20;not&#x20;be&#x20;able&#x20;to&#x20;do,&#x20;such&#x20;as&#x20;add&#x20;their&#x20;account&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;group.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks.','[{\"cis\": [\"2.3.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16008,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;signing&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;server&#x20;requires&#x20;LDAP&#x20;clients&#x20;to&#x20;negotiate&#x20;data&#x20;signing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;signing.&#x20;Note:&#x20;Domain&#x20;member&#x20;computers&#x20;must&#x20;have&#x20;Network&#x20;security:&#x20;LDAP&#x20;signing&#x20;requirements&#x20;&#40;Rule&#x20;2.3.11.8&#41;&#x20;set&#x20;to&#x20;Negotiate&#x20;signing&#x20;or&#x20;higher.&#x20;If&#x20;not,&#x20;they&#x20;will&#x20;fail&#x20;to&#x20;authenticate&#x20;once&#x20;the&#x20;above&#x20;Require&#x20;signing&#x20;value&#x20;is&#x20;configured&#x20;on&#x20;the&#x20;Domain&#x20;Controllers.&#x20;Fortunately,&#x20;Negotiate&#x20;signing&#x20;is&#x20;the&#x20;default&#x20;in&#x20;the&#x20;client&#x20;configuration.&#x20;Note&#x20;#2:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;shipped&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;LDAP&#x20;simple&#x20;bind&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;to&#x20;talk&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;Note&#x20;#3:&#x20;Before&#x20;enabling&#x20;this&#x20;setting,&#x20;you&#x20;should&#x20;first&#x20;ensure&#x20;that&#x20;there&#x20;are&#x20;no&#x20;clients&#x20;&#40;including&#x20;server-based&#x20;applications&#41;&#x20;that&#x20;are&#x20;configured&#x20;to&#x20;authenticate&#x20;with&#x20;Active&#x20;Directory&#x20;via&#x20;unsigned&#x20;LDAP,&#x20;because&#x20;changing&#x20;this&#x20;setting&#x20;will&#x20;break&#x20;those&#x20;applications.&#x20;Such&#x20;applications&#x20;should&#x20;first&#x20;be&#x20;reconfigured&#x20;to&#x20;use&#x20;signed&#x20;LDAP,&#x20;Secure&#x20;LDAP&#x20;&#40;LDAPS&#41;,&#x20;or&#x20;IPsec-protected&#x20;connections.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;In&#x20;such&#x20;attacks,&#x20;an&#x20;intruder&#x20;captures&#x20;packets&#x20;between&#x20;the&#x20;server&#x20;and&#x20;the&#x20;client,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;client.&#x20;Where&#x20;LDAP&#x20;servers&#x20;are&#x20;concerned,&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;client&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;records&#x20;from&#x20;the&#x20;LDAP&#x20;directory.&#x20;To&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;intrusion&#x20;in&#x20;an&#x20;organization&#039;s&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;could&#x20;implement&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;authentication&#x20;header&#x20;mode&#x20;&#40;AH&#41;,&#x20;which&#x20;performs&#x20;mutual&#x20;authentication&#x20;and&#x20;packet&#x20;integrity&#x20;for&#x20;IP&#x20;traffic&#x20;to&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-&#x20;in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult.&#x20;Additionally,&#x20;allowing&#x20;the&#x20;use&#x20;of&#x20;regular,&#x20;unsigned&#x20;LDAP&#x20;permits&#x20;credentials&#x20;to&#x20;be&#x20;received&#x20;over&#x20;the&#x20;network&#x20;in&#x20;clear&#x20;text,&#x20;which&#x20;could&#x20;very&#x20;easily&#x20;result&#x20;in&#x20;the&#x20;interception&#x20;of&#x20;account&#x20;passwords&#x20;by&#x20;other&#x20;systems&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;signing:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements.','[{\"cis\": [\"2.3.5.2\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16009,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;Domain&#x20;Controllers&#x20;will&#x20;refuse&#x20;requests&#x20;from&#x20;member&#x20;computers&#x20;to&#x20;change&#x20;computer&#x20;account&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;a&#x20;domain,&#x20;domain&#x20;members&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;change&#x20;their&#x20;computer&#x20;account&#x20;passwords,&#x20;and&#x20;those&#x20;passwords&#x20;will&#x20;be&#x20;more&#x20;susceptible&#x20;to&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes.','[{\"cis\": [\"2.3.5.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16010,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;is&#x20;initiated&#x20;by&#x20;the&#x20;domain&#x20;member&#x20;must&#x20;be&#x20;signed&#x20;or&#x20;encrypted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.6.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16011,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;encryption&#x20;for&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;.','[{\"cis\": [\"2.3.6.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16012,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates&#x20;must&#x20;be&#x20;digitally&#x20;signed.&#x20;Digital&#x20;signatures&#x20;protect&#x20;the&#x20;traffic&#x20;from&#x20;being&#x20;modified&#x20;by&#x20;anyone&#x20;who&#x20;captures&#x20;the&#x20;data&#x20;as&#x20;it&#x20;traverses&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;.','[{\"cis\": [\"2.3.6.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16013,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;can&#x20;periodically&#x20;change&#x20;its&#x20;computer&#x20;account&#x20;password.&#x20;Computers&#x20;that&#x20;cannot&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;passwords&#x20;are&#x20;potentially&#x20;vulnerable,&#x20;because&#x20;an&#x20;attacker&#x20;might&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;system&#039;s&#x20;domain&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;default&#x20;configuration&#x20;for&#x20;Windows&#x20;Server&#x20;2003-based&#x20;computers&#x20;that&#x20;belong&#x20;to&#x20;a&#x20;domain&#x20;is&#x20;that&#x20;they&#x20;are&#x20;automatically&#x20;required&#x20;to&#x20;change&#x20;the&#x20;passwords&#x20;for&#x20;their&#x20;accounts&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;computers&#x20;that&#x20;run&#x20;Windows&#x20;Server&#x20;2003&#x20;will&#x20;retain&#x20;the&#x20;same&#x20;passwords&#x20;as&#x20;their&#x20;computer&#x20;accounts.&#x20;Computers&#x20;that&#x20;are&#x20;no&#x20;longer&#x20;able&#x20;to&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;password&#x20;are&#x20;at&#x20;risk&#x20;from&#x20;an&#x20;attacker&#x20;who&#x20;could&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;computer&#039;s&#x20;domain&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes.','[{\"cis\": [\"2.3.6.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16014,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;secure&#x20;channel&#x20;can&#x20;only&#x20;be&#x20;established&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;encrypting&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;&#40;128-bit&#41;&#x20;session&#x20;key.&#x20;To&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;the&#x20;domain&#x20;must&#x20;be&#x20;able&#x20;to&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;key,&#x20;which&#x20;means&#x20;all&#x20;Domain&#x20;Controllers&#x20;must&#x20;be&#x20;running&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;or&#x20;newer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;keys&#x20;that&#x20;are&#x20;used&#x20;to&#x20;establish&#x20;secure&#x20;channel&#x20;communications&#x20;between&#x20;Domain&#x20;Controllers&#x20;and&#x20;member&#x20;computers&#x20;are&#x20;much&#x20;stronger&#x20;in&#x20;Windows&#x20;2000&#x20;than&#x20;they&#x20;were&#x20;in&#x20;previous&#x20;Microsoft&#x20;operating&#x20;systems.&#x20;Whenever&#x20;possible,&#x20;you&#x20;should&#x20;take&#x20;advantage&#x20;of&#x20;these&#x20;stronger&#x20;session&#x20;keys&#x20;to&#x20;help&#x20;protect&#x20;secure&#x20;channel&#x20;communications&#x20;from&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;hijack&#x20;network&#x20;sessions&#x20;and&#x20;eavesdropping.&#x20;&#40;Eavesdropping&#x20;is&#x20;a&#x20;form&#x20;of&#x20;hacking&#x20;in&#x20;which&#x20;network&#x20;data&#x20;is&#x20;read&#x20;or&#x20;altered&#x20;in&#x20;transit.&#x20;The&#x20;data&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;hide&#x20;or&#x20;change&#x20;the&#x20;sender,&#x20;or&#x20;be&#x20;redirected.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key.','[{\"cis\": [\"2.3.6.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16015,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;account&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;client&#x20;computers&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;be&#x20;displayed&#x20;in&#x20;each&#x20;computer&#039;s&#x20;respective&#x20;Windows&#x20;logon&#x20;screen.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;intruders&#x20;from&#x20;collecting&#x20;account&#x20;names&#x20;visually&#x20;from&#x20;the&#x20;screens&#x20;of&#x20;desktop&#x20;or&#x20;laptop&#x20;computers&#x20;in&#x20;your&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name.','[{\"cis\": [\"2.3.7.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16016,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;must&#x20;press&#x20;CTRL+ALT+DEL&#x20;before&#x20;they&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Microsoft&#x20;developed&#x20;this&#x20;feature&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;users&#x20;with&#x20;certain&#x20;types&#x20;of&#x20;physical&#x20;impairments&#x20;to&#x20;log&#x20;on&#x20;to&#x20;computers&#x20;that&#x20;run&#x20;Windows.&#x20;If&#x20;users&#x20;are&#x20;not&#x20;required&#x20;to&#x20;press&#x20;CTRL+ALT+DEL,&#x20;they&#x20;are&#x20;susceptible&#x20;to&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;intercept&#x20;their&#x20;passwords.&#x20;If&#x20;CTRL+ALT+DEL&#x20;is&#x20;required&#x20;before&#x20;logon,&#x20;user&#x20;passwords&#x20;are&#x20;communicated&#x20;by&#x20;means&#x20;of&#x20;a&#x20;trusted&#x20;path.&#x20;An&#x20;attacker&#x20;could&#x20;install&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;that&#x20;looks&#x20;like&#x20;the&#x20;standard&#x20;Windows&#x20;logon&#x20;dialog&#x20;box&#x20;and&#x20;capture&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;attacker&#x20;would&#x20;then&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;compromised&#x20;account&#x20;with&#x20;whatever&#x20;level&#x20;of&#x20;privilege&#x20;that&#x20;user&#x20;has.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL','[{\"cis\": [\"2.3.7.2\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16017,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;','Windows&#x20;notices&#x20;inactivity&#x20;of&#x20;a&#x20;logon&#x20;session,&#x20;and&#x20;if&#x20;the&#x20;amount&#x20;of&#x20;inactive&#x20;time&#x20;exceeds&#x20;the&#x20;inactivity&#x20;limit,&#x20;then&#x20;the&#x20;screen&#x20;saver&#x20;will&#x20;run,&#x20;locking&#x20;the&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;inactivity&#x20;limit.','If&#x20;a&#x20;user&#x20;forgets&#x20;to&#x20;lock&#x20;their&#x20;computer&#x20;when&#x20;they&#x20;walk&#x20;away&#x20;it&#039;s&#x20;possible&#x20;that&#x20;a&#x20;passerby&#x20;will&#x20;hijack&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;900&#x20;or&#x20;fewer&#x20;seconds,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit.','[{\"cis\": [\"2.3.7.3\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16018,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;4&#x20;or&#x20;few','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;user&#x20;can&#x20;log&#x20;on&#x20;to&#x20;a&#x20;Windows&#x20;domain&#x20;using&#x20;cached&#x20;account&#x20;information.&#x20;Logon&#x20;information&#x20;for&#x20;domain&#x20;accounts&#x20;can&#x20;be&#x20;cached&#x20;locally&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;log&#x20;on&#x20;even&#x20;if&#x20;a&#x20;Domain&#x20;Controller&#x20;cannot&#x20;be&#x20;contacted.&#x20;This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;unique&#x20;users&#x20;for&#x20;whom&#x20;logon&#x20;information&#x20;is&#x20;cached&#x20;locally.&#x20;If&#x20;this&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;the&#x20;logon&#x20;cache&#x20;feature&#x20;is&#x20;disabled.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;server&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;&#x20;.','The&#x20;number&#x20;that&#x20;is&#x20;assigned&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;indicates&#x20;the&#x20;number&#x20;of&#x20;users&#x20;whose&#x20;logon&#x20;information&#x20;the&#x20;computer&#x20;will&#x20;cache&#x20;locally.&#x20;If&#x20;the&#x20;number&#x20;is&#x20;set&#x20;to&#x20;4,&#x20;then&#x20;the&#x20;computer&#x20;caches&#x20;logon&#x20;information&#x20;for&#x20;4&#x20;users.&#x20;When&#x20;a&#x20;5th&#x20;user&#x20;logs&#x20;on&#x20;to&#x20;the&#x20;computer,&#x20;the&#x20;server&#x20;overwrites&#x20;the&#x20;oldest&#x20;cached&#x20;logon&#x20;session.&#x20;Users&#x20;who&#x20;access&#x20;the&#x20;computer&#x20;console&#x20;will&#x20;have&#x20;their&#x20;logon&#x20;credentials&#x20;cached&#x20;on&#x20;that&#x20;computer.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;computer&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;attempt&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;To&#x20;mitigate&#x20;this&#x20;type&#x20;of&#x20;attack,&#x20;Windows&#x20;encrypts&#x20;the&#x20;information&#x20;and&#x20;obscures&#x20;its&#x20;physical&#x20;location.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;','[{\"cis\": [\"2.3.7.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16019,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;between&#x20;5&#x20;and&#x20;14&#x20;days&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;far&#x20;in&#x20;advance&#x20;users&#x20;are&#x20;warned&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;at&#x20;least&#x20;5&#x20;days&#x20;but&#x20;no&#x20;more&#x20;than&#x20;14&#x20;days&#x20;to&#x20;sufficiently&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;passwords&#x20;will&#x20;expire.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days.','It&#x20;is&#x20;recommended&#x20;that&#x20;user&#x20;passwords&#x20;be&#x20;configured&#x20;to&#x20;expire&#x20;periodically.&#x20;Users&#x20;will&#x20;need&#x20;to&#x20;be&#x20;warned&#x20;that&#x20;their&#x20;passwords&#x20;are&#x20;going&#x20;to&#x20;expire,&#x20;or&#x20;they&#x20;may&#x20;inadvertently&#x20;be&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;computer&#x20;when&#x20;their&#x20;passwords&#x20;expire.&#x20;This&#x20;condition&#x20;could&#x20;lead&#x20;to&#x20;confusion&#x20;for&#x20;users&#x20;who&#x20;access&#x20;the&#x20;network&#x20;locally,&#x20;or&#x20;make&#x20;it&#x20;impossible&#x20;for&#x20;users&#x20;to&#x20;access&#x20;your&#x20;organization&#039;s&#x20;network&#x20;through&#x20;dial-up&#x20;or&#x20;virtual&#x20;private&#x20;network&#x20;&#40;VPN&#41;&#x20;connections.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration.','[{\"cis\": [\"2.3.7.7\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16020,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Logon&#x20;information&#x20;is&#x20;required&#x20;to&#x20;unlock&#x20;a&#x20;locked&#x20;computer.&#x20;For&#x20;domain&#x20;accounts,&#x20;this&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;it&#x20;is&#x20;necessary&#x20;to&#x20;contact&#x20;a&#x20;Domain&#x20;Controller&#x20;to&#x20;unlock&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','By&#x20;default,&#x20;the&#x20;computer&#x20;caches&#x20;in&#x20;memory&#x20;the&#x20;credentials&#x20;of&#x20;any&#x20;users&#x20;who&#x20;are&#x20;authenticated&#x20;locally.&#x20;The&#x20;computer&#x20;uses&#x20;these&#x20;cached&#x20;credentials&#x20;to&#x20;authenticate&#x20;anyone&#x20;who&#x20;attempts&#x20;to&#x20;unlock&#x20;the&#x20;console.&#x20;When&#x20;cached&#x20;credentials&#x20;are&#x20;used,&#x20;any&#x20;changes&#x20;that&#x20;have&#x20;recently&#x20;been&#x20;made&#x20;to&#x20;the&#x20;account&#x20;-&#x20;such&#x20;as&#x20;user&#x20;rights&#x20;assignments,&#x20;account&#x20;lockout,&#x20;or&#x20;the&#x20;account&#x20;being&#x20;disabled&#x20;-&#x20;are&#x20;not&#x20;considered&#x20;or&#x20;applied&#x20;after&#x20;the&#x20;account&#x20;is&#x20;authenticated.&#x20;User&#x20;privileges&#x20;are&#x20;not&#x20;updated,&#x20;and&#x20;&#40;more&#x20;importantly&#41;&#x20;disabled&#x20;accounts&#x20;are&#x20;still&#x20;able&#x20;to&#x20;unlock&#x20;the&#x20;console&#x20;of&#x20;the&#x20;computer.','','To&#x20;implement&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation','[{\"cis\": [\"2.3.7.8\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16021,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Lock&#x20;Workstation&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;happens&#x20;when&#x20;the&#x20;smart&#x20;card&#x20;for&#x20;a&#x20;logged-on&#x20;user&#x20;is&#x20;removed&#x20;from&#x20;the&#x20;smart&#x20;card&#x20;reader.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Lock&#x20;Workstation.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Users&#x20;sometimes&#x20;forget&#x20;to&#x20;lock&#x20;their&#x20;workstations&#x20;when&#x20;they&#x20;are&#x20;away&#x20;from&#x20;them,&#x20;allowing&#x20;the&#x20;possibility&#x20;for&#x20;malicious&#x20;users&#x20;to&#x20;access&#x20;their&#x20;computers.&#x20;If&#x20;smart&#x20;cards&#x20;are&#x20;used&#x20;for&#x20;authentication,&#x20;the&#x20;computer&#x20;should&#x20;automatically&#x20;lock&#x20;itself&#x20;when&#x20;the&#x20;card&#x20;is&#x20;removed&#x20;to&#x20;ensure&#x20;that&#x20;only&#x20;the&#x20;user&#x20;with&#x20;the&#x20;smart&#x20;card&#x20;is&#x20;accessing&#x20;resources&#x20;using&#x20;those&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Lock&#x20;Workstation&#x20;&#40;or,&#x20;if&#x20;applicable&#x20;for&#x20;your&#x20;environment,&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior.','[{\"cis\": [\"2.3.7.9\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16022,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;client&#x20;component.&#x20;Note:&#x20;When&#x20;Windows&#x20;Vista-based&#x20;computers&#x20;have&#x20;this&#x20;policy&#x20;setting&#x20;enabled&#x20;and&#x20;they&#x20;connect&#x20;to&#x20;file&#x20;or&#x20;print&#x20;shares&#x20;on&#x20;remote&#x20;servers,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;setting&#x20;is&#x20;synchronized&#x20;with&#x20;its&#x20;companion&#x20;setting,&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;,&#x20;on&#x20;those&#x20;servers.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;these&#x20;settings,&#x20;see&#x20;the&#x20;&#039;Microsoft&#x20;network&#x20;client&#x20;and&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;four&#x20;related&#x20;settings&#41;&#039;&#x20;section&#x20;in&#x20;Chapter&#x20;5&#x20;of&#x20;the&#x20;Threats&#x20;and&#x20;Countermeasures&#x20;guide.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.8.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16023,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;attempt&#x20;to&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing.&#x20;Note:&#x20;Enabling&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;makes&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;.','[{\"cis\": [\"2.3.8.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16024,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;redirector&#x20;will&#x20;send&#x20;plaintext&#x20;passwords&#x20;during&#x20;authentication&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#x20;that&#x20;do&#x20;not&#x20;support&#x20;password&#x20;encryption.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;strong&#x20;business&#x20;case&#x20;to&#x20;enable&#x20;it.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;unencrypted&#x20;passwords&#x20;will&#x20;be&#x20;allowed&#x20;across&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;the&#x20;server&#x20;can&#x20;transmit&#x20;passwords&#x20;in&#x20;plaintext&#x20;across&#x20;the&#x20;network&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;offer&#x20;SMB&#x20;services,&#x20;which&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;risk.&#x20;These&#x20;other&#x20;computers&#x20;may&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;SMB&#x20;security&#x20;mechanisms&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;Server&#x20;2003.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers.','[{\"cis\": [\"2.3.8.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16025,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;amount&#x20;of&#x20;continuous&#x20;idle&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;in&#x20;an&#x20;SMB&#x20;session&#x20;before&#x20;the&#x20;session&#x20;is&#x20;suspended&#x20;because&#x20;of&#x20;inactivity.&#x20;Administrators&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;control&#x20;when&#x20;a&#x20;computer&#x20;suspends&#x20;an&#x20;inactive&#x20;SMB&#x20;session.&#x20;If&#x20;client&#x20;activity&#x20;resumes,&#x20;the&#x20;session&#x20;is&#x20;automatically&#x20;reestablished.&#x20;A&#x20;value&#x20;of&#x20;0&#x20;appears&#x20;to&#x20;allow&#x20;sessions&#x20;to&#x20;persist&#x20;indefinitely.&#x20;The&#x20;maximum&#x20;value&#x20;is&#x20;99999,&#x20;which&#x20;is&#x20;over&#x20;69&#x20;days;&#x20;in&#x20;effect,&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&#x20;0.','Each&#x20;SMB&#x20;session&#x20;consumes&#x20;server&#x20;resources,&#x20;and&#x20;numerous&#x20;null&#x20;sessions&#x20;will&#x20;slow&#x20;the&#x20;server&#x20;or&#x20;possibly&#x20;cause&#x20;it&#x20;to&#x20;fail.&#x20;An&#x20;attacker&#x20;could&#x20;repeatedly&#x20;establish&#x20;SMB&#x20;sessions&#x20;until&#x20;the&#x20;server&#039;s&#x20;SMB&#x20;services&#x20;become&#x20;slow&#x20;or&#x20;unresponsive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session.','[{\"cis\": [\"2.3.9.1\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16026,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;server&#x20;component.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;in&#x20;a&#x20;mixed&#x20;environment&#x20;to&#x20;prevent&#x20;downstream&#x20;clients&#x20;from&#x20;using&#x20;the&#x20;workstation&#x20;as&#x20;a&#x20;network&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.9.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16027,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;server&#x20;will&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing&#x20;with&#x20;clients&#x20;that&#x20;request&#x20;it.&#x20;If&#x20;no&#x20;signing&#x20;request&#x20;comes&#x20;from&#x20;the&#x20;client,&#x20;a&#x20;connection&#x20;will&#x20;be&#x20;allowed&#x20;without&#x20;a&#x20;signature&#x20;if&#x20;the&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#x20;setting&#x20;is&#x20;not&#x20;enabled.&#x20;Note:&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;to&#x20;make&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;.','[{\"cis\": [\"2.3.9.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16028,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.11.6&#41;.&#x20;If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;necessary&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;effective.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;then&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting.&#x20;Otherwise,&#x20;users&#x20;who&#x20;should&#x20;not&#x20;have&#x20;access&#x20;to&#x20;network&#x20;resources&#x20;outside&#x20;of&#x20;their&#x20;logon&#x20;hours&#x20;may&#x20;actually&#x20;be&#x20;able&#x20;to&#x20;continue&#x20;to&#x20;use&#x20;those&#x20;resources&#x20;with&#x20;sessions&#x20;that&#x20;were&#x20;established&#x20;during&#x20;allowed&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire.','[{\"cis\": [\"2.3.9.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16029,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;level&#x20;of&#x20;validation&#x20;a&#x20;computer&#x20;with&#x20;shared&#x20;folders&#x20;or&#x20;printers&#x20;&#40;the&#x20;server&#41;&#x20;performs&#x20;on&#x20;the&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;that&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;client&#x20;computer&#x20;when&#x20;it&#x20;establishes&#x20;a&#x20;session&#x20;using&#x20;the&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;The&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;provides&#x20;the&#x20;basis&#x20;for&#x20;file&#x20;and&#x20;print&#x20;sharing&#x20;and&#x20;other&#x20;networking&#x20;operations,&#x20;such&#x20;as&#x20;remote&#x20;Windows&#x20;administration.&#x20;The&#x20;SMB&#x20;protocol&#x20;supports&#x20;validating&#x20;the&#x20;SMB&#x20;server&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;within&#x20;the&#x20;authentication&#x20;blob&#x20;provided&#x20;by&#x20;a&#x20;SMB&#x20;client&#x20;to&#x20;prevent&#x20;a&#x20;class&#x20;of&#x20;attacks&#x20;against&#x20;SMB&#x20;servers&#x20;referred&#x20;to&#x20;as&#x20;SMB&#x20;relay&#x20;attacks.&#x20;This&#x20;setting&#x20;will&#x20;affect&#x20;both&#x20;SMB1&#x20;and&#x20;SMB2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.&#x20;Note:&#x20;Since&#x20;the&#x20;release&#x20;of&#x20;the&#x20;MS&#x20;KB3161561&#x20;security&#x20;patch,&#x20;this&#x20;setting&#x20;can&#x20;cause&#x20;significant&#x20;issues&#x20;&#40;such&#x20;as&#x20;replication&#x20;problems,&#x20;group&#x20;policy&#x20;editing&#x20;issues&#x20;and&#x20;blue&#x20;screen&#x20;crashes&#41;&#x20;on&#x20;Domain&#x20;Controllers&#x20;when&#x20;used&#x20;simultaneously&#x20;with&#x20;UNC&#x20;path&#x20;hardening&#x20;&#40;i.e.&#x20;Rule&#x20;18.5.14.1&#41;.&#x20;CIS&#x20;therefore&#x20;recommends&#x20;against&#x20;deploying&#x20;this&#x20;setting&#x20;on&#x20;Domain&#x20;Controllers.','The&#x20;identity&#x20;of&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;spoofed&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;network&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;&#40;configuring&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level.','[{\"cis\": [\"2.3.9.5\"]}, {\"cis_csc\": [\"14\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16030,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;the&#x20;accounts&#x20;in&#x20;the&#x20;Security&#x20;Accounts&#x20;Manager&#x20;&#40;SAM&#41;.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;with&#x20;anonymous&#x20;connections&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;allows&#x20;additional&#x20;restrictions&#x20;on&#x20;anonymous&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts.','[{\"cis\": [\"2.3.10.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16031,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;SAM&#x20;accounts&#x20;as&#x20;well&#x20;as&#x20;shares.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;anonymous&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;and&#x20;network&#x20;share&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;U&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares.','[{\"cis\": [\"2.3.10.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16032,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Credential&#x20;Manager&#x20;&#40;formerly&#x20;called&#x20;Stored&#x20;User&#x20;Names&#x20;and&#x20;Passwords&#41;&#x20;saves&#x20;passwords&#x20;or&#x20;credentials&#x20;for&#x20;later&#x20;use&#x20;when&#x20;it&#x20;gains&#x20;domain&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Changes&#x20;to&#x20;this&#x20;setting&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;Windows&#x20;is&#x20;restarted.','Passwords&#x20;that&#x20;are&#x20;cached&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;the&#x20;user&#x20;when&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;computer.&#x20;Although&#x20;this&#x20;information&#x20;may&#x20;sound&#x20;obvious,&#x20;a&#x20;problem&#x20;can&#x20;arise&#x20;if&#x20;the&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;reads&#x20;the&#x20;passwords&#x20;and&#x20;forwards&#x20;them&#x20;to&#x20;another,&#x20;unauthorized&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication.','[{\"cis\": [\"2.3.10.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16033,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;additional&#x20;permissions&#x20;are&#x20;assigned&#x20;for&#x20;anonymous&#x20;connections&#x20;to&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords,&#x20;perform&#x20;social&#x20;engineering&#x20;attacks,&#x20;or&#x20;launch&#x20;DoS&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users.','[{\"cis\": [\"2.3.10.5\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16034,'Configure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;,&#x20;or&#x20;&#40;when&#x20;the&#x20;legacy&#x20;Computer&#x20;Browser&#x20;service&#x20;is&#x20;enabled&#41;&#x20;BROWSER.&#x20;Note:&#x20;A&#x20;Member&#x20;Server&#x20;that&#x20;holds&#x20;the&#x20;Remote&#x20;Desktop&#x20;Services&#x20;Role&#x20;with&#x20;Remote&#x20;Desktop&#x20;Licensing&#x20;Role&#x20;Service&#x20;will&#x20;require&#x20;a&#x20;special&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;allow&#x20;the&#x20;HydraLSPipe&#x20;and&#x20;TermServLicensing&#x20;Named&#x20;Pipes&#x20;to&#x20;be&#x20;accessed&#x20;anonymously.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously.','[{\"cis\": [\"2.3.10.6\"]}, {\"cis_csc\": [\"14.1\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16035,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;There&#x20;was&#x20;a&#x20;setting&#x20;with&#x20;that&#x20;name&#x20;in&#x20;Windows&#x20;XP,&#x20;but&#x20;it&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-&#x20;paths&#039;&#x20;in&#x20;Windows&#x20;Server&#x20;2003,&#x20;Windows&#x20;Vista,&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.','The&#x20;registry&#x20;is&#x20;a&#x20;database&#x20;that&#x20;contains&#x20;computer&#x20;configuration&#x20;information,&#x20;and&#x20;much&#x20;of&#x20;the&#x20;information&#x20;is&#x20;sensitive.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;information&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack,&#x20;suitable&#x20;ACLs&#x20;are&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;to&#x20;help&#x20;protect&#x20;it&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlProductOptions&#x20;|&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths.','[{\"cis\": [\"2.3.10.8\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16036,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;In&#x20;Windows&#x20;XP&#x20;this&#x20;setting&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths,&#039;&#x20;the&#x20;setting&#x20;with&#x20;that&#x20;same&#x20;name&#x20;in&#x20;Windows&#x20;Vista,&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;and&#x20;Windows&#x20;Server&#x20;2003&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.','The&#x20;registry&#x20;contains&#x20;sensitive&#x20;computer&#x20;configuration&#x20;information&#x20;that&#x20;could&#x20;be&#x20;used&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;The&#x20;fact&#x20;that&#x20;the&#x20;default&#x20;ACLs&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;are&#x20;fairly&#x20;restrictive&#x20;and&#x20;help&#x20;to&#x20;protect&#x20;the&#x20;registry&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;|&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;|&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;|&#x20;SystemCurrentControlSetServicesSysmonLog&#x20;|&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;|&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;|&#x20;and&#x20;sub-paths.&#x20;When&#x20;a&#x20;server&#x20;holds&#x20;the&#x20;Active&#x20;Directory&#x20;Certificate&#x20;Services&#x20;Role&#x20;with&#x20;Certification&#x20;Authority&#x20;Role&#x20;Service,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesCertSvc.&#x20;When&#x20;a&#x20;server&#x20;has&#x20;the&#x20;WINS&#x20;Server&#x20;Feature&#x20;installed,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesWINS','[{\"cis\": [\"2.3.10.9\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16037,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','When&#x20;enabled,&#x20;this&#x20;policy&#x20;setting&#x20;restricts&#x20;anonymous&#x20;access&#x20;to&#x20;only&#x20;those&#x20;shares&#x20;and&#x20;pipes&#x20;that&#x20;are&#x20;named&#x20;in&#x20;the&#x20;Network&#x20;access:&#x20;Named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;and&#x20;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;settings.&#x20;This&#x20;policy&#x20;setting&#x20;controls&#x20;null&#x20;session&#x20;access&#x20;to&#x20;shares&#x20;on&#x20;your&#x20;computers&#x20;by&#x20;adding&#x20;RestrictNullSessAccess&#x20;with&#x20;the&#x20;value&#x20;1&#x20;in&#x20;the&#x20;HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParameters&#x20;registry&#x20;key.&#x20;This&#x20;registry&#x20;value&#x20;toggles&#x20;null&#x20;session&#x20;shares&#x20;on&#x20;or&#x20;off&#x20;to&#x20;control&#x20;whether&#x20;the&#x20;server&#x20;service&#x20;restricts&#x20;unauthenticated&#x20;clients&#039;&#x20;access&#x20;to&#x20;named&#x20;resources.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Null&#x20;sessions&#x20;are&#x20;a&#x20;weakness&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;through&#x20;shares&#x20;&#40;including&#x20;the&#x20;default&#x20;shares&#41;&#x20;on&#x20;computers&#x20;in&#x20;your&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares.','[{\"cis\": [\"2.3.10.10\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16038,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;remote&#x20;RPC&#x20;connections&#x20;to&#x20;SAM.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#x20;.&#x20;Note:&#x20;A&#x20;Windows&#x20;10&#x20;R1607,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','To&#x20;ensure&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;cannot&#x20;anonymously&#x20;list&#x20;local&#x20;account&#x20;names&#x20;or&#x20;groups&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM','[{\"cis\": [\"2.3.10.11\"]}, {\"cis_csc\": [\"5.1\", \"9.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16039,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;network&#x20;shares&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;anonymous&#x20;users.&#x20;The&#x20;default&#x20;configuration&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;has&#x20;little&#x20;effect&#x20;because&#x20;all&#x20;users&#x20;have&#x20;to&#x20;be&#x20;authenticated&#x20;before&#x20;they&#x20;can&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;','It&#x20;is&#x20;very&#x20;dangerous&#x20;to&#x20;allow&#x20;any&#x20;values&#x20;in&#x20;this&#x20;setting.&#x20;Any&#x20;shares&#x20;that&#x20;are&#x20;listed&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;any&#x20;network&#x20;user,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously.','[{\"cis\": [\"2.3.10.12\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16040,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;network&#x20;logons&#x20;that&#x20;use&#x20;local&#x20;accounts&#x20;are&#x20;authenticated.&#x20;The&#x20;Classic&#x20;option&#x20;allows&#x20;precise&#x20;control&#x20;over&#x20;access&#x20;to&#x20;resources,&#x20;including&#x20;the&#x20;ability&#x20;to&#x20;assign&#x20;different&#x20;types&#x20;of&#x20;access&#x20;to&#x20;different&#x20;users&#x20;for&#x20;the&#x20;same&#x20;resource.&#x20;The&#x20;Guest&#x20;only&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;treat&#x20;all&#x20;users&#x20;equally.&#x20;In&#x20;this&#x20;context,&#x20;all&#x20;users&#x20;authenticate&#x20;as&#x20;Guest&#x20;only&#x20;to&#x20;receive&#x20;the&#x20;same&#x20;access&#x20;level&#x20;to&#x20;a&#x20;given&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;interactive&#x20;logons&#x20;that&#x20;are&#x20;performed&#x20;remotely&#x20;by&#x20;using&#x20;such&#x20;services&#x20;as&#x20;Telnet&#x20;or&#x20;Remote&#x20;Desktop&#x20;Services&#x20;&#40;formerly&#x20;called&#x20;Terminal&#x20;Services&#41;','With&#x20;the&#x20;Guest&#x20;only&#x20;model,&#x20;any&#x20;user&#x20;who&#x20;can&#x20;authenticate&#x20;to&#x20;your&#x20;computer&#x20;over&#x20;the&#x20;network&#x20;does&#x20;so&#x20;with&#x20;guest&#x20;privileges,&#x20;which&#x20;probably&#x20;means&#x20;that&#x20;they&#x20;will&#x20;not&#x20;have&#x20;write&#x20;access&#x20;to&#x20;shared&#x20;resources&#x20;on&#x20;that&#x20;computer.&#x20;Although&#x20;this&#x20;restriction&#x20;does&#x20;increase&#x20;security,&#x20;it&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;authorized&#x20;users&#x20;to&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;those&#x20;computers&#x20;because&#x20;ACLs&#x20;on&#x20;those&#x20;resources&#x20;must&#x20;include&#x20;access&#x20;control&#x20;entries&#x20;&#40;ACEs&#41;&#x20;for&#x20;the&#x20;Guest&#x20;account.&#x20;With&#x20;the&#x20;Classic&#x20;model,&#x20;local&#x20;accounts&#x20;should&#x20;be&#x20;password&#x20;protected.&#x20;Otherwise,&#x20;if&#x20;Guest&#x20;access&#x20;is&#x20;enabled,&#x20;anyone&#x20;can&#x20;use&#x20;those&#x20;user&#x20;accounts&#x20;to&#x20;access&#x20;shared&#x20;system&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts.','[{\"cis\": [\"2.3.10.13\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1.3\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16041,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Local&#x20;System&#x20;services&#x20;that&#x20;use&#x20;Negotiate&#x20;when&#x20;reverting&#x20;to&#x20;NTLM&#x20;authentication&#x20;can&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;This&#x20;policy&#x20;is&#x20;supported&#x20;on&#x20;at&#x20;least&#x20;Windows&#x20;7&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;R2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;connecting&#x20;to&#x20;computers&#x20;running&#x20;versions&#x20;of&#x20;Windows&#x20;earlier&#x20;than&#x20;Windows&#x20;Vista&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;services&#x20;running&#x20;as&#x20;Local&#x20;System&#x20;and&#x20;using&#x20;SPNEGO&#x20;&#40;Negotiate&#41;&#x20;that&#x20;revert&#x20;to&#x20;NTLM&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;In&#x20;Windows&#x20;7,&#x20;if&#x20;you&#x20;are&#x20;connecting&#x20;to&#x20;a&#x20;computer&#x20;running&#x20;Windows&#x20;Server&#x20;2008&#x20;or&#x20;Windows&#x20;Vista,&#x20;then&#x20;a&#x20;system&#x20;service&#x20;uses&#x20;either&#x20;the&#x20;computer&#x20;identity&#x20;or&#x20;a&#x20;NULL&#x20;session.&#x20;When&#x20;connecting&#x20;with&#x20;a&#x20;NULL&#x20;session,&#x20;a&#x20;system-generated&#x20;session&#x20;key&#x20;is&#x20;created,&#x20;which&#x20;provides&#x20;no&#x20;protection&#x20;but&#x20;allows&#x20;applications&#x20;to&#x20;sign&#x20;and&#x20;encrypt&#x20;data&#x20;without&#x20;errors.&#x20;When&#x20;connecting&#x20;with&#x20;the&#x20;computer&#x20;identity,&#x20;both&#x20;signing&#x20;and&#x20;encryption&#x20;is&#x20;supported&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;data&#x20;protection.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM.','[{\"cis\": [\"2.3.11.1\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16042,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;NTLM&#x20;is&#x20;allowed&#x20;to&#x20;fall&#x20;back&#x20;to&#x20;a&#x20;NULL&#x20;session&#x20;when&#x20;used&#x20;with&#x20;LocalSystem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','NULL&#x20;sessions&#x20;are&#x20;less&#x20;secure&#x20;because&#x20;by&#x20;definition&#x20;they&#x20;are&#x20;unauthenticated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback.','[{\"cis\": [\"2.3.11.2\"]}, {\"cis_csc\": [\"14\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16043,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;determines&#x20;if&#x20;online&#x20;identities&#x20;are&#x20;able&#x20;to&#x20;authenticate&#x20;to&#x20;this&#x20;computer.&#x20;The&#x20;Public&#x20;Key&#x20;Cryptography&#x20;Based&#x20;User-to-User&#x20;&#40;PKU2U&#41;&#x20;protocol&#x20;introduced&#x20;in&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;R2&#x20;is&#x20;implemented&#x20;as&#x20;a&#x20;security&#x20;support&#x20;provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;enables&#x20;peer-to-peer&#x20;authentication,&#x20;particularly&#x20;through&#x20;the&#x20;Windows&#x20;7&#x20;media&#x20;and&#x20;file&#x20;sharing&#x20;feature&#x20;called&#x20;Homegroup,&#x20;which&#x20;permits&#x20;sharing&#x20;between&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;members&#x20;of&#x20;a&#x20;domain.&#x20;With&#x20;PKU2U,&#x20;a&#x20;new&#x20;extension&#x20;was&#x20;introduced&#x20;to&#x20;the&#x20;Negotiate&#x20;authentication&#x20;package,&#x20;Spnego.dll.&#x20;In&#x20;previous&#x20;versions&#x20;of&#x20;Windows,&#x20;Negotiate&#x20;decided&#x20;whether&#x20;to&#x20;use&#x20;Kerberos&#x20;or&#x20;NTLM&#x20;for&#x20;authentication.&#x20;The&#x20;extension&#x20;SSP&#x20;for&#x20;Negotiate,&#x20;Negoexts.dll,&#x20;which&#x20;is&#x20;treated&#x20;as&#x20;an&#x20;authentication&#x20;protocol&#x20;by&#x20;Windows,&#x20;supports&#x20;Microsoft&#x20;SSPs&#x20;including&#x20;PKU2U.&#x20;When&#x20;computers&#x20;are&#x20;configured&#x20;to&#x20;accept&#x20;authentication&#x20;requests&#x20;by&#x20;using&#x20;online&#x20;IDs,&#x20;Negoexts.dll&#x20;calls&#x20;the&#x20;PKU2U&#x20;SSP&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;PKU2U&#x20;SSP&#x20;obtains&#x20;a&#x20;local&#x20;certificate&#x20;and&#x20;exchanges&#x20;the&#x20;policy&#x20;between&#x20;the&#x20;peer&#x20;computers.&#x20;When&#x20;validated&#x20;on&#x20;the&#x20;peer&#x20;computer,&#x20;the&#x20;certificate&#x20;within&#x20;the&#x20;metadata&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;logon&#x20;peer&#x20;for&#x20;validation&#x20;and&#x20;associates&#x20;the&#x20;user&#039;s&#x20;certificate&#x20;to&#x20;a&#x20;security&#x20;token&#x20;and&#x20;the&#x20;logon&#x20;process&#x20;completes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;PKU2U&#x20;protocol&#x20;is&#x20;a&#x20;peer-to-peer&#x20;authentication&#x20;protocol&#x20;-&#x20;authentication&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;in&#x20;most&#x20;managed&#x20;networks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities.','[{\"cis\": [\"2.3.11.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16044,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;RC4_HMAC_MD5,&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;t','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;encryption&#x20;types&#x20;that&#x20;Kerberos&#x20;is&#x20;allowed&#x20;to&#x20;use.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types.&#x20;Note:&#x20;Some&#x20;legacy&#x20;applications&#x20;and&#x20;OSes&#x20;may&#x20;require&#x20;RC4_HMAC_MD5&#x20;-&#x20;we&#x20;recommend&#x20;you&#x20;test&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;verify&#x20;whether&#x20;you&#x20;can&#x20;safely&#x20;remove&#x20;it.&#x20;For&#x20;the&#x20;purposes&#x20;of&#x20;scoring&#x20;we&#x20;have&#x20;allowed&#x20;the&#x20;use&#x20;of&#x20;RC4_HMAC_MD5&#x20;as&#x20;an&#x20;optional&#x20;setting.','The&#x20;strength&#x20;of&#x20;each&#x20;encryption&#x20;algorithm&#x20;varies&#x20;from&#x20;one&#x20;to&#x20;the&#x20;next,&#x20;choosing&#x20;stronger&#x20;algorithms&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;compromise&#x20;however&#x20;doing&#x20;so&#x20;may&#x20;cause&#x20;issues&#x20;when&#x20;the&#x20;computer&#x20;attempts&#x20;to&#x20;authenticate&#x20;with&#x20;systems&#x20;that&#x20;do&#x20;not&#x20;support&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos.','[{\"cis\": [\"2.3.11.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16045,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;hash&#x20;value&#x20;for&#x20;the&#x20;new&#x20;password&#x20;is&#x20;stored&#x20;when&#x20;the&#x20;password&#x20;is&#x20;changed.&#x20;The&#x20;LM&#x20;hash&#x20;is&#x20;relatively&#x20;weak&#x20;and&#x20;prone&#x20;to&#x20;attack&#x20;compared&#x20;to&#x20;the&#x20;cryptographically&#x20;stronger&#x20;Microsoft&#x20;Windows&#x20;NT&#x20;hash.&#x20;Since&#x20;LM&#x20;hashes&#x20;are&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;in&#x20;the&#x20;security&#x20;database,&#x20;passwords&#x20;can&#x20;then&#x20;be&#x20;easily&#x20;compromised&#x20;if&#x20;the&#x20;database&#x20;is&#x20;attacked.&#x20;Note:&#x20;Older&#x20;operating&#x20;systems&#x20;and&#x20;some&#x20;third-party&#x20;applications&#x20;may&#x20;fail&#x20;when&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled.&#x20;Also,&#x20;note&#x20;that&#x20;the&#x20;password&#x20;will&#x20;need&#x20;to&#x20;be&#x20;changed&#x20;on&#x20;all&#x20;accounts&#x20;after&#x20;you&#x20;enable&#x20;this&#x20;setting&#x20;to&#x20;gain&#x20;the&#x20;proper&#x20;benefit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;SAM&#x20;file&#x20;can&#x20;be&#x20;targeted&#x20;by&#x20;attackers&#x20;who&#x20;seek&#x20;access&#x20;to&#x20;username&#x20;and&#x20;password&#x20;hashes.&#x20;Such&#x20;attacks&#x20;use&#x20;special&#x20;tools&#x20;to&#x20;crack&#x20;passwords,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;users&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;resources&#x20;on&#x20;your&#x20;network.&#x20;These&#x20;types&#x20;of&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;prevented&#x20;if&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;but&#x20;it&#x20;will&#x20;be&#x20;much&#x20;more&#x20;difficult&#x20;for&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;to&#x20;succeed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change.','[{\"cis\": [\"2.3.11.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16046,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.9.4&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;unscored&#x20;because&#x20;there&#x20;is&#x20;not&#x20;a&#x20;documented&#x20;registry&#x20;value&#x20;that&#x20;corresponds&#x20;to&#x20;it.&#x20;We&#x20;still&#x20;strongly&#x20;encourage&#x20;that&#x20;it&#x20;be&#x20;configured&#x20;as&#x20;Enabled,&#x20;to&#x20;ensure&#x20;that&#x20;logon&#x20;hours&#x20;&#40;when&#x20;configured&#41;&#x20;are&#x20;properly&#x20;enforced.','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;a&#x20;user&#x20;could&#x20;remain&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;outside&#x20;of&#x20;their&#x20;allotted&#x20;logon&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire.','[{\"cis\": [\"2.3.11.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16047,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM&#039;','LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;was&#x20;a&#x20;family&#x20;of&#x20;early&#x20;Microsoft&#x20;client/server&#x20;software&#x20;&#40;predating&#x20;Windows&#x20;NT&#41;&#x20;that&#x20;allowed&#x20;users&#x20;to&#x20;link&#x20;personal&#x20;computers&#x20;together&#x20;on&#x20;a&#x20;single&#x20;network.&#x20;LM&#x20;network&#x20;capabilities&#x20;included&#x20;transparent&#x20;file&#x20;and&#x20;print&#x20;sharing,&#x20;user&#x20;security&#x20;features,&#x20;and&#x20;network&#x20;administration&#x20;tools.&#x20;In&#x20;Active&#x20;Directory&#x20;domains,&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;the&#x20;default&#x20;authentication&#x20;protocol.&#x20;However,&#x20;if&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;not&#x20;negotiated&#x20;for&#x20;some&#x20;reason,&#x20;Active&#x20;Directory&#x20;will&#x20;use&#x20;LM,&#x20;NTLM,&#x20;or&#x20;NTLMv2.&#x20;LAN&#x20;Manager&#x20;authentication&#x20;includes&#x20;the&#x20;LM,&#x20;NTLM,&#x20;and&#x20;NTLM&#x20;version&#x20;2&#x20;&#40;NTLMv2&#41;&#x20;variants,&#x20;and&#x20;is&#x20;the&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;to&#x20;authenticate&#x20;all&#x20;Windows&#x20;clients&#x20;when&#x20;they&#x20;perform&#x20;the&#x20;following&#x20;operations:&#x20;-Join&#x20;a&#x20;domain&#x20;-Authenticate&#x20;between&#x20;Active&#x20;Directory&#x20;forests&#x20;-Authenticate&#x20;to&#x20;down-level&#x20;domains&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;do&#x20;not&#x20;run&#x20;Windows&#x20;2000,&#x20;Windows&#x20;Server&#x20;2003,&#x20;or&#x20;Windows&#x20;XP&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;in&#x20;the&#x20;domain.&#x20;The&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#x20;setting&#x20;determines&#x20;which&#x20;challenge/response&#x20;authentication&#x20;protocol&#x20;is&#x20;used&#x20;for&#x20;network&#x20;logons.&#x20;This&#x20;choice&#x20;affects&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;protocol&#x20;used&#x20;by&#x20;clients,&#x20;the&#x20;level&#x20;of&#x20;session&#x20;security&#x20;negotiated,&#x20;and&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;accepted&#x20;by&#x20;servers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM.','Windows&#x20;2000&#x20;and&#x20;Windows&#x20;XP&#x20;clients&#x20;were&#x20;configured&#x20;by&#x20;default&#x20;to&#x20;send&#x20;LM&#x20;and&#x20;NTLM&#x20;authentication&#x20;responses&#x20;&#40;Windows&#x20;95-based&#x20;and&#x20;Windows&#x20;98-based&#x20;clients&#x20;only&#x20;send&#x20;LM&#41;.&#x20;The&#x20;default&#x20;settings&#x20;in&#x20;OSes&#x20;predating&#x20;Windows&#x20;Vista&#x20;/&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-&#x20;R2&#41;&#x20;allowed&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;with&#x20;servers&#x20;and&#x20;use&#x20;their&#x20;resources.&#x20;However,&#x20;this&#x20;meant&#x20;that&#x20;LM&#x20;responses&#x20;-&#x20;the&#x20;weakest&#x20;form&#x20;of&#x20;authentication&#x20;response&#x20;-&#x20;were&#x20;sent&#x20;over&#x20;the&#x20;network,&#x20;and&#x20;it&#x20;was&#x20;potentially&#x20;possible&#x20;for&#x20;attackers&#x20;to&#x20;sniff&#x20;that&#x20;traffic&#x20;to&#x20;more&#x20;easily&#x20;reproduce&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;operating&#x20;systems&#x20;cannot&#x20;use&#x20;the&#x20;Kerberos&#x20;version&#x20;5&#x20;protocol&#x20;for&#x20;authentication.&#x20;For&#x20;this&#x20;reason,&#x20;in&#x20;a&#x20;Windows&#x20;Server&#x20;2003&#x20;domain,&#x20;these&#x20;computers&#x20;authenticate&#x20;by&#x20;default&#x20;with&#x20;both&#x20;the&#x20;LM&#x20;and&#x20;NTLM&#x20;protocols&#x20;for&#x20;network&#x20;authentication.&#x20;You&#x20;can&#x20;enforce&#x20;a&#x20;more&#x20;secure&#x20;authentication&#x20;protocol&#x20;for&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;by&#x20;using&#x20;NTLMv2.&#x20;For&#x20;the&#x20;logon&#x20;process,&#x20;NTLMv2&#x20;uses&#x20;a&#x20;secure&#x20;channel&#x20;to&#x20;protect&#x20;the&#x20;authentication&#x20;process.&#x20;Even&#x20;if&#x20;you&#x20;use&#x20;NTLMv2&#x20;for&#x20;older&#x20;clients&#x20;and&#x20;servers,&#x20;Windows-based&#x20;clients&#x20;and&#x20;servers&#x20;that&#x20;are&#x20;members&#x20;of&#x20;the&#x20;domain&#x20;will&#x20;use&#x20;the&#x20;Kerberos&#x20;authentication&#x20;protocol&#x20;to&#x20;authenticate&#x20;with&#x20;Windows&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;Domain&#x20;Controllers.&#x20;For&#x20;these&#x20;reasons,&#x20;it&#x20;is&#x20;strongly&#x20;preferred&#x20;to&#x20;restrict&#x20;the&#x20;use&#x20;of&#x20;LM&#x20;&amp;&#x20;NTLM&#x20;&#40;non-v2&#41;&#x20;as&#x20;much&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level.','[{\"cis\": [\"2.3.11.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16048,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Negotiate&#x20;signing&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;data&#x20;signing&#x20;that&#x20;is&#x20;requested&#x20;on&#x20;behalf&#x20;of&#x20;clients&#x20;that&#x20;issue&#x20;LDAP&#x20;BIND&#x20;requests.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;ldap_simple_bind&#x20;or&#x20;ldap_simple_bind_s&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Negotiate&#x20;signing.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x20;in&#x20;which&#x20;an&#x20;intruder&#x20;captures&#x20;the&#x20;packets&#x20;between&#x20;the&#x20;client&#x20;and&#x20;server,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;server.&#x20;For&#x20;an&#x20;LDAP&#x20;server,&#x20;this&#x20;susceptibility&#x20;means&#x20;that&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;server&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;or&#x20;altered&#x20;data&#x20;from&#x20;the&#x20;LDAP&#x20;queries.&#x20;To&#x20;lower&#x20;this&#x20;risk&#x20;in&#x20;your&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;can&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult&#x20;if&#x20;you&#x20;require&#x20;digital&#x20;signatures&#x20;on&#x20;all&#x20;network&#x20;packets&#x20;by&#x20;means&#x20;of&#x20;IPsec&#x20;authentication&#x20;headers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Negotiate&#x20;signing&#x20;&#40;configuring&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements.','[{\"cis\": [\"2.3.11.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16049,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;clients&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;both&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;In&#x20;other&#x20;words,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients.','[{\"cis\": [\"2.3.11.9\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16050,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;servers&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;all&#x20;of&#x20;the&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;That&#x20;is,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers.','[{\"cis\": [\"2.3.11.10\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16051,'Ensure&#x20;&#039;Shutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;shut&#x20;down&#x20;when&#x20;a&#x20;user&#x20;is&#x20;not&#x20;logged&#x20;on.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;shutdown&#x20;command&#x20;is&#x20;available&#x20;on&#x20;the&#x20;Windows&#x20;logon&#x20;screen.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;restrict&#x20;the&#x20;ability&#x20;to&#x20;shut&#x20;down&#x20;the&#x20;computer&#x20;to&#x20;users&#x20;with&#x20;credentials&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Server&#x20;2008&#x20;R2&#x20;and&#x20;older&#x20;versions,&#x20;this&#x20;setting&#x20;had&#x20;no&#x20;impact&#x20;on&#x20;Remote&#x20;Desktop&#x20;&#40;RDP&#41;&#x20;/&#x20;Terminal&#x20;Services&#x20;sessions&#x20;-&#x20;it&#x20;only&#x20;affected&#x20;the&#x20;local&#x20;console.&#x20;However,&#x20;Microsoft&#x20;changed&#x20;the&#x20;behavior&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;where&#x20;if&#x20;set&#x20;to&#x20;Enabled,&#x20;RDP&#x20;sessions&#x20;are&#x20;also&#x20;allowed&#x20;to&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server.','Users&#x20;who&#x20;can&#x20;access&#x20;the&#x20;console&#x20;locally&#x20;could&#x20;shut&#x20;down&#x20;the&#x20;computer.&#x20;Attackers&#x20;could&#x20;also&#x20;walk&#x20;to&#x20;the&#x20;local&#x20;console&#x20;and&#x20;restart&#x20;the&#x20;server,&#x20;which&#x20;would&#x20;cause&#x20;a&#x20;temporary&#x20;DoS&#x20;condition.&#x20;Attackers&#x20;could&#x20;also&#x20;shut&#x20;down&#x20;the&#x20;server&#x20;and&#x20;leave&#x20;all&#x20;of&#x20;its&#x20;applications&#x20;and&#x20;services&#x20;unavailable.&#x20;As&#x20;noted&#x20;in&#x20;the&#x20;Description&#x20;above,&#x20;the&#x20;Denial&#x20;of&#x20;Service&#x20;&#40;DoS&#41;&#x20;risk&#x20;of&#x20;enabling&#x20;this&#x20;setting&#x20;dramatically&#x20;increases&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;as&#x20;even&#x20;remote&#x20;users&#x20;could&#x20;then&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server&#x20;from&#x20;the&#x20;logon&#x20;screen&#x20;of&#x20;an&#x20;RDP&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsShutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on.','[{\"cis\": [\"2.3.13.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16052,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;case&#x20;insensitivity&#x20;is&#x20;enforced&#x20;for&#x20;all&#x20;subsystems.&#x20;The&#x20;Microsoft&#x20;Win32&#x20;subsystem&#x20;is&#x20;case&#x20;insensitive.&#x20;However,&#x20;the&#x20;kernel&#x20;supports&#x20;case&#x20;sensitivity&#x20;for&#x20;other&#x20;subsystems,&#x20;such&#x20;as&#x20;the&#x20;Portable&#x20;Operating&#x20;System&#x20;Interface&#x20;for&#x20;UNIX&#x20;&#40;POSIX&#41;.&#x20;Because&#x20;Windows&#x20;is&#x20;case&#x20;insensitive&#x20;&#40;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity&#41;,&#x20;failure&#x20;to&#x20;enforce&#x20;this&#x20;policy&#x20;setting&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;the&#x20;POSIX&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;by&#x20;using&#x20;mixed&#x20;case&#x20;to&#x20;label&#x20;it.&#x20;Such&#x20;a&#x20;situation&#x20;can&#x20;block&#x20;access&#x20;to&#x20;these&#x20;files&#x20;by&#x20;another&#x20;user&#x20;who&#x20;uses&#x20;typical&#x20;Win32&#x20;tools,&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Because&#x20;Windows&#x20;is&#x20;case-insensitive&#x20;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity,&#x20;failure&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;would&#x20;make&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;that&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;but&#x20;with&#x20;a&#x20;different&#x20;mix&#x20;of&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letters.&#x20;Such&#x20;a&#x20;situation&#x20;could&#x20;potentially&#x20;confuse&#x20;users&#x20;when&#x20;they&#x20;try&#x20;to&#x20;access&#x20;such&#x20;files&#x20;from&#x20;normal&#x20;Win32&#x20;tools&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-&#x20;Windows&#x20;subsystems.','[{\"cis\": [\"2.3.15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16053,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;discretionary&#x20;access&#x20;control&#x20;list&#x20;&#40;DACL&#41;&#x20;for&#x20;objects.&#x20;Active&#x20;Directory&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;system&#x20;resources,&#x20;such&#x20;as&#x20;DOS&#x20;device&#x20;names,&#x20;mutexes,&#x20;and&#x20;semaphores.&#x20;In&#x20;this&#x20;way,&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;what&#x20;permissions&#x20;are&#x20;granted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;DACL&#x20;for&#x20;objects.&#x20;Windows&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;computer&#x20;resources&#x20;so&#x20;that&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;with&#x20;what&#x20;permissions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;','[{\"cis\": [\"2.3.15.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16054,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;built-in&#x20;Administrator&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;An&#x20;attack&#x20;vector&#x20;for&#x20;these&#x20;programs&#x20;was&#x20;to&#x20;discover&#x20;the&#x20;password&#x20;of&#x20;the&#x20;account&#x20;named&#x20;&#039;Administrator&#039;&#x20;because&#x20;that&#x20;user&#x20;account&#x20;was&#x20;created&#x20;for&#x20;all&#x20;installations&#x20;of&#x20;Windows.&#x20;To&#x20;address&#x20;this&#x20;risk,&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;newer,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;is&#x20;now&#x20;disabled&#x20;by&#x20;default.&#x20;In&#x20;a&#x20;default&#x20;installation&#x20;of&#x20;a&#x20;new&#x20;computer,&#x20;accounts&#x20;with&#x20;administrative&#x20;control&#x20;over&#x20;the&#x20;computer&#x20;are&#x20;initially&#x20;set&#x20;up&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;not&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;the&#x20;first&#x20;user&#x20;account&#x20;you&#x20;create&#x20;has&#x20;the&#x20;equivalent&#x20;permissions&#x20;as&#x20;a&#x20;local&#x20;administrator.&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;no&#x20;local&#x20;administrator&#x20;accounts&#x20;are&#x20;created.&#x20;The&#x20;Enterprise&#x20;or&#x20;Domain&#x20;Administrator&#x20;must&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;and&#x20;create&#x20;one&#x20;if&#x20;a&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;warranted.&#x20;Once&#x20;Windows&#x20;is&#x20;installed,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;may&#x20;be&#x20;manually&#x20;enabled,&#x20;but&#x20;we&#x20;strongly&#x20;recommend&#x20;that&#x20;this&#x20;account&#x20;remain&#x20;disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account.','[{\"cis\": [\"2.3.17.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16055,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Allow&#x20;UIAccess&#x20;applications&#x20;to&#x20;prompt&#x20;for&#x20;elevation&#x20;without&#x20;using&#x20;the&#x20;secure&#x20;desktop&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#x20;or&#x20;UIA&#41;&#x20;programs&#x20;can&#x20;automatically&#x20;disable&#x20;the&#x20;secure&#x20;desktop&#x20;for&#x20;elevation&#x20;prompts&#x20;used&#x20;by&#x20;a&#x20;standard&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;allows&#x20;the&#x20;administrator&#x20;to&#x20;perform&#x20;operations&#x20;that&#x20;require&#x20;elevated&#x20;privileges&#x20;while&#x20;connected&#x20;via&#x20;Remote&#x20;Assistance.&#x20;This&#x20;increases&#x20;security&#x20;in&#x20;that&#x20;organizations&#x20;can&#x20;use&#x20;UAC&#x20;even&#x20;when&#x20;end&#x20;user&#x20;support&#x20;is&#x20;provided&#x20;remotely.&#x20;However,&#x20;it&#x20;also&#x20;reduces&#x20;security&#x20;by&#x20;adding&#x20;the&#x20;risk&#x20;that&#x20;an&#x20;administrator&#x20;might&#x20;allow&#x20;an&#x20;unprivileged&#x20;user&#x20;to&#x20;share&#x20;elevated&#x20;privileges&#x20;for&#x20;an&#x20;application&#x20;that&#x20;the&#x20;administrator&#x20;needs&#x20;to&#x20;use&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Allow&#x20;UIAccess&#x20;applications&#x20;to&#x20;prompt&#x20;for&#x20;elevation&#x20;without&#x20;using&#x20;the&#x20;secure&#x20;desktop.','[{\"cis\": [\"2.3.17.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16056,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Prompt&#x20;for&#x20;consent&#x20','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;administrator&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;permits&#x20;the&#x20;administrator&#x20;to&#x20;prevent&#x20;a&#x20;malicious&#x20;program&#x20;from&#x20;elevating&#x20;its&#x20;privilege&#x20;when&#x20;the&#x20;program&#x20;attempts&#x20;to&#x20;do&#x20;so.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode.','[{\"cis\": [\"2.3.17.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16057,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Automatically&#x20;deny&#x20;elevation&#x20;requests&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;programs&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;their&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;user&#x20;that&#x20;a&#x20;program&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;requires&#x20;that&#x20;the&#x20;user&#x20;be&#x20;able&#x20;to&#x20;supply&#x20;administrative&#x20;credentials&#x20;in&#x20;order&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.','[{\"cis\": [\"2.3.17.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16058,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;application&#x20;installation&#x20;detection&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Some&#x20;malicious&#x20;software&#x20;will&#x20;attempt&#x20;to&#x20;install&#x20;itself&#x20;after&#x20;being&#x20;given&#x20;permission&#x20;to&#x20;run.&#x20;For&#x20;example,&#x20;malicious&#x20;software&#x20;with&#x20;a&#x20;trusted&#x20;application&#x20;shell.&#x20;The&#x20;user&#x20;may&#x20;have&#x20;given&#x20;permission&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run&#x20;because&#x20;the&#x20;program&#x20;is&#x20;trusted,&#x20;but&#x20;if&#x20;they&#x20;are&#x20;then&#x20;prompted&#x20;for&#x20;installation&#x20;of&#x20;an&#x20;unknown&#x20;component&#x20;this&#x20;provides&#x20;another&#x20;way&#x20;of&#x20;trapping&#x20;the&#x20;software&#x20;before&#x20;it&#x20;can&#x20;do&#x20;damage.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation.','[{\"cis\": [\"2.3.17.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16059,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;applications&#x20;that&#x20;request&#x20;to&#x20;run&#x20;with&#x20;a&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#41;&#x20;integrity&#x20;level&#x20;must&#x20;reside&#x20;in&#x20;a&#x20;secure&#x20;location&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;Secure&#x20;locations&#x20;are&#x20;limited&#x20;to&#x20;the&#x20;following:&#x20;...Program&#x20;Files,&#x20;including&#x20;subfolders;&#x20;...Windowssystem32;&#x20;...Program&#x20;Files&#x20;&#40;x86&#41;,&#x20;including&#x20;subfolders&#x20;&#40;for&#x20;64-bit&#x20;versions&#x20;of&#x20;Windows&#41;.&#x20;Note:&#x20;Windows&#x20;enforces&#x20;a&#x20;public&#x20;key&#x20;infrastructure&#x20;&#40;PKI&#41;&#x20;signature&#x20;check&#x20;on&#x20;any&#x20;interactive&#x20;application&#x20;that&#x20;requests&#x20;to&#x20;run&#x20;with&#x20;a&#x20;UIAccess&#x20;integrity&#x20;level&#x20;regardless&#x20;of&#x20;the&#x20;state&#x20;of&#x20;this&#x20;security&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','UIAccess&#x20;Integrity&#x20;allows&#x20;an&#x20;application&#x20;to&#x20;bypass&#x20;User&#x20;Interface&#x20;Privilege&#x20;Isolation&#x20;&#40;UIPI&#41;&#x20;restrictions&#x20;when&#x20;an&#x20;application&#x20;is&#x20;elevated&#x20;in&#x20;privilege&#x20;from&#x20;a&#x20;standard&#x20;user&#x20;to&#x20;an&#x20;administrator.&#x20;This&#x20;is&#x20;required&#x20;to&#x20;support&#x20;accessibility&#x20;features&#x20;such&#x20;as&#x20;screen&#x20;readers&#x20;that&#x20;are&#x20;transmitting&#x20;user&#x20;interfaces&#x20;to&#x20;alternative&#x20;forms.&#x20;A&#x20;process&#x20;that&#x20;is&#x20;started&#x20;with&#x20;UIAccess&#x20;rights&#x20;has&#x20;the&#x20;following&#x20;abilities:&#x20;-&#x20;To&#x20;set&#x20;the&#x20;foreground&#x20;window.&#x20;-&#x20;To&#x20;drive&#x20;any&#x20;application&#x20;window&#x20;using&#x20;SendInput&#x20;function.&#x20;-&#x20;To&#x20;use&#x20;read&#x20;input&#x20;for&#x20;all&#x20;integrity&#x20;levels&#x20;using&#x20;low-level&#x20;hooks,&#x20;raw&#x20;input,&#x20;GetKeyState,&#x20;GetAsyncKeyState,&#x20;and&#x20;GetKeyboardInput.&#x20;-&#x20;To&#x20;set&#x20;journal&#x20;hooks.&#x20;-&#x20;To&#x20;uses&#x20;AttachThreadInput&#x20;to&#x20;attach&#x20;a&#x20;thread&#x20;to&#x20;a&#x20;higher&#x20;integrity&#x20;input&#x20;queue.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations.','[{\"cis\": [\"2.3.17.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16060,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;all&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;policy&#x20;settings&#x20;for&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;change&#x20;this&#x20;policy&#x20;setting,&#x20;you&#x20;must&#x20;restart&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;Security&#x20;Center&#x20;notifies&#x20;you&#x20;that&#x20;the&#x20;overall&#x20;security&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;reduced.','This&#x20;is&#x20;the&#x20;setting&#x20;that&#x20;turns&#x20;on&#x20;or&#x20;off&#x20;UAC.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;used&#x20;and&#x20;any&#x20;security&#x20;benefits&#x20;and&#x20;risk&#x20;mitigations&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;present&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode.','[{\"cis\": [\"2.3.17.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16061,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;elevation&#x20;request&#x20;prompt&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;interactive&#x20;user&#039;s&#x20;desktop&#x20;or&#x20;the&#x20;secure&#x20;desktop.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Standard&#x20;elevation&#x20;prompt&#x20;dialog&#x20;boxes&#x20;can&#x20;be&#x20;spoofed,&#x20;which&#x20;may&#x20;cause&#x20;users&#x20;to&#x20;disclose&#x20;their&#x20;passwords&#x20;to&#x20;malicious&#x20;software.&#x20;The&#x20;secure&#x20;desktop&#x20;presents&#x20;a&#x20;very&#x20;distinct&#x20;appearance&#x20;when&#x20;prompting&#x20;for&#x20;elevation,&#x20;where&#x20;the&#x20;user&#x20;desktop&#x20;dims,&#x20;and&#x20;the&#x20;elevation&#x20;prompt&#x20;UI&#x20;is&#x20;more&#x20;prominent.&#x20;This&#x20;increases&#x20;the&#x20;likelihood&#x20;that&#x20;users&#x20;who&#x20;become&#x20;accustomed&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;will&#x20;recognize&#x20;a&#x20;spoofed&#x20;elevation&#x20;prompt&#x20;dialog&#x20;box&#x20;and&#x20;not&#x20;fall&#x20;for&#x20;the&#x20;trick.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation.','[{\"cis\": [\"2.3.17.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16062,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;application&#x20;write&#x20;failures&#x20;are&#x20;redirected&#x20;to&#x20;defined&#x20;registry&#x20;and&#x20;file&#x20;system&#x20;locations.&#x20;This&#x20;policy&#x20;setting&#x20;mitigates&#x20;applications&#x20;that&#x20;run&#x20;as&#x20;administrator&#x20;and&#x20;write&#x20;run-time&#x20;application&#x20;data&#x20;to:&#x20;-&#x20;%ProgramFiles%&#x20;-&#x20;%Windir%&#x20;-&#x20;%Windir%system32&#x20;-&#x20;HKEY_LOCAL_MACHINESoftware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;reduces&#x20;vulnerabilities&#x20;by&#x20;ensuring&#x20;that&#x20;legacy&#x20;applications&#x20;only&#x20;write&#x20;data&#x20;to&#x20;permitted&#x20;locations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations.','[{\"cis\": [\"2.3.17.9\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16063,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16064,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16065,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.1.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16066,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.1.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16067,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewalldomainfw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewalldomainfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewalldomainfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.1.5\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16068,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.1.6\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16069,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.1.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16070,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.1.8\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16071,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.2.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16072,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.2.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16073,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16074,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.2.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16075,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewallprivatefw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewallprivatefw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewallprivatefw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.2.5\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16076,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.2.6\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16077,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.2.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16078,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.2.8\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16079,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.3.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16080,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.3.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16081,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.3.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16082,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;avoid&#x20;alarming&#x20;users&#x20;when&#x20;firewall&#x20;rules&#x20;block&#x20;certain&#x20;types&#x20;of&#x20;network&#x20;activity.&#x20;However,&#x20;notifications&#x20;can&#x20;be&#x20;helpful&#x20;when&#x20;troubleshooting&#x20;network&#x20;issues&#x20;involving&#x20;the&#x20;firewall.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;No&#039;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.3.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16083,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;local&#x20;firewall&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;firewall&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','iWhen&#x20;in&#x20;the&#x20;Public&#x20;profile,&#x20;there&#x20;should&#x20;be&#x20;no&#x20;special&#x20;local&#x20;firewall&#x20;exceptions&#x20;per&#x20;computer.&#x20;These&#x20;settings&#x20;should&#x20;be&#x20;managed&#x20;by&#x20;a&#x20;centralized&#x20;policy.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;firewall&#x20;rules.','[{\"cis\": [\"9.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16084,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;connection&#x20;security&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;connection&#x20;security&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;connection&#x20;security&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Users&#x20;with&#x20;administrative&#x20;privileges&#x20;might&#x20;create&#x20;firewall&#x20;rules&#x20;that&#x20;expose&#x20;the&#x20;system&#x20;to&#x20;remote&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;connection&#x20;security&#x20;rules.','[{\"cis\": [\"9.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16085,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewallpublicfw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewallpublicfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewallpublicfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.3.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16086,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.3.8\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16087,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.3.9\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16088,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.3.10\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16089,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Disables&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;toggle&#x20;switch&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;camera&#x20;from&#x20;being&#x20;invoked&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;camera&#x20;features.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16090,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Disables&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;settings&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;slide&#x20;show&#x20;from&#x20;playing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;slide&#x20;show&#x20;contents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16091,'Ensure&#x20;&#039;Allow&#x20;input&#x20;personalization&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;enables&#x20;the&#x20;automatic&#x20;learning&#x20;component&#x20;of&#x20;input&#x20;personalization&#x20;that&#x20;includes&#x20;speech,&#x20;inking,&#x20;and&#x20;typing.&#x20;Automatic&#x20;learning&#x20;enables&#x20;the&#x20;collection&#x20;of&#x20;speech&#x20;and&#x20;handwriting&#x20;patterns,&#x20;typing&#x20;history,&#x20;contacts,&#x20;and&#x20;recent&#x20;calendar&#x20;information.&#x20;It&#x20;is&#x20;required&#x20;for&#x20;the&#x20;use&#x20;of&#x20;Cortana.&#x20;Some&#x20;of&#x20;this&#x20;collected&#x20;information&#x20;may&#x20;be&#x20;stored&#x20;on&#x20;the&#x20;user&#039;s&#x20;OneDrive,&#x20;in&#x20;the&#x20;case&#x20;of&#x20;inking&#x20;and&#x20;typing;&#x20;some&#x20;of&#x20;the&#x20;information&#x20;will&#x20;be&#x20;uploaded&#x20;to&#x20;Microsoft&#x20;to&#x20;personalize&#x20;speech.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;Enabled&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;stored&#x20;in&#x20;the&#x20;cloud&#x20;or&#x20;sent&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelRegional&#x20;and&#x20;Language&#x20;OptionsAllow&#x20;input&#x20;personalization&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.2.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16092,'Ensure&#x20;&#039;Allow&#x20;Online&#x20;Tips&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;the&#x20;retrieval&#x20;of&#x20;online&#x20;tips&#x20;and&#x20;help&#x20;for&#x20;the&#x20;Settings&#x20;app.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelAllow&#x20;Online&#x20;Tips&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanel.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.3.4\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16093,'Ensure&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;is&#x20;installed','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','In&#x20;order&#x20;to&#x20;utilize&#x20;LAPS,&#x20;a&#x20;minor&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;is&#x20;required,&#x20;and&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;each&#x20;managed&#x20;computer.&#x20;When&#x20;LAPS&#x20;is&#x20;installed,&#x20;the&#x20;file&#x20;AdmPwd.dll&#x20;must&#x20;be&#x20;present&#x20;in&#x20;the&#x20;following&#x20;location&#x20;and&#x20;registered&#x20;in&#x20;Windows&#x20;&#40;the&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;installation&#x20;does&#x20;this&#x20;for&#x20;you&#41;:&#x20;C:Program&#x20;FilesLAPSCSEAdmPwd.dll','[{\"cis\": [\"18.2.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16094,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSDo&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16095,'Ensure&#x20;&#039;Enable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSEnable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16096,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Complexity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Complexity&#x20;option&#x20;to&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.4\"]}, {\"cis_csc\": [\"5.7\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16097,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;or&#x20;more&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;or&#x20;more.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Length&#x20;option&#x20;to&#x20;15&#x20;or&#x20;more:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.5\"]}, {\"cis_csc\": [\"5.7\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16098,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;30&#x20;or&#x20;fewer&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;30&#x20;or&#x20;fewer.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#x20;option&#x20;to&#x20;30&#x20;or&#x20;fewer:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.6\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16099,'Ensure&#x20;&#039;Apply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;accounts&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;administration&#x20;via&#x20;network&#x20;logon&#x20;&#40;e.g.,&#x20;NET&#x20;USE,&#x20;connecting&#x20;to&#x20;C$,&#x20;etc.&#41;.&#x20;Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Enabling&#x20;this&#x20;policy&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.&#x20;Enabled:&#x20;Applies&#x20;UAC&#x20;token-filtering&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Membership&#x20;in&#x20;powerful&#x20;group&#x20;such&#x20;as&#x20;Administrators&#x20;is&#x20;disabled&#x20;and&#x20;powerful&#x20;privileges&#x20;are&#x20;removed&#x20;from&#x20;the&#x20;resulting&#x20;access&#x20;token.&#x20;This&#x20;configures&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;0.&#x20;This&#x20;is&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Windows.&#x20;Disabled:&#x20;Allows&#x20;local&#x20;accounts&#x20;to&#x20;have&#x20;full&#x20;administrative&#x20;rights&#x20;when&#x20;authenticating&#x20;via&#x20;network&#x20;logon,&#x20;by&#x20;configuring&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;1.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;LocalAccountTokenFilterPolicy,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;951016:&#x20;Description&#x20;of&#x20;User&#x20;Account&#x20;Control&#x20;and&#x20;remote&#x20;restrictions&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Ensuring&#x20;this&#x20;policy&#x20;is&#x20;Enabled&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideApply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;Microsoft.','[{\"cis\": [\"18.3.1\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16100,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;driver&#039;','This&#x20;setting&#x20;configures&#x20;the&#x20;start&#x20;type&#x20;for&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;client&#x20;driver&#x20;service&#x20;&#40;&#x20;MRxSmb10&#x20;&#41;,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;disabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;driver.&#x20;Note:&#x20;Do&#x20;not,&#x20;under&#x20;any&#x20;circumstances,&#x20;configure&#x20;this&#x20;overall&#x20;setting&#x20;as&#x20;Disabled&#x20;,&#x20;as&#x20;doing&#x20;so&#x20;will&#x20;delete&#x20;the&#x20;underlying&#x20;registry&#x20;entry&#x20;altogether,&#x20;which&#x20;will&#x20;cause&#x20;serious&#x20;problems.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16101,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;configures&#x20;the&#x20;server-side&#x20;processing&#x20;of&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;protocol.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;server&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16102,'Ensure&#x20;&#039;Enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Windows&#x20;includes&#x20;support&#x20;for&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;We&#x20;recommend&#x20;enabling&#x20;this&#x20;feature&#x20;to&#x20;improve&#x20;the&#x20;security&#x20;profile&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','This&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;block&#x20;exploits&#x20;that&#x20;use&#x20;the&#x20;Structured&#x20;Exception&#x20;Handler&#x20;&#40;SEH&#41;&#x20;overwrite&#x20;technique.&#x20;This&#x20;protection&#x20;mechanism&#x20;is&#x20;provided&#x20;at&#x20;run-time.&#x20;Therefore,&#x20;it&#x20;helps&#x20;protect&#x20;applications&#x20;regardless&#x20;of&#x20;whether&#x20;they&#x20;have&#x20;been&#x20;compiled&#x20;with&#x20;the&#x20;latest&#x20;improvements,&#x20;such&#x20;as&#x20;the&#x20;/SAFESEH&#x20;option.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideEnable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16103,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Windows&#x20;Defender&#x20;protection&#x20;against&#x20;Potentially&#x20;Unwanted&#x20;Applications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Enabling&#x20;this&#x20;Windows&#x20;Defender&#x20;feature&#x20;will&#x20;protect&#x20;against&#x20;Potentially&#x20;Unwanted&#x20;Applications&#x20;&#40;PUA&#41;,&#x20;which&#x20;are&#x20;sneaky&#x20;unwanted&#x20;application&#x20;bundlers&#x20;or&#x20;their&#x20;bundled&#x20;applications&#x20;to&#x20;deliver&#x20;adware&#x20;or&#x20;malware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideTurn&#x20;on&#x20;Windows&#x20;Defender&#x20;protection&#x20;against&#x20;Potentially&#x20;Unwanted&#x20;Applications&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.5\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16104,'Ensure&#x20;&#039;WDigest&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','When&#x20;WDigest&#x20;authentication&#x20;is&#x20;enabled,&#x20;Lsass.exe&#x20;retains&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;user&#039;s&#x20;plaintext&#x20;password&#x20;in&#x20;memory,&#x20;where&#x20;it&#x20;can&#x20;be&#x20;at&#x20;risk&#x20;of&#x20;theft.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured,&#x20;WDigest&#x20;authentication&#x20;is&#x20;disabled&#x20;in&#x20;Windows&#x20;8.1&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;R2;&#x20;it&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;in&#x20;earlier&#x20;versions&#x20;of&#x20;Windows&#x20;and&#x20;Windows&#x20;Server.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&quot;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&quot;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;UseLogonCredential&#x20;,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;2871997:&#x20;Microsoft&#x20;Security&#x20;Advisory&#x20;Update&#x20;to&#x20;improve&#x20;credentials&#x20;protection&#x20;and&#x20;management&#x20;May&#x20;13,&#x20;2014.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideWDigest&#x20;Authentication&#x20;&#40;disabling&#x20;may&#x20;require&#x20;KB2871997&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;Microsoft&#x20;at&#x20;this&#x20;link.','[{\"cis\": [\"18.3.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16105,'Ensure&#x20;&#039;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;is&#x20;separate&#x20;from&#x20;the&#x20;Welcome&#x20;screen&#x20;feature&#x20;in&#x20;Windows&#x20;XP&#x20;and&#x20;Windows&#x20;Vista;&#x20;if&#x20;that&#x20;feature&#x20;is&#x20;disabled,&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;disabled.&#x20;If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;to&#x20;which&#x20;the&#x20;computer&#x20;is&#x20;connected.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext,&#x20;and&#x20;the&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;value&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;that&#x20;the&#x20;computer&#x20;is&#x20;connected&#x20;to.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext.&#x20;The&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;setting&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;As&#x20;a&#x20;result,&#x20;this&#x20;entry&#x20;is&#x20;appropriate&#x20;only&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;physically&#x20;secured&#x20;and&#x20;if&#x20;you&#x20;ensure&#x20;that&#x20;untrusted&#x20;users&#x20;cannot&#x20;remotely&#x20;see&#x20;the&#x20;registry.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16106,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highe','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;follow&#x20;through&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16107,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highest&#x20;pr','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;take&#x20;through&#x20;the&#x20;network.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;Not&#x20;Defined&#x20;for&#x20;enterprise&#x20;environments&#x20;and&#x20;to&#x20;Highest&#x20;Protection&#x20;for&#x20;high&#x20;security&#x20;environments&#x20;to&#x20;completely&#x20;disable&#x20;source&#x20;routing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.3\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16108,'Ensure&#x20;&#039;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Internet&#x20;Control&#x20;Message&#x20;Protocol&#x20;&#40;ICMP&#41;&#x20;redirects&#x20;cause&#x20;the&#x20;IPv4&#x20;stack&#x20;to&#x20;plumb&#x20;host&#x20;routes.&#x20;These&#x20;routes&#x20;override&#x20;the&#x20;Open&#x20;Shortest&#x20;Path&#x20;First&#x20;&#40;OSPF&#41;&#x20;generated&#x20;routes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;behavior&#x20;is&#x20;expected.&#x20;The&#x20;problem&#x20;is&#x20;that&#x20;the&#x20;10&#x20;minute&#x20;time-out&#x20;period&#x20;for&#x20;the&#x20;ICMP&#x20;redirect-plumbed&#x20;routes&#x20;temporarily&#x20;creates&#x20;a&#x20;network&#x20;situation&#x20;in&#x20;which&#x20;traffic&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;routed&#x20;properly&#x20;for&#x20;the&#x20;affected&#x20;host.&#x20;Ignoring&#x20;such&#x20;ICMP&#x20;redirects&#x20;will&#x20;limit&#x20;the&#x20;system&#039;s&#x20;exposure&#x20;to&#x20;attacks&#x20;that&#x20;will&#x20;impact&#x20;its&#x20;ability&#x20;to&#x20;participate&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.4\"]}, {\"cis_csc\": [\"9\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(16109,'Ensure&#x20;&#039;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#039;','This&#x20;value&#x20;controls&#x20;how&#x20;often&#x20;TCP&#x20;attempts&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;idle&#x20;connection&#x20;is&#x20;still&#x20;intact&#x20;by&#x20;sending&#x20;a&#x20;keep-alive&#x20;packet.&#x20;If&#x20;the&#x20;remote&#x20;computer&#x20;is&#x20;still&#x20;reachable,&#x20;it&#x20;acknowledges&#x20;the&#x20;keep-alive&#x20;packet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;.','An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;network&#x20;applications&#x20;could&#x20;establish&#x20;numerous&#x20;connections&#x20;to&#x20;cause&#x20;a&#x20;DoS&#x20;condition.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.5\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16110,'Ensure&#x20;&#039;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enab','NetBIOS&#x20;over&#x20;TCP/IP&#x20;is&#x20;a&#x20;network&#x20;protocol&#x20;that&#x20;among&#x20;other&#x20;things&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;easily&#x20;resolve&#x20;NetBIOS&#x20;names&#x20;that&#x20;are&#x20;registered&#x20;on&#x20;Windows-based&#x20;systems&#x20;to&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;configured&#x20;on&#x20;those&#x20;systems.&#x20;This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;computer&#x20;releases&#x20;its&#x20;NetBIOS&#x20;name&#x20;when&#x20;it&#x20;receives&#x20;a&#x20;name-release&#x20;request.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;NetBT&#x20;protocol&#x20;is&#x20;designed&#x20;not&#x20;to&#x20;use&#x20;authentication,&#x20;and&#x20;is&#x20;therefore&#x20;vulnerable&#x20;to&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;exploit&#x20;the&#x20;unauthenticated&#x20;nature&#x20;of&#x20;the&#x20;protocol&#x20;to&#x20;send&#x20;a&#x20;name-conflict&#x20;datagram&#x20;to&#x20;a&#x20;target&#x20;computer,&#x20;which&#x20;would&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;relinquish&#x20;its&#x20;name&#x20;and&#x20;not&#x20;respond&#x20;to&#x20;queries.&#x20;An&#x20;attacker&#x20;could&#x20;send&#x20;a&#x20;request&#x20;over&#x20;the&#x20;network&#x20;and&#x20;query&#x20;a&#x20;computer&#x20;to&#x20;release&#x20;its&#x20;NetBIOS&#x20;name.&#x20;As&#x20;with&#x20;any&#x20;change&#x20;that&#x20;could&#x20;affect&#x20;applications,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;test&#x20;this&#x20;change&#x20;in&#x20;a&#x20;non-production&#x20;environment&#x20;before&#x20;you&#x20;change&#x20;the&#x20;production&#x20;environment.&#x20;The&#x20;result&#x20;of&#x20;such&#x20;an&#x20;attack&#x20;could&#x20;be&#x20;to&#x20;cause&#x20;intermittent&#x20;connectivity&#x20;issues&#x20;on&#x20;the&#x20;target&#x20;computer,&#x20;or&#x20;even&#x20;to&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;Network&#x20;Neighborhood,&#x20;domain&#x20;logons,&#x20;the&#x20;NET&#x20;SEND&#x20;command,&#x20;or&#x20;additional&#x20;NetBIOS&#x20;name&#x20;resolution.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16111,'Ensure&#x20;&#039;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','This&#x20;setting&#x20;is&#x20;used&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;the&#x20;Internet&#x20;Router&#x20;Discovery&#x20;Protocol&#x20;&#40;IRDP&#41;,&#x20;which&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;default&#x20;gateway&#x20;addresses&#x20;automatically&#x20;as&#x20;described&#x20;in&#x20;RFC&#x20;1256&#x20;on&#x20;a&#x20;per-interface&#x20;basis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;control&#x20;of&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;network&#x20;segment&#x20;could&#x20;configure&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;network&#x20;to&#x20;impersonate&#x20;a&#x20;router.&#x20;Other&#x20;computers&#x20;with&#x20;IRDP&#x20;enabled&#x20;would&#x20;then&#x20;attempt&#x20;to&#x20;route&#x20;their&#x20;traffic&#x20;through&#x20;the&#x20;already&#x20;compromised&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16112,'Ensure&#x20;&#039;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;DLL&#x20;search&#x20;order&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;that&#x20;are&#x20;requested&#x20;by&#x20;running&#x20;processes&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-Search&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;-Search&#x20;current&#x20;working&#x20;folder&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;When&#x20;enabled,&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;1.&#x20;With&#x20;a&#x20;setting&#x20;of&#x20;1,&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;When&#x20;disabled&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0&#x20;and&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;Applications&#x20;will&#x20;be&#x20;forced&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first.&#x20;For&#x20;applications&#x20;that&#x20;require&#x20;unique&#x20;versions&#x20;of&#x20;these&#x20;DLLs&#x20;that&#x20;are&#x20;included&#x20;with&#x20;the&#x20;application,&#x20;this&#x20;entry&#x20;could&#x20;cause&#x20;performance&#x20;or&#x20;stability&#x20;problems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;was&#x20;packaged&#x20;with&#x20;additional&#x20;files&#x20;that&#x20;include&#x20;modified&#x20;versions&#x20;of&#x20;system&#x20;DLLs,&#x20;the&#x20;hostile&#x20;code&#x20;could&#x20;load&#x20;its&#x20;own&#x20;versions&#x20;of&#x20;those&#x20;DLLs&#x20;and&#x20;potentially&#x20;increase&#x20;the&#x20;type&#x20;and&#x20;degree&#x20;of&#x20;damage&#x20;the&#x20;code&#x20;can&#x20;render.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.8\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16113,'Ensure&#x20;&#039;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','Windows&#x20;includes&#x20;a&#x20;grace&#x20;period&#x20;between&#x20;when&#x20;the&#x20;screen&#x20;saver&#x20;is&#x20;launched&#x20;and&#x20;when&#x20;the&#x20;console&#x20;is&#x20;actually&#x20;locked&#x20;automatically&#x20;when&#x20;screen&#x20;saver&#x20;locking&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds.','The&#x20;default&#x20;grace&#x20;period&#x20;that&#x20;is&#x20;allowed&#x20;for&#x20;user&#x20;movement&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;lock&#x20;takes&#x20;effect&#x20;is&#x20;five&#x20;seconds.&#x20;If&#x20;you&#x20;leave&#x20;the&#x20;default&#x20;grace&#x20;period&#x20;configuration,&#x20;your&#x20;computer&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;potential&#x20;attack&#x20;from&#x20;someone&#x20;who&#x20;could&#x20;approach&#x20;the&#x20;console&#x20;and&#x20;attempt&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;before&#x20;the&#x20;lock&#x20;takes&#x20;effect.&#x20;An&#x20;entry&#x20;to&#x20;the&#x20;registry&#x20;can&#x20;be&#x20;made&#x20;to&#x20;adjust&#x20;the&#x20;length&#x20;of&#x20;the&#x20;grace&#x20;period.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.9\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16114,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.10\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16115,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.11\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16116,'Ensure&#x20;&#039;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#039;&#x20;is&#x20;set&#x20;to&#x20;&','This&#x20;setting&#x20;can&#x20;generate&#x20;a&#x20;security&#x20;audit&#x20;in&#x20;the&#x20;Security&#x20;event&#x20;log&#x20;when&#x20;the&#x20;log&#x20;reaches&#x20;a&#x20;user-defined&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;90%&#x20;or&#x20;less.&#x20;Note:&#x20;If&#x20;log&#x20;settings&#x20;are&#x20;configured&#x20;to&#x20;Overwrite&#x20;events&#x20;as&#x20;needed&#x20;or&#x20;Overwrite&#x20;events&#x20;older&#x20;than&#x20;x&#x20;days,&#x20;this&#x20;event&#x20;will&#x20;not&#x20;be&#x20;generated.','If&#x20;the&#x20;Security&#x20;log&#x20;reaches&#x20;90&#x20;percent&#x20;of&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;not&#x20;been&#x20;configured&#x20;to&#x20;overwrite&#x20;events&#x20;as&#x20;needed,&#x20;more&#x20;recent&#x20;events&#x20;will&#x20;not&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.&#x20;If&#x20;the&#x20;log&#x20;reaches&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;shut&#x20;down&#x20;when&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;the&#x20;computer&#x20;will&#x20;shut&#x20;down&#x20;and&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;available&#x20;to&#x20;provide&#x20;network&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;90%&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(16117,'Set&#x20;&#039;NetBIOS&#x20;node&#x20;type&#039;&#x20;to&#x20;&#039;P-node&#039;&#x20;&#40;Ensure&#x20;NetBT&#x20;Parameter&#x20;&#039;NodeType&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0x2&#x20;&#40;2&#41;&#039;&#41;','This&#x20;parameter&#x20;determines&#x20;which&#x20;method&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;NetBT&#41;&#x20;will&#x20;use&#x20;to&#x20;register&#x20;and&#x20;resolve&#x20;names.&#x20;A&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;system&#x20;only&#x20;uses&#x20;broadcasts.&#x20;A&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;system&#x20;uses&#x20;only&#x20;name&#x20;queries&#x20;to&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;.&#x20;An&#x20;M-node&#x20;&#40;mixed&#41;&#x20;system&#x20;broadcasts&#x20;first,&#x20;then&#x20;queries&#x20;the&#x20;name&#x20;server&#x20;&#40;WINS&#41;.&#x20;An&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;system&#x20;queries&#x20;the&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;first,&#x20;then&#x20;broadcasts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;NodeType&#x20;-&#x20;0x2&#x20;&#40;2&#41;&#x20;&#40;P-node&#x20;/&#x20;point-to-point&#41;.','In&#x20;order&#x20;to&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;NetBIOS&#x20;Name&#x20;Service&#x20;&#40;NBT-NS&#41;&#x20;poisoning&#x20;attacks,&#x20;setting&#x20;the&#x20;node&#x20;type&#x20;to&#x20;P-node&#x20;will&#x20;prevent&#x20;the&#x20;system&#x20;from&#x20;sending&#x20;out&#x20;NetBIOS&#x20;broadcasts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0x2&#x20;&#40;2&#41;&#x20;&#40;DWORD&#41;&#x20;:&#x20;HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNetBTParameters:NodeType','[{\"cis\": [\"18.5.4.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16118,'Ensure&#x20;&#039;Turn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','LLMNR&#x20;is&#x20;a&#x20;secondary&#x20;name&#x20;resolution&#x20;protocol.&#x20;With&#x20;LLMNR,&#x20;queries&#x20;are&#x20;sent&#x20;using&#x20;multicast&#x20;over&#x20;a&#x20;local&#x20;network&#x20;link&#x20;on&#x20;a&#x20;single&#x20;subnet&#x20;from&#x20;a&#x20;client&#x20;computer&#x20;to&#x20;another&#x20;client&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;subnet&#x20;that&#x20;also&#x20;has&#x20;LLMNR&#x20;enabled.&#x20;LLMNR&#x20;does&#x20;not&#x20;require&#x20;a&#x20;DNS&#x20;server&#x20;or&#x20;DNS&#x20;client&#x20;configuration,&#x20;and&#x20;provides&#x20;name&#x20;resolution&#x20;in&#x20;scenarios&#x20;in&#x20;which&#x20;conventional&#x20;DNS&#x20;name&#x20;resolution&#x20;is&#x20;not&#x20;possible.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','An&#x20;attacker&#x20;can&#x20;listen&#x20;on&#x20;a&#x20;network&#x20;for&#x20;these&#x20;LLMNR&#x20;&#40;UDP/5355&#41;&#x20;or&#x20;NBT-NS&#x20;&#40;UDP/137&#41;&#x20;broadcasts&#x20;and&#x20;respond&#x20;to&#x20;them,&#x20;tricking&#x20;the&#x20;host&#x20;into&#x20;thinking&#x20;that&#x20;it&#x20;knows&#x20;the&#x20;location&#x20;of&#x20;the&#x20;requested&#x20;system.&#x20;Note:&#x20;To&#x20;completely&#x20;mitigate&#x20;local&#x20;name&#x20;resolution&#x20;poisoning,&#x20;in&#x20;addition&#x20;to&#x20;this&#x20;setting,&#x20;the&#x20;properties&#x20;of&#x20;each&#x20;installed&#x20;NIC&#x20;should&#x20;also&#x20;be&#x20;set&#x20;to&#x20;Disable&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;on&#x20;the&#x20;WINS&#x20;tab&#x20;in&#x20;the&#x20;NIC&#x20;properties&#41;.&#x20;Unfortunately,&#x20;there&#x20;is&#x20;no&#x20;global&#x20;setting&#x20;to&#x20;achieve&#x20;this&#x20;that&#x20;automatically&#x20;applies&#x20;to&#x20;all&#x20;NICs&#x20;-&#x20;it&#x20;is&#x20;a&#x20;per-NIC&#x20;setting&#x20;that&#x20;varies&#x20;with&#x20;different&#x20;NIC&#x20;hardware&#x20;installations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientTurn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#x20;ote:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16119,'Ensure&#x20;&#039;Enable&#x20;Font&#x20;Providers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;is&#x20;allowed&#x20;to&#x20;download&#x20;fonts&#x20;and&#x20;font&#x20;catalog&#x20;data&#x20;from&#x20;an&#x20;online&#x20;font&#x20;provider.The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;configuration,&#x20;to&#x20;ensure&#x20;all&#x20;changes&#x20;are&#x20;tested&#x20;and&#x20;approved.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkFontsEnable&#x20;Font&#x20;Providers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.5.1\"]}, {\"cis_csc\": [\"3\", \"13\"]}, {\"pci_dss\": [\"6.4.5\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\"]}]'),(16120,'Ensure&#x20;&#039;Enable&#x20;insecure&#x20;guest&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;if&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;allow&#x20;insecure&#x20;guest&#x20;logons&#x20;to&#x20;an&#x20;SMB&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Insecure&#x20;guest&#x20;logons&#x20;are&#x20;used&#x20;by&#x20;file&#x20;servers&#x20;to&#x20;allow&#x20;unauthenticated&#x20;access&#x20;to&#x20;shared&#x20;folders.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLanmanWorkstationEnable&#x20;insecure&#x20;guest&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LanmanWorkstation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.8.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16121,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Mapper&#x20;I/O&#x20;network&#x20;protocol&#x20;driver.&#x20;LLTDIO&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;discover&#x20;the&#x20;topology&#x20;of&#x20;a&#x20;network&#x20;it&#039;s&#x20;connected&#x20;to.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;initiate&#x20;Quality-of-Service&#x20;requests&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16122,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Responder&#x20;network&#x20;protocol&#x20;driver.&#x20;The&#x20;Responder&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Link&#x20;Layer&#x20;Topology&#x20;Discovery&#x20;requests&#x20;so&#x20;that&#x20;it&#x20;can&#x20;be&#x20;discovered&#x20;and&#x20;located&#x20;on&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Quality-of-Service&#x20;activities&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16123,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;allows&#x20;for&#x20;distributed&#x20;resolution&#x20;of&#x20;a&#x20;name&#x20;to&#x20;an&#x20;IPv6&#x20;address&#x20;and&#x20;port&#x20;number.&#x20;The&#x20;protocol&#x20;operates&#x20;in&#x20;the&#x20;context&#x20;of&#x20;clouds.&#x20;A&#x20;cloud&#x20;is&#x20;a&#x20;set&#x20;of&#x20;peer&#x20;computers&#x20;that&#x20;can&#x20;communicate&#x20;with&#x20;each&#x20;other&#x20;by&#x20;using&#x20;the&#x20;same&#x20;IPv6&#x20;scope.&#x20;Peer-to-Peer&#x20;protocols&#x20;allow&#x20;for&#x20;applications&#x20;in&#x20;the&#x20;areas&#x20;of&#x20;RTC,&#x20;collaboration,&#x20;content&#x20;distribution&#x20;and&#x20;distributed&#x20;processing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;peer-to-peer&#x20;networking.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkMicrosoft&#x20;Peer-to-Peer&#x20;Networking&#x20;ServicesTurn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;P2P-&#x20;pnrp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.10.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16124,'Ensure&#x20;&#039;Prohibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','You&#x20;can&#x20;use&#x20;this&#x20;procedure&#x20;to&#x20;controls&#x20;user&#039;s&#x20;ability&#x20;to&#x20;install&#x20;and&#x20;configure&#x20;a&#x20;Network&#x20;Bridge.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Network&#x20;Bridge&#x20;setting,&#x20;if&#x20;enabled,&#x20;allows&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Layer&#x20;2&#x20;Media&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;bridge,&#x20;enabling&#x20;them&#x20;to&#x20;connect&#x20;two&#x20;or&#x20;more&#x20;physical&#x20;network&#x20;segments&#x20;together.&#x20;A&#x20;Network&#x20;Bridge&#x20;thus&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;has&#x20;connections&#x20;to&#x20;two&#x20;different&#x20;networks&#x20;to&#x20;share&#x20;data&#x20;between&#x20;those&#x20;networks.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;where&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;control&#x20;network&#x20;traffic&#x20;to&#x20;only&#x20;authorized&#x20;paths,&#x20;allowing&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Network&#x20;Bridge&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface&#x20;from&#x20;the&#x20;bridged&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16125,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16126,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16127,'Ensure&#x20;&#039;Hardened&#x20;UNC&#x20;Paths&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&','This&#x20;policy&#x20;setting&#x20;configures&#x20;secure&#x20;access&#x20;to&#x20;UNC&#x20;paths.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&#x20;and&#x20;SYSVOL&#x20;shares&#x20;.','In&#x20;February&#x20;2015,&#x20;Microsoft&#x20;released&#x20;a&#x20;new&#x20;control&#x20;mechanism&#x20;to&#x20;mitigate&#x20;a&#x20;security&#x20;risk&#x20;in&#x20;Group&#x20;Policy&#x20;as&#x20;part&#x20;of&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update.&#x20;This&#x20;mechanism&#x20;requires&#x20;both&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;new&#x20;security&#x20;update&#x20;and&#x20;also&#x20;the&#x20;deployment&#x20;of&#x20;specific&#x20;group&#x20;policy&#x20;settings&#x20;to&#x20;all&#x20;computers&#x20;on&#x20;the&#x20;domain&#x20;from&#x20;Windows&#x20;Vista&#x20;/&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;&#40;the&#x20;associated&#x20;security&#x20;patch&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;was&#x20;not&#x20;released&#x20;for&#x20;Server&#x20;2003&#41;.&#x20;A&#x20;new&#x20;group&#x20;policy&#x20;template&#x20;&#40;&#x20;NetworkProvider.admx/adml&#x20;&#41;&#x20;was&#x20;also&#x20;provided&#x20;with&#x20;the&#x20;security&#x20;update.&#x20;Once&#x20;the&#x20;new&#x20;GPO&#x20;template&#x20;is&#x20;in&#x20;place,&#x20;the&#x20;following&#x20;are&#x20;the&#x20;minimum&#x20;requirements&#x20;to&#x20;remediate&#x20;the&#x20;Group&#x20;Policy&#x20;security&#x20;risk:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;the&#x20;following&#x20;paths&#x20;configured,&#x20;at&#x20;a&#x20;minimum:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ProviderHardened&#x20;UNC&#x20;Paths&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;NetworkProvider.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.5.14.1\"]}, {\"cis_csc\": [\"3\"]}]'),(16128,'Disable&#x20;IPv6&#x20;&#40;Ensure&#x20;TCPIP6&#x20;Parameter&#x20;&#039;DisabledComponents&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0xff&#x20;&#40;255&#41;&#039;&#41;','Internet&#x20;Protocol&#x20;version&#x20;6&#x20;&#40;IPv6&#41;&#x20;is&#x20;a&#x20;set&#x20;of&#x20;protocols&#x20;that&#x20;computers&#x20;use&#x20;to&#x20;exchange&#x20;information&#x20;over&#x20;the&#x20;Internet&#x20;and&#x20;over&#x20;home&#x20;and&#x20;business&#x20;networks.&#x20;IPv6&#x20;allows&#x20;for&#x20;many&#x20;more&#x20;IP&#x20;addresses&#x20;to&#x20;be&#x20;assigned&#x20;than&#x20;IPv4&#x20;did.&#x20;Older&#x20;networking,&#x20;hosts&#x20;and&#x20;operating&#x20;systems&#x20;may&#x20;not&#x20;support&#x20;IPv6&#x20;natively.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;DisabledComponents&#x20;-&#x20;0xff&#x20;&#40;255&#41;','Since&#x20;the&#x20;vast&#x20;majority&#x20;of&#x20;private&#x20;enterprise&#x20;managed&#x20;networks&#x20;have&#x20;no&#x20;need&#x20;to&#x20;utilize&#x20;IPv6&#x20;&#40;because&#x20;they&#x20;have&#x20;access&#x20;to&#x20;private&#x20;IPv4&#x20;addressing&#41;,&#x20;disabling&#x20;IPv6&#x20;components&#x20;reduces&#x20;a&#x20;possible&#x20;attack&#x20;surface&#x20;that&#x20;is&#x20;also&#x20;harder&#x20;to&#x20;monitor&#x20;the&#x20;traffic&#x20;on.&#x20;As&#x20;a&#x20;result,&#x20;we&#x20;recommend&#x20;configuring&#x20;IPv6&#x20;to&#x20;a&#x20;Disabled&#x20;state&#x20;when&#x20;it&#x20;is&#x20;not&#x20;needed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0xff&#x20;&#40;255&#41;&#x20;&#40;DWORD&#41;:&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTCPIP6Parameters:DisabledComponents.&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;Although&#x20;Microsoft&#x20;does&#x20;not&#x20;provide&#x20;an&#x20;ADMX&#x20;template&#x20;to&#x20;configure&#x20;this&#x20;registry&#x20;value,&#x20;a&#x20;custom&#x20;.ADM&#x20;template&#x20;&#40;Disable-IPv6-Components-KB929852.adm&#41;&#x20;is&#x20;provided&#x20;in&#x20;the&#x20;CIS&#x20;Benchmark&#x20;Remediation&#x20;Kit&#x20;to&#x20;facilitate&#x20;its&#x20;configuration.&#x20;Be&#x20;aware&#x20;though&#x20;that&#x20;simply&#x20;turning&#x20;off&#x20;the&#x20;group&#x20;policy&#x20;setting&#x20;in&#x20;the&#x20;.ADM&#x20;template&#x20;will&#x20;not&#x20;&quot;undo&quot;&#x20;the&#x20;change&#x20;once&#x20;applied.&#x20;Instead,&#x20;the&#x20;opposite&#x20;setting&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;change&#x20;the&#x20;registry&#x20;value&#x20;to&#x20;the&#x20;opposite&#x20;state.','[{\"cis\": [\"18.5.19.2.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16129,'Ensure&#x20;&#039;Configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;the&#x20;configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;.&#x20;The&#x20;WCN&#x20;Registrar&#x20;enables&#x20;the&#x20;discovery&#x20;and&#x20;configuration&#x20;of&#x20;devices&#x20;over&#x20;Ethernet&#x20;&#40;UPnP&#41;&#x20;over&#x20;in-band&#x20;802.11&#x20;Wi-Fi&#x20;through&#x20;the&#x20;Windows&#x20;Portable&#x20;Device&#x20;API&#x20;&#40;WPD&#41;&#x20;and&#x20;via&#x20;USB&#x20;Flash&#x20;drives.&#x20;Additional&#x20;options&#x20;are&#x20;available&#x20;to&#x20;allow&#x20;discovery&#x20;and&#x20;configuration&#x20;over&#x20;a&#x20;specific&#x20;medium.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;user&#x20;configuration&#x20;of&#x20;wireless&#x20;settings.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowConfiguration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.20.1\"]}, {\"cis_csc\": [\"15.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16130,'Ensure&#x20;&#039;Prohibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prohibits&#x20;access&#x20;to&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;standard&#x20;users&#x20;to&#x20;access&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizard&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetworkWindows&#x20;Connect&#x20;NowProhibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.20.2\"]}, {\"cis_csc\": [\"15.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16131,'Ensure&#x20;&#039;Minimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blocking&#x20;simultaneous&#x20;connections&#x20;can&#x20;help&#x20;prevent&#x20;a&#x20;user&#x20;unknowingly&#x20;allowing&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;Internet&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerMinimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.21.1\"]}, {\"cis_csc\": [\"12\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16132,'Ensure&#x20;&#039;Include&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;information&#x20;is&#x20;logged&#x20;in&#x20;security&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;any&#x20;user&#x20;who&#x20;has&#x20;read&#x20;access&#x20;to&#x20;the&#x20;security&#x20;events&#x20;can&#x20;read&#x20;the&#x20;command-line&#x20;arguments&#x20;for&#x20;any&#x20;successfully&#x20;created&#x20;process.&#x20;Command-line&#x20;arguments&#x20;may&#x20;contain&#x20;sensitive&#x20;or&#x20;private&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;or&#x20;user&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemAudit&#x20;Process&#x20;CreationInclude&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AuditSettings.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.3.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16133,'Ensure&#x20;&#039;Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;When&#x20;using&#x20;credential&#x20;delegation,&#x20;devices&#x20;provide&#x20;an&#x20;exportable&#x20;version&#x20;of&#x20;credentials&#x20;to&#x20;the&#x20;remote&#x20;host.&#x20;This&#x20;exposes&#x20;users&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;credential&#x20;theft&#x20;from&#x20;attackers&#x20;on&#x20;the&#x20;remote&#x20;host.&#x20;The&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;and&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;features&#x20;are&#x20;two&#x20;options&#x20;to&#x20;help&#x20;protect&#x20;against&#x20;this&#x20;risk.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Restricted&#x20;Admin&#x20;Mode&#x20;was&#x20;designed&#x20;to&#x20;help&#x20;protect&#x20;administrator&#x20;accounts&#x20;by&#x20;ensuring&#x20;that&#x20;reusable&#x20;credentials&#x20;are&#x20;not&#x20;stored&#x20;in&#x20;memory&#x20;on&#x20;remote&#x20;devices&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;compromised.&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;helps&#x20;you&#x20;protect&#x20;your&#x20;credentials&#x20;over&#x20;a&#x20;Remote&#x20;Desktop&#x20;connection&#x20;by&#x20;redirecting&#x20;Kerberos&#x20;requests&#x20;back&#x20;to&#x20;the&#x20;device&#x20;that&#x20;is&#x20;requesting&#x20;the&#x20;connection.&#x20;Both&#x20;features&#x20;should&#x20;be&#x20;enabled&#x20;and&#x20;supported,&#x20;as&#x20;they&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationRemote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16134,'Ensure&#x20;&#039;Boot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;which&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized&#x20;based&#x20;on&#x20;a&#x20;classification&#x20;determined&#x20;by&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;The&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;can&#x20;return&#x20;the&#x20;following&#x20;classifications&#x20;for&#x20;each&#x20;boot-start&#x20;driver:&#x20;-Good:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;signed&#x20;and&#x20;has&#x20;not&#x20;been&#x20;tampered&#x20;with.&#x20;-Bad:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;allow&#x20;known&#x20;bad&#x20;drivers&#x20;to&#x20;be&#x20;initialized.&#x20;-Bad,&#x20;but&#x20;required&#x20;for&#x20;boot:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware,&#x20;but&#x20;the&#x20;computer&#x20;cannot&#x20;successfully&#x20;boot&#x20;without&#x20;loading&#x20;this&#x20;driver.&#x20;-Unknown:&#x20;This&#x20;driver&#x20;has&#x20;not&#x20;been&#x20;attested&#x20;to&#x20;by&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;and&#x20;has&#x20;not&#x20;been&#x20;classified&#x20;by&#x20;the&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;choose&#x20;which&#x20;boot-start&#x20;drivers&#x20;to&#x20;initialize&#x20;the&#x20;next&#x20;time&#x20;the&#x20;computer&#x20;is&#x20;started.&#x20;If&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;does&#x20;not&#x20;include&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-&#x20;start&#x20;driver&#x20;or&#x20;if&#x20;your&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;has&#x20;been&#x20;disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;and&#x20;all&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical.','This&#x20;policy&#x20;setting&#x20;helps&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;malware&#x20;that&#x20;has&#x20;already&#x20;infected&#x20;your&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemEarly&#x20;Launch&#x20;AntimalwareBoot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EarlyLaunchAM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.14.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"5.1.1\"]}, {\"nist_800_53\": [\"SI.3\"]}, {\"tsc\": [\"CC6.8\"]}]'),(16135,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;FALSE&#039;','The&#x20;&#039;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;option&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;updating&#x20;affected&#x20;policies&#x20;in&#x20;the&#x20;background&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;When&#x20;background&#x20;updates&#x20;are&#x20;disabled,&#x20;policy&#x20;changes&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;FALSE&#x20;&#40;unchecked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;false&#x20;&#40;unchecked&#41;&#x20;will&#x20;ensure&#x20;that&#x20;domain&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#x20;option&#x20;to&#x20;FALSE&#x20;&#40;unchecked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.2\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16136,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;TRUE&#039;','The&#x20;&#039;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;option&#x20;updates&#x20;and&#x20;reapplies&#x20;policies&#x20;even&#x20;if&#x20;the&#x20;policies&#x20;have&#x20;not&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;TRUE&#x20;&#40;checked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;true&#x20;&#40;checked&#41;&#x20;will&#x20;ensure&#x20;unauthorized&#x20;changes&#x20;that&#x20;might&#x20;have&#x20;been&#x20;configured&#x20;locally&#x20;are&#x20;forced&#x20;to&#x20;match&#x20;the&#x20;domain-based&#x20;Group&#x20;Policy&#x20;settings&#x20;again.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#x20;option&#x20;to&#x20;TRUE&#x20;&#40;checked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.3\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"11.5.1\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(16137,'Ensure&#x20;&#039;Continue&#x20;experiences&#x20;on&#x20;this&#x20;device&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Windows&#x20;device&#x20;is&#x20;allowed&#x20;to&#x20;participate&#x20;in&#x20;cross-device&#x20;experiences&#x20;&#40;continue&#x20;experiences&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','A&#x20;cross-device&#x20;experience&#x20;is&#x20;when&#x20;a&#x20;system&#x20;can&#x20;access&#x20;app&#x20;and&#x20;send&#x20;messages&#x20;to&#x20;other&#x20;devices.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;only&#x20;trusted&#x20;systems&#x20;should&#x20;be&#x20;communicating&#x20;within&#x20;the&#x20;network.&#x20;Access&#x20;to&#x20;any&#x20;other&#x20;system&#x20;should&#x20;be&#x20;prohibited.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyContinue&#x20;experiences&#x20;on&#x20;this&#x20;device&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"nist_800_53\": [\"SA.11\", \"AU.14\", \"AC.7\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16138,'Ensure&#x20;&#039;Turn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;Group&#x20;Policy&#x20;from&#x20;being&#x20;updated&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;to&#x20;Group&#x20;Policy&#x20;for&#x20;computers,&#x20;users&#x20;and&#x20;Domain&#x20;Controllers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;group&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyTurn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.21.5\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16139,'Ensure&#x20;&#039;Turn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;computer&#x20;can&#x20;download&#x20;print&#x20;driver&#x20;packages&#x20;over&#x20;HTTP.&#x20;To&#x20;set&#x20;up&#x20;HTTP&#x20;printing,&#x20;printer&#x20;drivers&#x20;that&#x20;are&#x20;not&#x20;available&#x20;in&#x20;the&#x20;standard&#x20;operating&#x20;system&#x20;installation&#x20;might&#x20;need&#x20;to&#x20;be&#x20;downloaded&#x20;over&#x20;HTTP.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;might&#x20;download&#x20;drivers&#x20;that&#x20;include&#x20;malicious&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16140,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;turns&#x20;off&#x20;data&#x20;sharing&#x20;from&#x20;the&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool&#x20;enables&#x20;Tablet&#x20;PC&#x20;users&#x20;to&#x20;adapt&#x20;handwriting&#x20;recognition&#x20;to&#x20;their&#x20;own&#x20;writing&#x20;style&#x20;by&#x20;providing&#x20;writing&#x20;samples.&#x20;The&#x20;tool&#x20;can&#x20;optionally&#x20;share&#x20;user&#x20;writing&#x20;samples&#x20;with&#x20;Microsoft&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;tool&#x20;generates&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ShapeCollector.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16141,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Turns&#x20;off&#x20;the&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool&#x20;enables&#x20;users&#x20;to&#x20;report&#x20;errors&#x20;encountered&#x20;in&#x20;Tablet&#x20;PC&#x20;Input&#x20;Panel.&#x20;The&#x20;tool&#x20;generates&#x20;error&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;Microsoft&#x20;uses&#x20;these&#x20;error&#x20;reports&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InkWatson.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16142,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;can&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;Internet&#x20;Service&#x20;Providers&#x20;&#40;ISPs&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16143,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;will&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;for&#x20;the&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Although&#x20;the&#x20;risk&#x20;is&#x20;minimal,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;downloading&#x20;malicious&#x20;content&#x20;through&#x20;this&#x20;feature.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.5\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16144,'Ensure&#x20;&#039;Turn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;disable&#x20;the&#x20;client&#x20;computer&#039;s&#x20;ability&#x20;to&#x20;print&#x20;over&#x20;HTTP,&#x20;which&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;printers&#x20;on&#x20;the&#x20;intranet&#x20;as&#x20;well&#x20;as&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Information&#x20;that&#x20;is&#x20;transmitted&#x20;over&#x20;HTTP&#x20;through&#x20;this&#x20;capability&#x20;is&#x20;not&#x20;protected&#x20;and&#x20;can&#x20;be&#x20;intercepted&#x20;by&#x20;malicious&#x20;users.&#x20;For&#x20;this&#x20;reason,&#x20;it&#x20;is&#x20;not&#x20;often&#x20;used&#x20;in&#x20;enterprise&#x20;managed&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.6\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16145,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Registration&#x20;Wizard&#x20;connects&#x20;to&#x20;Microsoft.com&#x20;for&#x20;online&#x20;registration.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;should&#x20;not&#x20;be&#x20;registering&#x20;their&#x20;own&#x20;copies&#x20;of&#x20;Windows,&#x20;providing&#x20;their&#x20;own&#x20;PII&#x20;in&#x20;the&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16146,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Search&#x20;Companion&#x20;should&#x20;automatically&#x20;download&#x20;content&#x20;updates&#x20;during&#x20;local&#x20;and&#x20;Internet&#x20;searches.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;users&#x20;will&#x20;unknowingly&#x20;reveal&#x20;sensitive&#x20;information&#x20;because&#x20;of&#x20;the&#x20;topics&#x20;they&#x20;are&#x20;searching&#x20;for.&#x20;This&#x20;risk&#x20;is&#x20;very&#x20;low&#x20;because&#x20;even&#x20;if&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;users&#x20;still&#x20;must&#x20;submit&#x20;search&#x20;queries&#x20;to&#x20;the&#x20;desired&#x20;search&#x20;engine&#x20;in&#x20;order&#x20;to&#x20;perform&#x20;searches.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16147,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;&quot;Order&#x20;Prints&#x20;Online&quot;&#x20;task&#x20;is&#x20;available&#x20;from&#x20;Picture&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Order&#x20;Prints&#x20;Online&#x20;Wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;order&#x20;prints&#x20;online.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.9\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16148,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;tasks&#x20;Publish&#x20;this&#x20;file&#x20;to&#x20;the&#x20;Web,&#x20;Publish&#x20;this&#x20;folder&#x20;to&#x20;the&#x20;Web,&#x20;and&#x20;Publish&#x20;the&#x20;selected&#x20;items&#x20;to&#x20;the&#x20;Web&#x20;are&#x20;available&#x20;from&#x20;File&#x20;and&#x20;Folder&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Web&#x20;Publishing&#x20;wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;publish&#x20;content&#x20;to&#x20;the&#x20;Web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;may&#x20;publish&#x20;confidential&#x20;or&#x20;sensitive&#x20;information&#x20;to&#x20;a&#x20;public&#x20;service&#x20;outside&#x20;of&#x20;the&#x20;control&#x20;of&#x20;the&#x20;organization.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.10\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16149,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.11\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16150,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.12\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16151,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;errors&#x20;are&#x20;reported&#x20;to&#x20;Microsoft.&#x20;Error&#x20;Reporting&#x20;is&#x20;used&#x20;to&#x20;report&#x20;information&#x20;about&#x20;a&#x20;system&#x20;or&#x20;application&#x20;that&#x20;has&#x20;failed&#x20;or&#x20;has&#x20;stopped&#x20;responding&#x20;and&#x20;is&#x20;used&#x20;to&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;the&#x20;product.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16152,'Ensure&#x20;&#039;Support&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Automatic&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;support&#x20;for&#x20;Kerberos&#x20;to&#x20;attempt&#x20;authentication&#x20;using&#x20;the&#x20;certificate&#x20;for&#x20;the&#x20;device&#x20;to&#x20;the&#x20;domain.&#x20;Support&#x20;for&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;will&#x20;require&#x20;connectivity&#x20;to&#x20;a&#x20;DC&#x20;in&#x20;the&#x20;device&#x20;account&#x20;domain&#x20;which&#x20;supports&#x20;certificate&#x20;authentication&#x20;for&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Automatic&#x20;.','Having&#x20;stronger&#x20;device&#x20;authentication&#x20;with&#x20;the&#x20;use&#x20;of&#x20;certificates&#x20;is&#x20;strongly&#x20;encouraged&#x20;over&#x20;standard&#x20;username&#x20;and&#x20;password&#x20;authentication.&#x20;Having&#x20;this&#x20;set&#x20;to&#x20;Automatic&#x20;will&#x20;allow&#x20;certificate&#x20;based&#x20;authentication&#x20;to&#x20;be&#x20;used&#x20;whenever&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Automatic&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKerberosSupport&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Kerberos.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.25.1\"]}, {\"cis_csc\": [\"1.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16153,'Ensure&#x20;&#039;Disallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;prevents&#x20;automatic&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;use&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;user&#x20;is&#x20;restricted&#x20;to&#x20;the&#x20;set&#x20;of&#x20;input&#x20;methods&#x20;that&#x20;are&#x20;enabled&#x20;in&#x20;the&#x20;system&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;way&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLocale&#x20;ServicesDisallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16154,'Ensure&#x20;&#039;Block&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;&#40;email&#x20;address&#x20;or&#x20;user&#x20;name&#41;&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonBlock&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16155,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;anyone&#x20;can&#x20;interact&#x20;with&#x20;available&#x20;networks&#x20;UI&#x20;on&#x20;the&#x20;logon&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;disconnect&#x20;the&#x20;PC&#x20;from&#x20;the&#x20;network&#x20;or&#x20;can&#x20;connect&#x20;the&#x20;PC&#x20;to&#x20;other&#x20;available&#x20;networks&#x20;without&#x20;signing&#x20;into&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.2\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16156,'Ensure&#x20;&#039;Do&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;connected&#x20;users&#x20;from&#x20;being&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16157,'Ensure&#x20;&#039;Enumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;local&#x20;users&#x20;to&#x20;be&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonEnumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16158,'Ensure&#x20;&#039;Turn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;app&#x20;notifications&#x20;from&#x20;appearing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','App&#x20;notifications&#x20;might&#x20;display&#x20;sensitive&#x20;business&#x20;or&#x20;personal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.5\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16159,'Ensure&#x20;&#039;Turn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;picture&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;picture&#x20;password&#x20;feature&#x20;is&#x20;permitted,&#x20;the&#x20;user&#039;s&#x20;domain&#x20;password&#x20;is&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;it.','Picture&#x20;passwords&#x20;bypass&#x20;the&#x20;requirement&#x20;for&#x20;a&#x20;typed&#x20;complex&#x20;password.&#x20;In&#x20;a&#x20;shared&#x20;work&#x20;environment,&#x20;a&#x20;simple&#x20;shoulder&#x20;surf&#x20;where&#x20;someone&#x20;observed&#x20;the&#x20;on-screen&#x20;gestures&#x20;would&#x20;allow&#x20;that&#x20;person&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;the&#x20;need&#x20;to&#x20;know&#x20;the&#x20;complex&#x20;password.&#x20;Vertical&#x20;monitor&#x20;screens&#x20;with&#x20;an&#x20;image&#x20;are&#x20;much&#x20;more&#x20;visible&#x20;at&#x20;a&#x20;distance&#x20;than&#x20;horizontal&#x20;key&#x20;strokes,&#x20;increasing&#x20;the&#x20;likelihood&#x20;of&#x20;a&#x20;successful&#x20;observation&#x20;of&#x20;the&#x20;mouse&#x20;gestures.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.6\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16160,'Ensure&#x20;&#039;Turn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;convenience&#x20;PIN.&#x20;In&#x20;Windows&#x20;10,&#x20;convenience&#x20;PIN&#x20;was&#x20;replaced&#x20;with&#x20;Passport,&#x20;which&#x20;has&#x20;stronger&#x20;security&#x20;properties.&#x20;To&#x20;configure&#x20;Passport&#x20;for&#x20;domain&#x20;users,&#x20;use&#x20;the&#x20;policies&#x20;under&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Passport&#x20;for&#x20;Work.&#x20;Note:&#x20;The&#x20;user&#039;s&#x20;domain&#x20;password&#x20;will&#x20;be&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;this&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;PIN&#x20;is&#x20;created&#x20;from&#x20;a&#x20;much&#x20;smaller&#x20;selection&#x20;of&#x20;characters&#x20;than&#x20;a&#x20;password,&#x20;so&#x20;in&#x20;most&#x20;cases&#x20;a&#x20;PIN&#x20;will&#x20;be&#x20;much&#x20;less&#x20;robust&#x20;than&#x20;a&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;on&#x20;PIN&#x20;sign-in,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.27.7\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16161,'Ensure&#x20;&#039;Untrusted&#x20;Font&#x20;Blocking&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#x20;untrusted&#x20;fonts&#x20;and&#x20;log&#x20;events&#039;','This&#x20;security&#x20;feature&#x20;provides&#x20;a&#x20;global&#x20;setting&#x20;to&#x20;prevent&#x20;programs&#x20;from&#x20;loading&#x20;untrusted&#x20;fonts.&#x20;Untrusted&#x20;fonts&#x20;are&#x20;any&#x20;font&#x20;installed&#x20;outside&#x20;of&#x20;the&#x20;%windir%Fonts&#x20;directory.&#x20;This&#x20;feature&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;in&#x20;3&#x20;modes:&#x20;On,&#x20;Off,&#x20;and&#x20;Audit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;:&#x20;Block&#x20;untrusted&#x20;fonts&#x20;and&#x20;log&#x20;events','Blocking&#x20;untrusted&#x20;fonts&#x20;helps&#x20;prevent&#x20;both&#x20;remote&#x20;&#40;web-based&#x20;or&#x20;email-based&#41;&#x20;and&#x20;local&#x20;EOP&#x20;attacks&#x20;that&#x20;can&#x20;happen&#x20;during&#x20;the&#x20;font&#x20;file-parsing&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;untrusted&#x20;fonts&#x20;and&#x20;log&#x20;events&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemMitigationOptionsUntrusted&#x20;Font&#x20;Blocking&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.1\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16162,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;on&#x20;battery&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16163,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;plugged&#x20;in&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16164,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.3\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16165,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.4\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16166,'Ensure&#x20;&#039;Configure&#x20;Offer&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Offer&#x20;&#40;Unsolicited&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;Help&#x20;desk&#x20;and&#x20;support&#x20;personnel&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;proactively&#x20;offer&#x20;assistance,&#x20;although&#x20;they&#x20;can&#x20;still&#x20;respond&#x20;to&#x20;user&#x20;assistance&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;user&#x20;might&#x20;be&#x20;tricked&#x20;and&#x20;accept&#x20;an&#x20;unsolicited&#x20;Remote&#x20;Assistance&#x20;offer&#x20;from&#x20;a&#x20;malicious&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Offer&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.35.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16167,'Ensure&#x20;&#039;Configure&#x20;Solicited&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Solicited&#x20;&#40;Ask&#x20;for&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','There&#x20;is&#x20;slight&#x20;risk&#x20;that&#x20;a&#x20;rogue&#x20;administrator&#x20;will&#x20;gain&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;desktop&#x20;session,&#x20;however,&#x20;they&#x20;cannot&#x20;connect&#x20;to&#x20;a&#x20;user&#039;s&#x20;computer&#x20;unannounced&#x20;or&#x20;control&#x20;it&#x20;without&#x20;permission&#x20;from&#x20;the&#x20;user.&#x20;When&#x20;an&#x20;expert&#x20;tries&#x20;to&#x20;connect,&#x20;the&#x20;user&#x20;can&#x20;still&#x20;choose&#x20;to&#x20;deny&#x20;the&#x20;connection&#x20;or&#x20;give&#x20;the&#x20;expert&#x20;view-only&#x20;privileges.&#x20;The&#x20;user&#x20;must&#x20;explicitly&#x20;click&#x20;the&#x20;Yes&#x20;button&#x20;to&#x20;allow&#x20;the&#x20;expert&#x20;to&#x20;remotely&#x20;control&#x20;the&#x20;workstation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Solicited&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.35.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16168,'Ensure&#x20;&#039;Enable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;RPC&#x20;clients&#x20;authenticate&#x20;with&#x20;the&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;when&#x20;the&#x20;call&#x20;they&#x20;are&#x20;making&#x20;contains&#x20;authentication&#x20;information.&#x20;The&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;on&#x20;computers&#x20;running&#x20;Windows&#x20;NT4&#x20;&#40;all&#x20;service&#x20;packs&#41;&#x20;cannot&#x20;process&#x20;authentication&#x20;information&#x20;supplied&#x20;in&#x20;this&#x20;manner.&#x20;This&#x20;policy&#x20;setting&#x20;can&#x20;cause&#x20;a&#x20;specific&#x20;issue&#x20;with&#x20;1-way&#x20;forest&#x20;trusts&#x20;if&#x20;it&#x20;is&#x20;applied&#x20;to&#x20;the&#x20;trusting&#x20;domain&#x20;DCs&#x20;&#40;see&#x20;Microsoft&#x20;KB3073942&#41;,&#x20;so&#x20;we&#x20;do&#x20;not&#x20;recommend&#x20;applying&#x20;it&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;This&#x20;policy&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Anonymous&#x20;access&#x20;to&#x20;RPC&#x20;services&#x20;could&#x20;result&#x20;in&#x20;accidental&#x20;disclosure&#x20;of&#x20;information&#x20;to&#x20;unauthenticated&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallEnable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16169,'Ensure&#x20;&#039;Restrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Authenticated&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;how&#x20;the&#x20;RPC&#x20;server&#x20;runtime&#x20;handles&#x20;unauthenticated&#x20;RPC&#x20;clients&#x20;connecting&#x20;to&#x20;RPC&#x20;servers.','Unauthenticated&#x20;RPC&#x20;communication&#x20;can&#x20;create&#x20;a&#x20;security&#x20;vulnerability.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Authenticated:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallRestrict&#x20;Unauthenticated&#x20;RPC&#x20;clients.','[{\"cis\": [\"18.8.36.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16170,'Ensure&#x20;&#039;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool&#x20;&#40;MSDT&#41;&#x20;interactive&#x20;communication&#x20;with&#x20;the&#x20;support&#x20;provider.&#x20;MSDT&#x20;gathers&#x20;diagnostic&#x20;data&#x20;for&#x20;analysis&#x20;by&#x20;support&#x20;professionals.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsMicrosoft&#x20;Support&#x20;Diagnostic&#x20;ToolMicrosoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSDT.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.44.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16171,'Ensure&#x20;&#039;Enable/Disable&#x20;PerfTrack&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;tracking&#x20;of&#x20;responsiveness&#x20;events.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;enabled&#x20;the&#x20;aggregated&#x20;data&#x20;of&#x20;a&#x20;given&#x20;event&#x20;will&#x20;be&#x20;transmitted&#x20;to&#x20;Microsoft.&#x20;The&#x20;option&#x20;exists&#x20;to&#x20;restrict&#x20;this&#x20;feature&#x20;for&#x20;a&#x20;specific&#x20;user,&#x20;set&#x20;the&#x20;consent&#x20;level,&#x20;and&#x20;designate&#x20;specific&#x20;programs&#x20;for&#x20;which&#x20;error&#x20;reports&#x20;could&#x20;be&#x20;sent.&#x20;However,&#x20;centrally&#x20;restricting&#x20;the&#x20;ability&#x20;to&#x20;execute&#x20;PerfTrack&#x20;to&#x20;limit&#x20;the&#x20;potential&#x20;for&#x20;unauthorized&#x20;or&#x20;undesired&#x20;usage,&#x20;data&#x20;leakage,&#x20;or&#x20;unintentional&#x20;communications&#x20;is&#x20;highly&#x20;recommended.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsWindows&#x20;Performance&#x20;PerfTrackEnable/Disable&#x20;PerfTrack.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PerformancePerftrack.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.44.11.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16172,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;advertising&#x20;ID,&#x20;preventing&#x20;apps&#x20;from&#x20;using&#x20;the&#x20;ID&#x20;for&#x20;experiences&#x20;across&#x20;apps.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Tracking&#x20;user&#x20;activity&#x20;for&#x20;advertising&#x20;purposes,&#x20;even&#x20;anonymously,&#x20;may&#x20;be&#x20;a&#x20;privacy&#x20;concern.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;applications&#x20;should&#x20;not&#x20;need&#x20;or&#x20;require&#x20;tracking&#x20;for&#x20;targeted&#x20;advertising.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemUser&#x20;ProfilesTurn&#x20;off&#x20;the&#x20;advertising&#x20;ID.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;UserProfiles.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.46.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16173,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Client&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;is&#x20;enabled.&#x20;Enabling&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;allows&#x20;your&#x20;computer&#x20;to&#x20;synchronize&#x20;its&#x20;computer&#x20;clock&#x20;with&#x20;other&#x20;NTP&#x20;servers.&#x20;You&#x20;might&#x20;want&#x20;to&#x20;disable&#x20;this&#x20;service&#x20;if&#x20;you&#x20;decide&#x20;to&#x20;use&#x20;a&#x20;third-party&#x20;time&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;reliable&#x20;and&#x20;accurate&#x20;account&#x20;of&#x20;time&#x20;is&#x20;important&#x20;for&#x20;a&#x20;number&#x20;of&#x20;services&#x20;and&#x20;security&#x20;requirements,&#x20;including&#x20;but&#x20;not&#x20;limited&#x20;to&#x20;distributed&#x20;applications,&#x20;authentication&#x20;services,&#x20;multi-user&#x20;databases&#x20;and&#x20;logging&#x20;services.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;NTP&#x20;client&#x20;&#40;with&#x20;secure&#x20;operation&#41;&#x20;establishes&#x20;functional&#x20;accuracy&#x20;and&#x20;is&#x20;a&#x20;focal&#x20;point&#x20;when&#x20;reviewing&#x20;security&#x20;relevant&#x20;events.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Client.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.49.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(16174,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;is&#x20;enabled.','The&#x20;configuration&#x20;of&#x20;proper&#x20;time&#x20;synchronization&#x20;is&#x20;critically&#x20;important&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;both&#x20;due&#x20;to&#x20;the&#x20;sensitivity&#x20;of&#x20;Kerberos&#x20;authentication&#x20;timestamps&#x20;and&#x20;also&#x20;to&#x20;ensure&#x20;accurate&#x20;security&#x20;logging.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Server.','[{\"cis\": [\"18.8.49.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(16175,'Ensure&#x20;&#039;Allow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Manages&#x20;a&#x20;Windows&#x20;app&#039;s&#x20;ability&#x20;to&#x20;share&#x20;data&#x20;between&#x20;users&#x20;who&#x20;have&#x20;installed&#x20;the&#x20;app.&#x20;Data&#x20;is&#x20;shared&#x20;through&#x20;the&#x20;SharedLocal&#x20;folder.&#x20;This&#x20;folder&#x20;is&#x20;available&#x20;through&#x20;the&#x20;Windows.Storage&#x20;API.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Users&#x20;of&#x20;a&#x20;system&#x20;could&#x20;accidentally&#x20;share&#x20;sensitive&#x20;data&#x20;with&#x20;other&#x20;users&#x20;on&#x20;the&#x20;same&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentAllow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16176,'Ensure&#x20;&#039;Allow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;control&#x20;whether&#x20;Microsoft&#x20;accounts&#x20;are&#x20;optional&#x20;for&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;require&#x20;an&#x20;account&#x20;to&#x20;sign&#x20;in.&#x20;This&#x20;policy&#x20;only&#x20;affects&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;use&#x20;their&#x20;enterprise&#x20;user&#x20;accounts&#x20;instead&#x20;of&#x20;using&#x20;their&#x20;Microsoft&#x20;accounts&#x20;when&#x20;accessing&#x20;Windows&#x20;store&#x20;apps.&#x20;This&#x20;provides&#x20;the&#x20;organization&#x20;with&#x20;greater&#x20;control&#x20;over&#x20;relevant&#x20;credentials.&#x20;Microsoft&#x20;accounts&#x20;cannot&#x20;be&#x20;centrally&#x20;managed&#x20;and&#x20;as&#x20;such&#x20;enterprise&#x20;credential&#x20;security&#x20;policies&#x20;cannot&#x20;be&#x20;applied&#x20;to&#x20;them,&#x20;which&#x20;could&#x20;put&#x20;any&#x20;information&#x20;accessed&#x20;by&#x20;using&#x20;Microsoft&#x20;accounts&#x20;at&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeAllow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.6.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16177,'Ensure&#x20;&#039;Disallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;disallows&#x20;AutoPlay&#x20;for&#x20;MTP&#x20;devices&#x20;like&#x20;cameras&#x20;or&#x20;phones.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesDisallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16178,'Ensure&#x20;&#039;Set&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands&#039;','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Autorun&#x20;commands.&#x20;Autorun&#x20;commands&#x20;are&#x20;generally&#x20;stored&#x20;in&#x20;autorun.inf&#x20;files.&#x20;They&#x20;often&#x20;launch&#x20;the&#x20;installation&#x20;program&#x20;or&#x20;other&#x20;routines.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands.','Prior&#x20;to&#x20;Windows&#x20;Vista,&#x20;when&#x20;media&#x20;containing&#x20;an&#x20;autorun&#x20;command&#x20;is&#x20;inserted,&#x20;the&#x20;system&#x20;will&#x20;automatically&#x20;execute&#x20;the&#x20;program&#x20;without&#x20;user&#x20;intervention.&#x20;This&#x20;creates&#x20;a&#x20;major&#x20;security&#x20;concern&#x20;as&#x20;code&#x20;may&#x20;be&#x20;executed&#x20;without&#x20;user&#039;s&#x20;knowledge.&#x20;The&#x20;default&#x20;behavior&#x20;starting&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;to&#x20;prompt&#x20;the&#x20;user&#x20;whether&#x20;autorun&#x20;command&#x20;is&#x20;to&#x20;be&#x20;run.&#x20;The&#x20;autorun&#x20;command&#x20;is&#x20;represented&#x20;as&#x20;a&#x20;handler&#x20;in&#x20;the&#x20;Autoplay&#x20;dialog.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesSet&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16179,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Autoplay&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;All&#x20;drives&#039;','Autoplay&#x20;starts&#x20;to&#x20;read&#x20;from&#x20;a&#x20;drive&#x20;as&#x20;soon&#x20;as&#x20;you&#x20;insert&#x20;media&#x20;in&#x20;the&#x20;drive,&#x20;which&#x20;causes&#x20;the&#x20;setup&#x20;file&#x20;for&#x20;programs&#x20;or&#x20;audio&#x20;media&#x20;to&#x20;start&#x20;immediately.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;the&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.&#x20;Autoplay&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;on&#x20;some&#x20;removable&#x20;drive&#x20;types,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives,&#x20;but&#x20;not&#x20;on&#x20;CD-ROM&#x20;drives.&#x20;Note:&#x20;You&#x20;cannot&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enable&#x20;Autoplay&#x20;on&#x20;computer&#x20;drives&#x20;in&#x20;which&#x20;it&#x20;is&#x20;disabled&#x20;by&#x20;default,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;All&#x20;drives.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;All&#x20;drives:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesTurn&#x20;off&#x20;Autoplay&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.8.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16180,'Ensure&#x20;&#039;Configure&#x20;enhanced&#x20;anti-spoofing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;enhanced&#x20;anti-spoofing&#x20;is&#x20;configured&#x20;for&#x20;devices&#x20;which&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Enterprise&#x20;managed&#x20;environments&#x20;are&#x20;now&#x20;supporting&#x20;a&#x20;wider&#x20;range&#x20;of&#x20;mobile&#x20;devices,&#x20;increasing&#x20;the&#x20;security&#x20;on&#x20;these&#x20;devices&#x20;will&#x20;help&#x20;protect&#x20;against&#x20;unauthorized&#x20;access&#x20;on&#x20;your&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsBiometricsFacial&#x20;FeaturesConfigure&#x20;enhanced&#x20;anti-spoofing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Biometrics.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;and&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Use&#x20;enhanced&#x20;anti-spoofing&#x20;when&#x20;available.&#x20;It&#x20;was&#x20;renamed&#x20;to&#x20;Configure&#x20;enhanced&#x20;anti-spoofing&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.10.1.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16181,'Ensure&#x20;&#039;Allow&#x20;Use&#x20;of&#x20;Camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;use&#x20;of&#x20;Camera&#x20;devices&#x20;on&#x20;the&#x20;machine&#x20;are&#x20;permitted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Cameras&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment&#x20;can&#x20;pose&#x20;serious&#x20;privacy&#x20;and&#x20;data&#x20;exfiltration&#x20;risks&#x20;-&#x20;they&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;help&#x20;mitigate&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCameraAllow&#x20;Use&#x20;of&#x20;Camera&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Camera.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.12.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16182,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;experiences&#x20;that&#x20;help&#x20;consumers&#x20;make&#x20;the&#x20;most&#x20;of&#x20;their&#x20;devices&#x20;and&#x20;Microsoft&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet,&#x20;this&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.','Having&#x20;apps&#x20;silently&#x20;install&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;-&#x20;especially&#x20;if&#x20;the&#x20;apps&#x20;send&#x20;data&#x20;back&#x20;to&#x20;a&#x20;3rd&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.13.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16183,'Ensure&#x20;&#039;Require&#x20;pin&#x20;for&#x20;pairing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;PIN&#x20;is&#x20;required&#x20;for&#x20;pairing&#x20;to&#x20;a&#x20;wireless&#x20;display&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured&#x20;or&#x20;disabled&#x20;then&#x20;a&#x20;PIN&#x20;would&#x20;not&#x20;be&#x20;required&#x20;when&#x20;pairing&#x20;wireless&#x20;display&#x20;devices&#x20;to&#x20;the&#x20;system,&#x20;increasing&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsConnectRequire&#x20;pin&#x20;for&#x20;pairing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WirelessDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.1\"]}, {\"cis_csc\": [\"15.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16184,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;display&#x20;of&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;in&#x20;password&#x20;entry&#x20;user&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;useful&#x20;feature&#x20;when&#x20;entering&#x20;a&#x20;long&#x20;and&#x20;complex&#x20;password,&#x20;especially&#x20;when&#x20;using&#x20;a&#x20;touchscreen.&#x20;The&#x20;potential&#x20;risk&#x20;is&#x20;that&#x20;someone&#x20;else&#x20;may&#x20;see&#x20;your&#x20;password&#x20;while&#x20;surreptitiously&#x20;observing&#x20;your&#x20;screen.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceDo&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.15.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16185,'Ensure&#x20;&#039;Enumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;administrator&#x20;accounts&#x20;are&#x20;displayed&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;elevate&#x20;a&#x20;running&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;could&#x20;see&#x20;the&#x20;list&#x20;of&#x20;administrator&#x20;accounts,&#x20;making&#x20;it&#x20;slightly&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;user&#x20;who&#x20;has&#x20;logged&#x20;onto&#x20;a&#x20;console&#x20;session&#x20;to&#x20;try&#x20;to&#x20;crack&#x20;the&#x20;passwords&#x20;of&#x20;those&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceEnumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.15.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16186,'Ensure&#x20;&#039;Allow&#x20;Telemetry&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#039;&#x20;or&#x20;&#039;Enabled:&#x20;1&#x20;-&#x20;Basic&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;reported&#x20;to&#x20;Microsoft:A&#x20;value&#x20;of&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;will&#x20;send&#x20;minimal&#x20;data&#x20;to&#x20;Microsoft.&#x20;This&#x20;data&#x20;includes&#x20;Malicious&#x20;Software&#x20;Removal&#x20;Tool&#x20;&#40;MSRT&#41;&#x20;&amp;&#x20;Windows&#x20;Defender&#x20;data,&#x20;if&#x20;enabled,&#x20;and&#x20;telemetry&#x20;client&#x20;settings.&#x20;Setting&#x20;a&#x20;value&#x20;of&#x20;0&#x20;applies&#x20;to&#x20;enterprise,&#x20;EDU,&#x20;IoT&#x20;and&#x20;server&#x20;devices&#x20;only.&#x20;Setting&#x20;a&#x20;value&#x20;of&#x20;0&#x20;for&#x20;other&#x20;devices&#x20;is&#x20;equivalent&#x20;to&#x20;choosing&#x20;a&#x20;value&#x20;of&#x20;1.&#x20;A&#x20;value&#x20;of&#x20;1&#x20;-&#x20;Basic&#x20;sends&#x20;only&#x20;a&#x20;basic&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data.&#x20;Note&#x20;that&#x20;setting&#x20;values&#x20;of&#x20;0&#x20;or&#x20;1&#x20;will&#x20;degrade&#x20;certain&#x20;experiences&#x20;on&#x20;the&#x20;device.&#x20;A&#x20;value&#x20;of&#x20;2&#x20;-&#x20;Enhanced&#x20;sends&#x20;enhanced&#x20;diagnostic&#x20;and&#x20;usage&#x20;data.&#x20;A&#x20;value&#x20;of&#x20;3&#x20;-&#x20;Full&#x20;sends&#x20;the&#x20;same&#x20;data&#x20;as&#x20;a&#x20;value&#x20;of&#x20;2,&#x20;plus&#x20;additional&#x20;diagnostics&#x20;data,&#x20;including&#x20;the&#x20;files&#x20;and&#x20;content&#x20;that&#x20;may&#x20;have&#x20;caused&#x20;the&#x20;problem.&#x20;Windows&#x20;10&#x20;telemetry&#x20;settings&#x20;apply&#x20;to&#x20;the&#x20;Windows&#x20;operating&#x20;system&#x20;and&#x20;some&#x20;first&#x20;party&#x20;apps.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;third&#x20;party&#x20;apps&#x20;running&#x20;on&#x20;Windows&#x20;10.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;or&#x20;Enabled:&#x20;1&#x20;-&#x20;Basic&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;Allow&#x20;Telemetry&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;,&#x20;then&#x20;the&#x20;options&#x20;in&#x20;Windows&#x20;Update&#x20;to&#x20;defer&#x20;upgrades&#x20;and&#x20;updates&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates,&#x20;the&#x20;zero&#x20;value&#x20;was&#x20;named&#x20;0&#x20;-&#x20;Off&#x20;[Enterprise&#x20;Only]&#x20;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;or&#x20;Enabled:&#x20;1&#x20;-&#x20;Basic&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsAllow&#x20;Telemetry&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16187,'Ensure&#x20;&#039;Configure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Pr','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;can&#x20;automatically&#x20;use&#x20;an&#x20;authenticated&#x20;proxy&#x20;to&#x20;send&#x20;data&#x20;back&#x20;to&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsConfigure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16188,'Ensure&#x20;&#039;Disable&#x20;pre-release&#x20;features&#x20;or&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;that&#x20;Microsoft&#x20;can&#x20;experiment&#x20;with&#x20;the&#x20;product&#x20;to&#x20;study&#x20;user&#x20;preferences&#x20;or&#x20;device&#x20;behavior.&#x20;A&#x20;value&#x20;of&#x20;1&#x20;permits&#x20;Microsoft&#x20;to&#x20;configure&#x20;device&#x20;settings&#x20;only.&#x20;A&#x20;value&#x20;of&#x20;2&#x20;allows&#x20;Microsoft&#x20;to&#x20;conduct&#x20;full&#x20;experimentations.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.&#x20;Note:&#x20;Although&#x20;the&#x20;setting&#x20;of&#x20;Disabled&#x20;seems&#x20;counter-intuitive&#x20;&#40;disabling&#x20;a&#x20;Disable&#x20;setting&#x20;is&#x20;a&#x20;double&#x20;negative,&#x20;which&#x20;should&#x20;mean&#x20;Enable&#41;,&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded&#x20;in&#x20;the&#x20;Microsoft&#x20;templates.&#x20;Configuring&#x20;Disabled&#x20;does&#x20;indeed&#x20;achieve&#x20;the&#x20;desired&#x20;result&#x20;of&#x20;disabling&#x20;the&#x20;pre-release&#x20;features&#x20;and&#x20;settings.','It&#x20;can&#x20;be&#x20;dangerous&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;if&#x20;experimental&#x20;features&#x20;are&#x20;allowed&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDisable&#x20;pre-release&#x20;features&#x20;or&#x20;settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.3\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16189,'Ensure&#x20;&#039;Do&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;prevent&#x20;its&#x20;devices&#x20;from&#x20;showing&#x20;feedback&#x20;questions&#x20;from&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Users&#x20;should&#x20;not&#x20;be&#x20;sending&#x20;any&#x20;feedback&#x20;to&#x20;3rd&#x20;party&#x20;vendors&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDo&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;FeedbackNotifications.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16190,'Ensure&#x20;&#039;Toggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Insider&#x20;build&#x20;controls&#x20;in&#x20;the&#x20;Advanced&#x20;Options&#x20;for&#x20;Windows&#x20;Update.&#x20;These&#x20;controls&#x20;are&#x20;located&#x20;under&#x20;&quot;Get&#x20;Insider&#x20;builds,&quot;&#x20;and&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;Windows&#x20;preview&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;only&#x20;to&#x20;devices&#x20;running&#x20;Windows&#x20;Server&#x20;2016,&#x20;up&#x20;until&#x20;Release&#x20;1703.&#x20;For&#x20;Release&#x20;1709&#x20;or&#x20;newer,&#x20;Microsoft&#x20;encourages&#x20;using&#x20;the&#x20;Manage&#x20;preview&#x20;builds&#x20;setting&#x20;&#40;Rule&#x20;18.9.101.1.1&#41;.&#x20;We&#x20;have&#x20;kept&#x20;this&#x20;setting&#x20;in&#x20;the&#x20;benchmark&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;older&#x20;builds&#x20;of&#x20;Windows&#x20;Server&#x20;2016&#x20;in&#x20;the&#x20;environment&#x20;are&#x20;still&#x20;enforced.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsToggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AllowBuildPreview.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.5\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16191,'Ensure&#x20;&#039;Application:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16192,'Ensure&#x20;&#039;Application:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16193,'Ensure&#x20;&#039;Security:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecurityControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.2.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16194,'Ensure&#x20;&#039;Security:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;196,608&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecuritySpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.2.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16195,'Ensure&#x20;&#039;Setup:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.3.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16196,'Ensure&#x20;&#039;Setup:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.3.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16197,'Ensure&#x20;&#039;System:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.4.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16198,'Ensure&#x20;&#039;System:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.4.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16199,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Disabling&#x20;Data&#x20;Execution&#x20;Prevention&#x20;can&#x20;allow&#x20;certain&#x20;legacy&#x20;plug-in&#x20;applications&#x20;to&#x20;function&#x20;without&#x20;terminating&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Data&#x20;Execution&#x20;Prevention&#x20;is&#x20;an&#x20;important&#x20;security&#x20;feature&#x20;supported&#x20;by&#x20;Explorer&#x20;that&#x20;helps&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;of&#x20;certain&#x20;types&#x20;of&#x20;malware.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.30.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16200,'Ensure&#x20;&#039;Turn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.30.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16201,'Ensure&#x20;&#039;Turn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.30.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16202,'Ensure&#x20;&#039;Turn&#x20;off&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;location&#x20;feature&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&#039;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsTurn&#x20;off&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sensors.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.39.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16203,'Ensure&#x20;&#039;Allow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;backup&#x20;and&#x20;restore&#x20;of&#x20;cellular&#x20;text&#x20;messages&#x20;to&#x20;Microsoft&#039;s&#x20;cloud&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMessagingAllow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Messaging.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.43.1\"]}, {\"cis_csc\": [\"9.1\", \"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16204,'Ensure&#x20;&#039;Block&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;determines&#x20;whether&#x20;applications&#x20;and&#x20;services&#x20;on&#x20;the&#x20;device&#x20;can&#x20;utilize&#x20;new&#x20;consumer&#x20;Microsoft&#x20;account&#x20;authentication&#x20;via&#x20;the&#x20;Windows&#x20;OnlineID&#x20;and&#x20;WebAccountManager&#x20;APIs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;on&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;accountsBlock&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSAPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.44.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16205,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;However,&#x20;we&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;the&#x20;version&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Prevent&#x20;the&#x20;usage&#x20;of&#x20;SkyDrive&#x20;for&#x20;file&#x20;storage,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.52.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16206,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;helps&#x20;prevent&#x20;Remote&#x20;Desktop&#x20;clients&#x20;from&#x20;saving&#x20;passwords&#x20;on&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;was&#x20;previously&#x20;configured&#x20;as&#x20;Disabled&#x20;or&#x20;Not&#x20;configured,&#x20;any&#x20;previously&#x20;saved&#x20;passwords&#x20;will&#x20;be&#x20;deleted&#x20;the&#x20;first&#x20;time&#x20;a&#x20;Remote&#x20;Desktop&#x20;client&#x20;disconnects&#x20;from&#x20;any&#x20;server.','An&#x20;attacker&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;may&#x20;be&#x20;able&#x20;to&#x20;break&#x20;the&#x20;protection&#x20;guarding&#x20;saved&#x20;passwords.&#x20;An&#x20;attacker&#x20;who&#x20;compromises&#x20;a&#x20;user&#039;s&#x20;account&#x20;and&#x20;connects&#x20;to&#x20;their&#x20;computer&#x20;could&#x20;use&#x20;saved&#x20;passwords&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;additional&#x20;hosts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Connection&#x20;ClientDo&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.2.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16207,'Ensure&#x20;&#039;Restrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;users&#x20;&amp;&#x20;administrators&#x20;who&#x20;Remote&#x20;Desktop&#x20;to&#x20;a&#x20;server&#x20;will&#x20;continue&#x20;to&#x20;use&#x20;the&#x20;same&#x20;session&#x20;-&#x20;if&#x20;they&#x20;disconnect&#x20;and&#x20;reconnect,&#x20;they&#x20;will&#x20;go&#x20;back&#x20;to&#x20;the&#x20;same&#x20;session&#x20;they&#x20;were&#x20;using&#x20;before,&#x20;preventing&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;second&#x20;simultaneous&#x20;session.&#x20;This&#x20;both&#x20;prevents&#x20;unnecessary&#x20;resource&#x20;usage&#x20;by&#x20;having&#x20;the&#x20;server&#x20;host&#x20;unnecessary&#x20;additional&#x20;sessions&#x20;&#40;which&#x20;would&#x20;put&#x20;extra&#x20;load&#x20;on&#x20;the&#x20;server&#41;&#x20;and&#x20;also&#x20;ensures&#x20;a&#x20;consistency&#x20;of&#x20;experience&#x20;for&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostConnectionsRestrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Restrict&#x20;Terminal&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;remote&#x20;session,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.2.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16208,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;COM&#x20;ports&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;COM&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16209,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;sharing&#x20;the&#x20;local&#x20;drives&#x20;on&#x20;their&#x20;client&#x20;computers&#x20;to&#x20;Remote&#x20;Desktop&#x20;Servers&#x20;that&#x20;they&#x20;access.&#x20;Mapped&#x20;drives&#x20;appear&#x20;in&#x20;the&#x20;session&#x20;folder&#x20;tree&#x20;in&#x20;Windows&#x20;Explorer&#x20;in&#x20;the&#x20;following&#x20;format:&#x20;&#92;TSClient&lt;driveletter&gt;$&#x20;If&#x20;local&#x20;drives&#x20;are&#x20;shared&#x20;they&#x20;are&#x20;left&#x20;vulnerable&#x20;to&#x20;intruders&#x20;who&#x20;want&#x20;to&#x20;exploit&#x20;the&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Data&#x20;could&#x20;be&#x20;forwarded&#x20;from&#x20;the&#x20;user&#039;s&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;without&#x20;any&#x20;direct&#x20;user&#x20;interaction.&#x20;Malicious&#x20;software&#x20;already&#x20;present&#x20;on&#x20;a&#x20;compromised&#x20;server&#x20;would&#x20;have&#x20;direct&#x20;and&#x20;stealthy&#x20;disk&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16210,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;LPT&#x20;ports&#x20;during&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;LPT&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16211,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;redirection&#x20;of&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;devices,&#x20;such&#x20;as&#x20;Windows&#x20;Portable&#x20;Devices,&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.3.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16212,'Ensure&#x20;&#039;Always&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;always&#x20;prompts&#x20;the&#x20;client&#x20;computer&#x20;for&#x20;a&#x20;password&#x20;upon&#x20;connection.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enforce&#x20;a&#x20;password&#x20;prompt&#x20;for&#x20;users&#x20;who&#x20;log&#x20;on&#x20;to&#x20;Remote&#x20;Desktop&#x20;Services,&#x20;even&#x20;if&#x20;they&#x20;already&#x20;provided&#x20;the&#x20;password&#x20;in&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;have&#x20;the&#x20;option&#x20;to&#x20;store&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;when&#x20;they&#x20;create&#x20;a&#x20;new&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut.&#x20;If&#x20;the&#x20;server&#x20;that&#x20;runs&#x20;Remote&#x20;Desktop&#x20;Services&#x20;allows&#x20;users&#x20;who&#x20;have&#x20;used&#x20;this&#x20;feature&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;server&#x20;but&#x20;not&#x20;enter&#x20;their&#x20;password,&#x20;then&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer&#x20;could&#x20;connect&#x20;to&#x20;a&#x20;Remote&#x20;Desktop&#x20;Server&#x20;through&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut,&#x20;even&#x20;though&#x20;they&#x20;may&#x20;not&#x20;know&#x20;the&#x20;user&#039;s&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityAlways&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Always&#x20;prompt&#x20;client&#x20;for&#x20;password&#x20;upon&#x20;connection,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.9.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16213,'Ensure&#x20;&#039;Require&#x20;secure&#x20;RPC&#x20;communication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;requires&#x20;secure&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;communication&#x20;with&#x20;all&#x20;clients&#x20;or&#x20;allows&#x20;unsecured&#x20;communication.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;strengthen&#x20;the&#x20;security&#x20;of&#x20;RPC&#x20;communication&#x20;with&#x20;clients&#x20;by&#x20;allowing&#x20;only&#x20;authenticated&#x20;and&#x20;encrypted&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;unsecure&#x20;RPC&#x20;communication&#x20;can&#x20;exposes&#x20;the&#x20;server&#x20;to&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks&#x20;and&#x20;data&#x20;disclosure&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;secure&#x20;RPC&#x20;communication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.9.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16214,'Ensure&#x20;&#039;Set&#x20;client&#x20;connection&#x20;encryption&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;High&#x20;Level&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;encryption&#x20;level&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;client&#x20;computers&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;This&#x20;policy&#x20;only&#x20;applies&#x20;when&#x20;you&#x20;are&#x20;using&#x20;native&#x20;RDP&#x20;encryption.&#x20;However,&#x20;native&#x20;RDP&#x20;encryption&#x20;&#40;as&#x20;opposed&#x20;to&#x20;SSL&#x20;encryption&#41;&#x20;is&#x20;not&#x20;recommended.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;SSL&#x20;encryption.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;High&#x20;Level.','If&#x20;Remote&#x20;Desktop&#x20;client&#x20;connections&#x20;that&#x20;use&#x20;low&#x20;level&#x20;encryption&#x20;are&#x20;allowed,&#x20;it&#x20;is&#x20;more&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;any&#x20;captured&#x20;Remote&#x20;Desktop&#x20;Services&#x20;network&#x20;traffic.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.9.3\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16215,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;time&#x20;that&#x20;an&#x20;active&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;can&#x20;be&#x20;idle&#x20;&#40;without&#x20;user&#x20;input&#41;&#x20;before&#x20;it&#x20;is&#x20;automatically&#x20;disconnected.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;inactive&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Terminal&#x20;Services&#x20;sessions,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.10.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16216,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;1&#x20;minute&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;a&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;1&#x20;minute.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;disconnected&#x20;but&#x20;still&#x20;active&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.&#x20;This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;disconnected&#x20;session&#x20;is&#x20;properly&#x20;terminated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;1&#x20;minute:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.10.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16217,'Ensure&#x20;&#039;Do&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;retains&#x20;a&#x20;user&#039;s&#x20;per-session&#x20;temporary&#x20;folders&#x20;at&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;inside&#x20;the&#x20;temporary&#x20;folders&#x20;and&#x20;visible&#x20;to&#x20;other&#x20;administrators&#x20;that&#x20;log&#x20;into&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Do&#x20;not&#x20;delete&#x20;temp&#x20;folder&#x20;upon&#x20;exit,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.11.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16218,'Ensure&#x20;&#039;Do&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','By&#x20;default,&#x20;Remote&#x20;Desktop&#x20;Services&#x20;creates&#x20;a&#x20;separate&#x20;temporary&#x20;folder&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;for&#x20;each&#x20;active&#x20;session&#x20;that&#x20;a&#x20;user&#x20;maintains&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server.&#x20;The&#x20;temporary&#x20;folder&#x20;is&#x20;created&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;in&#x20;a&#x20;Temp&#x20;folder&#x20;under&#x20;the&#x20;user&#039;s&#x20;profile&#x20;folder&#x20;and&#x20;is&#x20;named&#x20;with&#x20;the&#x20;sessionid.&#x20;This&#x20;temporary&#x20;folder&#x20;is&#x20;used&#x20;to&#x20;store&#x20;individual&#x20;temporary&#x20;files.&#x20;To&#x20;reclaim&#x20;disk&#x20;space,&#x20;the&#x20;temporary&#x20;folder&#x20;is&#x20;deleted&#x20;when&#x20;the&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;a&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;keeps&#x20;the&#x20;cached&#x20;data&#x20;independent&#x20;for&#x20;each&#x20;session,&#x20;both&#x20;reducing&#x20;the&#x20;chance&#x20;of&#x20;problems&#x20;from&#x20;shared&#x20;cached&#x20;data&#x20;between&#x20;sessions,&#x20;and&#x20;keeping&#x20;possibly&#x20;sensitive&#x20;data&#x20;separate&#x20;to&#x20;each&#x20;user&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.3.11.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16219,'Ensure&#x20;&#039;Prevent&#x20;downloading&#x20;of&#x20;enclosures&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;having&#x20;enclosures&#x20;&#40;file&#x20;attachments&#41;&#x20;downloaded&#x20;from&#x20;an&#x20;RSS&#x20;feed&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;attachments&#x20;to&#x20;be&#x20;downloaded&#x20;through&#x20;the&#x20;RSS&#x20;feed&#x20;can&#x20;introduce&#x20;files&#x20;that&#x20;could&#x20;have&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRSS&#x20;FeedsPrevent&#x20;downloading&#x20;of&#x20;enclosures&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InetRes.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Turn&#x20;off&#x20;downloading&#x20;of&#x20;enclosures,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.1\"]}, {\"cis_csc\": [\"7.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16220,'Ensure&#x20;&#039;Allow&#x20;Cloud&#x20;Search&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;search&#x20;cloud&#x20;sources&#x20;like&#x20;OneDrive&#x20;and&#x20;SharePoint.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#x20;.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cloud&#x20;Search&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.60.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16221,'Ensure&#x20;&#039;Allow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;encrypted&#x20;items&#x20;are&#x20;allowed&#x20;to&#x20;be&#x20;indexed.&#x20;When&#x20;this&#x20;setting&#x20;is&#x20;changed,&#x20;the&#x20;index&#x20;is&#x20;rebuilt&#x20;completely.&#x20;Full&#x20;volume&#x20;encryption&#x20;&#40;such&#x20;as&#x20;BitLocker&#x20;Drive&#x20;Encryption&#x20;or&#x20;a&#x20;non-Microsoft&#x20;solution&#41;&#x20;must&#x20;be&#x20;used&#x20;for&#x20;the&#x20;location&#x20;of&#x20;the&#x20;index&#x20;to&#x20;maintain&#x20;security&#x20;for&#x20;encrypted&#x20;files.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Indexing&#x20;and&#x20;allowing&#x20;users&#x20;to&#x20;search&#x20;encrypted&#x20;files&#x20;could&#x20;potentially&#x20;reveal&#x20;confidential&#x20;data&#x20;stored&#x20;within&#x20;the&#x20;encrypted&#x20;files.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.60.3\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16222,'Ensure&#x20;&#039;Turn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;Key&#x20;Management&#x20;Service&#x20;&#40;KMS&#41;&#x20;is&#x20;a&#x20;Microsoft&#x20;license&#x20;activation&#x20;method&#x20;that&#x20;entails&#x20;setting&#x20;up&#x20;a&#x20;local&#x20;server&#x20;to&#x20;store&#x20;the&#x20;software&#x20;licenses.&#x20;The&#x20;KMS&#x20;server&#x20;itself&#x20;needs&#x20;to&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;activate&#x20;the&#x20;KMS&#x20;service,&#x20;but&#x20;subsequent&#x20;on-network&#x20;clients&#x20;can&#x20;activate&#x20;Microsoft&#x20;Windows&#x20;OS&#x20;and/or&#x20;their&#x20;Microsoft&#x20;Office&#x20;via&#x20;the&#x20;KMS&#x20;server&#x20;instead&#x20;of&#x20;connecting&#x20;directly&#x20;to&#x20;Microsoft.&#x20;This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;opt-out&#x20;of&#x20;sending&#x20;KMS&#x20;client&#x20;activation&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Even&#x20;though&#x20;the&#x20;KMS&#x20;licensing&#x20;method&#x20;does&#x20;not&#x20;require&#x20;KMS&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;Microsoft,&#x20;they&#x20;still&#x20;send&#x20;KMS&#x20;client&#x20;activation&#x20;state&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSoftware&#x20;Protection&#x20;PlatformTurn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AVSValidationGP.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]');
INSERT INTO `tsca` VALUES (16223,'Ensure&#x20;&#039;Configure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;a&#x20;local&#x20;override&#x20;for&#x20;the&#x20;configuration&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&quot;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&quot;.&#x20;This&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;set&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','The&#x20;decision&#x20;on&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;participate&#x20;in&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;for&#x20;malicious&#x20;software&#x20;reporting&#x20;should&#x20;be&#x20;made&#x20;centrally&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;so&#x20;that&#x20;all&#x20;computers&#x20;within&#x20;it&#x20;behave&#x20;consistently&#x20;in&#x20;that&#x20;regard.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Disabled&#x20;ensures&#x20;that&#x20;the&#x20;decision&#x20;remains&#x20;centrally&#x20;managed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusMAPSConfigure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.3.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16224,'Ensure&#x20;&#039;Join&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&#039;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#039;.&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;is&#x20;the&#x20;online&#x20;community&#x20;that&#x20;helps&#x20;you&#x20;choose&#x20;how&#x20;to&#x20;respond&#x20;to&#x20;potential&#x20;threats.&#x20;The&#x20;community&#x20;also&#x20;helps&#x20;stop&#x20;the&#x20;spread&#x20;of&#x20;new&#x20;malicious&#x20;software&#x20;infections.&#x20;You&#x20;can&#x20;choose&#x20;to&#x20;send&#x20;basic&#x20;or&#x20;additional&#x20;information&#x20;about&#x20;detected&#x20;software.&#x20;Additional&#x20;information&#x20;helps&#x20;Microsoft&#x20;create&#x20;new&#x20;definitions&#x20;and&#x20;help&#x20;it&#x20;to&#x20;protect&#x20;your&#x20;computer.&#x20;Possible&#x20;options&#x20;are:&#x20;-&#x20;&#40;0x0&#41;&#x20;Disabled&#x20;&#40;default&#41;&#x20;-&#x20;&#40;0x1&#41;&#x20;Basic&#x20;membership&#x20;-&#x20;&#40;0x2&#41;&#x20;Advanced&#x20;membership&#x20;&#x20;&#x20;Basic&#x20;membership&#x20;will&#x20;send&#x20;basic&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;software&#x20;that&#x20;has&#x20;been&#x20;detected&#x20;including&#x20;where&#x20;the&#x20;software&#x20;came&#x20;from&#x20;the&#x20;actions&#x20;that&#x20;you&#x20;apply&#x20;or&#x20;that&#x20;are&#x20;applied&#x20;automatically&#x20;and&#x20;whether&#x20;the&#x20;actions&#x20;were&#x20;successful.&#x20;Advanced&#x20;membership&#x20;in&#x20;addition&#x20;to&#x20;basic&#x20;information&#x20;will&#x20;send&#x20;more&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;malicious&#x20;software&#x20;spyware&#x20;and&#x20;potentially&#x20;unwanted&#x20;software&#x20;including&#x20;the&#x20;location&#x20;of&#x20;the&#x20;software&#x20;file&#x20;names&#x20;how&#x20;the&#x20;software&#x20;operates&#x20;and&#x20;how&#x20;it&#x20;has&#x20;impacted&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;information&#x20;that&#x20;would&#x20;be&#x20;sent&#x20;can&#x20;include&#x20;things&#x20;like&#x20;location&#x20;of&#x20;detected&#x20;items&#x20;on&#x20;your&#x20;computer&#x20;if&#x20;harmful&#x20;software&#x20;was&#x20;removed.&#x20;The&#x20;information&#x20;would&#x20;be&#x20;automatically&#x20;collected&#x20;and&#x20;sent.&#x20;In&#x20;some&#x20;instances&#x20;personal&#x20;information&#x20;might&#x20;unintentionally&#x20;be&#x20;sent&#x20;to&#x20;Microsoft.&#x20;However,&#x20;Microsoft&#x20;states&#x20;that&#x20;it&#x20;will&#x20;not&#x20;use&#x20;this&#x20;information&#x20;to&#x20;identify&#x20;you&#x20;or&#x20;contact&#x20;you.&#x20;For&#x20;privacy&#x20;reasons&#x20;in&#x20;high&#x20;security&#x20;environments,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;prevent&#x20;these&#x20;data&#x20;submissions&#x20;altogether.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusMAPSJoin&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.3.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16225,'Ensure&#x20;&#039;Turn&#x20;on&#x20;behavior&#x20;monitoring&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;behavior&#x20;monitoring&#x20;for&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Windows&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;behavior&#x20;monitoring&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.7.1\"]}, {\"cis_csc\": [\"8.1\"]}, {\"pci_dss\": [\"5.2\"]}, {\"tsc\": [\"CC6.8\"]}]'),(16226,'Ensure&#x20;&#039;Configure&#x20;Watson&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;whether&#x20;or&#x20;not&#x20;Watson&#x20;events&#x20;are&#x20;sent.','Watson&#x20;events&#x20;are&#x20;the&#x20;reports&#x20;that&#x20;get&#x20;sent&#x20;to&#x20;Microsoft&#x20;when&#x20;a&#x20;program&#x20;or&#x20;service&#x20;crashes&#x20;or&#x20;fails,&#x20;including&#x20;the&#x20;possibility&#x20;of&#x20;automatic&#x20;submission.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusReportingConfigure&#x20;Watson&#x20;events.','[{\"cis\": [\"18.9.76.9.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16227,'Ensure&#x20;&#039;Scan&#x20;removable&#x20;drives&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;scan&#x20;for&#x20;malicious&#x20;software&#x20;and&#x20;unwanted&#x20;software&#x20;in&#x20;the&#x20;contents&#x20;of&#x20;removable&#x20;drives,&#x20;such&#x20;as&#x20;USB&#x20;flash&#x20;drives,&#x20;when&#x20;running&#x20;a&#x20;full&#x20;scan.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;present&#x20;removable&#x20;drives&#x20;are&#x20;always&#x20;included&#x20;in&#x20;any&#x20;type&#x20;of&#x20;scan,&#x20;as&#x20;removable&#x20;drives&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;contain&#x20;malicious&#x20;software&#x20;brought&#x20;in&#x20;to&#x20;the&#x20;enterprise&#x20;managed&#x20;environment&#x20;from&#x20;an&#x20;external,&#x20;unmanaged&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusScanScan&#x20;removable&#x20;drives&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.10.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16228,'Ensure&#x20;&#039;Turn&#x20;on&#x20;e-mail&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;e-mail&#x20;scanning.&#x20;When&#x20;e-mail&#x20;scanning&#x20;is&#x20;enabled,&#x20;the&#x20;engine&#x20;will&#x20;parse&#x20;the&#x20;mailbox&#x20;and&#x20;mail&#x20;files,&#x20;according&#x20;to&#x20;their&#x20;specific&#x20;format,&#x20;in&#x20;order&#x20;to&#x20;analyze&#x20;the&#x20;mail&#x20;bodies&#x20;and&#x20;attachments.&#x20;Several&#x20;e-mail&#x20;formats&#x20;are&#x20;currently&#x20;supported,&#x20;for&#x20;example:&#x20;pst&#x20;&#40;Outlook&#41;,&#x20;dbx,&#x20;mbx,&#x20;mime&#x20;&#40;Outlook&#x20;Express&#41;,&#x20;binhex&#x20;&#40;Mac&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Incoming&#x20;e-mails&#x20;should&#x20;be&#x20;scanned&#x20;by&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Windows&#x20;Defender&#x20;Antivirus,&#x20;as&#x20;email&#x20;attachments&#x20;are&#x20;a&#x20;commonly&#x20;used&#x20;attack&#x20;vector&#x20;to&#x20;infiltrate&#x20;computers&#x20;with&#x20;malicious&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusScanTurn&#x20;on&#x20;e-mail&#x20;scanning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.10.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16229,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;state&#x20;for&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;&#40;ASR&#41;&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusWindows&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.13.1.1\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16230,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Windows&#x20;Defender&#x20;Exploit&#x20;Guard&#x20;network&#x20;protection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;.','This&#x20;setting&#x20;can&#x20;help&#x20;prevent&#x20;employees&#x20;from&#x20;using&#x20;any&#x20;application&#x20;to&#x20;access&#x20;dangerous&#x20;domains&#x20;that&#x20;may&#x20;host&#x20;phishing&#x20;scams,&#x20;exploit-hosting&#x20;sites,&#x20;and&#x20;other&#x20;malicious&#x20;content&#x20;on&#x20;the&#x20;Internet.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusWindows&#x20;Defender&#x20;Exploit&#x20;GuardNetwork&#x20;ProtectionPrevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.76.13.3.1\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16231,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Defender&#x20;AntiVirus&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;If&#x20;the&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;Disabled,&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;runs&#x20;and&#x20;computers&#x20;are&#x20;scanned&#x20;for&#x20;malware&#x20;and&#x20;other&#x20;potentially&#x20;unwanted&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;current,&#x20;updated&#x20;antivirus&#x20;product&#x20;is&#x20;scanning&#x20;each&#x20;computer&#x20;for&#x20;malicious&#x20;file&#x20;activity.&#x20;Microsoft&#x20;provides&#x20;a&#x20;competent&#x20;solution&#x20;out&#x20;of&#x20;the&#x20;box&#x20;in&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;Organizations&#x20;that&#x20;choose&#x20;to&#x20;purchase&#x20;a&#x20;reputable&#x20;3rd-party&#x20;antivirus&#x20;solution&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;in&#x20;lieu&#x20;of&#x20;the&#x20;commercial&#x20;alternative.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusTurn&#x20;off&#x20;Windows&#x20;Defender&#x20;AntiVirus&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;off&#x20;Windows&#x20;Defender,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.76.14\"]}, {\"cis_csc\": [\"8.1\"]}, {\"pci_dss\": [\"5.2\"]}, {\"tsc\": [\"CC6.8\"]}]'),(16232,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevent&#x20;users&#x20;from&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;Exploit&#x20;protection&#x20;settings&#x20;area&#x20;in&#x20;the&#x20;Windows&#x20;Defender&#x20;Security&#x20;Center.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Only&#x20;authorized&#x20;IT&#x20;staff&#x20;should&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;to&#x20;the&#x20;exploit&#x20;protection&#x20;settings&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;the&#x20;organizations&#x20;specific&#x20;configuration&#x20;is&#x20;not&#x20;modified.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;Security&#x20;CenterApp&#x20;and&#x20;browser&#x20;protectionPrevent&#x20;users&#x20;from&#x20;modifying&#x20;settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefenderSecurityCenter.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.79.1.1\"]}, {\"cis_csc\": [\"8.4\"]}]'),(16233,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;the&#x20;behavior&#x20;of&#x20;Windows&#x20;SmartScreen.&#x20;Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;Some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;with&#x20;this&#x20;feature&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass.','Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;However,&#x20;due&#x20;to&#x20;the&#x20;fact&#x20;that&#x20;some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;disable&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenExplorerConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Configure&#x20;Windows&#x20;SmartScreen,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.80.1.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16234,'Ensure&#x20;&#039;Allow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;are&#x20;allowed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','This&#x20;Microsoft&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;collect&#x20;data&#x20;and&#x20;suggest&#x20;apps&#x20;based&#x20;on&#x20;that&#x20;data&#x20;collected.&#x20;Disabling&#x20;this&#x20;setting&#x20;will&#x20;help&#x20;ensure&#x20;your&#x20;data&#x20;is&#x20;not&#x20;shared&#x20;with&#x20;any&#x20;third&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.84.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16235,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#039;&#x20;OR&#x20;&#039;Disabled&#039;&#x20;but&#x20;not&#x20;&#039;Enabled:&','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;Ink&#x20;items&#x20;are&#x20;allowed&#x20;above&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled&#x20;.','Allowing&#x20;any&#x20;apps&#x20;to&#x20;be&#x20;accessed&#x20;while&#x20;system&#x20;is&#x20;locked&#x20;is&#x20;not&#x20;recommended.&#x20;If&#x20;this&#x20;feature&#x20;is&#x20;permitted,&#x20;it&#x20;should&#x20;only&#x20;be&#x20;accessible&#x20;once&#x20;a&#x20;user&#x20;authenticates&#x20;with&#x20;the&#x20;proper&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.84.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16236,'Ensure&#x20;&#039;Allow&#x20;user&#x20;control&#x20;over&#x20;installs&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;are&#x20;permitted&#x20;to&#x20;change&#x20;installation&#x20;options&#x20;that&#x20;typically&#x20;are&#x20;available&#x20;only&#x20;to&#x20;system&#x20;administrators.&#x20;The&#x20;security&#x20;features&#x20;of&#x20;Windows&#x20;Installer&#x20;normally&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;installation&#x20;options&#x20;that&#x20;are&#x20;typically&#x20;reserved&#x20;for&#x20;system&#x20;administrators,&#x20;such&#x20;as&#x20;specifying&#x20;the&#x20;directory&#x20;to&#x20;which&#x20;files&#x20;are&#x20;installed.&#x20;If&#x20;Windows&#x20;Installer&#x20;detects&#x20;that&#x20;an&#x20;installation&#x20;package&#x20;has&#x20;permitted&#x20;the&#x20;user&#x20;to&#x20;change&#x20;a&#x20;protected&#x20;option,&#x20;it&#x20;stops&#x20;the&#x20;installation&#x20;and&#x20;displays&#x20;a&#x20;message.&#x20;These&#x20;security&#x20;features&#x20;operate&#x20;only&#x20;when&#x20;the&#x20;installation&#x20;program&#x20;is&#x20;running&#x20;in&#x20;a&#x20;privileged&#x20;security&#x20;context&#x20;in&#x20;which&#x20;it&#x20;has&#x20;access&#x20;to&#x20;directories&#x20;denied&#x20;to&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;only&#x20;IT&#x20;staff&#x20;with&#x20;administrative&#x20;rights&#x20;should&#x20;be&#x20;installing&#x20;or&#x20;changing&#x20;software&#x20;on&#x20;a&#x20;system.&#x20;Allowing&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;have&#x20;any&#x20;control&#x20;over&#x20;installs&#x20;can&#x20;risk&#x20;unapproved&#x20;software&#x20;from&#x20;being&#x20;installed&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;system,&#x20;which&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;become&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAllow&#x20;user&#x20;control&#x20;over&#x20;installs&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Enable&#x20;user&#x20;control&#x20;over&#x20;installs,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16237,'Ensure&#x20;&#039;Always&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;Windows&#x20;Installer&#x20;should&#x20;use&#x20;system&#x20;permissions&#x20;when&#x20;it&#x20;installs&#x20;any&#x20;program&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;This&#x20;setting&#x20;appears&#x20;both&#x20;in&#x20;the&#x20;Computer&#x20;Configuration&#x20;and&#x20;User&#x20;Configuration&#x20;folders.&#x20;To&#x20;make&#x20;this&#x20;setting&#x20;effective,&#x20;you&#x20;must&#x20;enable&#x20;the&#x20;setting&#x20;in&#x20;both&#x20;folders.&#x20;Caution:&#x20;If&#x20;enabled,&#x20;skilled&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;permissions&#x20;this&#x20;setting&#x20;grants&#x20;to&#x20;change&#x20;their&#x20;privileges&#x20;and&#x20;gain&#x20;permanent&#x20;access&#x20;to&#x20;restricted&#x20;files&#x20;and&#x20;folders.&#x20;Note&#x20;that&#x20;the&#x20;User&#x20;Configuration&#x20;version&#x20;of&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;guaranteed&#x20;to&#x20;be&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;with&#x20;limited&#x20;privileges&#x20;can&#x20;exploit&#x20;this&#x20;feature&#x20;by&#x20;creating&#x20;a&#x20;Windows&#x20;Installer&#x20;installation&#x20;package&#x20;that&#x20;creates&#x20;a&#x20;new&#x20;local&#x20;account&#x20;that&#x20;belongs&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;adds&#x20;their&#x20;current&#x20;account&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;installs&#x20;malicious&#x20;software,&#x20;or&#x20;performs&#x20;other&#x20;unauthorized&#x20;activities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAlways&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16238,'Ensure&#x20;&#039;Prevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Web-based&#x20;programs&#x20;are&#x20;allowed&#x20;to&#x20;install&#x20;software&#x20;on&#x20;the&#x20;computer&#x20;without&#x20;notifying&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Suppressing&#x20;the&#x20;system&#x20;warning&#x20;can&#x20;pose&#x20;a&#x20;security&#x20;risk&#x20;and&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerPrevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;IE&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.3\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16239,'Ensure&#x20;&#039;Sign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;a&#x20;device&#x20;will&#x20;automatically&#x20;sign-in&#x20;the&#x20;last&#x20;interactive&#x20;user&#x20;after&#x20;Windows&#x20;Update&#x20;restarts&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;feature&#x20;will&#x20;prevent&#x20;the&#x20;caching&#x20;of&#x20;user&#039;s&#x20;credentials&#x20;and&#x20;unauthorized&#x20;use&#x20;of&#x20;the&#x20;device,&#x20;and&#x20;also&#x20;ensure&#x20;the&#x20;user&#x20;is&#x20;aware&#x20;of&#x20;the&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Logon&#x20;OptionsSign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinLogon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.86.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16240,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;enables&#x20;logging&#x20;of&#x20;all&#x20;PowerShell&#x20;script&#x20;input&#x20;to&#x20;the&#x20;Microsoft-Windows-&#x20;PowerShell/Operational&#x20;event&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Microsoft&#039;s&#x20;own&#x20;hardening&#x20;guidance,&#x20;they&#x20;recommend&#x20;the&#x20;opposite&#x20;value,&#x20;Enabled,&#x20;because&#x20;having&#x20;this&#x20;data&#x20;logged&#x20;improves&#x20;investigations&#x20;of&#x20;PowerShell&#x20;attack&#x20;incidents.&#x20;However,&#x20;the&#x20;default&#x20;ACL&#x20;on&#x20;the&#x20;PowerShell&#x20;Operational&#x20;log&#x20;allows&#x20;Interactive&#x20;User&#x20;&#40;i.e.&#x20;any&#x20;logged&#x20;on&#x20;user&#41;&#x20;to&#x20;read&#x20;it,&#x20;and&#x20;therefore&#x20;possibly&#x20;expose&#x20;passwords&#x20;or&#x20;other&#x20;sensitive&#x20;information&#x20;to&#x20;unauthorized&#x20;users.&#x20;If&#x20;Microsoft&#x20;locks&#x20;down&#x20;the&#x20;default&#x20;ACL&#x20;on&#x20;that&#x20;log&#x20;in&#x20;the&#x20;future&#x20;&#40;e.g.&#x20;to&#x20;restrict&#x20;it&#x20;only&#x20;to&#x20;Administrators&#41;,&#x20;then&#x20;we&#x20;will&#x20;revisit&#x20;this&#x20;recommendation&#x20;in&#x20;a&#x20;future&#x20;release.','There&#x20;are&#x20;potential&#x20;risks&#x20;of&#x20;capturing&#x20;passwords&#x20;in&#x20;the&#x20;PowerShell&#x20;logs.&#x20;This&#x20;setting&#x20;should&#x20;only&#x20;be&#x20;needed&#x20;for&#x20;debugging&#x20;purposes,&#x20;and&#x20;not&#x20;in&#x20;normal&#x20;operation,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;this&#x20;is&#x20;set&#x20;to&#x20;Disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.95.1\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16241,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Transcription&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;Policy&#x20;setting&#x20;lets&#x20;you&#x20;capture&#x20;the&#x20;input&#x20;and&#x20;output&#x20;of&#x20;Windows&#x20;PowerShell&#x20;commands&#x20;into&#x20;text-based&#x20;transcripts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;that&#x20;passwords&#x20;could&#x20;get&#x20;stored&#x20;in&#x20;plain&#x20;text&#x20;in&#x20;the&#x20;PowerShell_transcript&#x20;output&#x20;file.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Transcription&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.95.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16242,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;uses&#x20;Basic&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.1\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16243,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.2\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16244,'Ensure&#x20;&#039;Disallow&#x20;Digest&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;will&#x20;not&#x20;use&#x20;Digest&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Digest&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM,&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientDisallow&#x20;Digest&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.3\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16245,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;accepts&#x20;Basic&#x20;authentication&#x20;from&#x20;a&#x20;remote&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.1\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16246,'Ensure&#x20;&#039;Allow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;automatically&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;requests&#x20;on&#x20;the&#x20;HTTP&#x20;transport&#x20;over&#x20;the&#x20;default&#x20;HTTP&#x20;port.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;automatic&#x20;configuration&#x20;of&#x20;listeners,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16247,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.3\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16248,'Ensure&#x20;&#039;Disallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;will&#x20;allow&#x20;RunAs&#x20;credentials&#x20;to&#x20;be&#x20;stored&#x20;for&#x20;any&#x20;plug-ins.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;you&#x20;enable&#x20;and&#x20;then&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;any&#x20;values&#x20;that&#x20;were&#x20;previously&#x20;configured&#x20;for&#x20;RunAsPassword&#x20;will&#x20;need&#x20;to&#x20;be&#x20;reset.','Although&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;RunAs&#x20;credentials&#x20;is&#x20;a&#x20;convenient&#x20;feature&#x20;it&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;account&#x20;compromise&#x20;slightly.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;forget&#x20;to&#x20;lock&#x20;your&#x20;desktop&#x20;before&#x20;leaving&#x20;it&#x20;unattended&#x20;for&#x20;a&#x20;few&#x20;minutes&#x20;another&#x20;person&#x20;could&#x20;access&#x20;not&#x20;only&#x20;the&#x20;desktop&#x20;of&#x20;your&#x20;computer&#x20;but&#x20;also&#x20;any&#x20;hosts&#x20;you&#x20;manage&#x20;via&#x20;WinRM&#x20;with&#x20;cached&#x20;RunAs&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceDisallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.97.2.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16249,'Ensure&#x20;&#039;Allow&#x20;Remote&#x20;Shell&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;configuration&#x20;of&#x20;remote&#x20;access&#x20;to&#x20;all&#x20;supported&#x20;shells&#x20;to&#x20;execute&#x20;scripts&#x20;and&#x20;commands.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;GPME&#x20;help&#x20;text&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded,&#x20;implying&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;reject&#x20;new&#x20;Remote&#x20;Shell&#x20;connections,&#x20;and&#x20;setting&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;allow&#x20;Remote&#x20;Shell&#x20;connections.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;title&#x20;of&#x20;the&#x20;setting&#41;.&#x20;This&#x20;is&#x20;a&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Shell&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;ShellAllow&#x20;Remote&#x20;Shell&#x20;Access.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteShell.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.98.1\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16250,'Ensure&#x20;&#039;Manage&#x20;preview&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;preview&#x20;builds&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Windows&#x20;Insider&#x20;Program&#x20;controls&#x20;in&#x20;Settings&#x20;-&gt;&#x20;Update&#x20;and&#x20;Security.&#x20;These&#x20;controls&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;preview&#x20;&#40;beta&#41;&#x20;builds&#x20;of&#x20;Windows&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;preview&#x20;builds&#x20;.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;preview&#x20;builds&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessManage&#x20;preview&#x20;builds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.101.1.1\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"6.4.2\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\"]}]'),(16251,'Ensure&#x20;&#039;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Semi-Annual&#x20;Channel,&#x20;180&#x20;or&#x20;more&#x20;days&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;Preview&#x20;Build&#x20;or&#x20;Feature&#x20;Updates&#x20;to&#x20;receive,&#x20;and&#x20;when.&#x20;The&#x20;Windows&#x20;readiness&#x20;level&#x20;for&#x20;each&#x20;new&#x20;Windows&#x20;10&#x20;Feature&#x20;Update&#x20;is&#x20;classified&#x20;in&#x20;one&#x20;of&#x20;5&#x20;categories,&#x20;depending&#x20;on&#x20;your&#x20;organizations&#x20;level&#x20;of&#x20;comfort&#x20;with&#x20;receiving&#x20;them:&#x20;Preview&#x20;Build&#x20;-&#x20;Fast:&#x20;Devices&#x20;set&#x20;to&#x20;this&#x20;level&#x20;will&#x20;be&#x20;the&#x20;first&#x20;to&#x20;receive&#x20;new&#x20;builds&#x20;of&#x20;Windows&#x20;with&#x20;features&#x20;not&#x20;yet&#x20;available&#x20;to&#x20;the&#x20;general&#x20;public.&#x20;Select&#x20;Fast&#x20;to&#x20;participate&#x20;in&#x20;identifying&#x20;and&#x20;reporting&#x20;issues&#x20;to&#x20;Microsoft,&#x20;and&#x20;provide&#x20;suggestions&#x20;on&#x20;new&#x20;functionality.&#x20;Preview&#x20;Build&#x20;-&#x20;Slow:&#x20;Devices&#x20;set&#x20;to&#x20;this&#x20;level&#x20;receive&#x20;new&#x20;builds&#x20;of&#x20;Windows&#x20;before&#x20;they&#x20;are&#x20;available&#x20;to&#x20;the&#x20;general&#x20;public,&#x20;but&#x20;at&#x20;a&#x20;slower&#x20;cadence&#x20;than&#x20;those&#x20;set&#x20;to&#x20;Fast,&#x20;and&#x20;with&#x20;changes&#x20;and&#x20;fixes&#x20;identified&#x20;in&#x20;earlier&#x20;builds.&#x20;Release&#x20;Preview:&#x20;Receive&#x20;builds&#x20;of&#x20;Windows&#x20;just&#x20;before&#x20;Microsoft&#x20;releases&#x20;them&#x20;to&#x20;the&#x20;general&#x20;public.&#x20;Semi-Annual&#x20;Channel&#x20;&#40;Targeted&#41;:&#x20;Receive&#x20;feature&#x20;updates&#x20;when&#x20;they&#x20;are&#x20;released&#x20;to&#x20;the&#x20;general&#x20;public.&#x20;Semi-Annual&#x20;Channel:&#x20;Feature&#x20;updates&#x20;will&#x20;arrive&#x20;when&#x20;they&#x20;are&#x20;declared&#x20;Semi-Annual&#x20;Channel.&#x20;This&#x20;usually&#x20;occurs&#x20;about&#x20;4&#x20;months&#x20;after&#x20;Semi-Annual&#x20;Channel&#x20;&#40;Targeted&#41;,&#x20;indicating&#x20;that&#x20;Microsoft,&#x20;Independent&#x20;Software&#x20;Vendors&#x20;&#40;ISVs&#41;,&#x20;partners&#x20;and&#x20;customer&#x20;believe&#x20;that&#x20;the&#x20;release&#x20;is&#x20;ready&#x20;for&#x20;broad&#x20;deployment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Semi-Annual&#x20;Channel,&#x20;180&#x20;or&#x20;more&#x20;days&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Telemetry&quot;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;RTM&#x20;&#40;Release&#x20;1607&#41;,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;Note&#x20;#3:&#x20;Prior&#x20;to&#x20;Windows&#x20;Server&#x20;2016&#x20;R1709,&#x20;values&#x20;above&#x20;180&#x20;days&#x20;are&#x20;not&#x20;recognized&#x20;by&#x20;the&#x20;OS.&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;R1709,&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;days&#x20;you&#x20;can&#x20;defer&#x20;is&#x20;365&#x20;days.','Forcing&#x20;new&#x20;features&#x20;without&#x20;prior&#x20;testing&#x20;in&#x20;your&#x20;environment&#x20;could&#x20;cause&#x20;software&#x20;incompatibilities&#x20;as&#x20;well&#x20;as&#x20;introducing&#x20;new&#x20;bugs&#x20;into&#x20;the&#x20;operating&#x20;system.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;it&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;delay&#x20;Feature&#x20;Updates&#x20;until&#x20;thorough&#x20;testing&#x20;and&#x20;a&#x20;deployment&#x20;plan&#x20;is&#x20;in&#x20;place.&#x20;This&#x20;recommendation&#x20;delays&#x20;the&#x20;automatic&#x20;installation&#x20;of&#x20;new&#x20;features&#x20;as&#x20;long&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Semi-Annual&#x20;Channel,&#x20;180&#x20;or&#x20;more&#x20;days&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Select&#x20;when&#x20;Feature&#x20;Updates&#x20;are&#x20;received,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.1.2\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16252,'Ensure&#x20;&#039;Select&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;days&#039;','This&#x20;settings&#x20;controls&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;days&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Telemetry&quot;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;RTM&#x20;&#40;Release&#x20;1607&#41;,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering','Quality&#x20;Updates&#x20;can&#x20;contain&#x20;important&#x20;bug&#x20;fixes&#x20;and/or&#x20;security&#x20;patches,&#x20;and&#x20;should&#x20;be&#x20;installed&#x20;as&#x20;soon&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:0&#x20;days&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;updated&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;WindowsUpdate.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.101.1.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16253,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;recognize&#x20;when&#x20;a&#x20;network&#x20;connection&#x20;is&#x20;available&#x20;and&#x20;then&#x20;use&#x20;the&#x20;network&#x20;connection&#x20;to&#x20;search&#x20;Windows&#x20;Update&#x20;or&#x20;your&#x20;designated&#x20;intranet&#x20;site&#x20;for&#x20;updates&#x20;that&#x20;apply&#x20;to&#x20;them.&#x20;After&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;select&#x20;one&#x20;of&#x20;the&#x20;following&#x20;three&#x20;options&#x20;in&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;Properties&#x20;dialog&#x20;box&#x20;to&#x20;specify&#x20;how&#x20;the&#x20;service&#x20;will&#x20;work:&#x20;2&#x20;-&#x20;Notify&#x20;for&#x20;download&#x20;and&#x20;auto&#x20;install&#x20;&#40;Notify&#x20;before&#x20;downloading&#x20;any&#x20;updates&#41;&#x20;3&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;notify&#x20;for&#x20;install&#x20;&#40;Download&#x20;the&#x20;updates&#x20;automatically&#x20;and&#x20;notify&#x20;when&#x20;they&#x20;are&#x20;ready&#x20;to&#x20;be&#x20;installed.&#41;&#x20;&#40;Default&#x20;setting&#41;&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;&#40;Automatically&#x20;download&#x20;updates&#x20;and&#x20;install&#x20;them&#x20;on&#x20;the&#x20;schedule&#x20;specified&#x20;below.&#41;&#41;&#x20;5&#x20;-&#x20;Allow&#x20;local&#x20;admin&#x20;to&#x20;choose&#x20;setting&#x20;&#40;Leave&#x20;decision&#x20;on&#x20;above&#x20;choices&#x20;up&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;&#40;Not&#x20;Recommended&#41;&#41;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;sub-setting&#x20;&#039;Configure&#x20;automatic&#x20;updating:&#039;&#x20;has&#x20;4&#x20;possible&#x20;values&#x20;-&#x20;all&#x20;of&#x20;them&#x20;are&#x20;valid&#x20;depending&#x20;on&#x20;specific&#x20;organizational&#x20;needs,&#x20;however&#x20;if&#x20;feasible&#x20;we&#x20;suggest&#x20;using&#x20;a&#x20;value&#x20;of&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install.&#x20;This&#x20;suggestion&#x20;is&#x20;not&#x20;a&#x20;scored&#x20;requirement.&#x20;Note&#x20;#2:&#x20;Organizations&#x20;that&#x20;utilize&#x20;a&#x20;3rd-party&#x20;solution&#x20;for&#x20;patching&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;setting,&#x20;and&#x20;instead&#x20;configure&#x20;it&#x20;to&#x20;Disabled&#x20;so&#x20;that&#x20;the&#x20;native&#x20;Windows&#x20;Update&#x20;mechanism&#x20;does&#x20;not&#x20;interfere&#x20;with&#x20;the&#x20;3rd-party&#x20;patching&#x20;process.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateConfigure&#x20;Automatic&#x20;Updates&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16254,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#x20;-&#x20;Every&#x20;day&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;when&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;0&#x20;-&#x20;Every&#x20;day.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;applicable&#x20;if&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;is&#x20;selected&#x20;in&#x20;Rule&#x20;18.9.101.2.&#x20;It&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;if&#x20;any&#x20;other&#x20;option&#x20;is&#x20;selected.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;0&#x20;-&#x20;Every&#x20;day:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateConfigure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16255,'Ensure&#x20;&#039;No&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;that&#x20;Automatic&#x20;Updates&#x20;will&#x20;wait&#x20;for&#x20;computers&#x20;to&#x20;be&#x20;restarted&#x20;by&#x20;the&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;on&#x20;to&#x20;them&#x20;to&#x20;complete&#x20;a&#x20;scheduled&#x20;installation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;applies&#x20;only&#x20;when&#x20;you&#x20;configure&#x20;Automatic&#x20;Updates&#x20;to&#x20;perform&#x20;scheduled&#x20;update&#x20;installations.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;to&#x20;Disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect.','Some&#x20;security&#x20;updates&#x20;require&#x20;that&#x20;the&#x20;computer&#x20;be&#x20;restarted&#x20;to&#x20;complete&#x20;an&#x20;installation.&#x20;If&#x20;the&#x20;computer&#x20;cannot&#x20;restart&#x20;automatically,&#x20;then&#x20;the&#x20;most&#x20;recent&#x20;update&#x20;will&#x20;not&#x20;completely&#x20;install&#x20;and&#x20;no&#x20;new&#x20;updates&#x20;will&#x20;download&#x20;to&#x20;the&#x20;computer&#x20;until&#x20;it&#x20;is&#x20;restarted.&#x20;Without&#x20;the&#x20;auto-restart&#x20;functionality,&#x20;users&#x20;who&#x20;are&#x20;not&#x20;security-conscious&#x20;may&#x20;choose&#x20;to&#x20;indefinitely&#x20;delay&#x20;the&#x20;restart,&#x20;therefore&#x20;keeping&#x20;the&#x20;computer&#x20;in&#x20;a&#x20;less&#x20;secure&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateNo&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;No&#x20;auto-restart&#x20;for&#x20;scheduled&#x20;Automatic&#x20;Updates&#x20;installations,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.101.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16500,'Ensure&#x20;&#039;Maximum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;','This&#x20;policy&#x20;setting&#x20;defines&#x20;how&#x20;long&#x20;a&#x20;user&#x20;can&#x20;use&#x20;their&#x20;password&#x20;before&#x20;it&#x20;expires.&#x20;Values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;range&#x20;from&#x20;0&#x20;to&#x20;999&#x20;days.&#x20;If&#x20;you&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0,&#x20;the&#x20;password&#x20;will&#x20;never&#x20;expire.&#x20;Because&#x20;attackers&#x20;can&#x20;crack&#x20;passwords,&#x20;the&#x20;more&#x20;frequently&#x20;you&#x20;change&#x20;the&#x20;password&#x20;the&#x20;less&#x20;opportunity&#x20;an&#x20;attacker&#x20;has&#x20;to&#x20;use&#x20;a&#x20;cracked&#x20;password.&#x20;However,&#x20;the&#x20;lower&#x20;this&#x20;value&#x20;is&#x20;set,&#x20;the&#x20;higher&#x20;the&#x20;potential&#x20;for&#x20;an&#x20;increase&#x20;in&#x20;calls&#x20;to&#x20;help&#x20;desk&#x20;support&#x20;due&#x20;to&#x20;users&#x20;having&#x20;to&#x20;change&#x20;their&#x20;password&#x20;or&#x20;forgetting&#x20;which&#x20;password&#x20;is&#x20;current.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.','The&#x20;longer&#x20;a&#x20;password&#x20;exists&#x20;the&#x20;higher&#x20;the&#x20;likelihood&#x20;that&#x20;it&#x20;will&#x20;be&#x20;compromised&#x20;by&#x20;a&#x20;brute&#x20;force&#x20;attack,&#x20;by&#x20;an&#x20;attacker&#x20;gaining&#x20;general&#x20;knowledge&#x20;about&#x20;the&#x20;user,&#x20;or&#x20;by&#x20;the&#x20;user&#x20;sharing&#x20;the&#x20;password.&#x20;Configuring&#x20;the&#x20;Maximum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;0&#x20;so&#x20;that&#x20;users&#x20;are&#x20;never&#x20;required&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;is&#x20;a&#x20;major&#x20;security&#x20;risk&#x20;because&#x20;that&#x20;allows&#x20;a&#x20;compromised&#x20;password&#x20;to&#x20;be&#x20;used&#x20;by&#x20;the&#x20;malicious&#x20;user&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;valid&#x20;user&#x20;is&#x20;authorized&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;60&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMaximum&#x20;password&#x20;age.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16501,'Ensure&#x20;&#039;Accounts:&#x20;Block&#x20;Microsoft&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;adding&#x20;new&#x20;Microsoft&#x20;accounts&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;onto&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Block&#x20;Microsoft&#x20;accounts.','[{\"cis\": [\"2.3.1.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16502,'Ensure&#x20;&#039;Accounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;local&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;password&#x20;protected&#x20;can&#x20;be&#x20;used&#x20;to&#x20;log&#x20;on&#x20;from&#x20;locations&#x20;other&#x20;than&#x20;the&#x20;physical&#x20;computer&#x20;console.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;local&#x20;accounts&#x20;that&#x20;have&#x20;blank&#x20;passwords&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;network&#x20;from&#x20;remote&#x20;client&#x20;computers.&#x20;Such&#x20;accounts&#x20;will&#x20;only&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;at&#x20;the&#x20;keyboard&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blank&#x20;passwords&#x20;are&#x20;a&#x20;serious&#x20;threat&#x20;to&#x20;computer&#x20;security&#x20;and&#x20;should&#x20;be&#x20;forbidden&#x20;through&#x20;both&#x20;organizational&#x20;policy&#x20;and&#x20;suitable&#x20;technical&#x20;measures.&#x20;In&#x20;fact,&#x20;the&#x20;default&#x20;settings&#x20;for&#x20;Active&#x20;Directory&#x20;domains&#x20;require&#x20;complex&#x20;passwords&#x20;of&#x20;at&#x20;least&#x20;seven&#x20;characters.&#x20;However,&#x20;if&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;create&#x20;new&#x20;accounts&#x20;bypass&#x20;your&#x20;domainbased&#x20;password&#x20;policies,&#x20;they&#x20;could&#x20;create&#x20;accounts&#x20;with&#x20;blank&#x20;passwords.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;could&#x20;build&#x20;a&#x20;stand-alone&#x20;computer,&#x20;create&#x20;one&#x20;or&#x20;more&#x20;accounts&#x20;with&#x20;blank&#x20;passwords,&#x20;and&#x20;then&#x20;join&#x20;the&#x20;computer&#x20;to&#x20;the&#x20;domain.&#x20;The&#x20;local&#x20;accounts&#x20;with&#x20;blank&#x20;passwords&#x20;would&#x20;still&#x20;function.&#x20;Anyone&#x20;who&#x20;knows&#x20;the&#x20;name&#x20;of&#x20;one&#x20;of&#x20;these&#x20;unprotected&#x20;accounts&#x20;could&#x20;then&#x20;use&#x20;it&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only.','[{\"cis\": [\"2.3.1.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16503,'Ensure&#x20;&#039;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#0','This&#x20;policy&#x20;setting&#x20;allows&#x20;administrators&#x20;to&#x20;enable&#x20;the&#x20;more&#x20;precise&#x20;auditing&#x20;capabilities&#x20;present&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;Audit&#x20;Policy&#x20;settings&#x20;available&#x20;in&#x20;Windows&#x20;Server&#x20;2003&#x20;Active&#x20;Directory&#x20;do&#x20;not&#x20;yet&#x20;contain&#x20;settings&#x20;for&#x20;managing&#x20;the&#x20;new&#x20;auditing&#x20;subcategories.&#x20;To&#x20;properly&#x20;apply&#x20;the&#x20;auditing&#x20;policies&#x20;prescribed&#x20;in&#x20;this&#x20;baseline,&#x20;the&#x20;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#x20;setting&#x20;needs&#x20;to&#x20;be&#x20;configured&#x20;to&#x20;Enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;*Important*:&#x20;Be&#x20;very&#x20;cautious&#x20;about&#x20;audit&#x20;settings&#x20;that&#x20;can&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;traffic.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;enable&#x20;either&#x20;success&#x20;or&#x20;failure&#x20;auditing&#x20;for&#x20;all&#x20;of&#x20;the&#x20;Privilege&#x20;Use&#x20;subcategories,&#x20;the&#x20;high&#x20;volume&#x20;of&#x20;audit&#x20;events&#x20;generated&#x20;can&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;find&#x20;other&#x20;types&#x20;of&#x20;entries&#x20;in&#x20;the&#x20;Security&#x20;log.&#x20;Such&#x20;a&#x20;configuration&#x20;could&#x20;also&#x20;have&#x20;a&#x20;significant&#x20;impact&#x20;on&#x20;system&#x20;performance.','Prior&#x20;to&#x20;the&#x20;introduction&#x20;of&#x20;auditing&#x20;subcategories&#x20;in&#x20;Windows&#x20;Vista,&#x20;it&#x20;was&#x20;difficult&#x20;to&#x20;track&#x20;events&#x20;at&#x20;a&#x20;per-system&#x20;or&#x20;per-user&#x20;level.&#x20;The&#x20;larger&#x20;event&#x20;categories&#x20;created&#x20;too&#x20;many&#x20;events&#x20;and&#x20;the&#x20;key&#x20;information&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;audited&#x20;was&#x20;difficult&#x20;to&#x20;find.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings.','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16504,'Ensure&#x20;&#039;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;system&#x20;shuts&#x20;down&#x20;if&#x20;it&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;Security&#x20;events.&#x20;It&#x20;is&#x20;a&#x20;requirement&#x20;for&#x20;Trusted&#x20;Computer&#x20;System&#x20;Evaluation&#x20;Criteria&#x20;&#40;TCSEC&#41;-C2&#x20;and&#x20;Common&#x20;Criteria&#x20;certification&#x20;to&#x20;prevent&#x20;auditable&#x20;events&#x20;from&#x20;occurring&#x20;if&#x20;the&#x20;audit&#x20;system&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;them.&#x20;Microsoft&#x20;has&#x20;chosen&#x20;to&#x20;meet&#x20;this&#x20;requirement&#x20;by&#x20;halting&#x20;the&#x20;system&#x20;and&#x20;displaying&#x20;a&#x20;stop&#x20;message&#x20;if&#x20;the&#x20;auditing&#x20;system&#x20;experiences&#x20;a&#x20;failure.&#x20;When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;system&#x20;will&#x20;be&#x20;shut&#x20;down&#x20;if&#x20;a&#x20;security&#x20;audit&#x20;cannot&#x20;be&#x20;logged&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;the&#x20;computer&#x20;is&#x20;unable&#x20;to&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;critical&#x20;evidence&#x20;or&#x20;important&#x20;troubleshooting&#x20;information&#x20;may&#x20;not&#x20;be&#x20;available&#x20;for&#x20;review&#x20;after&#x20;a&#x20;security&#x20;incident.&#x20;Also,&#x20;an&#x20;attacker&#x20;could&#x20;potentially&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;Security&#x20;log&#x20;events&#x20;to&#x20;purposely&#x20;force&#x20;a&#x20;computer&#x20;shutdown.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits.','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"10.7\"]}]'),(16505,'Ensure&#x20;&#039;Devices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;NTFS&#x20;media.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;unauthorized&#x20;users&#x20;from&#x20;removing&#x20;data&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;access&#x20;it&#x20;on&#x20;another&#x20;computer&#x20;on&#x20;which&#x20;they&#x20;have&#x20;local&#x20;administrator&#x20;privileges.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators.','Users&#x20;may&#x20;be&#x20;able&#x20;to&#x20;move&#x20;data&#x20;on&#x20;removable&#x20;disks&#x20;to&#x20;a&#x20;different&#x20;computer&#x20;where&#x20;they&#x20;have&#x20;administrative&#x20;privileges.&#x20;The&#x20;user&#x20;could&#x20;then&#x20;take&#x20;ownership&#x20;of&#x20;any&#x20;file,&#x20;grant&#x20;themselves&#x20;full&#x20;control,&#x20;and&#x20;view&#x20;or&#x20;modify&#x20;any&#x20;file.&#x20;The&#x20;fact&#x20;that&#x20;most&#x20;removable&#x20;storage&#x20;devices&#x20;will&#x20;eject&#x20;media&#x20;by&#x20;pressing&#x20;a&#x20;mechanical&#x20;button&#x20;diminishes&#x20;the&#x20;advantage&#x20;of&#x20;this&#x20;policy&#x20;setting.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media.','[{\"cis\": [\"2.3.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16506,'Ensure&#x20;&#039;Devices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','For&#x20;a&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;a&#x20;shared&#x20;printer,&#x20;the&#x20;driver&#x20;for&#x20;that&#x20;shared&#x20;printer&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;This&#x20;security&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;install&#x20;a&#x20;printer&#x20;driver&#x20;as&#x20;part&#x20;of&#x20;connecting&#x20;to&#x20;a&#x20;shared&#x20;printer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;ability&#x20;to&#x20;add&#x20;a&#x20;local&#x20;printer.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;Administrators.','It&#x20;may&#x20;be&#x20;appropriate&#x20;in&#x20;some&#x20;organizations&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;install&#x20;printer&#x20;drivers&#x20;on&#x20;their&#x20;own&#x20;workstations.&#x20;However,&#x20;you&#x20;should&#x20;allow&#x20;only&#x20;Administrators,&#x20;not&#x20;users,&#x20;to&#x20;do&#x20;so&#x20;on&#x20;servers,&#x20;because&#x20;printer&#x20;driver&#x20;installation&#x20;on&#x20;a&#x20;server&#x20;may&#x20;unintentionally&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;become&#x20;less&#x20;stable.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;install&#x20;inappropriate&#x20;printer&#x20;drivers&#x20;in&#x20;a&#x20;deliberate&#x20;attempt&#x20;to&#x20;damage&#x20;the&#x20;computer,&#x20;or&#x20;a&#x20;user&#x20;might&#x20;accidentally&#x20;install&#x20;malicious&#x20;software&#x20;that&#x20;masquerades&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;It&#x20;is&#x20;feasible&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;disguise&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;The&#x20;program&#x20;may&#x20;appear&#x20;to&#x20;users&#x20;as&#x20;if&#x20;they&#x20;must&#x20;use&#x20;it&#x20;to&#x20;print,&#x20;but&#x20;such&#x20;a&#x20;program&#x20;could&#x20;unleash&#x20;malicious&#x20;code&#x20;on&#x20;your&#x20;computer&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers.','[{\"cis\": [\"2.3.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\", \"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\", \"CC5.2\"]}]'),(16507,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;members&#x20;of&#x20;the&#x20;Server&#x20;Operators&#x20;group&#x20;are&#x20;allowed&#x20;to&#x20;submit&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;schedule&#x20;facility.&#x20;The&#x20;impact&#x20;of&#x20;this&#x20;policy&#x20;setting&#x20;configuration&#x20;should&#x20;be&#x20;small&#x20;for&#x20;most&#x20;organizations.&#x20;Users,&#x20;including&#x20;those&#x20;in&#x20;the&#x20;Server&#x20;Operators&#x20;group,&#x20;will&#x20;still&#x20;be&#x20;able&#x20;to&#x20;create&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;Task&#x20;Scheduler&#x20;Wizard,&#x20;but&#x20;those&#x20;jobs&#x20;will&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;with&#x20;which&#x20;the&#x20;user&#x20;authenticates&#x20;when&#x20;they&#x20;set&#x20;up&#x20;the&#x20;job.&#x20;Note:&#x20;An&#x20;AT&#x20;Service&#x20;Account&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;select&#x20;a&#x20;different&#x20;account&#x20;rather&#x20;than&#x20;the&#x20;LOCAL&#x20;SYSTEM&#x20;account.&#x20;To&#x20;change&#x20;the&#x20;account,&#x20;open&#x20;System&#x20;Tools,&#x20;click&#x20;Scheduled&#x20;Tasks,&#x20;and&#x20;then&#x20;click&#x20;Accessories&#x20;folder.&#x20;Then&#x20;click&#x20;AT&#x20;Service&#x20;Account&#x20;on&#x20;the&#x20;Advanced&#x20;menu.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;jobs&#x20;that&#x20;are&#x20;created&#x20;by&#x20;server&#x20;operators&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;service&#x20;will&#x20;execute&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;that&#x20;runs&#x20;that&#x20;service.&#x20;By&#x20;default,&#x20;that&#x20;is&#x20;the&#x20;local&#x20;SYSTEM&#x20;account.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;server&#x20;operators&#x20;could&#x20;perform&#x20;tasks&#x20;that&#x20;SYSTEM&#x20;is&#x20;able&#x20;to&#x20;do&#x20;but&#x20;that&#x20;they&#x20;would&#x20;typically&#x20;not&#x20;be&#x20;able&#x20;to&#x20;do,&#x20;such&#x20;as&#x20;add&#x20;their&#x20;account&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;group.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks.','[{\"cis\": [\"2.3.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16508,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;signing&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;server&#x20;requires&#x20;LDAP&#x20;clients&#x20;to&#x20;negotiate&#x20;data&#x20;signing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;signing.&#x20;Note:&#x20;Domain&#x20;member&#x20;computers&#x20;must&#x20;have&#x20;Network&#x20;security:&#x20;LDAP&#x20;signing&#x20;requirements&#x20;&#40;Rule&#x20;2.3.11.8&#41;&#x20;set&#x20;to&#x20;Negotiate&#x20;signing&#x20;or&#x20;higher.&#x20;If&#x20;not,&#x20;they&#x20;will&#x20;fail&#x20;to&#x20;authenticate&#x20;once&#x20;the&#x20;above&#x20;Require&#x20;signing&#x20;value&#x20;is&#x20;configured&#x20;on&#x20;the&#x20;Domain&#x20;Controllers.&#x20;Fortunately,&#x20;Negotiate&#x20;signing&#x20;is&#x20;the&#x20;default&#x20;in&#x20;the&#x20;client&#x20;configuration.&#x20;Note&#x20;#2:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;shipped&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;LDAP&#x20;simple&#x20;bind&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;to&#x20;talk&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;Note&#x20;#3:&#x20;Before&#x20;enabling&#x20;this&#x20;setting,&#x20;you&#x20;should&#x20;first&#x20;ensure&#x20;that&#x20;there&#x20;are&#x20;no&#x20;clients&#x20;&#40;including&#x20;server-based&#x20;applications&#41;&#x20;that&#x20;are&#x20;configured&#x20;to&#x20;authenticate&#x20;with&#x20;Active&#x20;Directory&#x20;via&#x20;unsigned&#x20;LDAP,&#x20;because&#x20;changing&#x20;this&#x20;setting&#x20;will&#x20;break&#x20;those&#x20;applications.&#x20;Such&#x20;applications&#x20;should&#x20;first&#x20;be&#x20;reconfigured&#x20;to&#x20;use&#x20;signed&#x20;LDAP,&#x20;Secure&#x20;LDAP&#x20;&#40;LDAPS&#41;,&#x20;or&#x20;IPsec-protected&#x20;connections.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;In&#x20;such&#x20;attacks,&#x20;an&#x20;intruder&#x20;captures&#x20;packets&#x20;between&#x20;the&#x20;server&#x20;and&#x20;the&#x20;client,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;client.&#x20;Where&#x20;LDAP&#x20;servers&#x20;are&#x20;concerned,&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;client&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;records&#x20;from&#x20;the&#x20;LDAP&#x20;directory.&#x20;To&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;intrusion&#x20;in&#x20;an&#x20;organization&#039;s&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;could&#x20;implement&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;authentication&#x20;header&#x20;mode&#x20;&#40;AH&#41;,&#x20;which&#x20;performs&#x20;mutual&#x20;authentication&#x20;and&#x20;packet&#x20;integrity&#x20;for&#x20;IP&#x20;traffic&#x20;to&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-&#x20;in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult.&#x20;Additionally,&#x20;allowing&#x20;the&#x20;use&#x20;of&#x20;regular,&#x20;unsigned&#x20;LDAP&#x20;permits&#x20;credentials&#x20;to&#x20;be&#x20;received&#x20;over&#x20;the&#x20;network&#x20;in&#x20;clear&#x20;text,&#x20;which&#x20;could&#x20;very&#x20;easily&#x20;result&#x20;in&#x20;the&#x20;interception&#x20;of&#x20;account&#x20;passwords&#x20;by&#x20;other&#x20;systems&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;signing:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements.','[{\"cis\": [\"2.3.5.2\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16509,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;Domain&#x20;Controllers&#x20;will&#x20;refuse&#x20;requests&#x20;from&#x20;member&#x20;computers&#x20;to&#x20;change&#x20;computer&#x20;account&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;a&#x20;domain,&#x20;domain&#x20;members&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;change&#x20;their&#x20;computer&#x20;account&#x20;passwords,&#x20;and&#x20;those&#x20;passwords&#x20;will&#x20;be&#x20;more&#x20;susceptible&#x20;to&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes.','[{\"cis\": [\"2.3.5.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16510,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;is&#x20;initiated&#x20;by&#x20;the&#x20;domain&#x20;member&#x20;must&#x20;be&#x20;signed&#x20;or&#x20;encrypted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.6.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16511,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;encryption&#x20;for&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;.','[{\"cis\": [\"2.3.6.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16512,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates&#x20;must&#x20;be&#x20;digitally&#x20;signed.&#x20;Digital&#x20;signatures&#x20;protect&#x20;the&#x20;traffic&#x20;from&#x20;being&#x20;modified&#x20;by&#x20;anyone&#x20;who&#x20;captures&#x20;the&#x20;data&#x20;as&#x20;it&#x20;traverses&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;.','[{\"cis\": [\"2.3.6.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16513,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;can&#x20;periodically&#x20;change&#x20;its&#x20;computer&#x20;account&#x20;password.&#x20;Computers&#x20;that&#x20;cannot&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;passwords&#x20;are&#x20;potentially&#x20;vulnerable,&#x20;because&#x20;an&#x20;attacker&#x20;might&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;system&#039;s&#x20;domain&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;default&#x20;configuration&#x20;for&#x20;Windows&#x20;Server&#x20;2003-based&#x20;computers&#x20;that&#x20;belong&#x20;to&#x20;a&#x20;domain&#x20;is&#x20;that&#x20;they&#x20;are&#x20;automatically&#x20;required&#x20;to&#x20;change&#x20;the&#x20;passwords&#x20;for&#x20;their&#x20;accounts&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;computers&#x20;that&#x20;run&#x20;Windows&#x20;Server&#x20;2003&#x20;will&#x20;retain&#x20;the&#x20;same&#x20;passwords&#x20;as&#x20;their&#x20;computer&#x20;accounts.&#x20;Computers&#x20;that&#x20;are&#x20;no&#x20;longer&#x20;able&#x20;to&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;password&#x20;are&#x20;at&#x20;risk&#x20;from&#x20;an&#x20;attacker&#x20;who&#x20;could&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;computer&#039;s&#x20;domain&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes.','[{\"cis\": [\"2.3.6.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16514,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;secure&#x20;channel&#x20;can&#x20;only&#x20;be&#x20;established&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;encrypting&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;&#40;128-bit&#41;&#x20;session&#x20;key.&#x20;To&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;the&#x20;domain&#x20;must&#x20;be&#x20;able&#x20;to&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;key,&#x20;which&#x20;means&#x20;all&#x20;Domain&#x20;Controllers&#x20;must&#x20;be&#x20;running&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;or&#x20;newer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;keys&#x20;that&#x20;are&#x20;used&#x20;to&#x20;establish&#x20;secure&#x20;channel&#x20;communications&#x20;between&#x20;Domain&#x20;Controllers&#x20;and&#x20;member&#x20;computers&#x20;are&#x20;much&#x20;stronger&#x20;in&#x20;Windows&#x20;2000&#x20;than&#x20;they&#x20;were&#x20;in&#x20;previous&#x20;Microsoft&#x20;operating&#x20;systems.&#x20;Whenever&#x20;possible,&#x20;you&#x20;should&#x20;take&#x20;advantage&#x20;of&#x20;these&#x20;stronger&#x20;session&#x20;keys&#x20;to&#x20;help&#x20;protect&#x20;secure&#x20;channel&#x20;communications&#x20;from&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;hijack&#x20;network&#x20;sessions&#x20;and&#x20;eavesdropping.&#x20;&#40;Eavesdropping&#x20;is&#x20;a&#x20;form&#x20;of&#x20;hacking&#x20;in&#x20;which&#x20;network&#x20;data&#x20;is&#x20;read&#x20;or&#x20;altered&#x20;in&#x20;transit.&#x20;The&#x20;data&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;hide&#x20;or&#x20;change&#x20;the&#x20;sender,&#x20;or&#x20;be&#x20;redirected.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key.','[{\"cis\": [\"2.3.6.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16515,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;must&#x20;press&#x20;CTRL+ALT+DEL&#x20;before&#x20;they&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Microsoft&#x20;developed&#x20;this&#x20;feature&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;users&#x20;with&#x20;certain&#x20;types&#x20;of&#x20;physical&#x20;impairments&#x20;to&#x20;log&#x20;on&#x20;to&#x20;computers&#x20;that&#x20;run&#x20;Windows.&#x20;If&#x20;users&#x20;are&#x20;not&#x20;required&#x20;to&#x20;press&#x20;CTRL+ALT+DEL,&#x20;they&#x20;are&#x20;susceptible&#x20;to&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;intercept&#x20;their&#x20;passwords.&#x20;If&#x20;CTRL+ALT+DEL&#x20;is&#x20;required&#x20;before&#x20;logon,&#x20;user&#x20;passwords&#x20;are&#x20;communicated&#x20;by&#x20;means&#x20;of&#x20;a&#x20;trusted&#x20;path.&#x20;An&#x20;attacker&#x20;could&#x20;install&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;that&#x20;looks&#x20;like&#x20;the&#x20;standard&#x20;Windows&#x20;logon&#x20;dialog&#x20;box&#x20;and&#x20;capture&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;attacker&#x20;would&#x20;then&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;compromised&#x20;account&#x20;with&#x20;whatever&#x20;level&#x20;of&#x20;privilege&#x20;that&#x20;user&#x20;has.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL','[{\"cis\": [\"2.3.7.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16516,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;account&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;client&#x20;computers&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;be&#x20;displayed&#x20;in&#x20;each&#x20;computer&#039;s&#x20;respective&#x20;Windows&#x20;logon&#x20;screen.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;intruders&#x20;from&#x20;collecting&#x20;account&#x20;names&#x20;visually&#x20;from&#x20;the&#x20;screens&#x20;of&#x20;desktop&#x20;or&#x20;laptop&#x20;computers&#x20;in&#x20;your&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in.','[{\"cis\": [\"2.3.7.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16517,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;','Windows&#x20;notices&#x20;inactivity&#x20;of&#x20;a&#x20;logon&#x20;session,&#x20;and&#x20;if&#x20;the&#x20;amount&#x20;of&#x20;inactive&#x20;time&#x20;exceeds&#x20;the&#x20;inactivity&#x20;limit,&#x20;then&#x20;the&#x20;screen&#x20;saver&#x20;will&#x20;run,&#x20;locking&#x20;the&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;inactivity&#x20;limit.','If&#x20;a&#x20;user&#x20;forgets&#x20;to&#x20;lock&#x20;their&#x20;computer&#x20;when&#x20;they&#x20;walk&#x20;away&#x20;it&#039;s&#x20;possible&#x20;that&#x20;a&#x20;passerby&#x20;will&#x20;hijack&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;900&#x20;or&#x20;fewer&#x20;seconds,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit.','[{\"cis\": [\"2.3.7.3\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16518,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;4&#x20;or&#x20;few','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;user&#x20;can&#x20;log&#x20;on&#x20;to&#x20;a&#x20;Windows&#x20;domain&#x20;using&#x20;cached&#x20;account&#x20;information.','The&#x20;number&#x20;that&#x20;is&#x20;assigned&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;indicates&#x20;the&#x20;number&#x20;of&#x20;users&#x20;whose&#x20;logon&#x20;information&#x20;the&#x20;computer&#x20;will&#x20;cache&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;.','[{\"cis\": [\"2.3.7.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16519,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;between&#x20;5&#x20;and&#x20;14&#x20;days&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;far&#x20;in&#x20;advance&#x20;users&#x20;are&#x20;warned&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;at&#x20;least&#x20;5&#x20;days&#x20;but&#x20;no&#x20;more&#x20;than&#x20;14&#x20;days&#x20;to&#x20;sufficiently&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;passwords&#x20;will&#x20;expire.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days.','It&#x20;is&#x20;recommended&#x20;that&#x20;user&#x20;passwords&#x20;be&#x20;configured&#x20;to&#x20;expire&#x20;periodically.&#x20;Users&#x20;will&#x20;need&#x20;to&#x20;be&#x20;warned&#x20;that&#x20;their&#x20;passwords&#x20;are&#x20;going&#x20;to&#x20;expire,&#x20;or&#x20;they&#x20;may&#x20;inadvertently&#x20;be&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;computer&#x20;when&#x20;their&#x20;passwords&#x20;expire.&#x20;This&#x20;condition&#x20;could&#x20;lead&#x20;to&#x20;confusion&#x20;for&#x20;users&#x20;who&#x20;access&#x20;the&#x20;network&#x20;locally,&#x20;or&#x20;make&#x20;it&#x20;impossible&#x20;for&#x20;users&#x20;to&#x20;access&#x20;your&#x20;organization&#039;s&#x20;network&#x20;through&#x20;dial-up&#x20;or&#x20;virtual&#x20;private&#x20;network&#x20;&#40;VPN&#41;&#x20;connections.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration.','[{\"cis\": [\"2.3.7.7\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16520,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Logon&#x20;information&#x20;is&#x20;required&#x20;to&#x20;unlock&#x20;a&#x20;locked&#x20;computer.&#x20;For&#x20;domain&#x20;accounts,&#x20;this&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;it&#x20;is&#x20;necessary&#x20;to&#x20;contact&#x20;a&#x20;Domain&#x20;Controller&#x20;to&#x20;unlock&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','By&#x20;default,&#x20;the&#x20;computer&#x20;caches&#x20;in&#x20;memory&#x20;the&#x20;credentials&#x20;of&#x20;any&#x20;users&#x20;who&#x20;are&#x20;authenticated&#x20;locally.&#x20;The&#x20;computer&#x20;uses&#x20;these&#x20;cached&#x20;credentials&#x20;to&#x20;authenticate&#x20;anyone&#x20;who&#x20;attempts&#x20;to&#x20;unlock&#x20;the&#x20;console.&#x20;When&#x20;cached&#x20;credentials&#x20;are&#x20;used,&#x20;any&#x20;changes&#x20;that&#x20;have&#x20;recently&#x20;been&#x20;made&#x20;to&#x20;the&#x20;account&#x20;-&#x20;such&#x20;as&#x20;user&#x20;rights&#x20;assignments,&#x20;account&#x20;lockout,&#x20;or&#x20;the&#x20;account&#x20;being&#x20;disabled&#x20;-&#x20;are&#x20;not&#x20;considered&#x20;or&#x20;applied&#x20;after&#x20;the&#x20;account&#x20;is&#x20;authenticated.&#x20;User&#x20;privileges&#x20;are&#x20;not&#x20;updated,&#x20;and&#x20;&#40;more&#x20;importantly&#41;&#x20;disabled&#x20;accounts&#x20;are&#x20;still&#x20;able&#x20;to&#x20;unlock&#x20;the&#x20;console&#x20;of&#x20;the&#x20;computer.','','To&#x20;implement&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation','[{\"cis\": [\"2.3.7.8\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16521,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Lock&#x20;Workstation&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;happens&#x20;when&#x20;the&#x20;smart&#x20;card&#x20;for&#x20;a&#x20;logged-on&#x20;user&#x20;is&#x20;removed&#x20;from&#x20;the&#x20;smart&#x20;card&#x20;reader.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Lock&#x20;Workstation.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Users&#x20;sometimes&#x20;forget&#x20;to&#x20;lock&#x20;their&#x20;workstations&#x20;when&#x20;they&#x20;are&#x20;away&#x20;from&#x20;them,&#x20;allowing&#x20;the&#x20;possibility&#x20;for&#x20;malicious&#x20;users&#x20;to&#x20;access&#x20;their&#x20;computers.&#x20;If&#x20;smart&#x20;cards&#x20;are&#x20;used&#x20;for&#x20;authentication,&#x20;the&#x20;computer&#x20;should&#x20;automatically&#x20;lock&#x20;itself&#x20;when&#x20;the&#x20;card&#x20;is&#x20;removed&#x20;to&#x20;ensure&#x20;that&#x20;only&#x20;the&#x20;user&#x20;with&#x20;the&#x20;smart&#x20;card&#x20;is&#x20;accessing&#x20;resources&#x20;using&#x20;those&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Lock&#x20;Workstation&#x20;&#40;or,&#x20;if&#x20;applicable&#x20;for&#x20;your&#x20;environment,&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior.','[{\"cis\": [\"2.3.7.9\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16522,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;client&#x20;component.&#x20;Note:&#x20;When&#x20;Windows&#x20;Vista-based&#x20;computers&#x20;have&#x20;this&#x20;policy&#x20;setting&#x20;enabled&#x20;and&#x20;they&#x20;connect&#x20;to&#x20;file&#x20;or&#x20;print&#x20;shares&#x20;on&#x20;remote&#x20;servers,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;setting&#x20;is&#x20;synchronized&#x20;with&#x20;its&#x20;companion&#x20;setting,&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;,&#x20;on&#x20;those&#x20;servers.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;these&#x20;settings,&#x20;see&#x20;the&#x20;&#039;Microsoft&#x20;network&#x20;client&#x20;and&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;four&#x20;related&#x20;settings&#41;&#039;&#x20;section&#x20;in&#x20;Chapter&#x20;5&#x20;of&#x20;the&#x20;Threats&#x20;and&#x20;Countermeasures&#x20;guide.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.8.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16523,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;attempt&#x20;to&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing.&#x20;Note:&#x20;Enabling&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;makes&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;.','[{\"cis\": [\"2.3.8.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16524,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;redirector&#x20;will&#x20;send&#x20;plaintext&#x20;passwords&#x20;during&#x20;authentication&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#x20;that&#x20;do&#x20;not&#x20;support&#x20;password&#x20;encryption.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;strong&#x20;business&#x20;case&#x20;to&#x20;enable&#x20;it.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;unencrypted&#x20;passwords&#x20;will&#x20;be&#x20;allowed&#x20;across&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;the&#x20;server&#x20;can&#x20;transmit&#x20;passwords&#x20;in&#x20;plaintext&#x20;across&#x20;the&#x20;network&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;offer&#x20;SMB&#x20;services,&#x20;which&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;risk.&#x20;These&#x20;other&#x20;computers&#x20;may&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;SMB&#x20;security&#x20;mechanisms&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;Server&#x20;2003.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers.','[{\"cis\": [\"2.3.8.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16525,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;amount&#x20;of&#x20;continuous&#x20;idle&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;in&#x20;an&#x20;SMB&#x20;session&#x20;before&#x20;the&#x20;session&#x20;is&#x20;suspended&#x20;because&#x20;of&#x20;inactivity.&#x20;Administrators&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;control&#x20;when&#x20;a&#x20;computer&#x20;suspends&#x20;an&#x20;inactive&#x20;SMB&#x20;session.&#x20;If&#x20;client&#x20;activity&#x20;resumes,&#x20;the&#x20;session&#x20;is&#x20;automatically&#x20;reestablished.&#x20;A&#x20;value&#x20;of&#x20;0&#x20;appears&#x20;to&#x20;allow&#x20;sessions&#x20;to&#x20;persist&#x20;indefinitely.&#x20;The&#x20;maximum&#x20;value&#x20;is&#x20;99999,&#x20;which&#x20;is&#x20;over&#x20;69&#x20;days;&#x20;in&#x20;effect,&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&#x20;0.','Each&#x20;SMB&#x20;session&#x20;consumes&#x20;server&#x20;resources,&#x20;and&#x20;numerous&#x20;null&#x20;sessions&#x20;will&#x20;slow&#x20;the&#x20;server&#x20;or&#x20;possibly&#x20;cause&#x20;it&#x20;to&#x20;fail.&#x20;An&#x20;attacker&#x20;could&#x20;repeatedly&#x20;establish&#x20;SMB&#x20;sessions&#x20;until&#x20;the&#x20;server&#039;s&#x20;SMB&#x20;services&#x20;become&#x20;slow&#x20;or&#x20;unresponsive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session.','[{\"cis\": [\"2.3.9.1\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16526,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;server&#x20;component.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;in&#x20;a&#x20;mixed&#x20;environment&#x20;to&#x20;prevent&#x20;downstream&#x20;clients&#x20;from&#x20;using&#x20;the&#x20;workstation&#x20;as&#x20;a&#x20;network&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;.','[{\"cis\": [\"2.3.9.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16527,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;server&#x20;will&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing&#x20;with&#x20;clients&#x20;that&#x20;request&#x20;it.&#x20;If&#x20;no&#x20;signing&#x20;request&#x20;comes&#x20;from&#x20;the&#x20;client,&#x20;a&#x20;connection&#x20;will&#x20;be&#x20;allowed&#x20;without&#x20;a&#x20;signature&#x20;if&#x20;the&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#x20;setting&#x20;is&#x20;not&#x20;enabled.&#x20;Note:&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;to&#x20;make&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;.','[{\"cis\": [\"2.3.9.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16528,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.11.6&#41;.&#x20;If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;necessary&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;effective.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;then&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting.&#x20;Otherwise,&#x20;users&#x20;who&#x20;should&#x20;not&#x20;have&#x20;access&#x20;to&#x20;network&#x20;resources&#x20;outside&#x20;of&#x20;their&#x20;logon&#x20;hours&#x20;may&#x20;actually&#x20;be&#x20;able&#x20;to&#x20;continue&#x20;to&#x20;use&#x20;those&#x20;resources&#x20;with&#x20;sessions&#x20;that&#x20;were&#x20;established&#x20;during&#x20;allowed&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire.','[{\"cis\": [\"2.3.9.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16529,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;level&#x20;of&#x20;validation&#x20;a&#x20;computer&#x20;with&#x20;shared&#x20;folders&#x20;or&#x20;printers&#x20;&#40;the&#x20;server&#41;&#x20;performs&#x20;on&#x20;the&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;that&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;client&#x20;computer&#x20;when&#x20;it&#x20;establishes&#x20;a&#x20;session&#x20;using&#x20;the&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;The&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;provides&#x20;the&#x20;basis&#x20;for&#x20;file&#x20;and&#x20;print&#x20;sharing&#x20;and&#x20;other&#x20;networking&#x20;operations,&#x20;such&#x20;as&#x20;remote&#x20;Windows&#x20;administration.&#x20;The&#x20;SMB&#x20;protocol&#x20;supports&#x20;validating&#x20;the&#x20;SMB&#x20;server&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;within&#x20;the&#x20;authentication&#x20;blob&#x20;provided&#x20;by&#x20;a&#x20;SMB&#x20;client&#x20;to&#x20;prevent&#x20;a&#x20;class&#x20;of&#x20;attacks&#x20;against&#x20;SMB&#x20;servers&#x20;referred&#x20;to&#x20;as&#x20;SMB&#x20;relay&#x20;attacks.&#x20;This&#x20;setting&#x20;will&#x20;affect&#x20;both&#x20;SMB1&#x20;and&#x20;SMB2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.&#x20;Note:&#x20;Since&#x20;the&#x20;release&#x20;of&#x20;the&#x20;MS&#x20;KB3161561&#x20;security&#x20;patch,&#x20;this&#x20;setting&#x20;can&#x20;cause&#x20;significant&#x20;issues&#x20;&#40;such&#x20;as&#x20;replication&#x20;problems,&#x20;group&#x20;policy&#x20;editing&#x20;issues&#x20;and&#x20;blue&#x20;screen&#x20;crashes&#41;&#x20;on&#x20;Domain&#x20;Controllers&#x20;when&#x20;used&#x20;simultaneously&#x20;with&#x20;UNC&#x20;path&#x20;hardening&#x20;&#40;i.e.&#x20;Rule&#x20;18.5.14.1&#41;.&#x20;CIS&#x20;therefore&#x20;recommends&#x20;against&#x20;deploying&#x20;this&#x20;setting&#x20;on&#x20;Domain&#x20;Controllers.','The&#x20;identity&#x20;of&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;spoofed&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;network&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;&#40;configuring&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level.','[{\"cis\": [\"2.3.9.5\"]}, {\"cis_csc\": [\"14\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16530,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;the&#x20;accounts&#x20;in&#x20;the&#x20;Security&#x20;Accounts&#x20;Manager&#x20;&#40;SAM&#41;.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;with&#x20;anonymous&#x20;connections&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;allows&#x20;additional&#x20;restrictions&#x20;on&#x20;anonymous&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts.','[{\"cis\": [\"2.3.10.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16531,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;SAM&#x20;accounts&#x20;as&#x20;well&#x20;as&#x20;shares.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;anonymous&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;and&#x20;network&#x20;share&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;U&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares.','[{\"cis\": [\"2.3.10.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16532,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Credential&#x20;Manager&#x20;&#40;formerly&#x20;called&#x20;Stored&#x20;User&#x20;Names&#x20;and&#x20;Passwords&#41;&#x20;saves&#x20;passwords&#x20;or&#x20;credentials&#x20;for&#x20;later&#x20;use&#x20;when&#x20;it&#x20;gains&#x20;domain&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Changes&#x20;to&#x20;this&#x20;setting&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;Windows&#x20;is&#x20;restarted.','Passwords&#x20;that&#x20;are&#x20;cached&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;the&#x20;user&#x20;when&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;computer.&#x20;Although&#x20;this&#x20;information&#x20;may&#x20;sound&#x20;obvious,&#x20;a&#x20;problem&#x20;can&#x20;arise&#x20;if&#x20;the&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;reads&#x20;the&#x20;passwords&#x20;and&#x20;forwards&#x20;them&#x20;to&#x20;another,&#x20;unauthorized&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication.','[{\"cis\": [\"2.3.10.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16533,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;additional&#x20;permissions&#x20;are&#x20;assigned&#x20;for&#x20;anonymous&#x20;connections&#x20;to&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords,&#x20;perform&#x20;social&#x20;engineering&#x20;attacks,&#x20;or&#x20;launch&#x20;DoS&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users.','[{\"cis\": [\"2.3.10.5\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16534,'Configure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&#40;Domain&#x20;Controller&#41;&#x20;LSARPC,&#x20;NETLOGON,&#x20;SAMR&#x20;&#40;Member&#x20;Server&#41;&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;,&#x20;or&#x20;&#40;when&#x20;the&#x20;legacy&#x20;Computer&#x20;Browser&#x20;service&#x20;is&#x20;enabled&#41;&#x20;BROWSER.&#x20;Note:&#x20;A&#x20;Member&#x20;Server&#x20;that&#x20;holds&#x20;the&#x20;Remote&#x20;Desktop&#x20;Services&#x20;Role&#x20;with&#x20;Remote&#x20;Desktop&#x20;Licensing&#x20;Role&#x20;Service&#x20;will&#x20;require&#x20;a&#x20;special&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;allow&#x20;the&#x20;HydraLSPipe&#x20;and&#x20;TermServLicensing&#x20;Named&#x20;Pipes&#x20;to&#x20;be&#x20;accessed&#x20;anonymously.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously.','[{\"cis\": [\"2.3.10.6\"]}, {\"cis_csc\": [\"14.1\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16535,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;There&#x20;was&#x20;a&#x20;setting&#x20;with&#x20;that&#x20;name&#x20;in&#x20;Windows&#x20;XP,&#x20;but&#x20;it&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-&#x20;paths&#039;&#x20;in&#x20;Windows&#x20;Server&#x20;2003,&#x20;Windows&#x20;Vista,&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.','The&#x20;registry&#x20;is&#x20;a&#x20;database&#x20;that&#x20;contains&#x20;computer&#x20;configuration&#x20;information,&#x20;and&#x20;much&#x20;of&#x20;the&#x20;information&#x20;is&#x20;sensitive.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;information&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack,&#x20;suitable&#x20;ACLs&#x20;are&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;to&#x20;help&#x20;protect&#x20;it&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlProductOptions&#x20;|&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths.','[{\"cis\": [\"2.3.10.8\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16536,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;In&#x20;Windows&#x20;XP&#x20;this&#x20;setting&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths,&#039;&#x20;the&#x20;setting&#x20;with&#x20;that&#x20;same&#x20;name&#x20;in&#x20;Windows&#x20;Vista,&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;and&#x20;Windows&#x20;Server&#x20;2003&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.','The&#x20;registry&#x20;contains&#x20;sensitive&#x20;computer&#x20;configuration&#x20;information&#x20;that&#x20;could&#x20;be&#x20;used&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;The&#x20;fact&#x20;that&#x20;the&#x20;default&#x20;ACLs&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;are&#x20;fairly&#x20;restrictive&#x20;and&#x20;help&#x20;to&#x20;protect&#x20;the&#x20;registry&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;|&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;|&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;|&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;|&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;|&#x20;SystemCurrentControlSetServicesSysmonLog&#x20;|&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;|&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;|&#x20;and&#x20;sub-paths.&#x20;When&#x20;a&#x20;server&#x20;holds&#x20;the&#x20;Active&#x20;Directory&#x20;Certificate&#x20;Services&#x20;Role&#x20;with&#x20;Certification&#x20;Authority&#x20;Role&#x20;Service,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesCertSvc.&#x20;When&#x20;a&#x20;server&#x20;has&#x20;the&#x20;WINS&#x20;Server&#x20;Feature&#x20;installed,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesWINS','[{\"cis\": [\"2.3.10.9\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16537,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','When&#x20;enabled,&#x20;this&#x20;policy&#x20;setting&#x20;restricts&#x20;anonymous&#x20;access&#x20;to&#x20;only&#x20;those&#x20;shares&#x20;and&#x20;pipes&#x20;that&#x20;are&#x20;named&#x20;in&#x20;the&#x20;Network&#x20;access:&#x20;Named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;and&#x20;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;settings.&#x20;This&#x20;policy&#x20;setting&#x20;controls&#x20;null&#x20;session&#x20;access&#x20;to&#x20;shares&#x20;on&#x20;your&#x20;computers&#x20;by&#x20;adding&#x20;RestrictNullSessAccess&#x20;with&#x20;the&#x20;value&#x20;1&#x20;in&#x20;the&#x20;HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParameters&#x20;registry&#x20;key.&#x20;This&#x20;registry&#x20;value&#x20;toggles&#x20;null&#x20;session&#x20;shares&#x20;on&#x20;or&#x20;off&#x20;to&#x20;control&#x20;whether&#x20;the&#x20;server&#x20;service&#x20;restricts&#x20;unauthenticated&#x20;clients&#039;&#x20;access&#x20;to&#x20;named&#x20;resources.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Null&#x20;sessions&#x20;are&#x20;a&#x20;weakness&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;through&#x20;shares&#x20;&#40;including&#x20;the&#x20;default&#x20;shares&#41;&#x20;on&#x20;computers&#x20;in&#x20;your&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares.','[{\"cis\": [\"2.3.10.10\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16538,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;remote&#x20;RPC&#x20;connections&#x20;to&#x20;SAM.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#x20;.&#x20;Note:&#x20;A&#x20;Windows&#x20;10&#x20;R1607,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','To&#x20;ensure&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;cannot&#x20;anonymously&#x20;list&#x20;local&#x20;account&#x20;names&#x20;or&#x20;groups&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM','[{\"cis\": [\"2.3.10.11\"]}, {\"cis_csc\": [\"5.1\", \"9.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16539,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;network&#x20;shares&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;anonymous&#x20;users.&#x20;The&#x20;default&#x20;configuration&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;has&#x20;little&#x20;effect&#x20;because&#x20;all&#x20;users&#x20;have&#x20;to&#x20;be&#x20;authenticated&#x20;before&#x20;they&#x20;can&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;','It&#x20;is&#x20;very&#x20;dangerous&#x20;to&#x20;allow&#x20;any&#x20;values&#x20;in&#x20;this&#x20;setting.&#x20;Any&#x20;shares&#x20;that&#x20;are&#x20;listed&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;any&#x20;network&#x20;user,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously.','[{\"cis\": [\"2.3.10.12\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16540,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;network&#x20;logons&#x20;that&#x20;use&#x20;local&#x20;accounts&#x20;are&#x20;authenticated.&#x20;The&#x20;Classic&#x20;option&#x20;allows&#x20;precise&#x20;control&#x20;over&#x20;access&#x20;to&#x20;resources,&#x20;including&#x20;the&#x20;ability&#x20;to&#x20;assign&#x20;different&#x20;types&#x20;of&#x20;access&#x20;to&#x20;different&#x20;users&#x20;for&#x20;the&#x20;same&#x20;resource.&#x20;The&#x20;Guest&#x20;only&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;treat&#x20;all&#x20;users&#x20;equally.&#x20;In&#x20;this&#x20;context,&#x20;all&#x20;users&#x20;authenticate&#x20;as&#x20;Guest&#x20;only&#x20;to&#x20;receive&#x20;the&#x20;same&#x20;access&#x20;level&#x20;to&#x20;a&#x20;given&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;interactive&#x20;logons&#x20;that&#x20;are&#x20;performed&#x20;remotely&#x20;by&#x20;using&#x20;such&#x20;services&#x20;as&#x20;Telnet&#x20;or&#x20;Remote&#x20;Desktop&#x20;Services&#x20;&#40;formerly&#x20;called&#x20;Terminal&#x20;Services&#41;','With&#x20;the&#x20;Guest&#x20;only&#x20;model,&#x20;any&#x20;user&#x20;who&#x20;can&#x20;authenticate&#x20;to&#x20;your&#x20;computer&#x20;over&#x20;the&#x20;network&#x20;does&#x20;so&#x20;with&#x20;guest&#x20;privileges,&#x20;which&#x20;probably&#x20;means&#x20;that&#x20;they&#x20;will&#x20;not&#x20;have&#x20;write&#x20;access&#x20;to&#x20;shared&#x20;resources&#x20;on&#x20;that&#x20;computer.&#x20;Although&#x20;this&#x20;restriction&#x20;does&#x20;increase&#x20;security,&#x20;it&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;authorized&#x20;users&#x20;to&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;those&#x20;computers&#x20;because&#x20;ACLs&#x20;on&#x20;those&#x20;resources&#x20;must&#x20;include&#x20;access&#x20;control&#x20;entries&#x20;&#40;ACEs&#41;&#x20;for&#x20;the&#x20;Guest&#x20;account.&#x20;With&#x20;the&#x20;Classic&#x20;model,&#x20;local&#x20;accounts&#x20;should&#x20;be&#x20;password&#x20;protected.&#x20;Otherwise,&#x20;if&#x20;Guest&#x20;access&#x20;is&#x20;enabled,&#x20;anyone&#x20;can&#x20;use&#x20;those&#x20;user&#x20;accounts&#x20;to&#x20;access&#x20;shared&#x20;system&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts.','[{\"cis\": [\"2.3.10.13\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1.3\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16541,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Local&#x20;System&#x20;services&#x20;that&#x20;use&#x20;Negotiate&#x20;when&#x20;reverting&#x20;to&#x20;NTLM&#x20;authentication&#x20;can&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;This&#x20;policy&#x20;is&#x20;supported&#x20;on&#x20;at&#x20;least&#x20;Windows&#x20;7&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;R2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;connecting&#x20;to&#x20;computers&#x20;running&#x20;versions&#x20;of&#x20;Windows&#x20;earlier&#x20;than&#x20;Windows&#x20;Vista&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;services&#x20;running&#x20;as&#x20;Local&#x20;System&#x20;and&#x20;using&#x20;SPNEGO&#x20;&#40;Negotiate&#41;&#x20;that&#x20;revert&#x20;to&#x20;NTLM&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;In&#x20;Windows&#x20;7,&#x20;if&#x20;you&#x20;are&#x20;connecting&#x20;to&#x20;a&#x20;computer&#x20;running&#x20;Windows&#x20;Server&#x20;2008&#x20;or&#x20;Windows&#x20;Vista,&#x20;then&#x20;a&#x20;system&#x20;service&#x20;uses&#x20;either&#x20;the&#x20;computer&#x20;identity&#x20;or&#x20;a&#x20;NULL&#x20;session.&#x20;When&#x20;connecting&#x20;with&#x20;a&#x20;NULL&#x20;session,&#x20;a&#x20;system-generated&#x20;session&#x20;key&#x20;is&#x20;created,&#x20;which&#x20;provides&#x20;no&#x20;protection&#x20;but&#x20;allows&#x20;applications&#x20;to&#x20;sign&#x20;and&#x20;encrypt&#x20;data&#x20;without&#x20;errors.&#x20;When&#x20;connecting&#x20;with&#x20;the&#x20;computer&#x20;identity,&#x20;both&#x20;signing&#x20;and&#x20;encryption&#x20;is&#x20;supported&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;data&#x20;protection.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM.','[{\"cis\": [\"2.3.11.1\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16542,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;NTLM&#x20;is&#x20;allowed&#x20;to&#x20;fall&#x20;back&#x20;to&#x20;a&#x20;NULL&#x20;session&#x20;when&#x20;used&#x20;with&#x20;LocalSystem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','NULL&#x20;sessions&#x20;are&#x20;less&#x20;secure&#x20;because&#x20;by&#x20;definition&#x20;they&#x20;are&#x20;unauthenticated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback.','[{\"cis\": [\"2.3.11.2\"]}, {\"cis_csc\": [\"14\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16543,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;determines&#x20;if&#x20;online&#x20;identities&#x20;are&#x20;able&#x20;to&#x20;authenticate&#x20;to&#x20;this&#x20;computer.&#x20;The&#x20;Public&#x20;Key&#x20;Cryptography&#x20;Based&#x20;User-to-User&#x20;&#40;PKU2U&#41;&#x20;protocol&#x20;introduced&#x20;in&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;R2&#x20;is&#x20;implemented&#x20;as&#x20;a&#x20;security&#x20;support&#x20;provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;enables&#x20;peer-to-peer&#x20;authentication,&#x20;particularly&#x20;through&#x20;the&#x20;Windows&#x20;7&#x20;media&#x20;and&#x20;file&#x20;sharing&#x20;feature&#x20;called&#x20;Homegroup,&#x20;which&#x20;permits&#x20;sharing&#x20;between&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;members&#x20;of&#x20;a&#x20;domain.&#x20;With&#x20;PKU2U,&#x20;a&#x20;new&#x20;extension&#x20;was&#x20;introduced&#x20;to&#x20;the&#x20;Negotiate&#x20;authentication&#x20;package,&#x20;Spnego.dll.&#x20;In&#x20;previous&#x20;versions&#x20;of&#x20;Windows,&#x20;Negotiate&#x20;decided&#x20;whether&#x20;to&#x20;use&#x20;Kerberos&#x20;or&#x20;NTLM&#x20;for&#x20;authentication.&#x20;The&#x20;extension&#x20;SSP&#x20;for&#x20;Negotiate,&#x20;Negoexts.dll,&#x20;which&#x20;is&#x20;treated&#x20;as&#x20;an&#x20;authentication&#x20;protocol&#x20;by&#x20;Windows,&#x20;supports&#x20;Microsoft&#x20;SSPs&#x20;including&#x20;PKU2U.&#x20;When&#x20;computers&#x20;are&#x20;configured&#x20;to&#x20;accept&#x20;authentication&#x20;requests&#x20;by&#x20;using&#x20;online&#x20;IDs,&#x20;Negoexts.dll&#x20;calls&#x20;the&#x20;PKU2U&#x20;SSP&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;PKU2U&#x20;SSP&#x20;obtains&#x20;a&#x20;local&#x20;certificate&#x20;and&#x20;exchanges&#x20;the&#x20;policy&#x20;between&#x20;the&#x20;peer&#x20;computers.&#x20;When&#x20;validated&#x20;on&#x20;the&#x20;peer&#x20;computer,&#x20;the&#x20;certificate&#x20;within&#x20;the&#x20;metadata&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;logon&#x20;peer&#x20;for&#x20;validation&#x20;and&#x20;associates&#x20;the&#x20;user&#039;s&#x20;certificate&#x20;to&#x20;a&#x20;security&#x20;token&#x20;and&#x20;the&#x20;logon&#x20;process&#x20;completes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;PKU2U&#x20;protocol&#x20;is&#x20;a&#x20;peer-to-peer&#x20;authentication&#x20;protocol&#x20;-&#x20;authentication&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;in&#x20;most&#x20;managed&#x20;networks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities.','[{\"cis\": [\"2.3.11.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16544,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;RC4_HMAC_MD5,&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;t','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;encryption&#x20;types&#x20;that&#x20;Kerberos&#x20;is&#x20;allowed&#x20;to&#x20;use.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types.&#x20;Note:&#x20;Some&#x20;legacy&#x20;applications&#x20;and&#x20;OSes&#x20;may&#x20;require&#x20;RC4_HMAC_MD5&#x20;-&#x20;we&#x20;recommend&#x20;you&#x20;test&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;verify&#x20;whether&#x20;you&#x20;can&#x20;safely&#x20;remove&#x20;it.&#x20;For&#x20;the&#x20;purposes&#x20;of&#x20;scoring&#x20;we&#x20;have&#x20;allowed&#x20;the&#x20;use&#x20;of&#x20;RC4_HMAC_MD5&#x20;as&#x20;an&#x20;optional&#x20;setting.','The&#x20;strength&#x20;of&#x20;each&#x20;encryption&#x20;algorithm&#x20;varies&#x20;from&#x20;one&#x20;to&#x20;the&#x20;next,&#x20;choosing&#x20;stronger&#x20;algorithms&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;compromise&#x20;however&#x20;doing&#x20;so&#x20;may&#x20;cause&#x20;issues&#x20;when&#x20;the&#x20;computer&#x20;attempts&#x20;to&#x20;authenticate&#x20;with&#x20;systems&#x20;that&#x20;do&#x20;not&#x20;support&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos.','[{\"cis\": [\"2.3.11.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(16545,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;hash&#x20;value&#x20;for&#x20;the&#x20;new&#x20;password&#x20;is&#x20;stored&#x20;when&#x20;the&#x20;password&#x20;is&#x20;changed.&#x20;The&#x20;LM&#x20;hash&#x20;is&#x20;relatively&#x20;weak&#x20;and&#x20;prone&#x20;to&#x20;attack&#x20;compared&#x20;to&#x20;the&#x20;cryptographically&#x20;stronger&#x20;Microsoft&#x20;Windows&#x20;NT&#x20;hash.&#x20;Since&#x20;LM&#x20;hashes&#x20;are&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;in&#x20;the&#x20;security&#x20;database,&#x20;passwords&#x20;can&#x20;then&#x20;be&#x20;easily&#x20;compromised&#x20;if&#x20;the&#x20;database&#x20;is&#x20;attacked.&#x20;Note:&#x20;Older&#x20;operating&#x20;systems&#x20;and&#x20;some&#x20;third-party&#x20;applications&#x20;may&#x20;fail&#x20;when&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled.&#x20;Also,&#x20;note&#x20;that&#x20;the&#x20;password&#x20;will&#x20;need&#x20;to&#x20;be&#x20;changed&#x20;on&#x20;all&#x20;accounts&#x20;after&#x20;you&#x20;enable&#x20;this&#x20;setting&#x20;to&#x20;gain&#x20;the&#x20;proper&#x20;benefit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;SAM&#x20;file&#x20;can&#x20;be&#x20;targeted&#x20;by&#x20;attackers&#x20;who&#x20;seek&#x20;access&#x20;to&#x20;username&#x20;and&#x20;password&#x20;hashes.&#x20;Such&#x20;attacks&#x20;use&#x20;special&#x20;tools&#x20;to&#x20;crack&#x20;passwords,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;users&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;resources&#x20;on&#x20;your&#x20;network.&#x20;These&#x20;types&#x20;of&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;prevented&#x20;if&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;but&#x20;it&#x20;will&#x20;be&#x20;much&#x20;more&#x20;difficult&#x20;for&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;to&#x20;succeed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change.','[{\"cis\": [\"2.3.11.5\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16546,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.9.4&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;unscored&#x20;because&#x20;there&#x20;is&#x20;not&#x20;a&#x20;documented&#x20;registry&#x20;value&#x20;that&#x20;corresponds&#x20;to&#x20;it.&#x20;We&#x20;still&#x20;strongly&#x20;encourage&#x20;that&#x20;it&#x20;be&#x20;configured&#x20;as&#x20;Enabled,&#x20;to&#x20;ensure&#x20;that&#x20;logon&#x20;hours&#x20;&#40;when&#x20;configured&#41;&#x20;are&#x20;properly&#x20;enforced.','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;a&#x20;user&#x20;could&#x20;remain&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;outside&#x20;of&#x20;their&#x20;allotted&#x20;logon&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire.','[{\"cis\": [\"2.3.11.6\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16547,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM&#039;','LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;was&#x20;a&#x20;family&#x20;of&#x20;early&#x20;Microsoft&#x20;client/server&#x20;software&#x20;&#40;predating&#x20;Windows&#x20;NT&#41;&#x20;that&#x20;allowed&#x20;users&#x20;to&#x20;link&#x20;personal&#x20;computers&#x20;together&#x20;on&#x20;a&#x20;single&#x20;network.&#x20;LM&#x20;network&#x20;capabilities&#x20;included&#x20;transparent&#x20;file&#x20;and&#x20;print&#x20;sharing,&#x20;user&#x20;security&#x20;features,&#x20;and&#x20;network&#x20;administration&#x20;tools.&#x20;In&#x20;Active&#x20;Directory&#x20;domains,&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;the&#x20;default&#x20;authentication&#x20;protocol.&#x20;However,&#x20;if&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;not&#x20;negotiated&#x20;for&#x20;some&#x20;reason,&#x20;Active&#x20;Directory&#x20;will&#x20;use&#x20;LM,&#x20;NTLM,&#x20;or&#x20;NTLMv2.&#x20;LAN&#x20;Manager&#x20;authentication&#x20;includes&#x20;the&#x20;LM,&#x20;NTLM,&#x20;and&#x20;NTLM&#x20;version&#x20;2&#x20;&#40;NTLMv2&#41;&#x20;variants,&#x20;and&#x20;is&#x20;the&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;to&#x20;authenticate&#x20;all&#x20;Windows&#x20;clients&#x20;when&#x20;they&#x20;perform&#x20;the&#x20;following&#x20;operations:&#x20;-Join&#x20;a&#x20;domain&#x20;-Authenticate&#x20;between&#x20;Active&#x20;Directory&#x20;forests&#x20;-Authenticate&#x20;to&#x20;down-level&#x20;domains&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;do&#x20;not&#x20;run&#x20;Windows&#x20;2000,&#x20;Windows&#x20;Server&#x20;2003,&#x20;or&#x20;Windows&#x20;XP&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;in&#x20;the&#x20;domain.&#x20;The&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#x20;setting&#x20;determines&#x20;which&#x20;challenge/response&#x20;authentication&#x20;protocol&#x20;is&#x20;used&#x20;for&#x20;network&#x20;logons.&#x20;This&#x20;choice&#x20;affects&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;protocol&#x20;used&#x20;by&#x20;clients,&#x20;the&#x20;level&#x20;of&#x20;session&#x20;security&#x20;negotiated,&#x20;and&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;accepted&#x20;by&#x20;servers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM.','Windows&#x20;2000&#x20;and&#x20;Windows&#x20;XP&#x20;clients&#x20;were&#x20;configured&#x20;by&#x20;default&#x20;to&#x20;send&#x20;LM&#x20;and&#x20;NTLM&#x20;authentication&#x20;responses&#x20;&#40;Windows&#x20;95-based&#x20;and&#x20;Windows&#x20;98-based&#x20;clients&#x20;only&#x20;send&#x20;LM&#41;.&#x20;The&#x20;default&#x20;settings&#x20;in&#x20;OSes&#x20;predating&#x20;Windows&#x20;Vista&#x20;/&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-&#x20;R2&#41;&#x20;allowed&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;with&#x20;servers&#x20;and&#x20;use&#x20;their&#x20;resources.&#x20;However,&#x20;this&#x20;meant&#x20;that&#x20;LM&#x20;responses&#x20;-&#x20;the&#x20;weakest&#x20;form&#x20;of&#x20;authentication&#x20;response&#x20;-&#x20;were&#x20;sent&#x20;over&#x20;the&#x20;network,&#x20;and&#x20;it&#x20;was&#x20;potentially&#x20;possible&#x20;for&#x20;attackers&#x20;to&#x20;sniff&#x20;that&#x20;traffic&#x20;to&#x20;more&#x20;easily&#x20;reproduce&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;operating&#x20;systems&#x20;cannot&#x20;use&#x20;the&#x20;Kerberos&#x20;version&#x20;5&#x20;protocol&#x20;for&#x20;authentication.&#x20;For&#x20;this&#x20;reason,&#x20;in&#x20;a&#x20;Windows&#x20;Server&#x20;2003&#x20;domain,&#x20;these&#x20;computers&#x20;authenticate&#x20;by&#x20;default&#x20;with&#x20;both&#x20;the&#x20;LM&#x20;and&#x20;NTLM&#x20;protocols&#x20;for&#x20;network&#x20;authentication.&#x20;You&#x20;can&#x20;enforce&#x20;a&#x20;more&#x20;secure&#x20;authentication&#x20;protocol&#x20;for&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;by&#x20;using&#x20;NTLMv2.&#x20;For&#x20;the&#x20;logon&#x20;process,&#x20;NTLMv2&#x20;uses&#x20;a&#x20;secure&#x20;channel&#x20;to&#x20;protect&#x20;the&#x20;authentication&#x20;process.&#x20;Even&#x20;if&#x20;you&#x20;use&#x20;NTLMv2&#x20;for&#x20;older&#x20;clients&#x20;and&#x20;servers,&#x20;Windows-based&#x20;clients&#x20;and&#x20;servers&#x20;that&#x20;are&#x20;members&#x20;of&#x20;the&#x20;domain&#x20;will&#x20;use&#x20;the&#x20;Kerberos&#x20;authentication&#x20;protocol&#x20;to&#x20;authenticate&#x20;with&#x20;Windows&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;Domain&#x20;Controllers.&#x20;For&#x20;these&#x20;reasons,&#x20;it&#x20;is&#x20;strongly&#x20;preferred&#x20;to&#x20;restrict&#x20;the&#x20;use&#x20;of&#x20;LM&#x20;&amp;&#x20;NTLM&#x20;&#40;non-v2&#41;&#x20;as&#x20;much&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level.','[{\"cis\": [\"2.3.11.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16548,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Negotiate&#x20;signing&#039;&#x20;or&#x20;higher','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;data&#x20;signing&#x20;that&#x20;is&#x20;requested&#x20;on&#x20;behalf&#x20;of&#x20;clients&#x20;that&#x20;issue&#x20;LDAP&#x20;BIND&#x20;requests.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;ldap_simple_bind&#x20;or&#x20;ldap_simple_bind_s&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Negotiate&#x20;signing.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x20;in&#x20;which&#x20;an&#x20;intruder&#x20;captures&#x20;the&#x20;packets&#x20;between&#x20;the&#x20;client&#x20;and&#x20;server,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;server.&#x20;For&#x20;an&#x20;LDAP&#x20;server,&#x20;this&#x20;susceptibility&#x20;means&#x20;that&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;server&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;or&#x20;altered&#x20;data&#x20;from&#x20;the&#x20;LDAP&#x20;queries.&#x20;To&#x20;lower&#x20;this&#x20;risk&#x20;in&#x20;your&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;can&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult&#x20;if&#x20;you&#x20;require&#x20;digital&#x20;signatures&#x20;on&#x20;all&#x20;network&#x20;packets&#x20;by&#x20;means&#x20;of&#x20;IPsec&#x20;authentication&#x20;headers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Negotiate&#x20;signing&#x20;&#40;configuring&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements.','[{\"cis\": [\"2.3.11.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16549,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;clients&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;both&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;In&#x20;other&#x20;words,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients.','[{\"cis\": [\"2.3.11.9\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16550,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;servers&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;all&#x20;of&#x20;the&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;That&#x20;is,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers.','[{\"cis\": [\"2.3.11.10\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16551,'Ensure&#x20;&#039;Shutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;shut&#x20;down&#x20;when&#x20;a&#x20;user&#x20;is&#x20;not&#x20;logged&#x20;on.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;shutdown&#x20;command&#x20;is&#x20;available&#x20;on&#x20;the&#x20;Windows&#x20;logon&#x20;screen.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;restrict&#x20;the&#x20;ability&#x20;to&#x20;shut&#x20;down&#x20;the&#x20;computer&#x20;to&#x20;users&#x20;with&#x20;credentials&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Server&#x20;2008&#x20;R2&#x20;and&#x20;older&#x20;versions,&#x20;this&#x20;setting&#x20;had&#x20;no&#x20;impact&#x20;on&#x20;Remote&#x20;Desktop&#x20;&#40;RDP&#41;&#x20;/&#x20;Terminal&#x20;Services&#x20;sessions&#x20;-&#x20;it&#x20;only&#x20;affected&#x20;the&#x20;local&#x20;console.&#x20;However,&#x20;Microsoft&#x20;changed&#x20;the&#x20;behavior&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;where&#x20;if&#x20;set&#x20;to&#x20;Enabled,&#x20;RDP&#x20;sessions&#x20;are&#x20;also&#x20;allowed&#x20;to&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server.','Users&#x20;who&#x20;can&#x20;access&#x20;the&#x20;console&#x20;locally&#x20;could&#x20;shut&#x20;down&#x20;the&#x20;computer.&#x20;Attackers&#x20;could&#x20;also&#x20;walk&#x20;to&#x20;the&#x20;local&#x20;console&#x20;and&#x20;restart&#x20;the&#x20;server,&#x20;which&#x20;would&#x20;cause&#x20;a&#x20;temporary&#x20;DoS&#x20;condition.&#x20;Attackers&#x20;could&#x20;also&#x20;shut&#x20;down&#x20;the&#x20;server&#x20;and&#x20;leave&#x20;all&#x20;of&#x20;its&#x20;applications&#x20;and&#x20;services&#x20;unavailable.&#x20;As&#x20;noted&#x20;in&#x20;the&#x20;Description&#x20;above,&#x20;the&#x20;Denial&#x20;of&#x20;Service&#x20;&#40;DoS&#41;&#x20;risk&#x20;of&#x20;enabling&#x20;this&#x20;setting&#x20;dramatically&#x20;increases&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;as&#x20;even&#x20;remote&#x20;users&#x20;could&#x20;then&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server&#x20;from&#x20;the&#x20;logon&#x20;screen&#x20;of&#x20;an&#x20;RDP&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsShutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on.','[{\"cis\": [\"2.3.13.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16552,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;case&#x20;insensitivity&#x20;is&#x20;enforced&#x20;for&#x20;all&#x20;subsystems.&#x20;The&#x20;Microsoft&#x20;Win32&#x20;subsystem&#x20;is&#x20;case&#x20;insensitive.&#x20;However,&#x20;the&#x20;kernel&#x20;supports&#x20;case&#x20;sensitivity&#x20;for&#x20;other&#x20;subsystems,&#x20;such&#x20;as&#x20;the&#x20;Portable&#x20;Operating&#x20;System&#x20;Interface&#x20;for&#x20;UNIX&#x20;&#40;POSIX&#41;.&#x20;Because&#x20;Windows&#x20;is&#x20;case&#x20;insensitive&#x20;&#40;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity&#41;,&#x20;failure&#x20;to&#x20;enforce&#x20;this&#x20;policy&#x20;setting&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;the&#x20;POSIX&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;by&#x20;using&#x20;mixed&#x20;case&#x20;to&#x20;label&#x20;it.&#x20;Such&#x20;a&#x20;situation&#x20;can&#x20;block&#x20;access&#x20;to&#x20;these&#x20;files&#x20;by&#x20;another&#x20;user&#x20;who&#x20;uses&#x20;typical&#x20;Win32&#x20;tools,&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Because&#x20;Windows&#x20;is&#x20;case-insensitive&#x20;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity,&#x20;failure&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;would&#x20;make&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;that&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;but&#x20;with&#x20;a&#x20;different&#x20;mix&#x20;of&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letters.&#x20;Such&#x20;a&#x20;situation&#x20;could&#x20;potentially&#x20;confuse&#x20;users&#x20;when&#x20;they&#x20;try&#x20;to&#x20;access&#x20;such&#x20;files&#x20;from&#x20;normal&#x20;Win32&#x20;tools&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-&#x20;Windows&#x20;subsystems.','[{\"cis\": [\"2.3.15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16553,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;discretionary&#x20;access&#x20;control&#x20;list&#x20;&#40;DACL&#41;&#x20;for&#x20;objects.&#x20;Active&#x20;Directory&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;system&#x20;resources,&#x20;such&#x20;as&#x20;DOS&#x20;device&#x20;names,&#x20;mutexes,&#x20;and&#x20;semaphores.&#x20;In&#x20;this&#x20;way,&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;what&#x20;permissions&#x20;are&#x20;granted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;DACL&#x20;for&#x20;objects.&#x20;Windows&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;computer&#x20;resources&#x20;so&#x20;that&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;with&#x20;what&#x20;permissions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;','[{\"cis\": [\"2.3.15.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16554,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;built-in&#x20;Administrator&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;An&#x20;attack&#x20;vector&#x20;for&#x20;these&#x20;programs&#x20;was&#x20;to&#x20;discover&#x20;the&#x20;password&#x20;of&#x20;the&#x20;account&#x20;named&#x20;&#039;Administrator&#039;&#x20;because&#x20;that&#x20;user&#x20;account&#x20;was&#x20;created&#x20;for&#x20;all&#x20;installations&#x20;of&#x20;Windows.&#x20;To&#x20;address&#x20;this&#x20;risk,&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;newer,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;is&#x20;now&#x20;disabled&#x20;by&#x20;default.&#x20;In&#x20;a&#x20;default&#x20;installation&#x20;of&#x20;a&#x20;new&#x20;computer,&#x20;accounts&#x20;with&#x20;administrative&#x20;control&#x20;over&#x20;the&#x20;computer&#x20;are&#x20;initially&#x20;set&#x20;up&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;not&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;the&#x20;first&#x20;user&#x20;account&#x20;you&#x20;create&#x20;has&#x20;the&#x20;equivalent&#x20;permissions&#x20;as&#x20;a&#x20;local&#x20;administrator.&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;no&#x20;local&#x20;administrator&#x20;accounts&#x20;are&#x20;created.&#x20;The&#x20;Enterprise&#x20;or&#x20;Domain&#x20;Administrator&#x20;must&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;and&#x20;create&#x20;one&#x20;if&#x20;a&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;warranted.&#x20;Once&#x20;Windows&#x20;is&#x20;installed,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;may&#x20;be&#x20;manually&#x20;enabled,&#x20;but&#x20;we&#x20;strongly&#x20;recommend&#x20;that&#x20;this&#x20;account&#x20;remain&#x20;disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account.','[{\"cis\": [\"2.3.17.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16555,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Prompt&#x20;for&#x20;consent&#x20','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;administrator&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;permits&#x20;the&#x20;administrator&#x20;to&#x20;prevent&#x20;a&#x20;malicious&#x20;program&#x20;from&#x20;elevating&#x20;its&#x20;privilege&#x20;when&#x20;the&#x20;program&#x20;attempts&#x20;to&#x20;do&#x20;so.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode.','[{\"cis\": [\"2.3.17.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16556,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Automatically&#x20;deny&#x20;elevation&#x20;requests&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;programs&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;their&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;user&#x20;that&#x20;a&#x20;program&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;requires&#x20;that&#x20;the&#x20;user&#x20;be&#x20;able&#x20;to&#x20;supply&#x20;administrative&#x20;credentials&#x20;in&#x20;order&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.','[{\"cis\": [\"2.3.17.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16557,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;application&#x20;installation&#x20;detection&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Some&#x20;malicious&#x20;software&#x20;will&#x20;attempt&#x20;to&#x20;install&#x20;itself&#x20;after&#x20;being&#x20;given&#x20;permission&#x20;to&#x20;run.&#x20;For&#x20;example,&#x20;malicious&#x20;software&#x20;with&#x20;a&#x20;trusted&#x20;application&#x20;shell.&#x20;The&#x20;user&#x20;may&#x20;have&#x20;given&#x20;permission&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run&#x20;because&#x20;the&#x20;program&#x20;is&#x20;trusted,&#x20;but&#x20;if&#x20;they&#x20;are&#x20;then&#x20;prompted&#x20;for&#x20;installation&#x20;of&#x20;an&#x20;unknown&#x20;component&#x20;this&#x20;provides&#x20;another&#x20;way&#x20;of&#x20;trapping&#x20;the&#x20;software&#x20;before&#x20;it&#x20;can&#x20;do&#x20;damage.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation.','[{\"cis\": [\"2.3.17.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16558,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;applications&#x20;that&#x20;request&#x20;to&#x20;run&#x20;with&#x20;a&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#41;&#x20;integrity&#x20;level&#x20;must&#x20;reside&#x20;in&#x20;a&#x20;secure&#x20;location&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;Secure&#x20;locations&#x20;are&#x20;limited&#x20;to&#x20;the&#x20;following:&#x20;...Program&#x20;Files,&#x20;including&#x20;subfolders;&#x20;...Windowssystem32;&#x20;...Program&#x20;Files&#x20;&#40;x86&#41;,&#x20;including&#x20;subfolders&#x20;&#40;for&#x20;64-bit&#x20;versions&#x20;of&#x20;Windows&#41;.&#x20;Note:&#x20;Windows&#x20;enforces&#x20;a&#x20;public&#x20;key&#x20;infrastructure&#x20;&#40;PKI&#41;&#x20;signature&#x20;check&#x20;on&#x20;any&#x20;interactive&#x20;application&#x20;that&#x20;requests&#x20;to&#x20;run&#x20;with&#x20;a&#x20;UIAccess&#x20;integrity&#x20;level&#x20;regardless&#x20;of&#x20;the&#x20;state&#x20;of&#x20;this&#x20;security&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','UIAccess&#x20;Integrity&#x20;allows&#x20;an&#x20;application&#x20;to&#x20;bypass&#x20;User&#x20;Interface&#x20;Privilege&#x20;Isolation&#x20;&#40;UIPI&#41;&#x20;restrictions&#x20;when&#x20;an&#x20;application&#x20;is&#x20;elevated&#x20;in&#x20;privilege&#x20;from&#x20;a&#x20;standard&#x20;user&#x20;to&#x20;an&#x20;administrator.&#x20;This&#x20;is&#x20;required&#x20;to&#x20;support&#x20;accessibility&#x20;features&#x20;such&#x20;as&#x20;screen&#x20;readers&#x20;that&#x20;are&#x20;transmitting&#x20;user&#x20;interfaces&#x20;to&#x20;alternative&#x20;forms.&#x20;A&#x20;process&#x20;that&#x20;is&#x20;started&#x20;with&#x20;UIAccess&#x20;rights&#x20;has&#x20;the&#x20;following&#x20;abilities:&#x20;-&#x20;To&#x20;set&#x20;the&#x20;foreground&#x20;window.&#x20;-&#x20;To&#x20;drive&#x20;any&#x20;application&#x20;window&#x20;using&#x20;SendInput&#x20;function.&#x20;-&#x20;To&#x20;use&#x20;read&#x20;input&#x20;for&#x20;all&#x20;integrity&#x20;levels&#x20;using&#x20;low-level&#x20;hooks,&#x20;raw&#x20;input,&#x20;GetKeyState,&#x20;GetAsyncKeyState,&#x20;and&#x20;GetKeyboardInput.&#x20;-&#x20;To&#x20;set&#x20;journal&#x20;hooks.&#x20;-&#x20;To&#x20;uses&#x20;AttachThreadInput&#x20;to&#x20;attach&#x20;a&#x20;thread&#x20;to&#x20;a&#x20;higher&#x20;integrity&#x20;input&#x20;queue.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations.','[{\"cis\": [\"2.3.17.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16559,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;all&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;policy&#x20;settings&#x20;for&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;change&#x20;this&#x20;policy&#x20;setting,&#x20;you&#x20;must&#x20;restart&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;Security&#x20;Center&#x20;notifies&#x20;you&#x20;that&#x20;the&#x20;overall&#x20;security&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;reduced.','This&#x20;is&#x20;the&#x20;setting&#x20;that&#x20;turns&#x20;on&#x20;or&#x20;off&#x20;UAC.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;used&#x20;and&#x20;any&#x20;security&#x20;benefits&#x20;and&#x20;risk&#x20;mitigations&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;present&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode.','[{\"cis\": [\"2.3.17.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16560,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;elevation&#x20;request&#x20;prompt&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;interactive&#x20;user&#039;s&#x20;desktop&#x20;or&#x20;the&#x20;secure&#x20;desktop.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Standard&#x20;elevation&#x20;prompt&#x20;dialog&#x20;boxes&#x20;can&#x20;be&#x20;spoofed,&#x20;which&#x20;may&#x20;cause&#x20;users&#x20;to&#x20;disclose&#x20;their&#x20;passwords&#x20;to&#x20;malicious&#x20;software.&#x20;The&#x20;secure&#x20;desktop&#x20;presents&#x20;a&#x20;very&#x20;distinct&#x20;appearance&#x20;when&#x20;prompting&#x20;for&#x20;elevation,&#x20;where&#x20;the&#x20;user&#x20;desktop&#x20;dims,&#x20;and&#x20;the&#x20;elevation&#x20;prompt&#x20;UI&#x20;is&#x20;more&#x20;prominent.&#x20;This&#x20;increases&#x20;the&#x20;likelihood&#x20;that&#x20;users&#x20;who&#x20;become&#x20;accustomed&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;will&#x20;recognize&#x20;a&#x20;spoofed&#x20;elevation&#x20;prompt&#x20;dialog&#x20;box&#x20;and&#x20;not&#x20;fall&#x20;for&#x20;the&#x20;trick.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation.','[{\"cis\": [\"2.3.17.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16561,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;application&#x20;write&#x20;failures&#x20;are&#x20;redirected&#x20;to&#x20;defined&#x20;registry&#x20;and&#x20;file&#x20;system&#x20;locations.&#x20;This&#x20;policy&#x20;setting&#x20;mitigates&#x20;applications&#x20;that&#x20;run&#x20;as&#x20;administrator&#x20;and&#x20;write&#x20;run-time&#x20;application&#x20;data&#x20;to:&#x20;-&#x20;%ProgramFiles%&#x20;-&#x20;%Windir%&#x20;-&#x20;%Windir%system32&#x20;-&#x20;HKEY_LOCAL_MACHINESoftware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;reduces&#x20;vulnerabilities&#x20;by&#x20;ensuring&#x20;that&#x20;legacy&#x20;applications&#x20;only&#x20;write&#x20;data&#x20;to&#x20;permitted&#x20;locations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations.','[{\"cis\": [\"2.3.17.8\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16562,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16563,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16564,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.1.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16565,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.1.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16566,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewalldomainfw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewalldomainfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewalldomainfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.1.5\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16567,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.1.6\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16568,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.1.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16569,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.1.8\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16570,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.2.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16571,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.2.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16572,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16573,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.2.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16574,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewallprivatefw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewallprivatefw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewallprivatefw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.2.5\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16575,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.2.6\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16576,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.2.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16577,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.2.8\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16578,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileFirewall&#x20;state.','[{\"cis\": [\"9.3.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16579,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileInbound&#x20;connections.','[{\"cis\": [\"9.3.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16580,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileOutbound&#x20;connections.','[{\"cis\": [\"9.3.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16581,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;avoid&#x20;alarming&#x20;users&#x20;when&#x20;firewall&#x20;rules&#x20;block&#x20;certain&#x20;types&#x20;of&#x20;network&#x20;activity.&#x20;However,&#x20;notifications&#x20;can&#x20;be&#x20;helpful&#x20;when&#x20;troubleshooting&#x20;network&#x20;issues&#x20;involving&#x20;the&#x20;firewall.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;No&#039;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification.','[{\"cis\": [\"9.3.4\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16582,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;local&#x20;firewall&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;firewall&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','iWhen&#x20;in&#x20;the&#x20;Public&#x20;profile,&#x20;there&#x20;should&#x20;be&#x20;no&#x20;special&#x20;local&#x20;firewall&#x20;exceptions&#x20;per&#x20;computer.&#x20;These&#x20;settings&#x20;should&#x20;be&#x20;managed&#x20;by&#x20;a&#x20;centralized&#x20;policy.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;firewall&#x20;rules.','[{\"cis\": [\"9.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16583,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;connection&#x20;security&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;connection&#x20;security&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;connection&#x20;security&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Users&#x20;with&#x20;administrative&#x20;privileges&#x20;might&#x20;create&#x20;firewall&#x20;rules&#x20;that&#x20;expose&#x20;the&#x20;system&#x20;to&#x20;remote&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;connection&#x20;security&#x20;rules.','[{\"cis\": [\"9.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16584,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SYSTEMROOT%System32logfilesfirewallpublicfw.log&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SYSTEMROOT%System32logfilesfirewallpublicfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SYSTEMROOT%System32logfilesfirewallpublicfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.3.7\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16585,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16384&#x20;KB&#x20;or&#x20;greater&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;.','[{\"cis\": [\"9.3.8\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16586,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets.','[{\"cis\": [\"9.3.9\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16587,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections.','[{\"cis\": [\"9.3.10\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16588,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Disables&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;toggle&#x20;switch&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;camera&#x20;from&#x20;being&#x20;invoked&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;camera&#x20;features.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16589,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Disables&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;settings&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;slide&#x20;show&#x20;from&#x20;playing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;slide&#x20;show&#x20;contents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16590,'Ensure&#x20;&#039;Allow&#x20;input&#x20;personalization&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;enables&#x20;the&#x20;automatic&#x20;learning&#x20;component&#x20;of&#x20;input&#x20;personalization&#x20;that&#x20;includes&#x20;speech,&#x20;inking,&#x20;and&#x20;typing.&#x20;Automatic&#x20;learning&#x20;enables&#x20;the&#x20;collection&#x20;of&#x20;speech&#x20;and&#x20;handwriting&#x20;patterns,&#x20;typing&#x20;history,&#x20;contacts,&#x20;and&#x20;recent&#x20;calendar&#x20;information.&#x20;It&#x20;is&#x20;required&#x20;for&#x20;the&#x20;use&#x20;of&#x20;Cortana.&#x20;Some&#x20;of&#x20;this&#x20;collected&#x20;information&#x20;may&#x20;be&#x20;stored&#x20;on&#x20;the&#x20;user&#039;s&#x20;OneDrive,&#x20;in&#x20;the&#x20;case&#x20;of&#x20;inking&#x20;and&#x20;typing;&#x20;some&#x20;of&#x20;the&#x20;information&#x20;will&#x20;be&#x20;uploaded&#x20;to&#x20;Microsoft&#x20;to&#x20;personalize&#x20;speech.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;Enabled&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;stored&#x20;in&#x20;the&#x20;cloud&#x20;or&#x20;sent&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelRegional&#x20;and&#x20;Language&#x20;OptionsAllow&#x20;input&#x20;personalization&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.2.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16591,'Ensure&#x20;&#039;Allow&#x20;Online&#x20;Tips&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;the&#x20;retrieval&#x20;of&#x20;online&#x20;tips&#x20;and&#x20;help&#x20;for&#x20;the&#x20;Settings&#x20;app.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelAllow&#x20;Online&#x20;Tips&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanel.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.3.4\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16592,'Ensure&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;is&#x20;installed','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','In&#x20;order&#x20;to&#x20;utilize&#x20;LAPS,&#x20;a&#x20;minor&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;is&#x20;required,&#x20;and&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;each&#x20;managed&#x20;computer.&#x20;When&#x20;LAPS&#x20;is&#x20;installed,&#x20;the&#x20;file&#x20;AdmPwd.dll&#x20;must&#x20;be&#x20;present&#x20;in&#x20;the&#x20;following&#x20;location&#x20;and&#x20;registered&#x20;in&#x20;Windows&#x20;&#40;the&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;installation&#x20;does&#x20;this&#x20;for&#x20;you&#41;:&#x20;C:Program&#x20;FilesLAPSCSEAdmPwd.dll','[{\"cis\": [\"18.2.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16593,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSDo&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16594,'Ensure&#x20;&#039;Enable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSEnable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16595,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Complexity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Complexity&#x20;option&#x20;to&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.4\"]}, {\"cis_csc\": [\"5.7\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16596,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;or&#x20;more&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;or&#x20;more.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Length&#x20;option&#x20;to&#x20;15&#x20;or&#x20;more:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.5\"]}, {\"cis_csc\": [\"5.7\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16597,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;30&#x20;or&#x20;fewer&#039;','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;30&#x20;or&#x20;fewer.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#x20;option&#x20;to&#x20;30&#x20;or&#x20;fewer:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.6\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16598,'Ensure&#x20;&#039;Apply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;accounts&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;administration&#x20;via&#x20;network&#x20;logon&#x20;&#40;e.g.,&#x20;NET&#x20;USE,&#x20;connecting&#x20;to&#x20;C$,&#x20;etc.&#41;.&#x20;Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Enabling&#x20;this&#x20;policy&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.&#x20;Enabled:&#x20;Applies&#x20;UAC&#x20;token-filtering&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Membership&#x20;in&#x20;powerful&#x20;group&#x20;such&#x20;as&#x20;Administrators&#x20;is&#x20;disabled&#x20;and&#x20;powerful&#x20;privileges&#x20;are&#x20;removed&#x20;from&#x20;the&#x20;resulting&#x20;access&#x20;token.&#x20;This&#x20;configures&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;0.&#x20;This&#x20;is&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Windows.&#x20;Disabled:&#x20;Allows&#x20;local&#x20;accounts&#x20;to&#x20;have&#x20;full&#x20;administrative&#x20;rights&#x20;when&#x20;authenticating&#x20;via&#x20;network&#x20;logon,&#x20;by&#x20;configuring&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;1.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;LocalAccountTokenFilterPolicy,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;951016:&#x20;Description&#x20;of&#x20;User&#x20;Account&#x20;Control&#x20;and&#x20;remote&#x20;restrictions&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Ensuring&#x20;this&#x20;policy&#x20;is&#x20;Enabled&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideApply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;Microsoft.','[{\"cis\": [\"18.3.1\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16599,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;driver&#039;','This&#x20;setting&#x20;configures&#x20;the&#x20;start&#x20;type&#x20;for&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;client&#x20;driver&#x20;service&#x20;&#40;&#x20;MRxSmb10&#x20;&#41;,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;disabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;driver.&#x20;Note:&#x20;Do&#x20;not,&#x20;under&#x20;any&#x20;circumstances,&#x20;configure&#x20;this&#x20;overall&#x20;setting&#x20;as&#x20;Disabled&#x20;,&#x20;as&#x20;doing&#x20;so&#x20;will&#x20;delete&#x20;the&#x20;underlying&#x20;registry&#x20;entry&#x20;altogether,&#x20;which&#x20;will&#x20;cause&#x20;serious&#x20;problems.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16600,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;configures&#x20;the&#x20;server-side&#x20;processing&#x20;of&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;protocol.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;server&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16601,'Ensure&#x20;&#039;Enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Windows&#x20;includes&#x20;support&#x20;for&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;We&#x20;recommend&#x20;enabling&#x20;this&#x20;feature&#x20;to&#x20;improve&#x20;the&#x20;security&#x20;profile&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','This&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;block&#x20;exploits&#x20;that&#x20;use&#x20;the&#x20;Structured&#x20;Exception&#x20;Handler&#x20;&#40;SEH&#41;&#x20;overwrite&#x20;technique.&#x20;This&#x20;protection&#x20;mechanism&#x20;is&#x20;provided&#x20;at&#x20;run-time.&#x20;Therefore,&#x20;it&#x20;helps&#x20;protect&#x20;applications&#x20;regardless&#x20;of&#x20;whether&#x20;they&#x20;have&#x20;been&#x20;compiled&#x20;with&#x20;the&#x20;latest&#x20;improvements,&#x20;such&#x20;as&#x20;the&#x20;/SAFESEH&#x20;option.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideEnable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16602,'Ensure&#x20;&#039;Extended&#x20;Protection&#x20;for&#x20;LDAP&#x20;Authentication&#x20;&#40;Domain&#x20;Controllers&#x20;only&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Enabled,&#x20;always&#x20;&#40;recommended&#41;&#039;','This&#x20;setting&#x20;controls&#x20;LDAP&#x20;authentication&#x20;over&#x20;SSL/TLS&#x20;to&#x20;help&#x20;make&#x20;it&#x20;more&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Enabled,&#x20;always&#x20;&#40;recommended&#41;&#x20;.&#x20;Note:&#x20;All&#x20;LDAP&#x20;clients&#x20;must&#x20;have&#x20;the&#x20;CVC-2017-8563&#x20;security&#x20;update&#x20;to&#x20;be&#x20;compatible&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;have&#x20;this&#x20;setting&#x20;enabled.','Configuring&#x20;the&#x20;LdapEnforceChannelBinding&#x20;registry&#x20;value&#x20;can&#x20;help&#x20;to&#x20;increase&#x20;protection&#x20;against&#x20;&#039;man-in-the-middle&#x20;attacks&#039;.&#x20;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Enabled,&#x20;always&#x20;&#40;recommended&#41;&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideExtended&#x20;Protection&#x20;for&#x20;LDAP&#x20;Authentication&#x20;&#40;Domain&#x20;Controllers&#x20;only&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.5\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16603,'Ensure&#x20;&#039;WDigest&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','When&#x20;WDigest&#x20;authentication&#x20;is&#x20;enabled,&#x20;Lsass.exe&#x20;retains&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;user&#039;s&#x20;plaintext&#x20;password&#x20;in&#x20;memory,&#x20;where&#x20;it&#x20;can&#x20;be&#x20;at&#x20;risk&#x20;of&#x20;theft.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured,&#x20;WDigest&#x20;authentication&#x20;is&#x20;disabled&#x20;in&#x20;Windows&#x20;8.1&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;R2;&#x20;it&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;in&#x20;earlier&#x20;versions&#x20;of&#x20;Windows&#x20;and&#x20;Windows&#x20;Server.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideWDigest&#x20;Authentication&#x20;&#40;disabling&#x20;may&#x20;require&#x20;KB2871997&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;SecGuide.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.6\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16604,'Ensure&#x20;&#039;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;is&#x20;separate&#x20;from&#x20;the&#x20;Welcome&#x20;screen&#x20;feature&#x20;in&#x20;Windows&#x20;XP&#x20;and&#x20;Windows&#x20;Vista;&#x20;if&#x20;that&#x20;feature&#x20;is&#x20;disabled,&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;disabled.&#x20;If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;to&#x20;which&#x20;the&#x20;computer&#x20;is&#x20;connected.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext,&#x20;and&#x20;the&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;value&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;that&#x20;the&#x20;computer&#x20;is&#x20;connected&#x20;to.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext.&#x20;The&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;setting&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;As&#x20;a&#x20;result,&#x20;this&#x20;entry&#x20;is&#x20;appropriate&#x20;only&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;physically&#x20;secured&#x20;and&#x20;if&#x20;you&#x20;ensure&#x20;that&#x20;untrusted&#x20;users&#x20;cannot&#x20;remotely&#x20;see&#x20;the&#x20;registry.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16605,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highe','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;follow&#x20;through&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16606,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highest&#x20;pr','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;take&#x20;through&#x20;the&#x20;network.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;Not&#x20;Defined&#x20;for&#x20;enterprise&#x20;environments&#x20;and&#x20;to&#x20;Highest&#x20;Protection&#x20;for&#x20;high&#x20;security&#x20;environments&#x20;to&#x20;completely&#x20;disable&#x20;source&#x20;routing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.3\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16607,'Ensure&#x20;&#039;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Internet&#x20;Control&#x20;Message&#x20;Protocol&#x20;&#40;ICMP&#41;&#x20;redirects&#x20;cause&#x20;the&#x20;IPv4&#x20;stack&#x20;to&#x20;plumb&#x20;host&#x20;routes.&#x20;These&#x20;routes&#x20;override&#x20;the&#x20;Open&#x20;Shortest&#x20;Path&#x20;First&#x20;&#40;OSPF&#41;&#x20;generated&#x20;routes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;behavior&#x20;is&#x20;expected.&#x20;The&#x20;problem&#x20;is&#x20;that&#x20;the&#x20;10&#x20;minute&#x20;time-out&#x20;period&#x20;for&#x20;the&#x20;ICMP&#x20;redirect-plumbed&#x20;routes&#x20;temporarily&#x20;creates&#x20;a&#x20;network&#x20;situation&#x20;in&#x20;which&#x20;traffic&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;routed&#x20;properly&#x20;for&#x20;the&#x20;affected&#x20;host.&#x20;Ignoring&#x20;such&#x20;ICMP&#x20;redirects&#x20;will&#x20;limit&#x20;the&#x20;system&#039;s&#x20;exposure&#x20;to&#x20;attacks&#x20;that&#x20;will&#x20;impact&#x20;its&#x20;ability&#x20;to&#x20;participate&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.4\"]}, {\"cis_csc\": [\"9\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(16608,'Ensure&#x20;&#039;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recomme','This&#x20;value&#x20;controls&#x20;how&#x20;often&#x20;TCP&#x20;attempts&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;idle&#x20;connection&#x20;is&#x20;still&#x20;intact&#x20;by&#x20;sending&#x20;a&#x20;keep-alive&#x20;packet.','An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;network&#x20;applications&#x20;could&#x20;establish&#x20;numerous&#x20;connections&#x20;to&#x20;cause&#x20;a&#x20;DoS&#x20;condition.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds.','[{\"cis\": [\"18.4.5\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16609,'Ensure&#x20;&#039;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enab','NetBIOS&#x20;over&#x20;TCP/IP&#x20;is&#x20;a&#x20;network&#x20;protocol&#x20;that&#x20;among&#x20;other&#x20;things&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;easily&#x20;resolve&#x20;NetBIOS&#x20;names&#x20;that&#x20;are&#x20;registered&#x20;on&#x20;Windows-based&#x20;systems&#x20;to&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;configured&#x20;on&#x20;those&#x20;systems.&#x20;This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;computer&#x20;releases&#x20;its&#x20;NetBIOS&#x20;name&#x20;when&#x20;it&#x20;receives&#x20;a&#x20;name-release&#x20;request.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;NetBT&#x20;protocol&#x20;is&#x20;designed&#x20;not&#x20;to&#x20;use&#x20;authentication,&#x20;and&#x20;is&#x20;therefore&#x20;vulnerable&#x20;to&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;exploit&#x20;the&#x20;unauthenticated&#x20;nature&#x20;of&#x20;the&#x20;protocol&#x20;to&#x20;send&#x20;a&#x20;name-conflict&#x20;datagram&#x20;to&#x20;a&#x20;target&#x20;computer,&#x20;which&#x20;would&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;relinquish&#x20;its&#x20;name&#x20;and&#x20;not&#x20;respond&#x20;to&#x20;queries.&#x20;An&#x20;attacker&#x20;could&#x20;send&#x20;a&#x20;request&#x20;over&#x20;the&#x20;network&#x20;and&#x20;query&#x20;a&#x20;computer&#x20;to&#x20;release&#x20;its&#x20;NetBIOS&#x20;name.&#x20;As&#x20;with&#x20;any&#x20;change&#x20;that&#x20;could&#x20;affect&#x20;applications,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;test&#x20;this&#x20;change&#x20;in&#x20;a&#x20;non-production&#x20;environment&#x20;before&#x20;you&#x20;change&#x20;the&#x20;production&#x20;environment.&#x20;The&#x20;result&#x20;of&#x20;such&#x20;an&#x20;attack&#x20;could&#x20;be&#x20;to&#x20;cause&#x20;intermittent&#x20;connectivity&#x20;issues&#x20;on&#x20;the&#x20;target&#x20;computer,&#x20;or&#x20;even&#x20;to&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;Network&#x20;Neighborhood,&#x20;domain&#x20;logons,&#x20;the&#x20;NET&#x20;SEND&#x20;command,&#x20;or&#x20;additional&#x20;NetBIOS&#x20;name&#x20;resolution.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16610,'Ensure&#x20;&#039;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','This&#x20;setting&#x20;is&#x20;used&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;the&#x20;Internet&#x20;Router&#x20;Discovery&#x20;Protocol&#x20;&#40;IRDP&#41;,&#x20;which&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;default&#x20;gateway&#x20;addresses&#x20;automatically&#x20;as&#x20;described&#x20;in&#x20;RFC&#x20;1256&#x20;on&#x20;a&#x20;per-interface&#x20;basis.','An&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;control&#x20;of&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;network&#x20;segment&#x20;could&#x20;configure&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;network&#x20;to&#x20;impersonate&#x20;a&#x20;router.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;.','[{\"cis\": [\"18.4.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16611,'Ensure&#x20;&#039;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;DLL&#x20;search&#x20;order&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;that&#x20;are&#x20;requested&#x20;by&#x20;running&#x20;processes&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-Search&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;-Search&#x20;current&#x20;working&#x20;folder&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;When&#x20;enabled,&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;1.&#x20;With&#x20;a&#x20;setting&#x20;of&#x20;1,&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;When&#x20;disabled&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0&#x20;and&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;Applications&#x20;will&#x20;be&#x20;forced&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first.&#x20;For&#x20;applications&#x20;that&#x20;require&#x20;unique&#x20;versions&#x20;of&#x20;these&#x20;DLLs&#x20;that&#x20;are&#x20;included&#x20;with&#x20;the&#x20;application,&#x20;this&#x20;entry&#x20;could&#x20;cause&#x20;performance&#x20;or&#x20;stability&#x20;problems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;was&#x20;packaged&#x20;with&#x20;additional&#x20;files&#x20;that&#x20;include&#x20;modified&#x20;versions&#x20;of&#x20;system&#x20;DLLs,&#x20;the&#x20;hostile&#x20;code&#x20;could&#x20;load&#x20;its&#x20;own&#x20;versions&#x20;of&#x20;those&#x20;DLLs&#x20;and&#x20;potentially&#x20;increase&#x20;the&#x20;type&#x20;and&#x20;degree&#x20;of&#x20;damage&#x20;the&#x20;code&#x20;can&#x20;render.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.8\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16612,'Ensure&#x20;&#039;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','Windows&#x20;includes&#x20;a&#x20;grace&#x20;period&#x20;between&#x20;when&#x20;the&#x20;screen&#x20;saver&#x20;is&#x20;launched&#x20;and&#x20;when&#x20;the&#x20;console&#x20;is&#x20;actually&#x20;locked&#x20;automatically&#x20;when&#x20;screen&#x20;saver&#x20;locking&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds.','The&#x20;default&#x20;grace&#x20;period&#x20;that&#x20;is&#x20;allowed&#x20;for&#x20;user&#x20;movement&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;lock&#x20;takes&#x20;effect&#x20;is&#x20;five&#x20;seconds.&#x20;If&#x20;you&#x20;leave&#x20;the&#x20;default&#x20;grace&#x20;period&#x20;configuration,&#x20;your&#x20;computer&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;potential&#x20;attack&#x20;from&#x20;someone&#x20;who&#x20;could&#x20;approach&#x20;the&#x20;console&#x20;and&#x20;attempt&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;before&#x20;the&#x20;lock&#x20;takes&#x20;effect.&#x20;An&#x20;entry&#x20;to&#x20;the&#x20;registry&#x20;can&#x20;be&#x20;made&#x20;to&#x20;adjust&#x20;the&#x20;length&#x20;of&#x20;the&#x20;grace&#x20;period.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.9\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16613,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.','[{\"cis\": [\"18.4.10\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16614,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.','[{\"cis\": [\"18.4.11\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(16615,'Ensure&#x20;&#039;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#039;&#x20;is&#x20;set&#x20;to&#x20;&','This&#x20;setting&#x20;can&#x20;generate&#x20;a&#x20;security&#x20;audit&#x20;in&#x20;the&#x20;Security&#x20;event&#x20;log&#x20;when&#x20;the&#x20;log&#x20;reaches&#x20;a&#x20;user-defined&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;90%&#x20;or&#x20;less.&#x20;Note:&#x20;If&#x20;log&#x20;settings&#x20;are&#x20;configured&#x20;to&#x20;Overwrite&#x20;events&#x20;as&#x20;needed&#x20;or&#x20;Overwrite&#x20;events&#x20;older&#x20;than&#x20;x&#x20;days,&#x20;this&#x20;event&#x20;will&#x20;not&#x20;be&#x20;generated.','If&#x20;the&#x20;Security&#x20;log&#x20;reaches&#x20;90&#x20;percent&#x20;of&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;not&#x20;been&#x20;configured&#x20;to&#x20;overwrite&#x20;events&#x20;as&#x20;needed,&#x20;more&#x20;recent&#x20;events&#x20;will&#x20;not&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.&#x20;If&#x20;the&#x20;log&#x20;reaches&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;shut&#x20;down&#x20;when&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;the&#x20;computer&#x20;will&#x20;shut&#x20;down&#x20;and&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;available&#x20;to&#x20;provide&#x20;network&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;90%&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;available&#x20;from&#x20;this&#x20;TechNet&#x20;blog&#x20;post:&#x20;The&#x20;MSS&#x20;settings&#x20;-&#x20;Microsoft&#x20;Security&#x20;Guidance&#x20;blog.','[{\"cis\": [\"18.4.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(16616,'Set&#x20;&#039;NetBIOS&#x20;node&#x20;type&#039;&#x20;to&#x20;&#039;P-node&#039;&#x20;&#40;Ensure&#x20;NetBT&#x20;Parameter&#x20;&#039;NodeType&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0x2&#x20;&#40;2&#41;&#039;&#41;','This&#x20;parameter&#x20;determines&#x20;which&#x20;method&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;NetBT&#41;&#x20;will&#x20;use&#x20;to&#x20;register&#x20;and&#x20;resolve&#x20;names.&#x20;A&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;system&#x20;only&#x20;uses&#x20;broadcasts.&#x20;A&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;system&#x20;uses&#x20;only&#x20;name&#x20;queries&#x20;to&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;.&#x20;An&#x20;M-node&#x20;&#40;mixed&#41;&#x20;system&#x20;broadcasts&#x20;first,&#x20;then&#x20;queries&#x20;the&#x20;name&#x20;server&#x20;&#40;WINS&#41;.&#x20;An&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;system&#x20;queries&#x20;the&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;first,&#x20;then&#x20;broadcasts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;NodeType&#x20;-&#x20;0x2&#x20;&#40;2&#41;&#x20;&#40;P-node&#x20;/&#x20;point-to-point&#41;.','In&#x20;order&#x20;to&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;NetBIOS&#x20;Name&#x20;Service&#x20;&#40;NBT-NS&#41;&#x20;poisoning&#x20;attacks,&#x20;setting&#x20;the&#x20;node&#x20;type&#x20;to&#x20;P-node&#x20;will&#x20;prevent&#x20;the&#x20;system&#x20;from&#x20;sending&#x20;out&#x20;NetBIOS&#x20;broadcasts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0x2&#x20;&#40;2&#41;&#x20;&#40;DWORD&#41;&#x20;:&#x20;HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNetBTParameters:NodeType','[{\"cis\": [\"18.5.4.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16617,'Ensure&#x20;&#039;Turn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','LLMNR&#x20;is&#x20;a&#x20;secondary&#x20;name&#x20;resolution&#x20;protocol.&#x20;With&#x20;LLMNR,&#x20;queries&#x20;are&#x20;sent&#x20;using&#x20;multicast&#x20;over&#x20;a&#x20;local&#x20;network&#x20;link&#x20;on&#x20;a&#x20;single&#x20;subnet&#x20;from&#x20;a&#x20;client&#x20;computer&#x20;to&#x20;another&#x20;client&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;subnet&#x20;that&#x20;also&#x20;has&#x20;LLMNR&#x20;enabled.&#x20;LLMNR&#x20;does&#x20;not&#x20;require&#x20;a&#x20;DNS&#x20;server&#x20;or&#x20;DNS&#x20;client&#x20;configuration,&#x20;and&#x20;provides&#x20;name&#x20;resolution&#x20;in&#x20;scenarios&#x20;in&#x20;which&#x20;conventional&#x20;DNS&#x20;name&#x20;resolution&#x20;is&#x20;not&#x20;possible.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','An&#x20;attacker&#x20;can&#x20;listen&#x20;on&#x20;a&#x20;network&#x20;for&#x20;these&#x20;LLMNR&#x20;&#40;UDP/5355&#41;&#x20;or&#x20;NBT-NS&#x20;&#40;UDP/137&#41;&#x20;broadcasts&#x20;and&#x20;respond&#x20;to&#x20;them,&#x20;tricking&#x20;the&#x20;host&#x20;into&#x20;thinking&#x20;that&#x20;it&#x20;knows&#x20;the&#x20;location&#x20;of&#x20;the&#x20;requested&#x20;system.&#x20;Note:&#x20;To&#x20;completely&#x20;mitigate&#x20;local&#x20;name&#x20;resolution&#x20;poisoning,&#x20;in&#x20;addition&#x20;to&#x20;this&#x20;setting,&#x20;the&#x20;properties&#x20;of&#x20;each&#x20;installed&#x20;NIC&#x20;should&#x20;also&#x20;be&#x20;set&#x20;to&#x20;Disable&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;on&#x20;the&#x20;WINS&#x20;tab&#x20;in&#x20;the&#x20;NIC&#x20;properties&#41;.&#x20;Unfortunately,&#x20;there&#x20;is&#x20;no&#x20;global&#x20;setting&#x20;to&#x20;achieve&#x20;this&#x20;that&#x20;automatically&#x20;applies&#x20;to&#x20;all&#x20;NICs&#x20;-&#x20;it&#x20;is&#x20;a&#x20;per-NIC&#x20;setting&#x20;that&#x20;varies&#x20;with&#x20;different&#x20;NIC&#x20;hardware&#x20;installations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientTurn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#x20;ote:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16618,'Ensure&#x20;&#039;Enable&#x20;Font&#x20;Providers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;is&#x20;allowed&#x20;to&#x20;download&#x20;fonts&#x20;and&#x20;font&#x20;catalog&#x20;data&#x20;from&#x20;an&#x20;online&#x20;font&#x20;provider.The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;configuration,&#x20;to&#x20;ensure&#x20;all&#x20;changes&#x20;are&#x20;tested&#x20;and&#x20;approved.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkFontsEnable&#x20;Font&#x20;Providers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.5.1\"]}, {\"cis_csc\": [\"3\", \"13\"]}, {\"pci_dss\": [\"6.4.5\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\"]}]'),(16619,'Ensure&#x20;&#039;Enable&#x20;insecure&#x20;guest&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;if&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;allow&#x20;insecure&#x20;guest&#x20;logons&#x20;to&#x20;an&#x20;SMB&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Insecure&#x20;guest&#x20;logons&#x20;are&#x20;used&#x20;by&#x20;file&#x20;servers&#x20;to&#x20;allow&#x20;unauthenticated&#x20;access&#x20;to&#x20;shared&#x20;folders.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLanmanWorkstationEnable&#x20;insecure&#x20;guest&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LanmanWorkstation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.8.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16620,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Mapper&#x20;I/O&#x20;network&#x20;protocol&#x20;driver.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver.','[{\"cis\": [\"18.5.9.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16621,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Responder&#x20;network&#x20;protocol&#x20;driver.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver.','[{\"cis\": [\"18.5.9.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16622,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;allows&#x20;for&#x20;distributed&#x20;resolution&#x20;of&#x20;a&#x20;name&#x20;to&#x20;an&#x20;IPv6&#x20;address&#x20;and&#x20;port&#x20;number.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;peer-to-peer&#x20;networking.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkMicrosoft&#x20;Peer-to-Peer&#x20;Networking&#x20;ServicesTurn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services.','[{\"cis\": [\"18.5.10.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16623,'Ensure&#x20;&#039;Prohibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','You&#x20;can&#x20;use&#x20;this&#x20;procedure&#x20;to&#x20;controls&#x20;user&#039;s&#x20;ability&#x20;to&#x20;install&#x20;and&#x20;configure&#x20;a&#x20;Network&#x20;Bridge.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Network&#x20;Bridge&#x20;setting,&#x20;if&#x20;enabled,&#x20;allows&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Layer&#x20;2&#x20;Media&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;bridge,&#x20;enabling&#x20;them&#x20;to&#x20;connect&#x20;two&#x20;or&#x20;more&#x20;physical&#x20;network&#x20;segments&#x20;together.&#x20;A&#x20;Network&#x20;Bridge&#x20;thus&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;has&#x20;connections&#x20;to&#x20;two&#x20;different&#x20;networks&#x20;to&#x20;share&#x20;data&#x20;between&#x20;those&#x20;networks.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;where&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;control&#x20;network&#x20;traffic&#x20;to&#x20;only&#x20;authorized&#x20;paths,&#x20;allowing&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Network&#x20;Bridge&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface&#x20;from&#x20;the&#x20;bridged&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16624,'Ensure&#x20;&#039;Prohibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Although&#x20;this&#x20;&quot;legacy&quot;&#x20;setting&#x20;traditionally&#x20;applied&#x20;to&#x20;the&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;in&#x20;Windows&#x20;2000,&#x20;Windows&#x20;XP&#x20;&amp;&#x20;Server&#x20;2003,&#x20;this&#x20;setting&#x20;now&#x20;freshly&#x20;applies&#x20;to&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;in&#x20;Windows&#x20;10&#x20;&amp;&#x20;Server&#x20;2016.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Non-administrators&#x20;should&#x20;not&#x20;be&#x20;able&#x20;to&#x20;turn&#x20;on&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;and&#x20;open&#x20;their&#x20;Internet&#x20;connectivity&#x20;up&#x20;to&#x20;nearby&#x20;mobile&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16625,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16626,'Ensure&#x20;&#039;Hardened&#x20;UNC&#x20;Paths&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&','This&#x20;policy&#x20;setting&#x20;configures&#x20;secure&#x20;access&#x20;to&#x20;UNC&#x20;paths.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&#x20;and&#x20;SYSVOL&#x20;shares&#x20;.','In&#x20;February&#x20;2015,&#x20;Microsoft&#x20;released&#x20;a&#x20;new&#x20;control&#x20;mechanism&#x20;to&#x20;mitigate&#x20;a&#x20;security&#x20;risk&#x20;in&#x20;Group&#x20;Policy&#x20;as&#x20;part&#x20;of&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update.&#x20;This&#x20;mechanism&#x20;requires&#x20;both&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;new&#x20;security&#x20;update&#x20;and&#x20;also&#x20;the&#x20;deployment&#x20;of&#x20;specific&#x20;group&#x20;policy&#x20;settings&#x20;to&#x20;all&#x20;computers&#x20;on&#x20;the&#x20;domain&#x20;from&#x20;Windows&#x20;Vista&#x20;/&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;&#40;the&#x20;associated&#x20;security&#x20;patch&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;was&#x20;not&#x20;released&#x20;for&#x20;Server&#x20;2003&#41;.&#x20;A&#x20;new&#x20;group&#x20;policy&#x20;template&#x20;&#40;&#x20;NetworkProvider.admx/adml&#x20;&#41;&#x20;was&#x20;also&#x20;provided&#x20;with&#x20;the&#x20;security&#x20;update.&#x20;Once&#x20;the&#x20;new&#x20;GPO&#x20;template&#x20;is&#x20;in&#x20;place,&#x20;the&#x20;following&#x20;are&#x20;the&#x20;minimum&#x20;requirements&#x20;to&#x20;remediate&#x20;the&#x20;Group&#x20;Policy&#x20;security&#x20;risk:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;the&#x20;following&#x20;paths&#x20;configured,&#x20;at&#x20;a&#x20;minimum:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ProviderHardened&#x20;UNC&#x20;Paths&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;NetworkProvider.admx/adml&#x20;&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.5.14.1\"]}, {\"cis_csc\": [\"3\"]}]'),(16627,'Disable&#x20;IPv6&#x20;&#40;Ensure&#x20;TCPIP6&#x20;Parameter&#x20;&#039;DisabledComponents&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0xff&#x20;&#40;255&#41;&#039;&#41;','','Since&#x20;the&#x20;vast&#x20;majority&#x20;of&#x20;private&#x20;enterprise&#x20;managed&#x20;networks&#x20;have&#x20;no&#x20;need&#x20;to&#x20;utilize&#x20;IPv6&#x20;&#40;because&#x20;they&#x20;have&#x20;access&#x20;to&#x20;private&#x20;IPv4&#x20;addressing&#41;,&#x20;disabling&#x20;IPv6&#x20;components&#x20;reduces&#x20;a&#x20;possible&#x20;attack&#x20;surface&#x20;that&#x20;is&#x20;also&#x20;harder&#x20;to&#x20;monitor&#x20;the&#x20;traffic&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0xff&#x20;&#40;255&#41;&#x20;&#40;DWORD&#41;:&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTCPIP6Parameters:DisabledComponents.','[{\"cis\": [\"18.5.19.2.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16628,'Ensure&#x20;&#039;Configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;the&#x20;configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;user&#x20;configuration&#x20;of&#x20;wireless&#x20;settings.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowConfiguration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now.','[{\"cis\": [\"18.5.20.1\"]}, {\"cis_csc\": [\"15.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16629,'Ensure&#x20;&#039;Prohibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prohibits&#x20;access&#x20;to&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;&#x20;wizards.','Allowing&#x20;standard&#x20;users&#x20;to&#x20;access&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizard&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesetworketworkWindows&#x20;Connect&#x20;NowProhibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards.','[{\"cis\": [\"18.5.20.2\"]}, {\"cis_csc\": [\"15.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16630,'Ensure&#x20;&#039;Minimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blocking&#x20;simultaneous&#x20;connections&#x20;can&#x20;help&#x20;prevent&#x20;a&#x20;user&#x20;unknowingly&#x20;allowing&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;Internet&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerMinimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.21.1\"]}, {\"cis_csc\": [\"12\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16631,'Ensure&#x20;&#039;Prohibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.','The&#x20;potential&#x20;concern&#x20;is&#x20;that&#x20;a&#x20;user&#x20;would&#x20;unknowingly&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;insecure&#x20;public&#x20;network&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerProhibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network.','[{\"cis\": [\"18.5.21.2\"]}, {\"cis_csc\": [\"12\"]}, {\"pci_dss\": [\"1.3.4\"]}, {\"tsc\": [\"CC6.6\"]}]'),(16632,'Ensure&#x20;&#039;Turn&#x20;off&#x20;notifications&#x20;network&#x20;usage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;blocks&#x20;applications&#x20;from&#x20;using&#x20;the&#x20;network&#x20;to&#x20;send&#x20;notifications&#x20;to&#x20;update&#x20;tiles,&#x20;tile&#x20;badges,&#x20;toast,&#x20;or&#x20;raw&#x20;notifications.&#x20;This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;connection&#x20;between&#x20;Windows&#x20;and&#x20;the&#x20;Windows&#x20;Push&#x20;Notification&#x20;Service&#x20;&#40;WNS&#41;.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;stops&#x20;applications&#x20;from&#x20;being&#x20;able&#x20;to&#x20;poll&#x20;application&#x20;services&#x20;to&#x20;update&#x20;tiles.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Windows&#x20;Push&#x20;Notification&#x20;Services&#x20;&#40;WNS&#41;&#x20;is&#x20;a&#x20;mechanism&#x20;to&#x20;receive&#x20;3rd-party&#x20;notifications&#x20;and&#x20;updates&#x20;from&#x20;the&#x20;cloud/Internet.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;external&#x20;systems,&#x20;especially&#x20;those&#x20;hosted&#x20;outside&#x20;the&#x20;organization,&#x20;should&#x20;be&#x20;prevented&#x20;from&#x20;having&#x20;an&#x20;impact&#x20;on&#x20;the&#x20;secure&#x20;workstations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesStart&#x20;Menu&#x20;and&#x20;TaskbarTurn&#x20;off&#x20;notifications&#x20;network&#x20;usage&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WPN.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.7.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16633,'Ensure&#x20;&#039;Include&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;information&#x20;is&#x20;logged&#x20;in&#x20;security&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;any&#x20;user&#x20;who&#x20;has&#x20;read&#x20;access&#x20;to&#x20;the&#x20;security&#x20;events&#x20;can&#x20;read&#x20;the&#x20;command-line&#x20;arguments&#x20;for&#x20;any&#x20;successfully&#x20;created&#x20;process.&#x20;Command-line&#x20;arguments&#x20;may&#x20;contain&#x20;sensitive&#x20;or&#x20;private&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;or&#x20;user&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemAudit&#x20;Process&#x20;CreationInclude&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AuditSettings.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.3.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16634,'Ensure&#x20;&#039;Encryption&#x20;Oracle&#x20;Remediation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Force&#x20;Updated&#x20;Clients&#039;','Some&#x20;versions&#x20;of&#x20;the&#x20;CredSSP&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;by&#x20;some&#x20;applications&#x20;&#40;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Connection&#41;&#x20;are&#x20;vulnerable&#x20;to&#x20;an&#x20;encryption&#x20;oracle&#x20;attack&#x20;against&#x20;the&#x20;client.&#x20;This&#x20;policy&#x20;controls&#x20;compatibility&#x20;with&#x20;vulnerable&#x20;clients&#x20;and&#x20;servers&#x20;and&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;level&#x20;of&#x20;protection&#x20;desired&#x20;for&#x20;the&#x20;encryption&#x20;oracle&#x20;vulnerability.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients&#x20;.','This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;mitigate&#x20;the&#x20;CredSSP&#x20;encryption&#x20;oracle&#x20;vulnerability,&#x20;for&#x20;which&#x20;information&#x20;was&#x20;published&#x20;by&#x20;Microsoft&#x20;on&#x20;03/13/2018&#x20;in&#x20;CVE-2018-0886&#x20;|&#x20;CredSSP&#x20;Remote&#x20;Code&#x20;Execution&#x20;Vulnerability.&#x20;All&#x20;versions&#x20;of&#x20;Windows&#x20;Server&#x20;from&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;onwards&#x20;are&#x20;affected&#x20;by&#x20;this&#x20;vulnerability,&#x20;and&#x20;will&#x20;be&#x20;compatible&#x20;with&#x20;this&#x20;recommendation&#x20;provided&#x20;that&#x20;they&#x20;have&#x20;been&#x20;patched&#x20;up&#x20;through&#x20;May&#x20;2018&#x20;&#40;or&#x20;later&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationEncryption&#x20;Oracle&#x20;Remediation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16635,'Ensure&#x20;&#039;Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;When&#x20;using&#x20;credential&#x20;delegation,&#x20;devices&#x20;provide&#x20;an&#x20;exportable&#x20;version&#x20;of&#x20;credentials&#x20;to&#x20;the&#x20;remote&#x20;host.&#x20;This&#x20;exposes&#x20;users&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;credential&#x20;theft&#x20;from&#x20;attackers&#x20;on&#x20;the&#x20;remote&#x20;host.&#x20;The&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;and&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;features&#x20;are&#x20;two&#x20;options&#x20;to&#x20;help&#x20;protect&#x20;against&#x20;this&#x20;risk.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Restricted&#x20;Admin&#x20;Mode&#x20;was&#x20;designed&#x20;to&#x20;help&#x20;protect&#x20;administrator&#x20;accounts&#x20;by&#x20;ensuring&#x20;that&#x20;reusable&#x20;credentials&#x20;are&#x20;not&#x20;stored&#x20;in&#x20;memory&#x20;on&#x20;remote&#x20;devices&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;compromised.&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;helps&#x20;you&#x20;protect&#x20;your&#x20;credentials&#x20;over&#x20;a&#x20;Remote&#x20;Desktop&#x20;connection&#x20;by&#x20;redirecting&#x20;Kerberos&#x20;requests&#x20;back&#x20;to&#x20;the&#x20;device&#x20;that&#x20;is&#x20;requesting&#x20;the&#x20;connection.&#x20;Both&#x20;features&#x20;should&#x20;be&#x20;enabled&#x20;and&#x20;supported,&#x20;as&#x20;they&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationRemote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16636,'Ensure&#x20;&#039;Boot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;which&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized&#x20;based&#x20;on&#x20;a&#x20;classification&#x20;determined&#x20;by&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;The&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;can&#x20;return&#x20;the&#x20;following&#x20;classifications&#x20;for&#x20;each&#x20;boot-start&#x20;driver:&#x20;-&#x20;Good:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;signed&#x20;and&#x20;has&#x20;not&#x20;been&#x20;tampered&#x20;with.&#x20;-&#x20;Bad:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;allow&#x20;known&#x20;bad&#x20;drivers&#x20;to&#x20;be&#x20;initialized.&#x20;-&#x20;Bad,&#x20;but&#x20;required&#x20;for&#x20;boot:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware,&#x20;but&#x20;the&#x20;computer&#x20;cannot&#x20;successfully&#x20;boot&#x20;without&#x20;loading&#x20;this&#x20;driver.&#x20;-&#x20;Unknown:&#x20;This&#x20;driver&#x20;has&#x20;not&#x20;been&#x20;attested&#x20;to&#x20;by&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;and&#x20;has&#x20;not&#x20;been&#x20;classified&#x20;by&#x20;the&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;choose&#x20;which&#x20;boot-start&#x20;drivers&#x20;to&#x20;initialize&#x20;the&#x20;next&#x20;time&#x20;the&#x20;computer&#x20;is&#x20;started.&#x20;If&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;does&#x20;not&#x20;include&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-&#x20;start&#x20;driver&#x20;or&#x20;if&#x20;your&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;has&#x20;been&#x20;disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;and&#x20;all&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical.','This&#x20;policy&#x20;setting&#x20;helps&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;malware&#x20;that&#x20;has&#x20;already&#x20;infected&#x20;your&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemEarly&#x20;Launch&#x20;AntimalwareBoot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EarlyLaunchAM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.14.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"5.1.1\"]}, {\"nist_800_53\": [\"SI.3\"]}, {\"tsc\": [\"CC6.8\"]}]'),(16637,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;FALSE&#039;','The&#x20;&#039;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;option&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;updating&#x20;affected&#x20;policies&#x20;in&#x20;the&#x20;background&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;When&#x20;background&#x20;updates&#x20;are&#x20;disabled,&#x20;policy&#x20;changes&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;FALSE&#x20;&#40;unchecked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;false&#x20;&#40;unchecked&#41;&#x20;will&#x20;ensure&#x20;that&#x20;domain&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#x20;option&#x20;to&#x20;FALSE&#x20;&#40;unchecked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.2\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16638,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;TRUE&#039;','The&#x20;&#039;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;option&#x20;updates&#x20;and&#x20;reapplies&#x20;policies&#x20;even&#x20;if&#x20;the&#x20;policies&#x20;have&#x20;not&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;TRUE&#x20;&#40;checked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;true&#x20;&#40;checked&#41;&#x20;will&#x20;ensure&#x20;unauthorized&#x20;changes&#x20;that&#x20;might&#x20;have&#x20;been&#x20;configured&#x20;locally&#x20;are&#x20;forced&#x20;to&#x20;match&#x20;the&#x20;domain-based&#x20;Group&#x20;Policy&#x20;settings&#x20;again.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#x20;option&#x20;to&#x20;TRUE&#x20;&#40;checked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.3\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"11.5.1\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(16639,'Ensure&#x20;&#039;Continue&#x20;experiences&#x20;on&#x20;this&#x20;device&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Windows&#x20;device&#x20;is&#x20;allowed&#x20;to&#x20;participate&#x20;in&#x20;cross-device&#x20;experiences&#x20;&#40;continue&#x20;experiences&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','A&#x20;cross-device&#x20;experience&#x20;is&#x20;when&#x20;a&#x20;system&#x20;can&#x20;access&#x20;app&#x20;and&#x20;send&#x20;messages&#x20;to&#x20;other&#x20;devices.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;only&#x20;trusted&#x20;systems&#x20;should&#x20;be&#x20;communicating&#x20;within&#x20;the&#x20;network.&#x20;Access&#x20;to&#x20;any&#x20;other&#x20;system&#x20;should&#x20;be&#x20;prohibited.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyContinue&#x20;experiences&#x20;on&#x20;this&#x20;device&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"nist_800_53\": [\"SA.11\", \"AU.14\", \"AC.7\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16640,'Ensure&#x20;&#039;Turn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;Group&#x20;Policy&#x20;from&#x20;being&#x20;updated&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;to&#x20;Group&#x20;Policy&#x20;for&#x20;computers,&#x20;users&#x20;and&#x20;Domain&#x20;Controllers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;group&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyTurn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.21.5\"]}, {\"cis_csc\": [\"3.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16641,'Ensure&#x20;&#039;Turn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;computer&#x20;can&#x20;download&#x20;print&#x20;driver&#x20;packages&#x20;over&#x20;HTTP.&#x20;To&#x20;set&#x20;up&#x20;HTTP&#x20;printing,&#x20;printer&#x20;drivers&#x20;that&#x20;are&#x20;not&#x20;available&#x20;in&#x20;the&#x20;standard&#x20;operating&#x20;system&#x20;installation&#x20;might&#x20;need&#x20;to&#x20;be&#x20;downloaded&#x20;over&#x20;HTTP.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;might&#x20;download&#x20;drivers&#x20;that&#x20;include&#x20;malicious&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16642,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;turns&#x20;off&#x20;data&#x20;sharing&#x20;from&#x20;the&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool&#x20;enables&#x20;Tablet&#x20;PC&#x20;users&#x20;to&#x20;adapt&#x20;handwriting&#x20;recognition&#x20;to&#x20;their&#x20;own&#x20;writing&#x20;style&#x20;by&#x20;providing&#x20;writing&#x20;samples.&#x20;The&#x20;tool&#x20;can&#x20;optionally&#x20;share&#x20;user&#x20;writing&#x20;samples&#x20;with&#x20;Microsoft&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;tool&#x20;generates&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ShapeCollector.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16643,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Turns&#x20;off&#x20;the&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool&#x20;enables&#x20;users&#x20;to&#x20;report&#x20;errors&#x20;encountered&#x20;in&#x20;Tablet&#x20;PC&#x20;Input&#x20;Panel.&#x20;The&#x20;tool&#x20;generates&#x20;error&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;Microsoft&#x20;uses&#x20;these&#x20;error&#x20;reports&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InkWatson.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16644,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;can&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;Internet&#x20;Service&#x20;Providers&#x20;&#40;ISPs&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16645,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;will&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;for&#x20;the&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Although&#x20;the&#x20;risk&#x20;is&#x20;minimal,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;downloading&#x20;malicious&#x20;content&#x20;through&#x20;this&#x20;feature.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.5\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16646,'Ensure&#x20;&#039;Turn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;disable&#x20;the&#x20;client&#x20;computer&#039;s&#x20;ability&#x20;to&#x20;print&#x20;over&#x20;HTTP,&#x20;which&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;printers&#x20;on&#x20;the&#x20;intranet&#x20;as&#x20;well&#x20;as&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Information&#x20;that&#x20;is&#x20;transmitted&#x20;over&#x20;HTTP&#x20;through&#x20;this&#x20;capability&#x20;is&#x20;not&#x20;protected&#x20;and&#x20;can&#x20;be&#x20;intercepted&#x20;by&#x20;malicious&#x20;users.&#x20;For&#x20;this&#x20;reason,&#x20;it&#x20;is&#x20;not&#x20;often&#x20;used&#x20;in&#x20;enterprise&#x20;managed&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.6\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16647,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Registration&#x20;Wizard&#x20;connects&#x20;to&#x20;Microsoft.com&#x20;for&#x20;online&#x20;registration.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;should&#x20;not&#x20;be&#x20;registering&#x20;their&#x20;own&#x20;copies&#x20;of&#x20;Windows,&#x20;providing&#x20;their&#x20;own&#x20;PII&#x20;in&#x20;the&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16648,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Search&#x20;Companion&#x20;should&#x20;automatically&#x20;download&#x20;content&#x20;updates&#x20;during&#x20;local&#x20;and&#x20;Internet&#x20;searches.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;users&#x20;will&#x20;unknowingly&#x20;reveal&#x20;sensitive&#x20;information&#x20;because&#x20;of&#x20;the&#x20;topics&#x20;they&#x20;are&#x20;searching&#x20;for.&#x20;This&#x20;risk&#x20;is&#x20;very&#x20;low&#x20;because&#x20;even&#x20;if&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;users&#x20;still&#x20;must&#x20;submit&#x20;search&#x20;queries&#x20;to&#x20;the&#x20;desired&#x20;search&#x20;engine&#x20;in&#x20;order&#x20;to&#x20;perform&#x20;searches.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16649,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;&quot;Order&#x20;Prints&#x20;Online&quot;&#x20;task&#x20;is&#x20;available&#x20;from&#x20;Picture&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Order&#x20;Prints&#x20;Online&#x20;Wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;order&#x20;prints&#x20;online.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.9\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16650,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;tasks&#x20;Publish&#x20;this&#x20;file&#x20;to&#x20;the&#x20;Web,&#x20;Publish&#x20;this&#x20;folder&#x20;to&#x20;the&#x20;Web,&#x20;and&#x20;Publish&#x20;the&#x20;selected&#x20;items&#x20;to&#x20;the&#x20;Web&#x20;are&#x20;available&#x20;from&#x20;File&#x20;and&#x20;Folder&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Web&#x20;Publishing&#x20;wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;publish&#x20;content&#x20;to&#x20;the&#x20;Web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;may&#x20;publish&#x20;confidential&#x20;or&#x20;sensitive&#x20;information&#x20;to&#x20;a&#x20;public&#x20;service&#x20;outside&#x20;of&#x20;the&#x20;control&#x20;of&#x20;the&#x20;organization.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.10\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16651,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.11\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16652,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.12\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16653,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;errors&#x20;are&#x20;reported&#x20;to&#x20;Microsoft.&#x20;Error&#x20;Reporting&#x20;is&#x20;used&#x20;to&#x20;report&#x20;information&#x20;about&#x20;a&#x20;system&#x20;or&#x20;application&#x20;that&#x20;has&#x20;failed&#x20;or&#x20;has&#x20;stopped&#x20;responding&#x20;and&#x20;is&#x20;used&#x20;to&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;the&#x20;product.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16654,'Ensure&#x20;&#039;Support&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Automatic&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;support&#x20;for&#x20;Kerberos&#x20;to&#x20;attempt&#x20;authentication&#x20;using&#x20;the&#x20;certificate&#x20;for&#x20;the&#x20;device&#x20;to&#x20;the&#x20;domain.&#x20;Support&#x20;for&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;will&#x20;require&#x20;connectivity&#x20;to&#x20;a&#x20;DC&#x20;in&#x20;the&#x20;device&#x20;account&#x20;domain&#x20;which&#x20;supports&#x20;certificate&#x20;authentication&#x20;for&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Automatic&#x20;.','Having&#x20;stronger&#x20;device&#x20;authentication&#x20;with&#x20;the&#x20;use&#x20;of&#x20;certificates&#x20;is&#x20;strongly&#x20;encouraged&#x20;over&#x20;standard&#x20;username&#x20;and&#x20;password&#x20;authentication.&#x20;Having&#x20;this&#x20;set&#x20;to&#x20;Automatic&#x20;will&#x20;allow&#x20;certificate&#x20;based&#x20;authentication&#x20;to&#x20;be&#x20;used&#x20;whenever&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Automatic&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKerberosSupport&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Kerberos.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.25.1\"]}, {\"cis_csc\": [\"1.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16655,'Ensure&#x20;&#039;Enumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#x20;All&#039;','This&#x20;policy&#x20;is&#x20;intended&#x20;to&#x20;provide&#x20;additional&#x20;security&#x20;against&#x20;external&#x20;DMA-capable&#x20;devices.&#x20;It&#x20;allows&#x20;for&#x20;more&#x20;control&#x20;over&#x20;the&#x20;enumeration&#x20;of&#x20;external&#x20;DMA-capable&#x20;devices&#x20;that&#x20;are&#x20;not&#x20;compatible&#x20;with&#x20;DMA&#x20;Remapping/device&#x20;memory&#x20;isolation&#x20;and&#x20;sandboxing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;All&#x20;.&#x20;&#x20;&#x20;&#x20;Note:&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;1394,&#x20;PCMCIA&#x20;or&#x20;ExpressCard&#x20;devices.&#x20;The&#x20;protection&#x20;also&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;R1803&#x20;or&#x20;higher,&#x20;and&#x20;also&#x20;requires&#x20;a&#x20;UEFI&#x20;BIOS&#x20;to&#x20;function.','Device&#x20;memory&#x20;sandboxing&#x20;allows&#x20;the&#x20;OS&#x20;to&#x20;leverage&#x20;the&#x20;I/O&#x20;Memory&#x20;Management&#x20;Unit&#x20;&#40;IOMMU&#41;&#x20;of&#x20;a&#x20;device&#x20;to&#x20;block&#x20;unpermitted&#x20;I/O,&#x20;or&#x20;memory&#x20;access,&#x20;by&#x20;the&#x20;peripheral.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;All&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKernel&#x20;DMA&#x20;ProtectionEnumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DmaGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16656,'Ensure&#x20;&#039;Disallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;prevents&#x20;automatic&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;use&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;user&#x20;is&#x20;restricted&#x20;to&#x20;the&#x20;set&#x20;of&#x20;input&#x20;methods&#x20;that&#x20;are&#x20;enabled&#x20;in&#x20;the&#x20;system&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;way&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLocale&#x20;ServicesDisallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16657,'Ensure&#x20;&#039;Block&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;&#40;email&#x20;address&#x20;or&#x20;user&#x20;name&#41;&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonBlock&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16658,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;anyone&#x20;can&#x20;interact&#x20;with&#x20;available&#x20;networks&#x20;UI&#x20;on&#x20;the&#x20;logon&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;disconnect&#x20;the&#x20;PC&#x20;from&#x20;the&#x20;network&#x20;or&#x20;can&#x20;connect&#x20;the&#x20;PC&#x20;to&#x20;other&#x20;available&#x20;networks&#x20;without&#x20;signing&#x20;into&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.2\"]}, {\"cis_csc\": [\"5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16659,'Ensure&#x20;&#039;Do&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;connected&#x20;users&#x20;from&#x20;being&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.3\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.5\"]}]'),(16660,'Ensure&#x20;&#039;Enumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;local&#x20;users&#x20;to&#x20;be&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonEnumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16661,'Ensure&#x20;&#039;Turn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;app&#x20;notifications&#x20;from&#x20;appearing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','App&#x20;notifications&#x20;might&#x20;display&#x20;sensitive&#x20;business&#x20;or&#x20;personal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.5\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16662,'Ensure&#x20;&#039;Turn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;picture&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;picture&#x20;password&#x20;feature&#x20;is&#x20;permitted,&#x20;the&#x20;user&#039;s&#x20;domain&#x20;password&#x20;is&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;it.','Picture&#x20;passwords&#x20;bypass&#x20;the&#x20;requirement&#x20;for&#x20;a&#x20;typed&#x20;complex&#x20;password.&#x20;In&#x20;a&#x20;shared&#x20;work&#x20;environment,&#x20;a&#x20;simple&#x20;shoulder&#x20;surf&#x20;where&#x20;someone&#x20;observed&#x20;the&#x20;on-screen&#x20;gestures&#x20;would&#x20;allow&#x20;that&#x20;person&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;the&#x20;need&#x20;to&#x20;know&#x20;the&#x20;complex&#x20;password.&#x20;Vertical&#x20;monitor&#x20;screens&#x20;with&#x20;an&#x20;image&#x20;are&#x20;much&#x20;more&#x20;visible&#x20;at&#x20;a&#x20;distance&#x20;than&#x20;horizontal&#x20;key&#x20;strokes,&#x20;increasing&#x20;the&#x20;likelihood&#x20;of&#x20;a&#x20;successful&#x20;observation&#x20;of&#x20;the&#x20;mouse&#x20;gestures.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.6\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16663,'Ensure&#x20;&#039;Turn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;convenience&#x20;PIN.&#x20;In&#x20;Windows&#x20;10,&#x20;convenience&#x20;PIN&#x20;was&#x20;replaced&#x20;with&#x20;Passport,&#x20;which&#x20;has&#x20;stronger&#x20;security&#x20;properties.&#x20;To&#x20;configure&#x20;Passport&#x20;for&#x20;domain&#x20;users,&#x20;use&#x20;the&#x20;policies&#x20;under&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Passport&#x20;for&#x20;Work.&#x20;Note:&#x20;The&#x20;user&#039;s&#x20;domain&#x20;password&#x20;will&#x20;be&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;this&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;PIN&#x20;is&#x20;created&#x20;from&#x20;a&#x20;much&#x20;smaller&#x20;selection&#x20;of&#x20;characters&#x20;than&#x20;a&#x20;password,&#x20;so&#x20;in&#x20;most&#x20;cases&#x20;a&#x20;PIN&#x20;will&#x20;be&#x20;much&#x20;less&#x20;robust&#x20;than&#x20;a&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;on&#x20;PIN&#x20;sign-in,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.28.7\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16664,'Ensure&#x20;&#039;Allow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Clipboard&#x20;contents&#x20;can&#x20;be&#x20;synchronized&#x20;across&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;clipboard&#x20;data&#x20;should&#x20;stay&#x20;local&#x20;to&#x20;the&#x20;system&#x20;and&#x20;not&#x20;synced&#x20;across&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices','[{\"cis\": [\"18.8.31.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16665,'Ensure&#x20;&#039;Allow&#x20;upload&#x20;of&#x20;User&#x20;Activities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;published&#x20;User&#x20;Activities&#x20;can&#x20;be&#x20;uploaded&#x20;to&#x20;the&#x20;cloud.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','TTo&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;upload&#x20;of&#x20;User&#x20;Activities','[{\"cis\": [\"18.8.31.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16666,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;on&#x20;battery&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.1\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16667,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;plugged&#x20;in&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.2\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16668,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.3\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16669,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.33.6.4\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16670,'Ensure&#x20;&#039;Configure&#x20;Offer&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Offer&#x20;&#40;Unsolicited&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;Help&#x20;desk&#x20;and&#x20;support&#x20;personnel&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;proactively&#x20;offer&#x20;assistance,&#x20;although&#x20;they&#x20;can&#x20;still&#x20;respond&#x20;to&#x20;user&#x20;assistance&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;user&#x20;might&#x20;be&#x20;tricked&#x20;and&#x20;accept&#x20;an&#x20;unsolicited&#x20;Remote&#x20;Assistance&#x20;offer&#x20;from&#x20;a&#x20;malicious&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Offer&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.35.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16671,'Ensure&#x20;&#039;Configure&#x20;Solicited&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Solicited&#x20;&#40;Ask&#x20;for&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','There&#x20;is&#x20;slight&#x20;risk&#x20;that&#x20;a&#x20;rogue&#x20;administrator&#x20;will&#x20;gain&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;desktop&#x20;session,&#x20;however,&#x20;they&#x20;cannot&#x20;connect&#x20;to&#x20;a&#x20;user&#039;s&#x20;computer&#x20;unannounced&#x20;or&#x20;control&#x20;it&#x20;without&#x20;permission&#x20;from&#x20;the&#x20;user.&#x20;When&#x20;an&#x20;expert&#x20;tries&#x20;to&#x20;connect,&#x20;the&#x20;user&#x20;can&#x20;still&#x20;choose&#x20;to&#x20;deny&#x20;the&#x20;connection&#x20;or&#x20;give&#x20;the&#x20;expert&#x20;view-only&#x20;privileges.&#x20;The&#x20;user&#x20;must&#x20;explicitly&#x20;click&#x20;the&#x20;Yes&#x20;button&#x20;to&#x20;allow&#x20;the&#x20;expert&#x20;to&#x20;remotely&#x20;control&#x20;the&#x20;workstation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Solicited&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16672,'Ensure&#x20;&#039;Enable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;RPC&#x20;clients&#x20;authenticate&#x20;with&#x20;the&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;when&#x20;the&#x20;call&#x20;they&#x20;are&#x20;making&#x20;contains&#x20;authentication&#x20;information.&#x20;The&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;on&#x20;computers&#x20;running&#x20;Windows&#x20;NT4&#x20;&#40;all&#x20;service&#x20;packs&#41;&#x20;cannot&#x20;process&#x20;authentication&#x20;information&#x20;supplied&#x20;in&#x20;this&#x20;manner.&#x20;This&#x20;policy&#x20;setting&#x20;can&#x20;cause&#x20;a&#x20;specific&#x20;issue&#x20;with&#x20;1-way&#x20;forest&#x20;trusts&#x20;if&#x20;it&#x20;is&#x20;applied&#x20;to&#x20;the&#x20;trusting&#x20;domain&#x20;DCs&#x20;&#40;see&#x20;Microsoft&#x20;KB3073942&#41;,&#x20;so&#x20;we&#x20;do&#x20;not&#x20;recommend&#x20;applying&#x20;it&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;This&#x20;policy&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Anonymous&#x20;access&#x20;to&#x20;RPC&#x20;services&#x20;could&#x20;result&#x20;in&#x20;accidental&#x20;disclosure&#x20;of&#x20;information&#x20;to&#x20;unauthenticated&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallEnable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16673,'Ensure&#x20;&#039;Restrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Authenticated&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;how&#x20;the&#x20;RPC&#x20;server&#x20;runtime&#x20;handles&#x20;unauthenticated&#x20;RPC&#x20;clients&#x20;connecting&#x20;to&#x20;RPC&#x20;servers.','Unauthenticated&#x20;RPC&#x20;communication&#x20;can&#x20;create&#x20;a&#x20;security&#x20;vulnerability.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Authenticated:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallRestrict&#x20;Unauthenticated&#x20;RPC&#x20;clients.','[{\"cis\": [\"18.8.37.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16674,'Ensure&#x20;&#039;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool&#x20;&#40;MSDT&#41;&#x20;interactive&#x20;communication&#x20;with&#x20;the&#x20;support&#x20;provider.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsMicrosoft&#x20;Support&#x20;Diagnostic&#x20;ToolMicrosoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider.','[{\"cis\": [\"18.8.45.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16675,'Ensure&#x20;&#039;Enable/Disable&#x20;PerfTrack&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;tracking&#x20;of&#x20;responsiveness&#x20;events.','When&#x20;enabled&#x20;the&#x20;aggregated&#x20;data&#x20;of&#x20;a&#x20;given&#x20;event&#x20;will&#x20;be&#x20;transmitted&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsWindows&#x20;Performance&#x20;PerfTrackEnable/Disable&#x20;PerfTrack.','[{\"cis\": [\"18.8.45.11.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16676,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;advertising&#x20;ID,&#x20;preventing&#x20;apps&#x20;from&#x20;using&#x20;the&#x20;ID&#x20;for&#x20;experiences&#x20;across&#x20;apps.','Tracking&#x20;user&#x20;activity&#x20;for&#x20;advertising&#x20;purposes,&#x20;even&#x20;anonymously,&#x20;may&#x20;be&#x20;a&#x20;privacy&#x20;concern.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemUser&#x20;ProfilesTurn&#x20;off&#x20;the&#x20;advertising&#x20;ID.','[{\"cis\": [\"18.8.47.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16677,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Client&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;is&#x20;enabled.','A&#x20;reliable&#x20;and&#x20;accurate&#x20;account&#x20;of&#x20;time&#x20;is&#x20;important&#x20;for&#x20;a&#x20;number&#x20;of&#x20;services&#x20;and&#x20;security&#x20;requirements,&#x20;including&#x20;but&#x20;not&#x20;limited&#x20;to&#x20;distributed&#x20;applications,&#x20;authentication&#x20;services,&#x20;multi-user&#x20;databases&#x20;and&#x20;logging&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Client.','[{\"cis\": [\"18.8.50.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(16678,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;is&#x20;enabled.','The&#x20;configuration&#x20;of&#x20;proper&#x20;time&#x20;synchronization&#x20;is&#x20;critically&#x20;important&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;both&#x20;due&#x20;to&#x20;the&#x20;sensitivity&#x20;of&#x20;Kerberos&#x20;authentication&#x20;timestamps&#x20;and&#x20;also&#x20;to&#x20;ensure&#x20;accurate&#x20;security&#x20;logging.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Server.','[{\"cis\": [\"18.8.50.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16679,'Ensure&#x20;&#039;Allow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Manages&#x20;a&#x20;Windows&#x20;app&#039;s&#x20;ability&#x20;to&#x20;share&#x20;data&#x20;between&#x20;users&#x20;who&#x20;have&#x20;installed&#x20;the&#x20;app.&#x20;Data&#x20;is&#x20;shared&#x20;through&#x20;the&#x20;SharedLocal&#x20;folder.&#x20;This&#x20;folder&#x20;is&#x20;available&#x20;through&#x20;the&#x20;Windows.Storage&#x20;API.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Users&#x20;of&#x20;a&#x20;system&#x20;could&#x20;accidentally&#x20;share&#x20;sensitive&#x20;data&#x20;with&#x20;other&#x20;users&#x20;on&#x20;the&#x20;same&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentAllow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16680,'Ensure&#x20;&#039;Allow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;control&#x20;whether&#x20;Microsoft&#x20;accounts&#x20;are&#x20;optional&#x20;for&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;require&#x20;an&#x20;account&#x20;to&#x20;sign&#x20;in.&#x20;This&#x20;policy&#x20;only&#x20;affects&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;use&#x20;their&#x20;enterprise&#x20;user&#x20;accounts&#x20;instead&#x20;of&#x20;using&#x20;their&#x20;Microsoft&#x20;accounts&#x20;when&#x20;accessing&#x20;Windows&#x20;store&#x20;apps.&#x20;This&#x20;provides&#x20;the&#x20;organization&#x20;with&#x20;greater&#x20;control&#x20;over&#x20;relevant&#x20;credentials.&#x20;Microsoft&#x20;accounts&#x20;cannot&#x20;be&#x20;centrally&#x20;managed&#x20;and&#x20;as&#x20;such&#x20;enterprise&#x20;credential&#x20;security&#x20;policies&#x20;cannot&#x20;be&#x20;applied&#x20;to&#x20;them,&#x20;which&#x20;could&#x20;put&#x20;any&#x20;information&#x20;accessed&#x20;by&#x20;using&#x20;Microsoft&#x20;accounts&#x20;at&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeAllow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.6.1\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16681,'Ensure&#x20;&#039;Disallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;disallows&#x20;AutoPlay&#x20;for&#x20;MTP&#x20;devices&#x20;like&#x20;cameras&#x20;or&#x20;phones.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesDisallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16682,'Ensure&#x20;&#039;Set&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands&#039;','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Autorun&#x20;commands.&#x20;Autorun&#x20;commands&#x20;are&#x20;generally&#x20;stored&#x20;in&#x20;autorun.inf&#x20;files.&#x20;They&#x20;often&#x20;launch&#x20;the&#x20;installation&#x20;program&#x20;or&#x20;other&#x20;routines.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands.','Prior&#x20;to&#x20;Windows&#x20;Vista,&#x20;when&#x20;media&#x20;containing&#x20;an&#x20;autorun&#x20;command&#x20;is&#x20;inserted,&#x20;the&#x20;system&#x20;will&#x20;automatically&#x20;execute&#x20;the&#x20;program&#x20;without&#x20;user&#x20;intervention.&#x20;This&#x20;creates&#x20;a&#x20;major&#x20;security&#x20;concern&#x20;as&#x20;code&#x20;may&#x20;be&#x20;executed&#x20;without&#x20;user&#039;s&#x20;knowledge.&#x20;The&#x20;default&#x20;behavior&#x20;starting&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;to&#x20;prompt&#x20;the&#x20;user&#x20;whether&#x20;autorun&#x20;command&#x20;is&#x20;to&#x20;be&#x20;run.&#x20;The&#x20;autorun&#x20;command&#x20;is&#x20;represented&#x20;as&#x20;a&#x20;handler&#x20;in&#x20;the&#x20;Autoplay&#x20;dialog.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesSet&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16683,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Autoplay&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;All&#x20;drives&#039;','Autoplay&#x20;starts&#x20;to&#x20;read&#x20;from&#x20;a&#x20;drive&#x20;as&#x20;soon&#x20;as&#x20;you&#x20;insert&#x20;media&#x20;in&#x20;the&#x20;drive,&#x20;which&#x20;causes&#x20;the&#x20;setup&#x20;file&#x20;for&#x20;programs&#x20;or&#x20;audio&#x20;media&#x20;to&#x20;start&#x20;immediately.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;the&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.&#x20;Autoplay&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;on&#x20;some&#x20;removable&#x20;drive&#x20;types,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives,&#x20;but&#x20;not&#x20;on&#x20;CD-ROM&#x20;drives.&#x20;Note:&#x20;You&#x20;cannot&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enable&#x20;Autoplay&#x20;on&#x20;computer&#x20;drives&#x20;in&#x20;which&#x20;it&#x20;is&#x20;disabled&#x20;by&#x20;default,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;All&#x20;drives.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;All&#x20;drives:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesTurn&#x20;off&#x20;Autoplay&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.8.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16684,'Ensure&#x20;&#039;Configure&#x20;enhanced&#x20;anti-spoofing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;enhanced&#x20;anti-spoofing&#x20;is&#x20;configured&#x20;for&#x20;devices&#x20;which&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Enterprise&#x20;managed&#x20;environments&#x20;are&#x20;now&#x20;supporting&#x20;a&#x20;wider&#x20;range&#x20;of&#x20;mobile&#x20;devices,&#x20;increasing&#x20;the&#x20;security&#x20;on&#x20;these&#x20;devices&#x20;will&#x20;help&#x20;protect&#x20;against&#x20;unauthorized&#x20;access&#x20;on&#x20;your&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsBiometricsFacial&#x20;FeaturesConfigure&#x20;enhanced&#x20;anti-spoofing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Biometrics.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;and&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Use&#x20;enhanced&#x20;anti-spoofing&#x20;when&#x20;available.&#x20;It&#x20;was&#x20;renamed&#x20;to&#x20;Configure&#x20;enhanced&#x20;anti-spoofing&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.10.1.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16685,'Ensure&#x20;&#039;Allow&#x20;Use&#x20;of&#x20;Camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;use&#x20;of&#x20;Camera&#x20;devices&#x20;on&#x20;the&#x20;machine&#x20;are&#x20;permitted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','Cameras&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment&#x20;can&#x20;pose&#x20;serious&#x20;privacy&#x20;and&#x20;data&#x20;exfiltration&#x20;risks&#x20;-&#x20;they&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;help&#x20;mitigate&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCameraAllow&#x20;Use&#x20;of&#x20;Camera&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Camera.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.12.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16686,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;experiences&#x20;that&#x20;help&#x20;consumers&#x20;make&#x20;the&#x20;most&#x20;of&#x20;their&#x20;devices&#x20;and&#x20;Microsoft&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet,&#x20;this&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.','Having&#x20;apps&#x20;silently&#x20;install&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;-&#x20;especially&#x20;if&#x20;the&#x20;apps&#x20;send&#x20;data&#x20;back&#x20;to&#x20;a&#x20;3rd&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.13.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16687,'Ensure&#x20;&#039;Require&#x20;pin&#x20;for&#x20;pairing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;First&#x20;Time&#039;&#x20;OR&#x20;&#039;Enabled:&#x20;Always&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;PIN&#x20;is&#x20;required&#x20;for&#x20;pairing&#x20;to&#x20;a&#x20;wireless&#x20;display&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&#039;Enabled:&#x20;First&#x20;Time&#039;&#x20;OR&#x20;&#039;Enabled:&#x20;Always&#039;.','If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured&#x20;or&#x20;disabled&#x20;then&#x20;a&#x20;PIN&#x20;would&#x20;not&#x20;be&#x20;required&#x20;when&#x20;pairing&#x20;wireless&#x20;display&#x20;devices&#x20;to&#x20;the&#x20;system,&#x20;increasing&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;Enabled:&#x20;First&#x20;Time&#039;&#x20;OR&#x20;&#039;Enabled:&#x20;Always&#039;&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsConnectRequire&#x20;pin&#x20;for&#x20;pairing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WirelessDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.1\"]}, {\"cis_csc\": [\"15.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16688,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;display&#x20;of&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;in&#x20;password&#x20;entry&#x20;user&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;useful&#x20;feature&#x20;when&#x20;entering&#x20;a&#x20;long&#x20;and&#x20;complex&#x20;password,&#x20;especially&#x20;when&#x20;using&#x20;a&#x20;touchscreen.&#x20;The&#x20;potential&#x20;risk&#x20;is&#x20;that&#x20;someone&#x20;else&#x20;may&#x20;see&#x20;your&#x20;password&#x20;while&#x20;surreptitiously&#x20;observing&#x20;your&#x20;screen.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceDo&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.15.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16689,'Ensure&#x20;&#039;Enumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;administrator&#x20;accounts&#x20;are&#x20;displayed&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;elevate&#x20;a&#x20;running&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;could&#x20;see&#x20;the&#x20;list&#x20;of&#x20;administrator&#x20;accounts,&#x20;making&#x20;it&#x20;slightly&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;user&#x20;who&#x20;has&#x20;logged&#x20;onto&#x20;a&#x20;console&#x20;session&#x20;to&#x20;try&#x20;to&#x20;crack&#x20;the&#x20;passwords&#x20;of&#x20;those&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceEnumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.15.2\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16690,'Ensure&#x20;&#039;Allow&#x20;Telemetry&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#039;&#x20;or&#x20;&#039;Enabled:&#x20;1&#x20;-&#x20;Basic&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;reported&#x20;to&#x20;Microsoft:A&#x20;value&#x20;of&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;will&#x20;send&#x20;minimal&#x20;data&#x20;to&#x20;Microsoft.&#x20;This&#x20;data&#x20;includes&#x20;Malicious&#x20;Software&#x20;Removal&#x20;Tool&#x20;&#40;MSRT&#41;&#x20;&amp;&#x20;Windows&#x20;Defender&#x20;data,&#x20;if&#x20;enabled,&#x20;and&#x20;telemetry&#x20;client&#x20;settings.&#x20;Setting&#x20;a&#x20;value&#x20;of&#x20;0&#x20;applies&#x20;to&#x20;enterprise,&#x20;EDU,&#x20;IoT&#x20;and&#x20;server&#x20;devices&#x20;only.&#x20;Setting&#x20;a&#x20;value&#x20;of&#x20;0&#x20;for&#x20;other&#x20;devices&#x20;is&#x20;equivalent&#x20;to&#x20;choosing&#x20;a&#x20;value&#x20;of&#x20;1.&#x20;A&#x20;value&#x20;of&#x20;1&#x20;-&#x20;Basic&#x20;sends&#x20;only&#x20;a&#x20;basic&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data.&#x20;Note&#x20;that&#x20;setting&#x20;values&#x20;of&#x20;0&#x20;or&#x20;1&#x20;will&#x20;degrade&#x20;certain&#x20;experiences&#x20;on&#x20;the&#x20;device.&#x20;A&#x20;value&#x20;of&#x20;2&#x20;-&#x20;Enhanced&#x20;sends&#x20;enhanced&#x20;diagnostic&#x20;and&#x20;usage&#x20;data.&#x20;A&#x20;value&#x20;of&#x20;3&#x20;-&#x20;Full&#x20;sends&#x20;the&#x20;same&#x20;data&#x20;as&#x20;a&#x20;value&#x20;of&#x20;2,&#x20;plus&#x20;additional&#x20;diagnostics&#x20;data,&#x20;including&#x20;the&#x20;files&#x20;and&#x20;content&#x20;that&#x20;may&#x20;have&#x20;caused&#x20;the&#x20;problem.&#x20;Windows&#x20;10&#x20;telemetry&#x20;settings&#x20;apply&#x20;to&#x20;the&#x20;Windows&#x20;operating&#x20;system&#x20;and&#x20;some&#x20;first&#x20;party&#x20;apps.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;third&#x20;party&#x20;apps&#x20;running&#x20;on&#x20;Windows&#x20;10.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;or&#x20;Enabled:&#x20;1&#x20;-&#x20;Basic&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;Allow&#x20;Telemetry&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;,&#x20;then&#x20;the&#x20;options&#x20;in&#x20;Windows&#x20;Update&#x20;to&#x20;defer&#x20;upgrades&#x20;and&#x20;updates&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates,&#x20;the&#x20;zero&#x20;value&#x20;was&#x20;named&#x20;0&#x20;-&#x20;Off&#x20;[Enterprise&#x20;Only]&#x20;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;0&#x20;-&#x20;Security&#x20;[Enterprise&#x20;Only]&#x20;or&#x20;Enabled:&#x20;1&#x20;-&#x20;Basic&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsAllow&#x20;Telemetry&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16691,'Ensure&#x20;&#039;Configure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Pr','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;can&#x20;automatically&#x20;use&#x20;an&#x20;authenticated&#x20;proxy&#x20;to&#x20;send&#x20;data&#x20;back&#x20;to&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsConfigure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16692,'Ensure&#x20;&#039;Do&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;prevent&#x20;its&#x20;devices&#x20;from&#x20;showing&#x20;feedback&#x20;questions&#x20;from&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Users&#x20;should&#x20;not&#x20;be&#x20;sending&#x20;any&#x20;feedback&#x20;to&#x20;3rd&#x20;party&#x20;vendors&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDo&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;FeedbackNotifications.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16693,'Ensure&#x20;&#039;Toggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Insider&#x20;build&#x20;controls&#x20;in&#x20;the&#x20;Advanced&#x20;Options&#x20;for&#x20;Windows&#x20;Update.&#x20;These&#x20;controls&#x20;are&#x20;located&#x20;under&#x20;&quot;Get&#x20;Insider&#x20;builds,&quot;&#x20;and&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;Windows&#x20;preview&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;only&#x20;to&#x20;devices&#x20;running&#x20;Windows&#x20;Server&#x20;2016,&#x20;up&#x20;until&#x20;Release&#x20;1703.&#x20;For&#x20;Release&#x20;1709&#x20;or&#x20;newer,&#x20;Microsoft&#x20;encourages&#x20;using&#x20;the&#x20;Manage&#x20;preview&#x20;builds&#x20;setting&#x20;&#40;Rule&#x20;18.9.102.1.1&#41;.&#x20;We&#x20;have&#x20;kept&#x20;this&#x20;setting&#x20;in&#x20;the&#x20;benchmark&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;older&#x20;builds&#x20;of&#x20;Windows&#x20;Server&#x20;2016&#x20;in&#x20;the&#x20;environment&#x20;are&#x20;still&#x20;enforced.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsToggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AllowBuildPreview.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.4\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16694,'Ensure&#x20;&#039;Application:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16695,'Ensure&#x20;&#039;Application:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16696,'Ensure&#x20;&#039;Security:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecurityControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.2.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16697,'Ensure&#x20;&#039;Security:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;196,608&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecuritySpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.2.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16698,'Ensure&#x20;&#039;Setup:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.3.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16699,'Ensure&#x20;&#039;Setup:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.3.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16700,'Ensure&#x20;&#039;System:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.4.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16701,'Ensure&#x20;&#039;System:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.26.4.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(16702,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','Disabling&#x20;Data&#x20;Execution&#x20;Prevention&#x20;can&#x20;allow&#x20;certain&#x20;legacy&#x20;plug-in&#x20;applications&#x20;to&#x20;function&#x20;without&#x20;terminating&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Data&#x20;Execution&#x20;Prevention&#x20;is&#x20;an&#x20;important&#x20;security&#x20;feature&#x20;supported&#x20;by&#x20;Explorer&#x20;that&#x20;helps&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;of&#x20;certain&#x20;types&#x20;of&#x20;malware.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.30.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16703,'Ensure&#x20;&#039;Turn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.30.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16704,'Ensure&#x20;&#039;Turn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.30.4\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16705,'Ensure&#x20;&#039;Turn&#x20;off&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;location&#x20;feature&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&#039;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsTurn&#x20;off&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sensors.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.39.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16706,'Ensure&#x20;&#039;Allow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;backup&#x20;and&#x20;restore&#x20;of&#x20;cellular&#x20;text&#x20;messages&#x20;to&#x20;Microsoft&#039;s&#x20;cloud&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMessagingAllow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Messaging.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.43.1\"]}, {\"cis_csc\": [\"9.1\", \"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16707,'Ensure&#x20;&#039;Block&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;setting&#x20;determines&#x20;whether&#x20;applications&#x20;and&#x20;services&#x20;on&#x20;the&#x20;device&#x20;can&#x20;utilize&#x20;new&#x20;consumer&#x20;Microsoft&#x20;account&#x20;authentication&#x20;via&#x20;the&#x20;Windows&#x20;OnlineID&#x20;and&#x20;WebAccountManager&#x20;APIs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;on&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;accountsBlock&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSAPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.44.1\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16708,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;However,&#x20;we&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;the&#x20;version&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Prevent&#x20;the&#x20;usage&#x20;of&#x20;SkyDrive&#x20;for&#x20;file&#x20;storage,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.52.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16709,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;helps&#x20;prevent&#x20;Remote&#x20;Desktop&#x20;clients&#x20;from&#x20;saving&#x20;passwords&#x20;on&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;was&#x20;previously&#x20;configured&#x20;as&#x20;Disabled&#x20;or&#x20;Not&#x20;configured,&#x20;any&#x20;previously&#x20;saved&#x20;passwords&#x20;will&#x20;be&#x20;deleted&#x20;the&#x20;first&#x20;time&#x20;a&#x20;Remote&#x20;Desktop&#x20;client&#x20;disconnects&#x20;from&#x20;any&#x20;server.','An&#x20;attacker&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;may&#x20;be&#x20;able&#x20;to&#x20;break&#x20;the&#x20;protection&#x20;guarding&#x20;saved&#x20;passwords.&#x20;An&#x20;attacker&#x20;who&#x20;compromises&#x20;a&#x20;user&#039;s&#x20;account&#x20;and&#x20;connects&#x20;to&#x20;their&#x20;computer&#x20;could&#x20;use&#x20;saved&#x20;passwords&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;additional&#x20;hosts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Connection&#x20;ClientDo&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.2.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16710,'Ensure&#x20;&#039;Restrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;users&#x20;&amp;&#x20;administrators&#x20;who&#x20;Remote&#x20;Desktop&#x20;to&#x20;a&#x20;server&#x20;will&#x20;continue&#x20;to&#x20;use&#x20;the&#x20;same&#x20;session&#x20;-&#x20;if&#x20;they&#x20;disconnect&#x20;and&#x20;reconnect,&#x20;they&#x20;will&#x20;go&#x20;back&#x20;to&#x20;the&#x20;same&#x20;session&#x20;they&#x20;were&#x20;using&#x20;before,&#x20;preventing&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;second&#x20;simultaneous&#x20;session.&#x20;This&#x20;both&#x20;prevents&#x20;unnecessary&#x20;resource&#x20;usage&#x20;by&#x20;having&#x20;the&#x20;server&#x20;host&#x20;unnecessary&#x20;additional&#x20;sessions&#x20;&#40;which&#x20;would&#x20;put&#x20;extra&#x20;load&#x20;on&#x20;the&#x20;server&#41;&#x20;and&#x20;also&#x20;ensures&#x20;a&#x20;consistency&#x20;of&#x20;experience&#x20;for&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostConnectionsRestrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Restrict&#x20;Terminal&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;remote&#x20;session,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.2.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16711,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;COM&#x20;ports&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;COM&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.3.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16712,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;sharing&#x20;the&#x20;local&#x20;drives&#x20;on&#x20;their&#x20;client&#x20;computers&#x20;to&#x20;Remote&#x20;Desktop&#x20;Servers&#x20;that&#x20;they&#x20;access.&#x20;Mapped&#x20;drives&#x20;appear&#x20;in&#x20;the&#x20;session&#x20;folder&#x20;tree&#x20;in&#x20;Windows&#x20;Explorer&#x20;in&#x20;the&#x20;following&#x20;format:&#x20;&#92;TSClient&lt;driveletter&gt;$&#x20;If&#x20;local&#x20;drives&#x20;are&#x20;shared&#x20;they&#x20;are&#x20;left&#x20;vulnerable&#x20;to&#x20;intruders&#x20;who&#x20;want&#x20;to&#x20;exploit&#x20;the&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Data&#x20;could&#x20;be&#x20;forwarded&#x20;from&#x20;the&#x20;user&#039;s&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;without&#x20;any&#x20;direct&#x20;user&#x20;interaction.&#x20;Malicious&#x20;software&#x20;already&#x20;present&#x20;on&#x20;a&#x20;compromised&#x20;server&#x20;would&#x20;have&#x20;direct&#x20;and&#x20;stealthy&#x20;disk&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.3.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16713,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;LPT&#x20;ports&#x20;during&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;LPT&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.3.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16714,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;redirection&#x20;of&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;devices,&#x20;such&#x20;as&#x20;Windows&#x20;Portable&#x20;Devices,&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.3.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16715,'Ensure&#x20;&#039;Always&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;always&#x20;prompts&#x20;the&#x20;client&#x20;computer&#x20;for&#x20;a&#x20;password&#x20;upon&#x20;connection.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enforce&#x20;a&#x20;password&#x20;prompt&#x20;for&#x20;users&#x20;who&#x20;log&#x20;on&#x20;to&#x20;Remote&#x20;Desktop&#x20;Services,&#x20;even&#x20;if&#x20;they&#x20;already&#x20;provided&#x20;the&#x20;password&#x20;in&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;have&#x20;the&#x20;option&#x20;to&#x20;store&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;when&#x20;they&#x20;create&#x20;a&#x20;new&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut.&#x20;If&#x20;the&#x20;server&#x20;that&#x20;runs&#x20;Remote&#x20;Desktop&#x20;Services&#x20;allows&#x20;users&#x20;who&#x20;have&#x20;used&#x20;this&#x20;feature&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;server&#x20;but&#x20;not&#x20;enter&#x20;their&#x20;password,&#x20;then&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer&#x20;could&#x20;connect&#x20;to&#x20;a&#x20;Remote&#x20;Desktop&#x20;Server&#x20;through&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut,&#x20;even&#x20;though&#x20;they&#x20;may&#x20;not&#x20;know&#x20;the&#x20;user&#039;s&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityAlways&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Always&#x20;prompt&#x20;client&#x20;for&#x20;password&#x20;upon&#x20;connection,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.9.1\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16716,'Ensure&#x20;&#039;Require&#x20;secure&#x20;RPC&#x20;communication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;requires&#x20;secure&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;communication&#x20;with&#x20;all&#x20;clients&#x20;or&#x20;allows&#x20;unsecured&#x20;communication.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;strengthen&#x20;the&#x20;security&#x20;of&#x20;RPC&#x20;communication&#x20;with&#x20;clients&#x20;by&#x20;allowing&#x20;only&#x20;authenticated&#x20;and&#x20;encrypted&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;unsecure&#x20;RPC&#x20;communication&#x20;can&#x20;exposes&#x20;the&#x20;server&#x20;to&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks&#x20;and&#x20;data&#x20;disclosure&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;secure&#x20;RPC&#x20;communication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.9.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16717,'Ensure&#x20;&#039;Require&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;SSL&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;security&#x20;layer&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;SSL.&#x20;Note:&#x20;In&#x20;spite&#x20;of&#x20;this&#x20;setting&#x20;being&#x20;labeled&#x20;SSL,&#x20;it&#x20;is&#x20;actually&#x20;enforcing&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;version&#x20;1.0,&#x20;not&#x20;the&#x20;older&#x20;&#40;and&#x20;less&#x20;secure&#41;&#x20;SSL&#x20;protocol.','The&#x20;native&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;encryption&#x20;is&#x20;now&#x20;considered&#x20;a&#x20;weak&#x20;protocol,&#x20;so&#x20;enforcing&#x20;the&#x20;use&#x20;of&#x20;stronger&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;encryption&#x20;for&#x20;all&#x20;RDP&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;is&#x20;preferred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.9.5.3\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16718,'Ensure&#x20;&#039;Require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;to&#x20;require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;to&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Requiring&#x20;that&#x20;user&#x20;authentication&#x20;occur&#x20;earlier&#x20;in&#x20;the&#x20;remote&#x20;connection&#x20;process&#x20;enhances&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.9.4\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16719,'Ensure&#x20;&#039;Set&#x20;client&#x20;connection&#x20;encryption&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;High&#x20;Level&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;encryption&#x20;level&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;client&#x20;computers&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;This&#x20;policy&#x20;only&#x20;applies&#x20;when&#x20;you&#x20;are&#x20;using&#x20;native&#x20;RDP&#x20;encryption.&#x20;However,&#x20;native&#x20;RDP&#x20;encryption&#x20;&#40;as&#x20;opposed&#x20;to&#x20;SSL&#x20;encryption&#41;&#x20;is&#x20;not&#x20;recommended.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;SSL&#x20;encryption.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;High&#x20;Level.','If&#x20;Remote&#x20;Desktop&#x20;client&#x20;connections&#x20;that&#x20;use&#x20;low&#x20;level&#x20;encryption&#x20;are&#x20;allowed,&#x20;it&#x20;is&#x20;more&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;any&#x20;captured&#x20;Remote&#x20;Desktop&#x20;Services&#x20;network&#x20;traffic.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.9.5\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16720,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;time&#x20;that&#x20;an&#x20;active&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;can&#x20;be&#x20;idle&#x20;&#40;without&#x20;user&#x20;input&#41;&#x20;before&#x20;it&#x20;is&#x20;automatically&#x20;disconnected.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;inactive&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Terminal&#x20;Services&#x20;sessions,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.10.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16721,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;1&#x20;minute&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;a&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;1&#x20;minute.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;disconnected&#x20;but&#x20;still&#x20;active&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.&#x20;This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;disconnected&#x20;session&#x20;is&#x20;properly&#x20;terminated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;1&#x20;minute:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.10.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16722,'Ensure&#x20;&#039;Do&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;retains&#x20;a&#x20;user&#039;s&#x20;per-session&#x20;temporary&#x20;folders&#x20;at&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;inside&#x20;the&#x20;temporary&#x20;folders&#x20;and&#x20;visible&#x20;to&#x20;other&#x20;administrators&#x20;that&#x20;log&#x20;into&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Do&#x20;not&#x20;delete&#x20;temp&#x20;folder&#x20;upon&#x20;exit,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.11.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16723,'Ensure&#x20;&#039;Do&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','By&#x20;default,&#x20;Remote&#x20;Desktop&#x20;Services&#x20;creates&#x20;a&#x20;separate&#x20;temporary&#x20;folder&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;for&#x20;each&#x20;active&#x20;session&#x20;that&#x20;a&#x20;user&#x20;maintains&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server.&#x20;The&#x20;temporary&#x20;folder&#x20;is&#x20;created&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;in&#x20;a&#x20;Temp&#x20;folder&#x20;under&#x20;the&#x20;user&#039;s&#x20;profile&#x20;folder&#x20;and&#x20;is&#x20;named&#x20;with&#x20;the&#x20;sessionid.&#x20;This&#x20;temporary&#x20;folder&#x20;is&#x20;used&#x20;to&#x20;store&#x20;individual&#x20;temporary&#x20;files.&#x20;To&#x20;reclaim&#x20;disk&#x20;space,&#x20;the&#x20;temporary&#x20;folder&#x20;is&#x20;deleted&#x20;when&#x20;the&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;a&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;keeps&#x20;the&#x20;cached&#x20;data&#x20;independent&#x20;for&#x20;each&#x20;session,&#x20;both&#x20;reducing&#x20;the&#x20;chance&#x20;of&#x20;problems&#x20;from&#x20;shared&#x20;cached&#x20;data&#x20;between&#x20;sessions,&#x20;and&#x20;keeping&#x20;possibly&#x20;sensitive&#x20;data&#x20;separate&#x20;to&#x20;each&#x20;user&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.59.3.11.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16724,'Ensure&#x20;&#039;Prevent&#x20;downloading&#x20;of&#x20;enclosures&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;having&#x20;enclosures&#x20;&#40;file&#x20;attachments&#41;&#x20;downloaded&#x20;from&#x20;an&#x20;RSS&#x20;feed&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;attachments&#x20;to&#x20;be&#x20;downloaded&#x20;through&#x20;the&#x20;RSS&#x20;feed&#x20;can&#x20;introduce&#x20;files&#x20;that&#x20;could&#x20;have&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRSS&#x20;FeedsPrevent&#x20;downloading&#x20;of&#x20;enclosures&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InetRes.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Turn&#x20;off&#x20;downloading&#x20;of&#x20;enclosures,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.60.1\"]}, {\"cis_csc\": [\"7.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16725,'Ensure&#x20;&#039;Allow&#x20;Cloud&#x20;Search&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;search&#x20;cloud&#x20;sources&#x20;like&#x20;OneDrive&#x20;and&#x20;SharePoint.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#x20;.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cloud&#x20;Search&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.61.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16726,'Ensure&#x20;&#039;Allow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;encrypted&#x20;items&#x20;are&#x20;allowed&#x20;to&#x20;be&#x20;indexed.&#x20;When&#x20;this&#x20;setting&#x20;is&#x20;changed,&#x20;the&#x20;index&#x20;is&#x20;rebuilt&#x20;completely.&#x20;Full&#x20;volume&#x20;encryption&#x20;&#40;such&#x20;as&#x20;BitLocker&#x20;Drive&#x20;Encryption&#x20;or&#x20;a&#x20;non-Microsoft&#x20;solution&#41;&#x20;must&#x20;be&#x20;used&#x20;for&#x20;the&#x20;location&#x20;of&#x20;the&#x20;index&#x20;to&#x20;maintain&#x20;security&#x20;for&#x20;encrypted&#x20;files.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Indexing&#x20;and&#x20;allowing&#x20;users&#x20;to&#x20;search&#x20;encrypted&#x20;files&#x20;could&#x20;potentially&#x20;reveal&#x20;confidential&#x20;data&#x20;stored&#x20;within&#x20;the&#x20;encrypted&#x20;files.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.61.3\"]}, {\"cis_csc\": [\"13.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16727,'Ensure&#x20;&#039;Turn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','The&#x20;Key&#x20;Management&#x20;Service&#x20;&#40;KMS&#41;&#x20;is&#x20;a&#x20;Microsoft&#x20;license&#x20;activation&#x20;method&#x20;that&#x20;entails&#x20;setting&#x20;up&#x20;a&#x20;local&#x20;server&#x20;to&#x20;store&#x20;the&#x20;software&#x20;licenses.&#x20;The&#x20;KMS&#x20;server&#x20;itself&#x20;needs&#x20;to&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;activate&#x20;the&#x20;KMS&#x20;service,&#x20;but&#x20;subsequent&#x20;on-network&#x20;clients&#x20;can&#x20;activate&#x20;Microsoft&#x20;Windows&#x20;OS&#x20;and/or&#x20;their&#x20;Microsoft&#x20;Office&#x20;via&#x20;the&#x20;KMS&#x20;server&#x20;instead&#x20;of&#x20;connecting&#x20;directly&#x20;to&#x20;Microsoft.&#x20;This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;opt-out&#x20;of&#x20;sending&#x20;KMS&#x20;client&#x20;activation&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Even&#x20;though&#x20;the&#x20;KMS&#x20;licensing&#x20;method&#x20;does&#x20;not&#x20;require&#x20;KMS&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;Microsoft,&#x20;they&#x20;still&#x20;send&#x20;KMS&#x20;client&#x20;activation&#x20;state&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSoftware&#x20;Protection&#x20;PlatformTurn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AVSValidationGP.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.66.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16728,'Ensure&#x20;&#039;Configure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;configures&#x20;a&#x20;local&#x20;override&#x20;for&#x20;the&#x20;configuration&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&quot;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&quot;.&#x20;This&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;set&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','The&#x20;decision&#x20;on&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;participate&#x20;in&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;for&#x20;malicious&#x20;software&#x20;reporting&#x20;should&#x20;be&#x20;made&#x20;centrally&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;so&#x20;that&#x20;all&#x20;computers&#x20;within&#x20;it&#x20;behave&#x20;consistently&#x20;in&#x20;that&#x20;regard.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Disabled&#x20;ensures&#x20;that&#x20;the&#x20;decision&#x20;remains&#x20;centrally&#x20;managed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusMAPSConfigure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.3.1\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16729,'Ensure&#x20;&#039;Join&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&#039;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#039;.&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;is&#x20;the&#x20;online&#x20;community&#x20;that&#x20;helps&#x20;you&#x20;choose&#x20;how&#x20;to&#x20;respond&#x20;to&#x20;potential&#x20;threats.&#x20;The&#x20;community&#x20;also&#x20;helps&#x20;stop&#x20;the&#x20;spread&#x20;of&#x20;new&#x20;malicious&#x20;software&#x20;infections.&#x20;You&#x20;can&#x20;choose&#x20;to&#x20;send&#x20;basic&#x20;or&#x20;additional&#x20;information&#x20;about&#x20;detected&#x20;software.&#x20;Additional&#x20;information&#x20;helps&#x20;Microsoft&#x20;create&#x20;new&#x20;definitions&#x20;and&#x20;help&#x20;it&#x20;to&#x20;protect&#x20;your&#x20;computer.&#x20;Possible&#x20;options&#x20;are:&#x20;-&#x20;&#40;0x0&#41;&#x20;Disabled&#x20;&#40;default&#41;&#x20;-&#x20;&#40;0x1&#41;&#x20;Basic&#x20;membership&#x20;-&#x20;&#40;0x2&#41;&#x20;Advanced&#x20;membership&#x20;&#x20;&#x20;Basic&#x20;membership&#x20;will&#x20;send&#x20;basic&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;software&#x20;that&#x20;has&#x20;been&#x20;detected&#x20;including&#x20;where&#x20;the&#x20;software&#x20;came&#x20;from&#x20;the&#x20;actions&#x20;that&#x20;you&#x20;apply&#x20;or&#x20;that&#x20;are&#x20;applied&#x20;automatically&#x20;and&#x20;whether&#x20;the&#x20;actions&#x20;were&#x20;successful.&#x20;Advanced&#x20;membership&#x20;in&#x20;addition&#x20;to&#x20;basic&#x20;information&#x20;will&#x20;send&#x20;more&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;malicious&#x20;software&#x20;spyware&#x20;and&#x20;potentially&#x20;unwanted&#x20;software&#x20;including&#x20;the&#x20;location&#x20;of&#x20;the&#x20;software&#x20;file&#x20;names&#x20;how&#x20;the&#x20;software&#x20;operates&#x20;and&#x20;how&#x20;it&#x20;has&#x20;impacted&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;information&#x20;that&#x20;would&#x20;be&#x20;sent&#x20;can&#x20;include&#x20;things&#x20;like&#x20;location&#x20;of&#x20;detected&#x20;items&#x20;on&#x20;your&#x20;computer&#x20;if&#x20;harmful&#x20;software&#x20;was&#x20;removed.&#x20;The&#x20;information&#x20;would&#x20;be&#x20;automatically&#x20;collected&#x20;and&#x20;sent.&#x20;In&#x20;some&#x20;instances&#x20;personal&#x20;information&#x20;might&#x20;unintentionally&#x20;be&#x20;sent&#x20;to&#x20;Microsoft.&#x20;However,&#x20;Microsoft&#x20;states&#x20;that&#x20;it&#x20;will&#x20;not&#x20;use&#x20;this&#x20;information&#x20;to&#x20;identify&#x20;you&#x20;or&#x20;contact&#x20;you.&#x20;For&#x20;privacy&#x20;reasons&#x20;in&#x20;high&#x20;security&#x20;environments,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;prevent&#x20;these&#x20;data&#x20;submissions&#x20;altogether.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusMAPSJoin&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.3.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16730,'Ensure&#x20;&#039;Turn&#x20;on&#x20;behavior&#x20;monitoring&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;behavior&#x20;monitoring&#x20;for&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Windows&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;behavior&#x20;monitoring&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.7.1\"]}, {\"cis_csc\": [\"8.1\"]}, {\"pci_dss\": [\"5.2\"]}]'),(16731,'Ensure&#x20;&#039;Configure&#x20;Watson&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;whether&#x20;or&#x20;not&#x20;Watson&#x20;events&#x20;are&#x20;sent.','Watson&#x20;events&#x20;are&#x20;the&#x20;reports&#x20;that&#x20;get&#x20;sent&#x20;to&#x20;Microsoft&#x20;when&#x20;a&#x20;program&#x20;or&#x20;service&#x20;crashes&#x20;or&#x20;fails,&#x20;including&#x20;the&#x20;possibility&#x20;of&#x20;automatic&#x20;submission.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusReportingConfigure&#x20;Watson&#x20;events.','[{\"cis\": [\"18.9.77.9.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16732,'Ensure&#x20;&#039;Scan&#x20;removable&#x20;drives&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;scan&#x20;for&#x20;malicious&#x20;software&#x20;and&#x20;unwanted&#x20;software&#x20;in&#x20;the&#x20;contents&#x20;of&#x20;removable&#x20;drives,&#x20;such&#x20;as&#x20;USB&#x20;flash&#x20;drives,&#x20;when&#x20;running&#x20;a&#x20;full&#x20;scan.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;present&#x20;removable&#x20;drives&#x20;are&#x20;always&#x20;included&#x20;in&#x20;any&#x20;type&#x20;of&#x20;scan,&#x20;as&#x20;removable&#x20;drives&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;contain&#x20;malicious&#x20;software&#x20;brought&#x20;in&#x20;to&#x20;the&#x20;enterprise&#x20;managed&#x20;environment&#x20;from&#x20;an&#x20;external,&#x20;unmanaged&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusScanScan&#x20;removable&#x20;drives&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.10.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16733,'Ensure&#x20;&#039;Turn&#x20;on&#x20;e-mail&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;e-mail&#x20;scanning.&#x20;When&#x20;e-mail&#x20;scanning&#x20;is&#x20;enabled,&#x20;the&#x20;engine&#x20;will&#x20;parse&#x20;the&#x20;mailbox&#x20;and&#x20;mail&#x20;files,&#x20;according&#x20;to&#x20;their&#x20;specific&#x20;format,&#x20;in&#x20;order&#x20;to&#x20;analyze&#x20;the&#x20;mail&#x20;bodies&#x20;and&#x20;attachments.&#x20;Several&#x20;e-mail&#x20;formats&#x20;are&#x20;currently&#x20;supported,&#x20;for&#x20;example:&#x20;pst&#x20;&#40;Outlook&#41;,&#x20;dbx,&#x20;mbx,&#x20;mime&#x20;&#40;Outlook&#x20;Express&#41;,&#x20;binhex&#x20;&#40;Mac&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Incoming&#x20;e-mails&#x20;should&#x20;be&#x20;scanned&#x20;by&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Windows&#x20;Defender&#x20;Antivirus,&#x20;as&#x20;email&#x20;attachments&#x20;are&#x20;a&#x20;commonly&#x20;used&#x20;attack&#x20;vector&#x20;to&#x20;infiltrate&#x20;computers&#x20;with&#x20;malicious&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusScanTurn&#x20;on&#x20;e-mail&#x20;scanning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.10.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16734,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;Windows&#x20;Defender&#x20;Exploit&#x20;Guard&#x20;network&#x20;protection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;.','This&#x20;setting&#x20;can&#x20;help&#x20;prevent&#x20;employees&#x20;from&#x20;using&#x20;any&#x20;application&#x20;to&#x20;access&#x20;dangerous&#x20;domains&#x20;that&#x20;may&#x20;host&#x20;phishing&#x20;scams,&#x20;exploit-hosting&#x20;sites,&#x20;and&#x20;other&#x20;malicious&#x20;content&#x20;on&#x20;the&#x20;Internet.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusWindows&#x20;Defender&#x20;Exploit&#x20;GuardNetwork&#x20;ProtectionPrevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.13.3.1\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16735,'Ensure&#x20;&#039;Configure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;detection&#x20;and&#x20;action&#x20;for&#x20;Potentially&#x20;Unwanted&#x20;Applications&#x20;&#40;PUA&#41;,&#x20;which&#x20;are&#x20;sneaky&#x20;unwanted&#x20;application&#x20;bundlers&#x20;or&#x20;their&#x20;bundled&#x20;applications,&#x20;that&#x20;can&#x20;deliver&#x20;adware&#x20;or&#x20;malware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;.&#x20;For&#x20;more&#x20;information,&#x20;see&#x20;this&#x20;link:&#x20;Block&#x20;potentially&#x20;unwanted&#x20;applications&#x20;with&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;|&#x20;Microsoft&#x20;Docs','Potentially&#x20;unwanted&#x20;applications&#x20;can&#x20;increase&#x20;the&#x20;risk&#x20;of&#x20;your&#x20;network&#x20;being&#x20;infected&#x20;with&#x20;malware,&#x20;cause&#x20;malware&#x20;infections&#x20;to&#x20;be&#x20;harder&#x20;to&#x20;identify,&#x20;and&#x20;can&#x20;waste&#x20;IT&#x20;resources&#x20;in&#x20;cleaning&#x20;up&#x20;the&#x20;applications.&#x20;They&#x20;should&#x20;be&#x20;blocked&#x20;from&#x20;installation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusConfigure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.77.14\"]}, {\"cis_csc\": [\"8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16736,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Defender&#x20;AntiVirus&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;If&#x20;the&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;Disabled,&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;runs&#x20;and&#x20;computers&#x20;are&#x20;scanned&#x20;for&#x20;malware&#x20;and&#x20;other&#x20;potentially&#x20;unwanted&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;current,&#x20;updated&#x20;antivirus&#x20;product&#x20;is&#x20;scanning&#x20;each&#x20;computer&#x20;for&#x20;malicious&#x20;file&#x20;activity.&#x20;Microsoft&#x20;provides&#x20;a&#x20;competent&#x20;solution&#x20;out&#x20;of&#x20;the&#x20;box&#x20;in&#x20;Windows&#x20;Defender&#x20;Antivirus.&#x20;Organizations&#x20;that&#x20;choose&#x20;to&#x20;purchase&#x20;a&#x20;reputable&#x20;3rd-party&#x20;antivirus&#x20;solution&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;in&#x20;lieu&#x20;of&#x20;the&#x20;commercial&#x20;alternative.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusTurn&#x20;off&#x20;Windows&#x20;Defender&#x20;AntiVirus&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;off&#x20;Windows&#x20;Defender,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.77.15\"]}, {\"cis_csc\": [\"8.1\"]}, {\"pci_dss\": [\"5.2\"]}, {\"tsc\": [\"CC6.8\"]}]'),(16737,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;the&#x20;behavior&#x20;of&#x20;Windows&#x20;SmartScreen.&#x20;Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;Some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;with&#x20;this&#x20;feature&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass.','Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;However,&#x20;due&#x20;to&#x20;the&#x20;fact&#x20;that&#x20;some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;disable&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenExplorerConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Configure&#x20;Windows&#x20;SmartScreen,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.80.1.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(16738,'Ensure&#x20;&#039;Allow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;are&#x20;allowed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;.','This&#x20;Microsoft&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;collect&#x20;data&#x20;and&#x20;suggest&#x20;apps&#x20;based&#x20;on&#x20;that&#x20;data&#x20;collected.&#x20;Disabling&#x20;this&#x20;setting&#x20;will&#x20;help&#x20;ensure&#x20;your&#x20;data&#x20;is&#x20;not&#x20;shared&#x20;with&#x20;any&#x20;third&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.84.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16739,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#039;&#x20;OR&#x20;&#039;Disabled&#039;&#x20;but&#x20;not&#x20;&#039;Enabled:&','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;Ink&#x20;items&#x20;are&#x20;allowed&#x20;above&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled&#x20;.','Allowing&#x20;any&#x20;apps&#x20;to&#x20;be&#x20;accessed&#x20;while&#x20;system&#x20;is&#x20;locked&#x20;is&#x20;not&#x20;recommended.&#x20;If&#x20;this&#x20;feature&#x20;is&#x20;permitted,&#x20;it&#x20;should&#x20;only&#x20;be&#x20;accessible&#x20;once&#x20;a&#x20;user&#x20;authenticates&#x20;with&#x20;the&#x20;proper&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.84.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16740,'Ensure&#x20;&#039;Allow&#x20;user&#x20;control&#x20;over&#x20;installs&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;are&#x20;permitted&#x20;to&#x20;change&#x20;installation&#x20;options&#x20;that&#x20;typically&#x20;are&#x20;available&#x20;only&#x20;to&#x20;system&#x20;administrators.&#x20;The&#x20;security&#x20;features&#x20;of&#x20;Windows&#x20;Installer&#x20;normally&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;installation&#x20;options&#x20;that&#x20;are&#x20;typically&#x20;reserved&#x20;for&#x20;system&#x20;administrators,&#x20;such&#x20;as&#x20;specifying&#x20;the&#x20;directory&#x20;to&#x20;which&#x20;files&#x20;are&#x20;installed.&#x20;If&#x20;Windows&#x20;Installer&#x20;detects&#x20;that&#x20;an&#x20;installation&#x20;package&#x20;has&#x20;permitted&#x20;the&#x20;user&#x20;to&#x20;change&#x20;a&#x20;protected&#x20;option,&#x20;it&#x20;stops&#x20;the&#x20;installation&#x20;and&#x20;displays&#x20;a&#x20;message.&#x20;These&#x20;security&#x20;features&#x20;operate&#x20;only&#x20;when&#x20;the&#x20;installation&#x20;program&#x20;is&#x20;running&#x20;in&#x20;a&#x20;privileged&#x20;security&#x20;context&#x20;in&#x20;which&#x20;it&#x20;has&#x20;access&#x20;to&#x20;directories&#x20;denied&#x20;to&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;only&#x20;IT&#x20;staff&#x20;with&#x20;administrative&#x20;rights&#x20;should&#x20;be&#x20;installing&#x20;or&#x20;changing&#x20;software&#x20;on&#x20;a&#x20;system.&#x20;Allowing&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;have&#x20;any&#x20;control&#x20;over&#x20;installs&#x20;can&#x20;risk&#x20;unapproved&#x20;software&#x20;from&#x20;being&#x20;installed&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;system,&#x20;which&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;become&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAllow&#x20;user&#x20;control&#x20;over&#x20;installs&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Enable&#x20;user&#x20;control&#x20;over&#x20;installs,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16741,'Ensure&#x20;&#039;Always&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;Windows&#x20;Installer&#x20;should&#x20;use&#x20;system&#x20;permissions&#x20;when&#x20;it&#x20;installs&#x20;any&#x20;program&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;This&#x20;setting&#x20;appears&#x20;both&#x20;in&#x20;the&#x20;Computer&#x20;Configuration&#x20;and&#x20;User&#x20;Configuration&#x20;folders.&#x20;To&#x20;make&#x20;this&#x20;setting&#x20;effective,&#x20;you&#x20;must&#x20;enable&#x20;the&#x20;setting&#x20;in&#x20;both&#x20;folders.&#x20;Caution:&#x20;If&#x20;enabled,&#x20;skilled&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;permissions&#x20;this&#x20;setting&#x20;grants&#x20;to&#x20;change&#x20;their&#x20;privileges&#x20;and&#x20;gain&#x20;permanent&#x20;access&#x20;to&#x20;restricted&#x20;files&#x20;and&#x20;folders.&#x20;Note&#x20;that&#x20;the&#x20;User&#x20;Configuration&#x20;version&#x20;of&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;guaranteed&#x20;to&#x20;be&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;with&#x20;limited&#x20;privileges&#x20;can&#x20;exploit&#x20;this&#x20;feature&#x20;by&#x20;creating&#x20;a&#x20;Windows&#x20;Installer&#x20;installation&#x20;package&#x20;that&#x20;creates&#x20;a&#x20;new&#x20;local&#x20;account&#x20;that&#x20;belongs&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;adds&#x20;their&#x20;current&#x20;account&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;installs&#x20;malicious&#x20;software,&#x20;or&#x20;performs&#x20;other&#x20;unauthorized&#x20;activities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAlways&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(16742,'Ensure&#x20;&#039;Prevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Web-based&#x20;programs&#x20;are&#x20;allowed&#x20;to&#x20;install&#x20;software&#x20;on&#x20;the&#x20;computer&#x20;without&#x20;notifying&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Suppressing&#x20;the&#x20;system&#x20;warning&#x20;can&#x20;pose&#x20;a&#x20;security&#x20;risk&#x20;and&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerPrevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;IE&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.3\"]}, {\"cis_csc\": [\"7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(16743,'Ensure&#x20;&#039;Sign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;a&#x20;device&#x20;will&#x20;automatically&#x20;sign-in&#x20;the&#x20;last&#x20;interactive&#x20;user&#x20;after&#x20;Windows&#x20;Update&#x20;restarts&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;feature&#x20;will&#x20;prevent&#x20;the&#x20;caching&#x20;of&#x20;user&#039;s&#x20;credentials&#x20;and&#x20;unauthorized&#x20;use&#x20;of&#x20;the&#x20;device,&#x20;and&#x20;also&#x20;ensure&#x20;the&#x20;user&#x20;is&#x20;aware&#x20;of&#x20;the&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Logon&#x20;OptionsSign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinLogon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.86.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(16744,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;enables&#x20;logging&#x20;of&#x20;all&#x20;PowerShell&#x20;script&#x20;input&#x20;to&#x20;the&#x20;Microsoft-Windows-&#x20;PowerShell/Operational&#x20;event&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Microsoft&#039;s&#x20;own&#x20;hardening&#x20;guidance,&#x20;they&#x20;recommend&#x20;the&#x20;opposite&#x20;value,&#x20;Enabled,&#x20;because&#x20;having&#x20;this&#x20;data&#x20;logged&#x20;improves&#x20;investigations&#x20;of&#x20;PowerShell&#x20;attack&#x20;incidents.&#x20;However,&#x20;the&#x20;default&#x20;ACL&#x20;on&#x20;the&#x20;PowerShell&#x20;Operational&#x20;log&#x20;allows&#x20;Interactive&#x20;User&#x20;&#40;i.e.&#x20;any&#x20;logged&#x20;on&#x20;user&#41;&#x20;to&#x20;read&#x20;it,&#x20;and&#x20;therefore&#x20;possibly&#x20;expose&#x20;passwords&#x20;or&#x20;other&#x20;sensitive&#x20;information&#x20;to&#x20;unauthorized&#x20;users.&#x20;If&#x20;Microsoft&#x20;locks&#x20;down&#x20;the&#x20;default&#x20;ACL&#x20;on&#x20;that&#x20;log&#x20;in&#x20;the&#x20;future&#x20;&#40;e.g.&#x20;to&#x20;restrict&#x20;it&#x20;only&#x20;to&#x20;Administrators&#41;,&#x20;then&#x20;we&#x20;will&#x20;revisit&#x20;this&#x20;recommendation&#x20;in&#x20;a&#x20;future&#x20;release.','There&#x20;are&#x20;potential&#x20;risks&#x20;of&#x20;capturing&#x20;passwords&#x20;in&#x20;the&#x20;PowerShell&#x20;logs.&#x20;This&#x20;setting&#x20;should&#x20;only&#x20;be&#x20;needed&#x20;for&#x20;debugging&#x20;purposes,&#x20;and&#x20;not&#x20;in&#x20;normal&#x20;operation,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;this&#x20;is&#x20;set&#x20;to&#x20;Disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.95.1\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16745,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Transcription&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;Policy&#x20;setting&#x20;lets&#x20;you&#x20;capture&#x20;the&#x20;input&#x20;and&#x20;output&#x20;of&#x20;Windows&#x20;PowerShell&#x20;commands&#x20;into&#x20;text-based&#x20;transcripts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;that&#x20;passwords&#x20;could&#x20;get&#x20;stored&#x20;in&#x20;plain&#x20;text&#x20;in&#x20;the&#x20;PowerShell_transcript&#x20;output&#x20;file.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Transcription&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.95.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16746,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;uses&#x20;Basic&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.1\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16747,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.2\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16748,'Ensure&#x20;&#039;Disallow&#x20;Digest&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;will&#x20;not&#x20;use&#x20;Digest&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Digest&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM,&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientDisallow&#x20;Digest&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.1.3\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16749,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;accepts&#x20;Basic&#x20;authentication&#x20;from&#x20;a&#x20;remote&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.1\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16750,'Ensure&#x20;&#039;Allow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;automatically&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;requests&#x20;on&#x20;the&#x20;HTTP&#x20;transport&#x20;over&#x20;the&#x20;default&#x20;HTTP&#x20;port.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;automatic&#x20;configuration&#x20;of&#x20;listeners,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16751,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.97.2.3\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16752,'Ensure&#x20;&#039;Disallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;will&#x20;allow&#x20;RunAs&#x20;credentials&#x20;to&#x20;be&#x20;stored&#x20;for&#x20;any&#x20;plug-ins.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;you&#x20;enable&#x20;and&#x20;then&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;any&#x20;values&#x20;that&#x20;were&#x20;previously&#x20;configured&#x20;for&#x20;RunAsPassword&#x20;will&#x20;need&#x20;to&#x20;be&#x20;reset.','Although&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;RunAs&#x20;credentials&#x20;is&#x20;a&#x20;convenient&#x20;feature&#x20;it&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;account&#x20;compromise&#x20;slightly.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;forget&#x20;to&#x20;lock&#x20;your&#x20;desktop&#x20;before&#x20;leaving&#x20;it&#x20;unattended&#x20;for&#x20;a&#x20;few&#x20;minutes&#x20;another&#x20;person&#x20;could&#x20;access&#x20;not&#x20;only&#x20;the&#x20;desktop&#x20;of&#x20;your&#x20;computer&#x20;but&#x20;also&#x20;any&#x20;hosts&#x20;you&#x20;manage&#x20;via&#x20;WinRM&#x20;with&#x20;cached&#x20;RunAs&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceDisallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.97.2.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16753,'Ensure&#x20;&#039;Allow&#x20;Remote&#x20;Shell&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;configuration&#x20;of&#x20;remote&#x20;access&#x20;to&#x20;all&#x20;supported&#x20;shells&#x20;to&#x20;execute&#x20;scripts&#x20;and&#x20;commands.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;GPME&#x20;help&#x20;text&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded,&#x20;implying&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;reject&#x20;new&#x20;Remote&#x20;Shell&#x20;connections,&#x20;and&#x20;setting&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;allow&#x20;Remote&#x20;Shell&#x20;connections.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;title&#x20;of&#x20;the&#x20;setting&#41;.&#x20;This&#x20;is&#x20;a&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Shell&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;ShellAllow&#x20;Remote&#x20;Shell&#x20;Access.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteShell.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.98.1\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16754,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;prevent&#x20;users&#x20;from&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;Exploit&#x20;protection&#x20;settings&#x20;area&#x20;in&#x20;the&#x20;Windows&#x20;Security&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;.','Only&#x20;authorized&#x20;IT&#x20;staff&#x20;should&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;to&#x20;the&#x20;exploit&#x20;protection&#x20;settings&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;the&#x20;organizations&#x20;specific&#x20;configuration&#x20;is&#x20;not&#x20;modified.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SecurityApp&#x20;and&#x20;browser&#x20;protectionPrevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefenderSecurityCenter.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.99.2.1\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(16755,'Ensure&#x20;&#039;Manage&#x20;preview&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;preview&#x20;builds&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Windows&#x20;Insider&#x20;Program&#x20;controls&#x20;in&#x20;Settings&#x20;-&gt;&#x20;Update&#x20;and&#x20;Security.&#x20;These&#x20;controls&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;preview&#x20;&#40;beta&#41;&#x20;builds&#x20;of&#x20;Windows&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;preview&#x20;builds&#x20;.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;preview&#x20;builds&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessManage&#x20;preview&#x20;builds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.102.1.1\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"6.4.2\"]}, {\"tsc\": [\"CC6.6\", \"CC7.1\"]}]'),(16756,'Ensure&#x20;&#039;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Semi-Annual&#x20;Channel,&#x20;180&#x20;or&#x20;more&#x20;days&#039;','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;Preview&#x20;Build&#x20;or&#x20;Feature&#x20;Updates&#x20;to&#x20;receive,&#x20;and&#x20;when.&#x20;The&#x20;Windows&#x20;readiness&#x20;level&#x20;for&#x20;each&#x20;new&#x20;Windows&#x20;10&#x20;Feature&#x20;Update&#x20;is&#x20;classified&#x20;in&#x20;one&#x20;of&#x20;5&#x20;categories,&#x20;depending&#x20;on&#x20;your&#x20;organizations&#x20;level&#x20;of&#x20;comfort&#x20;with&#x20;receiving&#x20;them:&#x20;Preview&#x20;Build&#x20;-&#x20;Fast:&#x20;Devices&#x20;set&#x20;to&#x20;this&#x20;level&#x20;will&#x20;be&#x20;the&#x20;first&#x20;to&#x20;receive&#x20;new&#x20;builds&#x20;of&#x20;Windows&#x20;with&#x20;features&#x20;not&#x20;yet&#x20;available&#x20;to&#x20;the&#x20;general&#x20;public.&#x20;Select&#x20;Fast&#x20;to&#x20;participate&#x20;in&#x20;identifying&#x20;and&#x20;reporting&#x20;issues&#x20;to&#x20;Microsoft,&#x20;and&#x20;provide&#x20;suggestions&#x20;on&#x20;new&#x20;functionality.&#x20;Preview&#x20;Build&#x20;-&#x20;Slow:&#x20;Devices&#x20;set&#x20;to&#x20;this&#x20;level&#x20;receive&#x20;new&#x20;builds&#x20;of&#x20;Windows&#x20;before&#x20;they&#x20;are&#x20;available&#x20;to&#x20;the&#x20;general&#x20;public,&#x20;but&#x20;at&#x20;a&#x20;slower&#x20;cadence&#x20;than&#x20;those&#x20;set&#x20;to&#x20;Fast,&#x20;and&#x20;with&#x20;changes&#x20;and&#x20;fixes&#x20;identified&#x20;in&#x20;earlier&#x20;builds.&#x20;Release&#x20;Preview:&#x20;Receive&#x20;builds&#x20;of&#x20;Windows&#x20;just&#x20;before&#x20;Microsoft&#x20;releases&#x20;them&#x20;to&#x20;the&#x20;general&#x20;public.&#x20;Semi-Annual&#x20;Channel&#x20;&#40;Targeted&#41;:&#x20;Receive&#x20;feature&#x20;updates&#x20;when&#x20;they&#x20;are&#x20;released&#x20;to&#x20;the&#x20;general&#x20;public.&#x20;Semi-Annual&#x20;Channel:&#x20;Feature&#x20;updates&#x20;will&#x20;arrive&#x20;when&#x20;they&#x20;are&#x20;declared&#x20;Semi-Annual&#x20;Channel.&#x20;This&#x20;usually&#x20;occurs&#x20;about&#x20;4&#x20;months&#x20;after&#x20;Semi-Annual&#x20;Channel&#x20;&#40;Targeted&#41;,&#x20;indicating&#x20;that&#x20;Microsoft,&#x20;Independent&#x20;Software&#x20;Vendors&#x20;&#40;ISVs&#41;,&#x20;partners&#x20;and&#x20;customer&#x20;believe&#x20;that&#x20;the&#x20;release&#x20;is&#x20;ready&#x20;for&#x20;broad&#x20;deployment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Semi-Annual&#x20;Channel,&#x20;180&#x20;or&#x20;more&#x20;days&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Telemetry&quot;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;RTM&#x20;&#40;Release&#x20;1607&#41;,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;Note&#x20;#3:&#x20;Prior&#x20;to&#x20;Windows&#x20;Server&#x20;2016&#x20;R1709,&#x20;values&#x20;above&#x20;180&#x20;days&#x20;are&#x20;not&#x20;recognized&#x20;by&#x20;the&#x20;OS.&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;R1709,&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;days&#x20;you&#x20;can&#x20;defer&#x20;is&#x20;365&#x20;days.','Forcing&#x20;new&#x20;features&#x20;without&#x20;prior&#x20;testing&#x20;in&#x20;your&#x20;environment&#x20;could&#x20;cause&#x20;software&#x20;incompatibilities&#x20;as&#x20;well&#x20;as&#x20;introducing&#x20;new&#x20;bugs&#x20;into&#x20;the&#x20;operating&#x20;system.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;it&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;delay&#x20;Feature&#x20;Updates&#x20;until&#x20;thorough&#x20;testing&#x20;and&#x20;a&#x20;deployment&#x20;plan&#x20;is&#x20;in&#x20;place.&#x20;This&#x20;recommendation&#x20;delays&#x20;the&#x20;automatic&#x20;installation&#x20;of&#x20;new&#x20;features&#x20;as&#x20;long&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Semi-Annual&#x20;Channel,&#x20;180&#x20;or&#x20;more&#x20;days&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Select&#x20;when&#x20;Feature&#x20;Updates&#x20;are&#x20;received,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.2\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(16757,'Ensure&#x20;&#039;Select&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;days&#039;','This&#x20;settings&#x20;controls&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;days&#x20;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Telemetry&quot;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;RTM&#x20;&#40;Release&#x20;1607&#41;,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering','Quality&#x20;Updates&#x20;can&#x20;contain&#x20;important&#x20;bug&#x20;fixes&#x20;and/or&#x20;security&#x20;patches,&#x20;and&#x20;should&#x20;be&#x20;installed&#x20;as&#x20;soon&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:0&#x20;days&#x20;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;updated&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;&#x20;WindowsUpdate.admx/adml&#x20;&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.102.1.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16758,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;recognize&#x20;when&#x20;a&#x20;network&#x20;connection&#x20;is&#x20;available&#x20;and&#x20;then&#x20;use&#x20;the&#x20;network&#x20;connection&#x20;to&#x20;search&#x20;Windows&#x20;Update&#x20;or&#x20;your&#x20;designated&#x20;intranet&#x20;site&#x20;for&#x20;updates&#x20;that&#x20;apply&#x20;to&#x20;them.&#x20;After&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;select&#x20;one&#x20;of&#x20;the&#x20;following&#x20;three&#x20;options&#x20;in&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;Properties&#x20;dialog&#x20;box&#x20;to&#x20;specify&#x20;how&#x20;the&#x20;service&#x20;will&#x20;work:&#x20;2&#x20;-&#x20;Notify&#x20;for&#x20;download&#x20;and&#x20;auto&#x20;install&#x20;&#40;Notify&#x20;before&#x20;downloading&#x20;any&#x20;updates&#41;&#x20;3&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;notify&#x20;for&#x20;install&#x20;&#40;Download&#x20;the&#x20;updates&#x20;automatically&#x20;and&#x20;notify&#x20;when&#x20;they&#x20;are&#x20;ready&#x20;to&#x20;be&#x20;installed.&#41;&#x20;&#40;Default&#x20;setting&#41;&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;&#40;Automatically&#x20;download&#x20;updates&#x20;and&#x20;install&#x20;them&#x20;on&#x20;the&#x20;schedule&#x20;specified&#x20;below.&#41;&#41;&#x20;5&#x20;-&#x20;Allow&#x20;local&#x20;admin&#x20;to&#x20;choose&#x20;setting&#x20;&#40;Leave&#x20;decision&#x20;on&#x20;above&#x20;choices&#x20;up&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;&#40;Not&#x20;Recommended&#41;&#41;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;sub-setting&#x20;&#039;Configure&#x20;automatic&#x20;updating:&#039;&#x20;has&#x20;4&#x20;possible&#x20;values&#x20;-&#x20;all&#x20;of&#x20;them&#x20;are&#x20;valid&#x20;depending&#x20;on&#x20;specific&#x20;organizational&#x20;needs,&#x20;however&#x20;if&#x20;feasible&#x20;we&#x20;suggest&#x20;using&#x20;a&#x20;value&#x20;of&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install.&#x20;This&#x20;suggestion&#x20;is&#x20;not&#x20;a&#x20;scored&#x20;requirement.&#x20;Note&#x20;#2:&#x20;Organizations&#x20;that&#x20;utilize&#x20;a&#x20;3rd-party&#x20;solution&#x20;for&#x20;patching&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;setting,&#x20;and&#x20;instead&#x20;configure&#x20;it&#x20;to&#x20;Disabled&#x20;so&#x20;that&#x20;the&#x20;native&#x20;Windows&#x20;Update&#x20;mechanism&#x20;does&#x20;not&#x20;interfere&#x20;with&#x20;the&#x20;3rd-party&#x20;patching&#x20;process.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateConfigure&#x20;Automatic&#x20;Updates&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16759,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#x20;-&#x20;Every&#x20;day&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;when&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;0&#x20;-&#x20;Every&#x20;day.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;applicable&#x20;if&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;is&#x20;selected&#x20;in&#x20;Rule&#x20;18.9.102.2.&#x20;It&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;if&#x20;any&#x20;other&#x20;option&#x20;is&#x20;selected.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;0&#x20;-&#x20;Every&#x20;day:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateConfigure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(16760,'Ensure&#x20;&#039;No&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;','This&#x20;policy&#x20;setting&#x20;specifies&#x20;that&#x20;Automatic&#x20;Updates&#x20;will&#x20;wait&#x20;for&#x20;computers&#x20;to&#x20;be&#x20;restarted&#x20;by&#x20;the&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;on&#x20;to&#x20;them&#x20;to&#x20;complete&#x20;a&#x20;scheduled&#x20;installation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;applies&#x20;only&#x20;when&#x20;you&#x20;configure&#x20;Automatic&#x20;Updates&#x20;to&#x20;perform&#x20;scheduled&#x20;update&#x20;installations.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;to&#x20;Disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect.','Some&#x20;security&#x20;updates&#x20;require&#x20;that&#x20;the&#x20;computer&#x20;be&#x20;restarted&#x20;to&#x20;complete&#x20;an&#x20;installation.&#x20;If&#x20;the&#x20;computer&#x20;cannot&#x20;restart&#x20;automatically,&#x20;then&#x20;the&#x20;most&#x20;recent&#x20;update&#x20;will&#x20;not&#x20;completely&#x20;install&#x20;and&#x20;no&#x20;new&#x20;updates&#x20;will&#x20;download&#x20;to&#x20;the&#x20;computer&#x20;until&#x20;it&#x20;is&#x20;restarted.&#x20;Without&#x20;the&#x20;auto-restart&#x20;functionality,&#x20;users&#x20;who&#x20;are&#x20;not&#x20;security-conscious&#x20;may&#x20;choose&#x20;to&#x20;indefinitely&#x20;delay&#x20;the&#x20;restart,&#x20;therefore&#x20;keeping&#x20;the&#x20;computer&#x20;in&#x20;a&#x20;less&#x20;secure&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateNo&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;No&#x20;auto-restart&#x20;for&#x20;scheduled&#x20;Automatic&#x20;Updates&#x20;installations,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(17000,'Verify&#x20;all&#x20;Apple&#x20;provided&#x20;software&#x20;is&#x20;current','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following:&#x20;softwareupdate&#x20;-l&#x20;&#x20;&#x20;&#x20;2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename','[{\"cis\": [\"1.1\"]}]'),(17001,'Enable&#x20;Auto&#x20;Update','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-bool&#x20;true','[{\"cis\": [\"1.2\"]}]'),(17002,'Enable&#x20;Download&#x20;new&#x20;updates&#x20;when&#x20;available','In&#x20;the&#x20;GUI&#x20;both&#x20;&quot;Install&#x20;macOS&#x20;updates&quot;&#x20;and&#x20;&quot;Install&#x20;app&#x20;updates&#x20;from&#x20;the&#x20;App&#x20;Store&quot;&#x20;are&#x20;dependent&#x20;on&#x20;whether&#x20;&quot;Download&#x20;new&#x20;updates&#x20;when&#x20;available&quot;&#x20;is&#x20;selected','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;downloaded&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;applied.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticDownload&#x20;-bool&#x20;true','[{\"cis\": [\"1.3\"]}]'),(17003,'Enable&#x20;app&#x20;update&#x20;installs','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-&#x20;bool&#x20;TRUE','[{\"cis\": [\"1.4\"]}]'),(17004,'Enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;update&#x20;installs','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper,&#x20;with&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.5\"]}]'),(17005,'Enable&#x20;macOS&#x20;update&#x20;installs','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-&#x20;bool&#x20;TRUE','[{\"cis\": [\"1.6\"]}]'),(17006,'Turn&#x20;off&#x20;Bluetooth,&#x20;if&#x20;no&#x20;paired&#x20;devices&#x20;exist','Bluetooth&#x20;devices&#x20;use&#x20;a&#x20;wireless&#x20;communications&#x20;system&#x20;that&#x20;replaces&#x20;the&#x20;cables&#x20;used&#x20;by&#x20;other&#x20;peripherals&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;system.&#x20;It&#x20;is&#x20;by&#x20;design&#x20;a&#x20;peer-to-peer&#x20;network&#x20;technology&#x20;and&#x20;typically&#x20;lacks&#x20;centralized&#x20;administration&#x20;and&#x20;security&#x20;enforcement&#x20;infrastructure.','Bluetooth&#x20;is&#x20;particularly&#x20;susceptible&#x20;to&#x20;a&#x20;diverse&#x20;set&#x20;of&#x20;security&#x20;vulnerabilities&#x20;involving&#x20;identity&#x20;detection,&#x20;location&#x20;tracking,&#x20;denial&#x20;of&#x20;service,&#x20;unintended&#x20;control&#x20;and&#x20;access&#x20;of&#x20;data&#x20;and&#x20;voice&#x20;channels,&#x20;and&#x20;unauthorized&#x20;device&#x20;control&#x20;and&#x20;data&#x20;access.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;bluetooth:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.Bluetooth&#x20;ControllerPowerState&#x20;-int&#x20;0&#x20;&amp;&amp;&#x20;sudo&#x20;killall&#x20;-HUP&#x20;blued','[{\"cis\": [\"2.1.1\"]}]'),(17008,'Enable&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;&#x20;&#x20;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on','[{\"cis\": [\"2.2.1\"]}]'),(17009,'Ensure&#x20;time&#x20;set&#x20;is&#x20;within&#x20;appropriate&#x20;limits','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;Ensure&#x20;that&#x20;time&#x20;on&#x20;the&#x20;computer&#x20;is&#x20;within&#x20;acceptable&#x20;limits.&#x20;Truly&#x20;accurate&#x20;time&#x20;is&#x20;measured&#x20;within&#x20;milliseconds,&#x20;for&#x20;this&#x20;audit&#x20;a&#x20;drift&#x20;under&#x20;four&#x20;and&#x20;a&#x20;half&#x20;minutes&#x20;passes&#x20;the&#x20;control&#x20;check.&#x20;Since&#x20;Kerberos&#x20;is&#x20;one&#x20;of&#x20;the&#x20;important&#x20;features&#x20;of&#x20;macOS&#x20;integration&#x20;into&#x20;Directory&#x20;systems&#x20;the&#x20;guidance&#x20;here&#x20;is&#x20;to&#x20;warn&#x20;you&#x20;before&#x20;there&#x20;could&#x20;be&#x20;an&#x20;impact&#x20;to&#x20;operations.&#x20;From&#x20;the&#x20;perspective&#x20;of&#x20;accurate&#x20;time&#x20;this&#x20;check&#x20;is&#x20;not&#x20;strict,&#x20;it&#x20;may&#x20;be&#x20;too&#x20;great&#x20;for&#x20;your&#x20;organization,&#x20;adjust&#x20;to&#x20;a&#x20;smaller&#x20;offset&#x20;value&#x20;as&#x20;needed.&#x20;Note:&#x20;ntpdate&#x20;has&#x20;been&#x20;deprecated&#x20;with&#x20;10.14.&#x20;sntp&#x20;replaces&#x20;that&#x20;command.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.&#x20;Audit&#x20;check&#x20;is&#x20;for&#x20;more&#x20;than&#x20;4&#x20;minutes&#x20;and&#x20;30&#x20;seconds&#x20;ahead&#x20;or&#x20;behind.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;ensure&#x20;your&#x20;time&#x20;is&#x20;set&#x20;within&#x20;an&#x20;appropriate&#x20;limit:&#x20;sudo&#x20;systemsetup&#x20;-getnetworktimeserver&#x20;-&gt;&#x20;Get&#x20;the&#x20;time&#x20;server&#x20;name&#x20;and&#x20;then&#x20;run:&#x20;sudo&#x20;touch&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;root:wheel&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;sntp&#x20;-sS&#x20;&lt;YOUR-TIME-SERVER&gt;&#x20;','[{\"cis\": [\"2.2.2\"]}]'),(17010,'Set&#x20;an&#x20;inactivity&#x20;interval&#x20;of&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;for&#x20;the&#x20;screen&#x20;saver','A&#x20;locking&#x20;screensaver&#x20;is&#x20;one&#x20;of&#x20;the&#x20;standard&#x20;security&#x20;controls&#x20;to&#x20;limit&#x20;access&#x20;to&#x20;a&#x20;computer&#x20;and&#x20;the&#x20;current&#x20;user&#039;s&#x20;session&#x20;when&#x20;the&#x20;computer&#x20;is&#x20;temporarily&#x20;unused&#x20;or&#x20;unattended.&#x20;In&#x20;macOS&#x20;the&#x20;screensaver&#x20;starts&#x20;after&#x20;a&#x20;value&#x20;selected&#x20;in&#x20;a&#x20;drop&#x20;down&#x20;menu,&#x20;10&#x20;minutes&#x20;and&#x20;20&#x20;minutes&#x20;are&#x20;both&#x20;options&#x20;and&#x20;either&#x20;is&#x20;acceptable.&#x20;Any&#x20;value&#x20;can&#x20;be&#x20;selected&#x20;through&#x20;the&#x20;command&#x20;line&#x20;or&#x20;script&#x20;but&#x20;a&#x20;number&#x20;that&#x20;is&#x20;not&#x20;reflected&#x20;in&#x20;the&#x20;GUI&#x20;can&#x20;be&#x20;problematic.&#x20;20&#x20;minutes&#x20;is&#x20;the&#x20;default&#x20;for&#x20;new&#x20;accounts.','Setting&#x20;an&#x20;inactivity&#x20;interval&#x20;for&#x20;the&#x20;screensaver&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;a&#x20;system&#x20;left&#x20;unattended&#x20;for&#x20;an&#x20;extensive&#x20;period&#x20;of&#x20;time.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;that&#x20;the&#x20;idle&#x20;time&#x20;of&#x20;the&#x20;screen&#x20;saver&#x20;to&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;&#40;&le;1200&#41;:&#x20;sudo&#x20;defaults&#x20;-currentHost&#x20;write&#x20;com.apple.screensaver&#x20;idleTime&#x20;-int&#x20;600&#x20;','[{\"cis\": [\"2.3.1\"]}]'),(17011,'Secure&#x20;screen&#x20;saver&#x20;corners','Hot&#x20;Corners&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;by&#x20;moving&#x20;the&#x20;mouse&#x20;cursor&#x20;to&#x20;a&#x20;corner&#x20;of&#x20;the&#x20;screen.','Setting&#x20;a&#x20;hot&#x20;corner&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;since&#x20;an&#x20;unauthorized&#x20;person&#x20;could&#x20;use&#x20;this&#x20;to&#x20;bypass&#x20;the&#x20;login&#x20;screen&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Disable&#x20;Screen&#x20;Saver&#x20;for&#x20;a&#x20;Hot&#x20;Corner:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.dock&#x20;&lt;corner&#x20;that&#x20;is&#x20;set&#x20;to&#x20;&#039;6&#039;&gt;&#x20;-int&#x20;0&#x20;','[{\"cis\": [\"2.3.2\"]}]'),(17012,'Disable&#x20;Remote&#x20;Apple&#x20;Events','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}]'),(17013,'Disable&#x20;Internet&#x20;Sharing','Internet&#x20;Sharing&#x20;uses&#x20;the&#x20;open&#x20;source&#x20;natd&#x20;process&#x20;to&#x20;share&#x20;an&#x20;internet&#x20;connection&#x20;with&#x20;other&#x20;computers&#x20;and&#x20;devices&#x20;on&#x20;a&#x20;local&#x20;network.&#x20;This&#x20;allows&#x20;the&#x20;Mac&#x20;to&#x20;function&#x20;as&#x20;a&#x20;router&#x20;and&#x20;share&#x20;the&#x20;connection&#x20;to&#x20;other,&#x20;possibly&#x20;unauthorized,&#x20;devices.','Disabling&#x20;Internet&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Internet&#x20;Sharing:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/SystemConfiguration/com.apple.nat&#x20;NAT&#x20;-dict&#x20;Enabled&#x20;-int&#x20;0','[{\"cis\": [\"2.4.2\"]}]'),(17014,'Disable&#x20;Screen&#x20;Sharing','Screen&#x20;sharing&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;connect&#x20;to&#x20;another&#x20;computer&#x20;on&#x20;a&#x20;network&#x20;and&#x20;display&#x20;the&#x20;computer&rsquo;s&#x20;screen.&#x20;While&#x20;sharing&#x20;the&#x20;computer&rsquo;s&#x20;screen,&#x20;the&#x20;user&#x20;can&#x20;control&#x20;what&#x20;happens&#x20;on&#x20;that&#x20;computer,&#x20;such&#x20;as&#x20;opening&#x20;documents&#x20;or&#x20;applications,&#x20;opening,&#x20;moving,&#x20;or&#x20;closing&#x20;windows,&#x20;and&#x20;even&#x20;shutting&#x20;down&#x20;the&#x20;computer.','Disabling&#x20;screen&#x20;sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;remote&#x20;connections&#x20;being&#x20;made&#x20;without&#x20;the&#x20;user&#x20;of&#x20;the&#x20;console&#x20;knowing&#x20;that&#x20;they&#x20;are&#x20;sharing&#x20;the&#x20;computer.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Screen&#x20;Sharing:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.screensharing.plist','[{\"cis\": [\"2.4.3\"]}]'),(17015,'Disable&#x20;Printer&#x20;Sharing','By&#x20;enabling&#x20;Printer&#x20;sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;cupsctl&#x20;--no-share-printers','[{\"cis\": [\"2.4.4\"]}]'),(17016,'Disable&#x20;Remote&#x20;Login','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.&#x20;macOS&#x20;does&#x20;have&#x20;an&#x20;IP&#x20;based&#x20;firewall&#x20;available&#x20;&#40;pf,&#x20;ipfw&#x20;has&#x20;been&#x20;deprecated&#41;&#x20;that&#x20;is&#x20;not&#x20;enabled&#x20;or&#x20;configured.&#x20;There&#x20;are&#x20;more&#x20;details&#x20;and&#x20;links&#x20;in&#x20;section&#x20;7.5.&#x20;macOS&#x20;no&#x20;longer&#x20;has&#x20;TCP&#x20;Wrappers&#x20;support&#x20;built-in&#x20;and&#x20;does&#x20;not&#x20;have&#x20;strong&#x20;Brute-Force&#x20;password&#x20;guessing&#x20;mitigations,&#x20;or&#x20;frequent&#x20;patching&#x20;of&#x20;openssh&#x20;by&#x20;Apple.&#x20;Most&#x20;macOS&#x20;computers&#x20;are&#x20;mobile&#x20;workstations,&#x20;managing&#x20;IP&#x20;based&#x20;firewall&#x20;rules&#x20;on&#x20;mobile&#x20;devices&#x20;can&#x20;be&#x20;very&#x20;resource&#x20;intensive.&#x20;All&#x20;of&#x20;these&#x20;factors&#x20;can&#x20;be&#x20;parts&#x20;of&#x20;running&#x20;a&#x20;hardened&#x20;SSH&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}]'),(17017,'Disable&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing','DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;allows&#x20;users&#x20;to&#x20;remotely&#x20;access&#x20;the&#x20;system&#039;s&#x20;optical&#x20;drive.','Disabling&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;the&#x20;optical&#x20;drive&#x20;as&#x20;a&#x20;vector&#x20;for&#x20;attack&#x20;and&#x20;exposure&#x20;of&#x20;sensitive&#x20;data.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;DVD&#x20;or&#x20;CD&#x20;sharing:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.ODSAgent.plist','[{\"cis\": [\"2.4.6\"]}]'),(17018,'Disable&#x20;Bluetooth&#x20;Sharing&#x20;','Bluetooth&#x20;Sharing&#x20;allows&#x20;files&#x20;to&#x20;be&#x20;exchanged&#x20;with&#x20;Bluetooth&#x20;enabled&#x20;devices.','Disabling&#x20;Bluetooth&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;Bluetooth&#x20;to&#x20;remotely&#x20;attack&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;Bluetooth&#x20;Sharing:&#x20;Graphical&#x20;Method:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Sharing&#x20;3.&#x20;Uncheck&#x20;Bluetooth&#x20;Sharing','[{\"cis\": [\"2.4.7\"]}]'),(17019,'Disable&#x20;File&#x20;Sharing','Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;a&#x20;combination&#x20;of&#x20;SMB&#x20;&#40;Windows&#x20;sharing&#41;&#x20;and&#x20;AFP&#x20;&#40;Mac&#x20;sharing&#41;','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;AFP&#x20;and&#x20;SMB&#x20;file&#x20;sharing&#x20;from&#x20;the&#x20;command&#x20;line:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.AppleFileServer.plist&#x20;&amp;&amp;&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.smbd.plist','[{\"cis\": [\"2.4.8\"]}]'),(17020,'Disable&#x20;Remote&#x20;Management','Remote&#x20;Management&#x20;is&#x20;the&#x20;client&#x20;portion&#x20;of&#x20;Apple&#x20;Remote&#x20;Desktop&#x20;&#40;ARD&#41;.&#x20;Remote&#x20;Management&#x20;can&#x20;be&#x20;used&#x20;by&#x20;remote&#x20;administrators&#x20;to&#x20;view&#x20;the&#x20;current&#x20;Screen,&#x20;install&#x20;software,&#x20;report&#x20;on,&#x20;and&#x20;generally&#x20;manage&#x20;client&#x20;Macs.&#x20;The&#x20;screen&#x20;sharing&#x20;options&#x20;in&#x20;Remote&#x20;Management&#x20;are&#x20;identical&#x20;to&#x20;those&#x20;in&#x20;the&#x20;Screen&#x20;Sharing&#x20;section.&#x20;In&#x20;fact,&#x20;only&#x20;one&#x20;of&#x20;the&#x20;two&#x20;can&#x20;be&#x20;configured.&#x20;If&#x20;Remote&#x20;Management&#x20;is&#x20;used,&#x20;refer&#x20;to&#x20;the&#x20;Screen&#x20;Sharing&#x20;section&#x20;above&#x20;on&#x20;issues&#x20;regard&#x20;screen&#x20;sharing.&#x20;Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;a&#x20;Directory&#x20;is&#x20;in&#x20;place&#x20;to&#x20;manage&#x20;the&#x20;accounts&#x20;with&#x20;access.&#x20;Computers&#x20;will&#x20;be&#x20;available&#x20;on&#x20;port&#x20;5900&#x20;on&#x20;a&#x20;macOS&#x20;System&#x20;and&#x20;could&#x20;accept&#x20;connections&#x20;from&#x20;untrusted&#x20;hosts&#x20;depending&#x20;on&#x20;the&#x20;configuration,&#x20;definitely&#x20;a&#x20;concern&#x20;for&#x20;mobile&#x20;systems.','Remote&#x20;management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;on&#x20;trusted&#x20;networks&#x20;with&#x20;strong&#x20;user&#x20;controls&#x20;present&#x20;in&#x20;a&#x20;Directory&#x20;system.&#x20;Mobile&#x20;devices&#x20;without&#x20;strict&#x20;controls&#x20;are&#x20;vulnerable&#x20;to&#x20;exploit&#x20;and&#x20;monitoring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;remote&#x20;management:&#x20;sudo&#x20;/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources&#x20;/kickstart&#x20;-deactivate&#x20;-stop','[{\"cis\": [\"2.4.9\"]}]'),(17021,'Disable&#x20;Content&#x20;Caching','Starting&#x20;with&#x20;10.13&#x20;&#40;macOS&#x20;High&#x20;Sierra&#41;&#x20;Apple&#x20;introduced&#x20;a&#x20;service&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;deploy&#x20;data&#x20;from&#x20;Apple,&#x20;including&#x20;software&#x20;updates,&#x20;where&#x20;there&#x20;are&#x20;bandwidth&#x20;constraints&#x20;to&#x20;the&#x20;Internet&#x20;and&#x20;fewer&#x20;constraints&#x20;and&#x20;greater&#x20;bandwidth&#x20;on&#x20;the&#x20;local&#x20;subnet.&#x20;This&#x20;capability&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;for&#x20;organizations&#x20;that&#x20;have&#x20;throttled&#x20;and&#x20;possibly&#x20;metered&#x20;Internet&#x20;connections.&#x20;In&#x20;heterogeneous&#x20;enterprise&#x20;networks&#x20;with&#x20;multiple&#x20;subnets&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;capability&#x20;would&#x20;be&#x20;determined&#x20;on&#x20;how&#x20;many&#x20;Macs&#x20;were&#x20;on&#x20;each&#x20;subnet&#x20;at&#x20;the&#x20;time&#x20;new&#x20;large&#x20;updates&#x20;were&#x20;made&#x20;available&#x20;upstream.&#x20;This&#x20;capability&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;mac&#x20;OS&#x20;clients&#x20;as&#x20;P2P&#x20;nodes&#x20;for&#x20;updated&#x20;Apple&#x20;content.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;business&#x20;requirement&#x20;to&#x20;manage&#x20;operational&#x20;Internet&#x20;connectivity&#x20;bandwidth&#x20;user&#x20;endpoints&#x20;should&#x20;not&#x20;store&#x20;content&#x20;and&#x20;act&#x20;as&#x20;a&#x20;cluster&#x20;to&#x20;provision&#x20;data.','The&#x20;main&#x20;use&#x20;case&#x20;for&#x20;Mac&#x20;computers&#x20;is&#x20;as&#x20;mobile&#x20;user&#x20;endpoints.&#x20;P2P&#x20;sharing&#x20;services&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;laptops&#x20;that&#x20;are&#x20;using&#x20;untrusted&#x20;networks.&#x20;Content&#x20;Caching&#x20;can&#x20;allow&#x20;a&#x20;computer&#x20;to&#x20;be&#x20;a&#x20;server&#x20;for&#x20;local&#x20;nodes&#x20;on&#x20;an&#x20;untrusted&#x20;network.&#x20;While&#x20;there&#x20;are&#x20;certainly&#x20;logical&#x20;controls&#x20;that&#x20;could&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;risk&#x20;they&#x20;add&#x20;to&#x20;the&#x20;management&#x20;complexity,&#x20;since&#x20;the&#x20;value&#x20;of&#x20;the&#x20;service&#x20;is&#x20;in&#x20;specific&#x20;use&#x20;cases&#x20;organizations&#x20;with&#x20;the&#x20;use&#x20;case&#x20;described&#x20;above&#x20;can&#x20;accept&#x20;risk&#x20;as&#x20;necessary.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;to&#x20;disable&#x20;content&#x20;caching:&#x20;sudo&#x20;AssetCacheManagerUtil&#x20;deactivate','[{\"cis\": [\"2.4.10\"]}]'),(17022,'Enable&#x20;FileVault','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.&#x20;Filevault&#x20;may&#x20;also&#x20;be&#x20;enabled&#x20;using&#x20;command&#x20;line&#x20;using&#x20;the&#x20;fdesetup&#x20;command.&#x20;To&#x20;use&#x20;this&#x20;functionality,&#x20;consult&#x20;the&#x20;Der&#x20;Flounder&#x20;blog&#x20;for&#x20;more&#x20;details:&#x20;https://derflounder.wordpress.com/2015/02/02/managing-yosemites-filevault-2-with-fdesetup/&#x20;https://derflounder.wordpress.com/2019/01/15/unlock-or-decrypt-your-filevault-encrypted-boot-drive-from-the-command-line-on-macos-mojave/&#x20;','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.5.1.1\"]}]'),(17023,'Enable&#x20;Gatekeeper','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;white-listing&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;spctl&#x20;--master-enable','[{\"cis\": [\"2.5.2\"]}]'),(17024,'Enable&#x20;Firewall','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-&#x20;int&#x20;&lt;value&gt;&#x20;&#x20;&#x20;&#x20;Where&#x20;&lt;value&gt;&#x20;is:&#x20;-&#x20;1&#x20;=&#x20;on&#x20;for&#x20;specific&#x20;services&#x20;-&#x20;2&#x20;=&#x20;on&#x20;for&#x20;essential&#x20;services&#x20;','[{\"cis\": [\"2.5.3\"]}]'),(17025,'Enable&#x20;Firewall&#x20;Stealth&#x20;Mode','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.5.4\"]}]'),(17026,'Enable&#x20;Location&#x20;Services','macOS&#x20;uses&#x20;location&#x20;information&#x20;gathered&#x20;through&#x20;local&#x20;Wi-Fi&#x20;networks&#x20;to&#x20;enable&#x20;applications&#x20;to&#x20;supply&#x20;relevant&#x20;information&#x20;to&#x20;users.&#x20;Users&#x20;do&#x20;not&#x20;need&#x20;to&#x20;change&#x20;the&#x20;time&#x20;or&#x20;the&#x20;time&#x20;zone,&#x20;the&#x20;computer&#x20;will&#x20;do&#x20;it&#x20;for&#x20;them.&#x20;They&#x20;do&#x20;not&#x20;need&#x20;to&#x20;specify&#x20;their&#x20;location&#x20;for&#x20;weather&#x20;or&#x20;travel&#x20;times&#x20;and&#x20;even&#x20;get&#x20;alerts&#x20;on&#x20;travel&#x20;times&#x20;to&#x20;meetings&#x20;and&#x20;appointment&#x20;where&#x20;location&#x20;information&#x20;is&#x20;supplied.&#x20;For&#x20;the&#x20;purpose&#x20;of&#x20;asset&#x20;management&#x20;and&#x20;time&#x20;and&#x20;log&#x20;management&#x20;with&#x20;mobile&#x20;computers&#x20;location&#x20;services&#x20;simplify&#x20;some&#x20;processes.There&#x20;are&#x20;some&#x20;use&#x20;cases&#x20;where&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;computer&#x20;not&#x20;be&#x20;able&#x20;to&#x20;report&#x20;it&#039;s&#x20;exact&#x20;location.&#x20;While&#x20;the&#x20;general&#x20;use&#x20;case&#x20;is&#x20;to&#x20;enable&#x20;Location&#x20;Services,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;if&#x20;the&#x20;physical&#x20;location&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;the&#x20;user&#x20;should&#x20;not&#x20;be&#x20;public&#x20;knowledge.','Location&#x20;services&#x20;are&#x20;helpful&#x20;in&#x20;most&#x20;use&#x20;cases&#x20;and&#x20;can&#x20;simplify&#x20;log&#x20;and&#x20;time&#x20;management&#x20;where&#x20;computers&#x20;change&#x20;time&#x20;zones.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;location&#x20;services:&#x20;sudo&#x20;launchctl&#x20;load&#x20;/System/Library/LaunchDaemons/com.apple.locationd.plist','[{\"cis\": [\"2.5.6\"]}]'),(17027,'Disable&#x20;sending&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;to&#x20;Apple','Apple&#x20;provides&#x20;a&#x20;mechanism&#x20;to&#x20;send&#x20;diagnostic&#x20;and&#x20;analytics&#x20;data&#x20;back&#x20;to&#x20;Apple&#x20;to&#x20;help&#x20;them&#x20;improve&#x20;the&#x20;platform.&#x20;Information&#x20;sent&#x20;to&#x20;Apple&#x20;may&#x20;contain&#x20;internal&#x20;organizational&#x20;information&#x20;that&#x20;should&#x20;be&#x20;controlled&#x20;and&#x20;not&#x20;available&#x20;for&#x20;processing&#x20;by&#x20;Apple.&#x20;Turn&#x20;off&#x20;all&#x20;Analytics&#x20;and&#x20;Improvements&#x20;sharing.','Organizations&#x20;should&#x20;have&#x20;knowledge&#x20;of&#x20;what&#x20;is&#x20;shared&#x20;with&#x20;the&#x20;vendor&#x20;and&#x20;the&#x20;setting&#x20;automatically&#x20;forwards&#x20;information&#x20;to&#x20;Apple.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"2.5.8\"]}]'),(17028,'Time&#x20;Machine&#x20;Auto-Backup','Backup&#x20;solutions&#x20;are&#x20;only&#x20;effective&#x20;if&#x20;the&#x20;backups&#x20;run&#x20;on&#x20;a&#x20;regular&#x20;basis.&#x20;The&#x20;time&#x20;to&#x20;check&#x20;for&#x20;backups&#x20;is&#x20;before&#x20;the&#x20;hard&#x20;drive&#x20;fails&#x20;or&#x20;the&#x20;computer&#x20;goes&#x20;missing.&#x20;In&#x20;order&#x20;to&#x20;simplify&#x20;the&#x20;user&#x20;experience&#x20;so&#x20;that&#x20;backups&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;occur&#x20;Time&#x20;Machine&#x20;should&#x20;be&#x20;on&#x20;and&#x20;set&#x20;to&#x20;Back&#x20;Up&#x20;Automatically&#x20;whenever&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;available.&#x20;Operational&#x20;staff&#x20;should&#x20;ensure&#x20;that&#x20;backups&#x20;complete&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;the&#x20;backups&#x20;are&#x20;tested&#x20;to&#x20;ensure&#x20;that&#x20;file&#x20;restoration&#x20;from&#x20;backup&#x20;is&#x20;possible&#x20;when&#x20;needed.&#x20;Backup&#x20;dates&#x20;are&#x20;available&#x20;even&#x20;when&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;not&#x20;available&#x20;in&#x20;the&#x20;Time&#x20;Machine&#x20;plist.&#x20;When&#x20;the&#x20;backup&#x20;volume&#x20;is&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;more&#x20;extensive&#x20;information&#x20;is&#x20;available&#x20;through&#x20;tmutil.&#x20;See&#x20;man&#x20;tmutil','Backups&#x20;should&#x20;automatically&#x20;run&#x20;whenever&#x20;the&#x20;backup&#x20;drive&#x20;is&#x20;available.','','Run&#x20;the&#x20;following&#x20;enable&#x20;TimeMachine:&#x20;sudo&#x20;sudo&#x20;tmutil&#x20;setdestination&#x20;-a&#x20;/Volumes/&lt;volumename&gt;&#x20;&amp;&amp;&#x20;sudo&#x20;tmutil&#x20;enable','[{\"cis\": [\"2.7.1\"]}]'),(17030,'Disable&#x20;Wake&#x20;for&#x20;network&#x20;access','This&#x20;feature&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;Theie&#x20;macOS&#x20;feature&#x20;is&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&rsquo;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;unmanaged&#x20;network&#x20;where&#x20;untrusted&#x20;devices&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access:&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0&#x20;','[{\"cis\": [\"2.8\"]}]'),(17031,'Disable&#x20;Power&#x20;Nap','This&#x20;features&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;This&#x20;macOS&#x20;features&#x20;are&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;Power&#x20;Nap&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;stay&#x20;in&#x20;low&#x20;power&#x20;mode,&#x20;especially&#x20;while&#x20;on&#x20;battery&#x20;power&#x20;and&#x20;periodically&#x20;connect&#x20;to&#x20;previously&#x20;named&#x20;networks&#x20;with&#x20;stored&#x20;credentials&#x20;for&#x20;user&#x20;applications&#x20;to&#x20;phone&#x20;home&#x20;and&#x20;get&#x20;updates.&#x20;This&#x20;capability&#x20;requires&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;the&#x20;use&#x20;of&#x20;previously&#x20;joined&#x20;networks&#x20;to&#x20;be&#x20;risk&#x20;accepted&#x20;based&#x20;on&#x20;the&#x20;SSID&#x20;without&#x20;user&#x20;input.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Power&#x20;Nap:&#x20;sudo&#x20;pmset&#x20;-a&#x20;powernap&#x20;0','[{\"cis\": [\"2.9\"]}]'),(17032,'Enable&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;in&#x20;terminal.app','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Terminal&#x20;2.&#x20;Select&#x20;Terminal&#x20;3.&#x20;Select&#x20;Secure&#x20;Keyboard&#x20;Entry','[{\"cis\": [\"2.10\"]}]'),(17033,'Ensure&#x20;EFI&#x20;version&#x20;is&#x20;valid&#x20;and&#x20;being&#x20;regularly&#x20;checked','In&#x20;order&#x20;to&#x20;mitigate&#x20;firmware&#x20;attacks&#x20;Apple&#x20;has&#x20;created&#x20;a&#x20;automated&#x20;Firmware&#x20;check&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;EFI&#x20;version&#x20;running&#x20;is&#x20;a&#x20;known&#x20;good&#x20;version&#x20;from&#x20;Apple.&#x20;There&#x20;is&#x20;also&#x20;an&#x20;automated&#x20;process&#x20;to&#x20;check&#x20;it&#x20;every&#x20;seven&#x20;days.','If&#x20;the&#x20;Firmware&#x20;of&#x20;a&#x20;computer&#x20;has&#x20;been&#x20;compromised&#x20;the&#x20;Operating&#x20;System&#x20;that&#x20;the&#x20;Firmware&#x20;loads&#x20;cannot&#x20;be&#x20;trusted&#x20;either.','','If&#x20;EFI&#x20;does&#x20;not&#x20;pass&#x20;the&#x20;integrity&#x20;check&#x20;you&#x20;may&#x20;send&#x20;a&#x20;report&#x20;to&#x20;Apple.&#x20;Backing&#x20;up&#x20;files&#x20;and&#x20;clean&#x20;installing&#x20;a&#x20;known&#x20;good&#x20;Operating&#x20;System&#x20;and&#x20;Firmware&#x20;is&#x20;recommended.','[{\"cis\": [\"2.12\"]}]'),(17034,'Enable&#x20;security&#x20;auditing','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.1\"]}]'),(17035,'Retain&#x20;install.log&#x20;for&#x20;365&#x20;or&#x20;more&#x20;days&#x20;with&#x20;no&#x20;maximum&#x20;size','macOS&#x20;writes&#x20;information&#x20;pertaining&#x20;to&#x20;system-related&#x20;events&#x20;to&#x20;the&#x20;file&#x20;/var/log/install.log&#x20;and&#x20;has&#x20;a&#x20;configurable&#x20;retention&#x20;policy&#x20;for&#x20;this&#x20;file.&#x20;The&#x20;default&#x20;logging&#x20;setting&#x20;limits&#x20;the&#x20;file&#x20;size&#x20;of&#x20;the&#x20;logs&#x20;and&#x20;the&#x20;maximum&#x20;size&#x20;for&#x20;all&#x20;logs.&#x20;The&#x20;default&#x20;allows&#x20;for&#x20;an&#x20;errant&#x20;application&#x20;to&#x20;fill&#x20;the&#x20;log&#x20;files&#x20;and&#x20;does&#x20;not&#x20;enforce&#x20;sufficient&#x20;log&#x20;retention.&#x20;The&#x20;Benchmark&#x20;recommends&#x20;a&#x20;value&#x20;based&#x20;on&#x20;standard&#x20;use&#x20;cases.&#x20;The&#x20;value&#x20;should&#x20;align&#x20;with&#x20;local&#x20;requirements&#x20;within&#x20;the&#x20;organization.','Archiving&#x20;and&#x20;retaining&#x20;install.log&#x20;for&#x20;at&#x20;least&#x20;a&#x20;year&#x20;is&#x20;beneficial&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;incident&#x20;as&#x20;it&#x20;will&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;view&#x20;the&#x20;various&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;along&#x20;with&#x20;the&#x20;date&#x20;and&#x20;time&#x20;they&#x20;occurred.','','Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;install&#x20;logs&#x20;are&#x20;retained&#x20;for&#x20;at&#x20;least&#x20;365&#x20;days:Edit&#x20;the&#x20;/etc/asl/com.apple.install&#x20;file&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;ttl&#x20;value&#x20;to&#x20;365&#x20;or&#x20;greater&#x20;on&#x20;the&#x20;file&#x20;line.&#x20;Also,&#x20;remove&#x20;the&#x20;all_max=&#x20;setting&#x20;and&#x20;value&#x20;from&#x20;the&#x20;file&#x20;line.','[{\"cis\": [\"3.3\"]}]'),(17037,'Control&#x20;access&#x20;to&#x20;audit&#x20;records','The&#x20;audit&#x20;system&#x20;on&#x20;macOS&#x20;writes&#x20;important&#x20;operational&#x20;and&#x20;security&#x20;information&#x20;that&#x20;can&#x20;be&#x20;both&#x20;useful&#x20;for&#x20;an&#x20;attacker&#x20;and&#x20;a&#x20;place&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;attempt&#x20;to&#x20;obfuscate&#x20;unwanted&#x20;changes&#x20;that&#x20;were&#x20;recorded.&#x20;As&#x20;part&#x20;of&#x20;defense-in-depth&#x20;the&#x20;/etc/security/audit_control&#x20;configuration&#x20;and&#x20;the&#x20;files&#x20;in&#x20;/var/audit&#x20;should&#x20;be&#x20;owned&#x20;only&#x20;by&#x20;root&#x20;with&#x20;group&#x20;wheel&#x20;with&#x20;read&#x20;only&#x20;rights&#x20;and&#x20;no&#x20;other&#x20;access&#x20;allowed.&#x20;macOS&#x20;ACLs&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;these&#x20;files.','Audit&#x20;records&#x20;should&#x20;never&#x20;be&#x20;changed&#x20;except&#x20;by&#x20;the&#x20;system&#x20;daemon&#x20;posting&#x20;events.&#x20;Records&#x20;may&#x20;be&#x20;viewed&#x20;or&#x20;extracts&#x20;manipulated&#x20;but&#x20;the&#x20;authoritative&#x20;files&#x20;should&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes.','','Run&#x20;the&#x20;following&#x20;to&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;root&#x20;user&#x20;and&#x20;wheel&#x20;group:&#x20;&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/etc/security/audit_control&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/var/audit/','[{\"cis\": [\"3.5\"]}]'),(17038,'Ensure&#x20;Firewall&#x20;is&#x20;configured&#x20;to&#x20;log','The&#x20;socketfilter&#x20;firewall&#x20;is&#x20;what&#x20;is&#x20;used&#x20;when&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;on&#x20;in&#x20;the&#x20;Security&#x20;PreferencePane.&#x20;In&#x20;order&#x20;to&#x20;appropriately&#x20;monitor&#x20;what&#x20;access&#x20;is&#x20;allowed&#x20;and&#x20;denied&#x20;logging&#x20;must&#x20;be&#x20;enabled.','In&#x20;order&#x20;to&#x20;troubleshoot&#x20;the&#x20;successes&#x20;and&#x20;failures&#x20;of&#x20;a&#x20;firewall&#x20;logging&#x20;should&#x20;be&#x20;enabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;logging&#x20;of&#x20;the&#x20;firewall:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setloggingmode&#x20;on','[{\"cis\": [\"3.6\"]}]'),(17039,'Disable&#x20;Bonjour&#x20;advertising&#x20;service','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers..&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;stop&#x20;the&#x20;computer&#x20;from&#x20;sending&#x20;out&#x20;service&#x20;discovery&#x20;messages&#x20;when&#x20;looking&#x20;for&#x20;services&#x20;on&#x20;an&#x20;internal&#x20;subnet,&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;looking&#x20;for&#x20;a&#x20;printer&#x20;or&#x20;server&#x20;and&#x20;using&#x20;service&#x20;discovery.&#x20;To&#x20;block&#x20;all&#x20;Bonjour&#x20;traffic&#x20;except&#x20;to&#x20;approved&#x20;devices&#x20;the&#x20;pf&#x20;or&#x20;other&#x20;firewall&#x20;would&#x20;be&#x20;needed.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements&#x20;-bool&#x20;true','[{\"cis\": [\"4.1\"]}]'),(17041,'Ensure&#x20;http&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;Web&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;Web&#x20;Server:&#x20;sudo&#x20;apachectl&#x20;stop&#x20;&#x20;&#x20;&#x20;Ensure&#x20;that&#x20;the&#x20;web&#x20;server&#x20;will&#x20;not&#x20;auto-start&#x20;at&#x20;boot&#x20;sudo:&#x20;defaults&#x20;write&#x20;/System/Library/LaunchDaemons/org.apache.httpd&#x20;Disabled&#x20;-&#x20;bool&#x20;true','[{\"cis\": [\"4.4\"]}]'),(17042,'Ensure&#x20;nfs&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop,&#x20;dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;NFS&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;NFS&#x20;Server:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.nfsd.plist&#x20;&#x20;&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing:&#x20;sudo&#x20;rm&#x20;/etc/export','[{\"cis\": [\"4.5\"]}]'),(17044,'Check&#x20;System&#x20;Wide&#x20;Applications&#x20;for&#x20;appropriate&#x20;permissions','Applications&#x20;in&#x20;the&#x20;System&#x20;Applications&#x20;Directory&#x20;&#40;/Applications&#41;&#x20;should&#x20;be&#x20;world&#x20;executable&#x20;since&#x20;that&#x20;is&#x20;their&#x20;reason&#x20;to&#x20;be&#x20;on&#x20;the&#x20;system.&#x20;They&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable&#x20;and&#x20;allow&#x20;any&#x20;process&#x20;or&#x20;user&#x20;to&#x20;alter&#x20;them&#x20;for&#x20;other&#x20;processes&#x20;or&#x20;users&#x20;to&#x20;then&#x20;execute&#x20;modified&#x20;versions','Unauthorized&#x20;modifications&#x20;of&#x20;applications&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;execution&#x20;of&#x20;malicious&#x20;code.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;permissions&#x20;for&#x20;each&#x20;application&#x20;that&#x20;does&#x20;not&#x20;meet&#x20;the&#x20;requirements:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Applications/&lt;applicationname&gt;','[{\"cis\": [\"5.1.2\"]}]'),(17045,'Check&#x20;System&#x20;folder&#x20;for&#x20;world&#x20;writable&#x20;files','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/System&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world&#x20;writable&#x20;permissions.','Folders&#x20;in&#x20;/System&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;&quot;Drop&#x20;Box&quot;&#x20;folder&#x20;that&#x20;is&#x20;part&#x20;of&#x20;Apple&#039;s&#x20;default&#x20;user&#x20;template.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/System&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Path/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.3\"]}]'),(17046,'Check&#x20;Library&#x20;folder&#x20;for&#x20;world&#x20;writable&#x20;files','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/Library&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world&#x20;writable&#x20;permissions.','Folders&#x20;in&#x20;/Library&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;/Library/Caches&#x20;folder&#x20;where&#x20;the&#x20;sticky&#x20;bit&#x20;is&#x20;set.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/Library&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Library/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.4\"]}]'),(17051,'Reduce&#x20;the&#x20;sudo&#x20;timeout&#x20;period','The&#x20;sudo&#x20;command&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;run&#x20;programs&#x20;as&#x20;the&#x20;root&#x20;user.&#x20;Working&#x20;as&#x20;the&#x20;root&#x20;user&#x20;allows&#x20;the&#x20;user&#x20;an&#x20;extremely&#x20;high&#x20;level&#x20;of&#x20;configurability&#x20;within&#x20;the&#x20;system.','The&#x20;sudo&#x20;command&#x20;stays&#x20;logged&#x20;in&#x20;as&#x20;the&#x20;root&#x20;user&#x20;for&#x20;five&#x20;minutes&#x20;before&#x20;timing&#x20;out&#x20;and&#x20;re-requesting&#x20;a&#x20;password.&#x20;This&#x20;five&#x20;minute&#x20;window&#x20;should&#x20;be&#x20;eliminated&#x20;since&#x20;it&#x20;leaves&#x20;the&#x20;system&#x20;extremely&#x20;vulnerable.&#x20;This&#x20;is&#x20;especially&#x20;true&#x20;if&#x20;an&#x20;exploit&#x20;were&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;since&#x20;they&#x20;would&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;as&#x20;a&#x20;root&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo&#x20;-&gt;&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}]'),(17052,'Use&#x20;a&#x20;separate&#x20;timestamp&#x20;for&#x20;each&#x20;user/tty&#x20;combo','Using&#x20;tty&#x20;tickets&#x20;ensures&#x20;that&#x20;a&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;sudo&#x20;password&#x20;in&#x20;each&#x20;Terminal&#x20;session.&#x20;With&#x20;sudo&#x20;versions&#x20;1.8&#x20;and&#x20;higher,&#x20;introduced&#x20;in&#x20;10.12,&#x20;the&#x20;default&#x20;value&#x20;is&#x20;to&#x20;have&#x20;tty&#x20;tickets&#x20;for&#x20;each&#x20;interface&#x20;so&#x20;that&#x20;root&#x20;access&#x20;is&#x20;limited&#x20;to&#x20;a&#x20;specific&#x20;terminal.&#x20;The&#x20;default&#x20;configuration&#x20;can&#x20;be&#x20;overwritten&#x20;or&#x20;not&#x20;configured&#x20;correctly&#x20;on&#x20;earlier&#x20;versions&#x20;of&#x20;macOS.','In&#x20;combination&#x20;with&#x20;removing&#x20;the&#x20;sudo&#x20;timeout&#x20;grace&#x20;period&#x20;a&#x20;further&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;background&#x20;process&#x20;using&#x20;elevated&#x20;rights&#x20;when&#x20;a&#x20;user&#x20;elevates&#x20;to&#x20;root&#x20;in&#x20;an&#x20;explicit&#x20;context&#x20;or&#x20;tty.&#x20;Additional&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;privilege&#x20;escalation&#x20;of&#x20;background&#x20;processes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo&#x20;-&gt;&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}]'),(17053,'Do&#x20;not&#x20;enable&#x20;the&#x20;&quot;root&quot;&#x20;account','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;Linux&#x20;distros&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;uses&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Open&#x20;System&#x20;Preferences,&#x20;Uses&#x20;&amp;&#x20;Groups.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;In&#x20;the&#x20;Network&#x20;Account&#x20;Server&#x20;section,&#x20;click&#x20;Join&#x20;or&#x20;Edit.&#x20;Click&#x20;Open&#x20;Directory&#x20;Utility.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;Select&#x20;the&#x20;Edit&#x20;menu&#x20;&gt;&#x20;Disable&#x20;Root&#x20;User.','[{\"cis\": [\"5.7\"]}]'),(17054,'Disable&#x20;automatic&#x20;login','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen,&#x20;instead&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.8\"]}]'),(17058,'Create&#x20;a&#x20;custom&#x20;message&#x20;for&#x20;the&#x20;Login&#x20;Screen','An&#x20;access&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only,&#x20;and&#x20;that&#x20;the&#x20;use&#x20;of&#x20;the&#x20;system&#x20;may&#x20;be&#x20;monitored.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;a&#x20;custom&#x20;login&#x20;screen&#x20;message:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;LoginwindowText&#x20;&quot;&lt;custom.message&gt;&quot;','[{\"cis\": [\"5.13\"]}]'),(17059,'Create&#x20;a&#x20;Login&#x20;window&#x20;banner','A&#x20;Login&#x20;window&#x20;banner&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only.&#x20;It&#x20;enforces&#x20;an&#x20;acknowledgment&#x20;by&#x20;the&#x20;user&#x20;that&#x20;they&#x20;have&#x20;been&#x20;informed&#x20;of&#x20;the&#x20;use&#x20;policy&#x20;in&#x20;the&#x20;banner&#x20;if&#x20;required.&#x20;The&#x20;system&#x20;recognizes&#x20;either&#x20;the&#x20;.txt&#x20;and&#x20;the&#x20;.rtf&#x20;formats.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Edit&#x20;&#40;or&#x20;create&#41;&#x20;a&#x20;PolicyBanner.txt&#x20;or&#x20;PolicyBanner.rtf&#x20;file,&#x20;in&#x20;the&#x20;/Library/Security/&#x20;folder,&#x20;to&#x20;include&#x20;the&#x20;required&#x20;login&#x20;window&#x20;banner&#x20;text.','[{\"cis\": [\"5.14\"]}]'),(17061,'System&#x20;Integrity&#x20;Protection&#x20;status','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;macOS&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;&#x20;&#x20;&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.19\"]}]'),(17062,'Display&#x20;login&#x20;window&#x20;as&#x20;name&#x20;and&#x20;password','The&#x20;login&#x20;window&#x20;prompts&#x20;a&#x20;user&#x20;for&#x20;his/her&#x20;credentials,&#x20;verifies&#x20;their&#x20;authorization&#x20;level&#x20;and&#x20;then&#x20;allows&#x20;or&#x20;denies&#x20;the&#x20;user&#x20;access&#x20;to&#x20;the&#x20;system.','Prompting&#x20;the&#x20;user&#x20;to&#x20;enter&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;makes&#x20;it&#x20;twice&#x20;as&#x20;hard&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;since&#x20;they&#x20;must&#x20;discover&#x20;two&#x20;attributes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;login&#x20;window&#x20;to&#x20;display&#x20;name&#x20;and&#x20;password:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;SHOWFULLNAME&#x20;-bool&#x20;true','[{\"cis\": [\"6.1.1\"]}]'),(17063,'Disable&#x20;&quot;Show&#x20;password&#x20;hints&quot;','Password&#x20;hints&#x20;are&#x20;user&#x20;created&#x20;text&#x20;displayed&#x20;when&#x20;an&#x20;incorrect&#x20;password&#x20;is&#x20;used&#x20;for&#x20;an&#x20;account.','Password&#x20;hints&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;systems&#x20;by&#x20;providing&#x20;information&#x20;to&#x20;anyone&#x20;that&#x20;the&#x20;user&#x20;provided&#x20;to&#x20;assist&#x20;remembering&#x20;the&#x20;password.&#x20;This&#x20;info&#x20;could&#x20;include&#x20;the&#x20;password&#x20;itself&#x20;or&#x20;other&#x20;information&#x20;that&#x20;might&#x20;be&#x20;readily&#x20;discerned&#x20;with&#x20;basic&#x20;knowledge&#x20;of&#x20;the&#x20;end&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;password&#x20;hints:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;RetriesUntilHint&#x20;-int&#x20;0','[{\"cis\": [\"6.1.2\"]}]'),(17064,'Disable&#x20;guest&#x20;account&#x20;login','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes,&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system&#x20;and&#x20;all&#x20;created&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;false','[{\"cis\": [\"6.1.3\"]}]'),(17065,'Disable&#x20;&quot;Allow&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&quot;','Allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;enables&#x20;users&#x20;to&#x20;access&#x20;selected&#x20;shared&#x20;folders&#x20;and&#x20;their&#x20;contents&#x20;from&#x20;different&#x20;computers&#x20;on&#x20;a&#x20;network.','Not&#x20;allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;use&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;false','[{\"cis\": [\"6.1.4\"]}]'),(17066,'Remove&#x20;Guest&#x20;home&#x20;folder','In&#x20;the&#x20;previous&#x20;two&#x20;controls&#x20;the&#x20;guest&#x20;account&#x20;login&#x20;has&#x20;been&#x20;disabled&#x20;and&#x20;sharing&#x20;to&#x20;guests&#x20;has&#x20;been&#x20;disabled&#x20;as&#x20;well.&#x20;There&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folders&#x20;continued&#x20;existence&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;rm&#x20;-R&#x20;/Users/Guest&#x20;&#x20;2.&#x20;Make&#x20;sure&#x20;there&#x20;is&#x20;no&#x20;output','[{\"cis\": [\"6.1.5\"]}]'),(17067,'Turn&#x20;on&#x20;filename&#x20;extensions','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Select&#x20;Finder&#x20;2.&#x20;Select&#x20;Preferences&#x20;3.&#x20;Check&#x20;Show&#x20;all&#x20;filename&#x20;extensions&#x20;&#x20;&#x20;&#x20;Alternatively,&#x20;use&#x20;the&#x20;following&#x20;command:&#x20;defaults&#x20;write&#x20;NSGlobalDomain&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}]'),(17068,'Disable&#x20;the&#x20;automatic&#x20;run&#x20;of&#x20;safe&#x20;files&#x20;in&#x20;Safari','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Safari&#x20;2.&#x20;Select&#x20;Safari&#x20;from&#x20;the&#x20;menu&#x20;bar&#x20;3.&#x20;Select&#x20;Preferences&#x20;4.&#x20;Select&#x20;General&#x20;5.&#x20;Uncheck&#x20;Open&#x20;&quot;safe&quot;&#x20;files&#x20;after&#x20;downloading&#x20;&#x20;&#x20;&#x20;Alternatively&#x20;run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-boolean&#x20;no','[{\"cis\": [\"6.3\"]}]'),(17070,'Disable&#x20;Fast&#x20;User&#x20;Switching','Fast&#x20;user&#x20;switching&#x20;allows&#x20;a&#x20;person&#x20;to&#x20;quickly&#x20;log&#x20;in&#x20;to&#x20;the&#x20;computer&#x20;with&#x20;a&#x20;different&#x20;account.&#x20;While&#x20;only&#x20;a&#x20;minimal&#x20;security&#x20;risk,&#x20;when&#x20;a&#x20;second&#x20;user&#x20;is&#x20;logged&#x20;in,&#x20;that&#x20;user&#x20;might&#x20;be&#x20;able&#x20;to&#x20;see&#x20;what&#x20;processes&#x20;the&#x20;first&#x20;user&#x20;is&#x20;using,&#x20;or&#x20;possibly&#x20;gain&#x20;other&#x20;information&#x20;about&#x20;the&#x20;first&#x20;user.&#x20;In&#x20;a&#x20;large&#x20;directory&#x20;environment&#x20;where&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;limit&#x20;login&#x20;access&#x20;many&#x20;valid&#x20;users&#x20;can&#x20;login&#x20;to&#x20;other&#x20;user&#039;s&#x20;assigned&#x20;computers.','Fast&#x20;user&#x20;switching&#x20;allows&#x20;multiple&#x20;users&#x20;to&#x20;run&#x20;applications&#x20;simultaneously&#x20;at&#x20;console.&#x20;There&#x20;can&#x20;be&#x20;information&#x20;disclosed&#x20;about&#x20;processes&#x20;running&#x20;under&#x20;a&#x20;different&#x20;user.&#x20;Without&#x20;a&#x20;specific&#x20;configuration&#x20;to&#x20;save&#x20;data&#x20;and&#x20;log&#x20;out&#x20;users&#x20;can&#x20;have&#x20;unsaved&#x20;data&#x20;running&#x20;in&#x20;a&#x20;background&#x20;session&#x20;that&#x20;is&#x20;not&#x20;obvious.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;fast&#x20;user&#x20;switching&#x20;off:&#x20;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/.GlobalPreferences&#x20;MultipleSessionEnabled&#x20;-bool&#x20;false','[{\"cis\": [\"5.16\"]}]'),(17500,'Verify&#x20;all&#x20;Apple&#x20;provided&#x20;software&#x20;is&#x20;current','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following:&#x20;softwareupdate&#x20;-l&#x20;&#x20;&#x20;&#x20;2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename','[{\"cis\": [\"1.1\"]}]'),(17501,'Enable&#x20;Auto&#x20;Update','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-bool&#x20;true','[{\"cis\": [\"1.2\"]}]'),(17502,'Enable&#x20;Download&#x20;new&#x20;updates&#x20;when&#x20;available','In&#x20;the&#x20;GUI&#x20;both&#x20;&quot;Install&#x20;macOS&#x20;updates&quot;&#x20;and&#x20;&quot;Install&#x20;app&#x20;updates&#x20;from&#x20;the&#x20;App&#x20;Store&quot;&#x20;are&#x20;dependent&#x20;on&#x20;whether&#x20;&quot;Download&#x20;new&#x20;updates&#x20;when&#x20;available&quot;&#x20;is&#x20;selected','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;downloaded&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;applied.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticDownload&#x20;-bool&#x20;true','[{\"cis\": [\"1.3\"]}]'),(17503,'Enable&#x20;app&#x20;update&#x20;installs','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-&#x20;bool&#x20;TRUE','[{\"cis\": [\"1.4\"]}]'),(17504,'Enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;update&#x20;installs','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper,&#x20;with&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.5\"]}]'),(17505,'Enable&#x20;macOS&#x20;update&#x20;installs','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-&#x20;bool&#x20;TRUE','[{\"cis\": [\"1.6\"]}]'),(17506,'Turn&#x20;off&#x20;Bluetooth,&#x20;if&#x20;no&#x20;paired&#x20;devices&#x20;exist','Bluetooth&#x20;devices&#x20;use&#x20;a&#x20;wireless&#x20;communications&#x20;system&#x20;that&#x20;replaces&#x20;the&#x20;cables&#x20;used&#x20;by&#x20;other&#x20;peripherals&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;system.&#x20;It&#x20;is&#x20;by&#x20;design&#x20;a&#x20;peer-to-peer&#x20;network&#x20;technology&#x20;and&#x20;typically&#x20;lacks&#x20;centralized&#x20;administration&#x20;and&#x20;security&#x20;enforcement&#x20;infrastructure.','Bluetooth&#x20;is&#x20;particularly&#x20;susceptible&#x20;to&#x20;a&#x20;diverse&#x20;set&#x20;of&#x20;security&#x20;vulnerabilities&#x20;involving&#x20;identity&#x20;detection,&#x20;location&#x20;tracking,&#x20;denial&#x20;of&#x20;service,&#x20;unintended&#x20;control&#x20;and&#x20;access&#x20;of&#x20;data&#x20;and&#x20;voice&#x20;channels,&#x20;and&#x20;unauthorized&#x20;device&#x20;control&#x20;and&#x20;data&#x20;access.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;bluetooth:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.Bluetooth&#x20;ControllerPowerState&#x20;-int&#x20;0&#x20;&amp;&amp;&#x20;sudo&#x20;killall&#x20;-HUP&#x20;blued','[{\"cis\": [\"2.1.1\"]}]'),(17508,'Enable&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;&#x20;&#x20;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on','[{\"cis\": [\"2.2.1\"]}]'),(17509,'Ensure&#x20;time&#x20;set&#x20;is&#x20;within&#x20;appropriate&#x20;limits','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;Ensure&#x20;that&#x20;time&#x20;on&#x20;the&#x20;computer&#x20;is&#x20;within&#x20;acceptable&#x20;limits.&#x20;Truly&#x20;accurate&#x20;time&#x20;is&#x20;measured&#x20;within&#x20;milliseconds,&#x20;for&#x20;this&#x20;audit&#x20;a&#x20;drift&#x20;under&#x20;four&#x20;and&#x20;a&#x20;half&#x20;minutes&#x20;passes&#x20;the&#x20;control&#x20;check.&#x20;Since&#x20;Kerberos&#x20;is&#x20;one&#x20;of&#x20;the&#x20;important&#x20;features&#x20;of&#x20;macOS&#x20;integration&#x20;into&#x20;Directory&#x20;systems&#x20;the&#x20;guidance&#x20;here&#x20;is&#x20;to&#x20;warn&#x20;you&#x20;before&#x20;there&#x20;could&#x20;be&#x20;an&#x20;impact&#x20;to&#x20;operations.&#x20;From&#x20;the&#x20;perspective&#x20;of&#x20;accurate&#x20;time&#x20;this&#x20;check&#x20;is&#x20;not&#x20;strict,&#x20;it&#x20;may&#x20;be&#x20;too&#x20;great&#x20;for&#x20;your&#x20;organization,&#x20;adjust&#x20;to&#x20;a&#x20;smaller&#x20;offset&#x20;value&#x20;as&#x20;needed.&#x20;Note:&#x20;ntpdate&#x20;has&#x20;been&#x20;deprecated&#x20;with&#x20;10.14.&#x20;sntp&#x20;replaces&#x20;that&#x20;command.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.&#x20;Audit&#x20;check&#x20;is&#x20;for&#x20;more&#x20;than&#x20;4&#x20;minutes&#x20;and&#x20;30&#x20;seconds&#x20;ahead&#x20;or&#x20;behind.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;ensure&#x20;your&#x20;time&#x20;is&#x20;set&#x20;within&#x20;an&#x20;appropriate&#x20;limit:&#x20;sudo&#x20;systemsetup&#x20;-getnetworktimeserver&#x20;-&gt;&#x20;Get&#x20;the&#x20;time&#x20;server&#x20;name&#x20;and&#x20;then&#x20;run:&#x20;sudo&#x20;touch&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;root:wheel&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;sntp&#x20;-sS&#x20;&lt;YOUR-TIME-SERVER&gt;&#x20;','[{\"cis\": [\"2.2.2\"]}]'),(17510,'Set&#x20;an&#x20;inactivity&#x20;interval&#x20;of&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;for&#x20;the&#x20;screen&#x20;saver','A&#x20;locking&#x20;screensaver&#x20;is&#x20;one&#x20;of&#x20;the&#x20;standard&#x20;security&#x20;controls&#x20;to&#x20;limit&#x20;access&#x20;to&#x20;a&#x20;computer&#x20;and&#x20;the&#x20;current&#x20;user&#039;s&#x20;session&#x20;when&#x20;the&#x20;computer&#x20;is&#x20;temporarily&#x20;unused&#x20;or&#x20;unattended.&#x20;In&#x20;macOS&#x20;the&#x20;screensaver&#x20;starts&#x20;after&#x20;a&#x20;value&#x20;selected&#x20;in&#x20;a&#x20;drop&#x20;down&#x20;menu,&#x20;10&#x20;minutes&#x20;and&#x20;20&#x20;minutes&#x20;are&#x20;both&#x20;options&#x20;and&#x20;either&#x20;is&#x20;acceptable.&#x20;Any&#x20;value&#x20;can&#x20;be&#x20;selected&#x20;through&#x20;the&#x20;command&#x20;line&#x20;or&#x20;script&#x20;but&#x20;a&#x20;number&#x20;that&#x20;is&#x20;not&#x20;reflected&#x20;in&#x20;the&#x20;GUI&#x20;can&#x20;be&#x20;problematic.&#x20;20&#x20;minutes&#x20;is&#x20;the&#x20;default&#x20;for&#x20;new&#x20;accounts.','Setting&#x20;an&#x20;inactivity&#x20;interval&#x20;for&#x20;the&#x20;screensaver&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;a&#x20;system&#x20;left&#x20;unattended&#x20;for&#x20;an&#x20;extensive&#x20;period&#x20;of&#x20;time.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;that&#x20;the&#x20;idle&#x20;time&#x20;of&#x20;the&#x20;screen&#x20;saver&#x20;to&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;&#40;&le;1200&#41;:&#x20;sudo&#x20;defaults&#x20;-currentHost&#x20;write&#x20;com.apple.screensaver&#x20;idleTime&#x20;-int&#x20;600&#x20;','[{\"cis\": [\"2.3.1\"]}]'),(17511,'Secure&#x20;screen&#x20;saver&#x20;corners','Hot&#x20;Corners&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;by&#x20;moving&#x20;the&#x20;mouse&#x20;cursor&#x20;to&#x20;a&#x20;corner&#x20;of&#x20;the&#x20;screen.','Setting&#x20;a&#x20;hot&#x20;corner&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;since&#x20;an&#x20;unauthorized&#x20;person&#x20;could&#x20;use&#x20;this&#x20;to&#x20;bypass&#x20;the&#x20;login&#x20;screen&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Disable&#x20;Screen&#x20;Saver&#x20;for&#x20;a&#x20;Hot&#x20;Corner:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.dock&#x20;&lt;corner&#x20;that&#x20;is&#x20;set&#x20;to&#x20;&#039;6&#039;&gt;&#x20;-int&#x20;0&#x20;','[{\"cis\": [\"2.3.2\"]}]'),(17512,'Disable&#x20;Remote&#x20;Apple&#x20;Events','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}]'),(17513,'Disable&#x20;Internet&#x20;Sharing','Internet&#x20;Sharing&#x20;uses&#x20;the&#x20;open&#x20;source&#x20;natd&#x20;process&#x20;to&#x20;share&#x20;an&#x20;internet&#x20;connection&#x20;with&#x20;other&#x20;computers&#x20;and&#x20;devices&#x20;on&#x20;a&#x20;local&#x20;network.&#x20;This&#x20;allows&#x20;the&#x20;Mac&#x20;to&#x20;function&#x20;as&#x20;a&#x20;router&#x20;and&#x20;share&#x20;the&#x20;connection&#x20;to&#x20;other,&#x20;possibly&#x20;unauthorized,&#x20;devices.','Disabling&#x20;Internet&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Internet&#x20;Sharing:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/SystemConfiguration/com.apple.nat&#x20;NAT&#x20;-dict&#x20;Enabled&#x20;-int&#x20;0','[{\"cis\": [\"2.4.2\"]}]'),(17514,'Disable&#x20;Screen&#x20;Sharing','Screen&#x20;sharing&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;connect&#x20;to&#x20;another&#x20;computer&#x20;on&#x20;a&#x20;network&#x20;and&#x20;display&#x20;the&#x20;computer&rsquo;s&#x20;screen.&#x20;While&#x20;sharing&#x20;the&#x20;computer&rsquo;s&#x20;screen,&#x20;the&#x20;user&#x20;can&#x20;control&#x20;what&#x20;happens&#x20;on&#x20;that&#x20;computer,&#x20;such&#x20;as&#x20;opening&#x20;documents&#x20;or&#x20;applications,&#x20;opening,&#x20;moving,&#x20;or&#x20;closing&#x20;windows,&#x20;and&#x20;even&#x20;shutting&#x20;down&#x20;the&#x20;computer.','Disabling&#x20;screen&#x20;sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;remote&#x20;connections&#x20;being&#x20;made&#x20;without&#x20;the&#x20;user&#x20;of&#x20;the&#x20;console&#x20;knowing&#x20;that&#x20;they&#x20;are&#x20;sharing&#x20;the&#x20;computer.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Screen&#x20;Sharing:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.screensharing.plist','[{\"cis\": [\"2.4.3\"]}]'),(17515,'Disable&#x20;Printer&#x20;Sharing','By&#x20;enabling&#x20;Printer&#x20;sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;cupsctl&#x20;--no-share-printers','[{\"cis\": [\"2.4.4\"]}]'),(17516,'Disable&#x20;Remote&#x20;Login','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.&#x20;macOS&#x20;does&#x20;have&#x20;an&#x20;IP&#x20;based&#x20;firewall&#x20;available&#x20;&#40;pf,&#x20;ipfw&#x20;has&#x20;been&#x20;deprecated&#41;&#x20;that&#x20;is&#x20;not&#x20;enabled&#x20;or&#x20;configured.&#x20;There&#x20;are&#x20;more&#x20;details&#x20;and&#x20;links&#x20;in&#x20;section&#x20;7.5.&#x20;macOS&#x20;no&#x20;longer&#x20;has&#x20;TCP&#x20;Wrappers&#x20;support&#x20;built-in&#x20;and&#x20;does&#x20;not&#x20;have&#x20;strong&#x20;Brute-Force&#x20;password&#x20;guessing&#x20;mitigations,&#x20;or&#x20;frequent&#x20;patching&#x20;of&#x20;openssh&#x20;by&#x20;Apple.&#x20;Most&#x20;macOS&#x20;computers&#x20;are&#x20;mobile&#x20;workstations,&#x20;managing&#x20;IP&#x20;based&#x20;firewall&#x20;rules&#x20;on&#x20;mobile&#x20;devices&#x20;can&#x20;be&#x20;very&#x20;resource&#x20;intensive.&#x20;All&#x20;of&#x20;these&#x20;factors&#x20;can&#x20;be&#x20;parts&#x20;of&#x20;running&#x20;a&#x20;hardened&#x20;SSH&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}]'),(17517,'Disable&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing','DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;allows&#x20;users&#x20;to&#x20;remotely&#x20;access&#x20;the&#x20;system&#039;s&#x20;optical&#x20;drive.','Disabling&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;the&#x20;optical&#x20;drive&#x20;as&#x20;a&#x20;vector&#x20;for&#x20;attack&#x20;and&#x20;exposure&#x20;of&#x20;sensitive&#x20;data.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;DVD&#x20;or&#x20;CD&#x20;sharing:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.ODSAgent.plist','[{\"cis\": [\"2.4.6\"]}]'),(17518,'Disable&#x20;Bluetooth&#x20;Sharing&#x20;','Bluetooth&#x20;Sharing&#x20;allows&#x20;files&#x20;to&#x20;be&#x20;exchanged&#x20;with&#x20;Bluetooth&#x20;enabled&#x20;devices.','Disabling&#x20;Bluetooth&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;Bluetooth&#x20;to&#x20;remotely&#x20;attack&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;Bluetooth&#x20;Sharing:&#x20;Graphical&#x20;Method:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Sharing&#x20;3.&#x20;Uncheck&#x20;Bluetooth&#x20;Sharing','[{\"cis\": [\"2.4.7\"]}]'),(17519,'Disable&#x20;File&#x20;Sharing','Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;a&#x20;combination&#x20;of&#x20;SMB&#x20;&#40;Windows&#x20;sharing&#41;&#x20;and&#x20;AFP&#x20;&#40;Mac&#x20;sharing&#41;','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;AFP&#x20;and&#x20;SMB&#x20;file&#x20;sharing&#x20;from&#x20;the&#x20;command&#x20;line:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.AppleFileServer.plist&#x20;&amp;&amp;&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.smbd.plist','[{\"cis\": [\"2.4.8\"]}]'),(17520,'Disable&#x20;Remote&#x20;Management','Remote&#x20;Management&#x20;is&#x20;the&#x20;client&#x20;portion&#x20;of&#x20;Apple&#x20;Remote&#x20;Desktop&#x20;&#40;ARD&#41;.&#x20;Remote&#x20;Management&#x20;can&#x20;be&#x20;used&#x20;by&#x20;remote&#x20;administrators&#x20;to&#x20;view&#x20;the&#x20;current&#x20;Screen,&#x20;install&#x20;software,&#x20;report&#x20;on,&#x20;and&#x20;generally&#x20;manage&#x20;client&#x20;Macs.&#x20;The&#x20;screen&#x20;sharing&#x20;options&#x20;in&#x20;Remote&#x20;Management&#x20;are&#x20;identical&#x20;to&#x20;those&#x20;in&#x20;the&#x20;Screen&#x20;Sharing&#x20;section.&#x20;In&#x20;fact,&#x20;only&#x20;one&#x20;of&#x20;the&#x20;two&#x20;can&#x20;be&#x20;configured.&#x20;If&#x20;Remote&#x20;Management&#x20;is&#x20;used,&#x20;refer&#x20;to&#x20;the&#x20;Screen&#x20;Sharing&#x20;section&#x20;above&#x20;on&#x20;issues&#x20;regard&#x20;screen&#x20;sharing.&#x20;Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;a&#x20;Directory&#x20;is&#x20;in&#x20;place&#x20;to&#x20;manage&#x20;the&#x20;accounts&#x20;with&#x20;access.&#x20;Computers&#x20;will&#x20;be&#x20;available&#x20;on&#x20;port&#x20;5900&#x20;on&#x20;a&#x20;macOS&#x20;System&#x20;and&#x20;could&#x20;accept&#x20;connections&#x20;from&#x20;untrusted&#x20;hosts&#x20;depending&#x20;on&#x20;the&#x20;configuration,&#x20;definitely&#x20;a&#x20;concern&#x20;for&#x20;mobile&#x20;systems.','Remote&#x20;management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;on&#x20;trusted&#x20;networks&#x20;with&#x20;strong&#x20;user&#x20;controls&#x20;present&#x20;in&#x20;a&#x20;Directory&#x20;system.&#x20;Mobile&#x20;devices&#x20;without&#x20;strict&#x20;controls&#x20;are&#x20;vulnerable&#x20;to&#x20;exploit&#x20;and&#x20;monitoring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;remote&#x20;management:&#x20;sudo&#x20;/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources&#x20;/kickstart&#x20;-deactivate&#x20;-stop','[{\"cis\": [\"2.4.9\"]}]'),(17521,'Disable&#x20;Content&#x20;Caching','Starting&#x20;with&#x20;10.13&#x20;&#40;macOS&#x20;High&#x20;Sierra&#41;&#x20;Apple&#x20;introduced&#x20;a&#x20;service&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;deploy&#x20;data&#x20;from&#x20;Apple,&#x20;including&#x20;software&#x20;updates,&#x20;where&#x20;there&#x20;are&#x20;bandwidth&#x20;constraints&#x20;to&#x20;the&#x20;Internet&#x20;and&#x20;fewer&#x20;constraints&#x20;and&#x20;greater&#x20;bandwidth&#x20;on&#x20;the&#x20;local&#x20;subnet.&#x20;This&#x20;capability&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;for&#x20;organizations&#x20;that&#x20;have&#x20;throttled&#x20;and&#x20;possibly&#x20;metered&#x20;Internet&#x20;connections.&#x20;In&#x20;heterogeneous&#x20;enterprise&#x20;networks&#x20;with&#x20;multiple&#x20;subnets&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;capability&#x20;would&#x20;be&#x20;determined&#x20;on&#x20;how&#x20;many&#x20;Macs&#x20;were&#x20;on&#x20;each&#x20;subnet&#x20;at&#x20;the&#x20;time&#x20;new&#x20;large&#x20;updates&#x20;were&#x20;made&#x20;available&#x20;upstream.&#x20;This&#x20;capability&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;mac&#x20;OS&#x20;clients&#x20;as&#x20;P2P&#x20;nodes&#x20;for&#x20;updated&#x20;Apple&#x20;content.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;business&#x20;requirement&#x20;to&#x20;manage&#x20;operational&#x20;Internet&#x20;connectivity&#x20;bandwidth&#x20;user&#x20;endpoints&#x20;should&#x20;not&#x20;store&#x20;content&#x20;and&#x20;act&#x20;as&#x20;a&#x20;cluster&#x20;to&#x20;provision&#x20;data.','The&#x20;main&#x20;use&#x20;case&#x20;for&#x20;Mac&#x20;computers&#x20;is&#x20;as&#x20;mobile&#x20;user&#x20;endpoints.&#x20;P2P&#x20;sharing&#x20;services&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;laptops&#x20;that&#x20;are&#x20;using&#x20;untrusted&#x20;networks.&#x20;Content&#x20;Caching&#x20;can&#x20;allow&#x20;a&#x20;computer&#x20;to&#x20;be&#x20;a&#x20;server&#x20;for&#x20;local&#x20;nodes&#x20;on&#x20;an&#x20;untrusted&#x20;network.&#x20;While&#x20;there&#x20;are&#x20;certainly&#x20;logical&#x20;controls&#x20;that&#x20;could&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;risk&#x20;they&#x20;add&#x20;to&#x20;the&#x20;management&#x20;complexity,&#x20;since&#x20;the&#x20;value&#x20;of&#x20;the&#x20;service&#x20;is&#x20;in&#x20;specific&#x20;use&#x20;cases&#x20;organizations&#x20;with&#x20;the&#x20;use&#x20;case&#x20;described&#x20;above&#x20;can&#x20;accept&#x20;risk&#x20;as&#x20;necessary.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;to&#x20;disable&#x20;content&#x20;caching:&#x20;sudo&#x20;AssetCacheManagerUtil&#x20;deactivate','[{\"cis\": [\"2.4.10\"]}]'),(17522,'Disable&#x20;Media&#x20;Sharing','Starting&#x20;with&#x20;macOS&#x20;10.15&#x20;Apple&#x20;has&#x20;provided&#x20;a&#x20;control&#x20;to&#x20;allow&#x20;a&#x20;user&#x20;to&#x20;share&#x20;Apple&#x20;downloaded&#x20;content&#x20;on&#x20;all&#x20;Apple&#x20;devices&#x20;that&#x20;are&#x20;signed&#x20;in&#x20;with&#x20;the&#x20;same&#x20;Apple&#x20;ID.&#x20;This&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;share&#x20;downloaded&#x20;Movies,&#x20;Music&#x20;or&#x20;TV&#x20;shows&#x20;with&#x20;other&#x20;controlled&#x20;macOS,&#x20;iOS&#x20;and&#x20;iPadOS&#x20;devices&#x20;as&#x20;well&#x20;as&#x20;photos&#x20;with&#x20;Apple&#x20;TVs.&#x20;With&#x20;this&#x20;capability&#x20;guest&#x20;users&#x20;can&#x20;also&#x20;use&#x20;media&#x20;downloaded&#x20;on&#x20;the&#x20;computer.&#x20;Best&#x20;practice&#x20;is&#x20;not&#x20;to&#x20;use&#x20;the&#x20;computer&#x20;as&#x20;a&#x20;server&#x20;but&#x20;to&#x20;utilize&#x20;Apple&#039;s&#x20;cloud&#x20;storage&#x20;to&#x20;download&#x20;and&#x20;use&#x20;content&#x20;stored&#x20;there&#x20;if&#x20;content&#x20;stored&#x20;with&#x20;Apple&#x20;is&#x20;used&#x20;on&#x20;multiple&#x20;devices.','Disabling&#x20;Media&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;to&#x20;disable&#x20;content&#x20;caching:&#x20;sudo&#x20;AssetCacheManagerUtil&#x20;deactivate','[{\"cis\": [\"2.4.11\"]}]'),(17523,'Enable&#x20;FileVault','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.&#x20;Filevault&#x20;may&#x20;also&#x20;be&#x20;enabled&#x20;using&#x20;command&#x20;line&#x20;using&#x20;the&#x20;fdesetup&#x20;command.&#x20;To&#x20;use&#x20;this&#x20;functionality,&#x20;consult&#x20;the&#x20;Der&#x20;Flounder&#x20;blog&#x20;for&#x20;more&#x20;details:&#x20;','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.5.1.1\"]}]'),(17524,'Enable&#x20;Gatekeeper','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;white-listing&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;spctl&#x20;--master-enable','[{\"cis\": [\"2.5.2\"]}]'),(17525,'Enable&#x20;Firewall','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-&#x20;int&#x20;&lt;value&gt;&#x20;&#x20;&#x20;&#x20;Where&#x20;&lt;value&gt;&#x20;is:&#x20;-&#x20;1&#x20;=&#x20;on&#x20;for&#x20;specific&#x20;services&#x20;-&#x20;2&#x20;=&#x20;on&#x20;for&#x20;essential&#x20;services&#x20;','[{\"cis\": [\"2.5.3\"]}]'),(17526,'Enable&#x20;Firewall&#x20;Stealth&#x20;Mode','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.5.4\"]}]'),(17527,'Enable&#x20;Location&#x20;Services','macOS&#x20;uses&#x20;location&#x20;information&#x20;gathered&#x20;through&#x20;local&#x20;Wi-Fi&#x20;networks&#x20;to&#x20;enable&#x20;applications&#x20;to&#x20;supply&#x20;relevant&#x20;information&#x20;to&#x20;users.&#x20;Users&#x20;do&#x20;not&#x20;need&#x20;to&#x20;change&#x20;the&#x20;time&#x20;or&#x20;the&#x20;time&#x20;zone,&#x20;the&#x20;computer&#x20;will&#x20;do&#x20;it&#x20;for&#x20;them.&#x20;They&#x20;do&#x20;not&#x20;need&#x20;to&#x20;specify&#x20;their&#x20;location&#x20;for&#x20;weather&#x20;or&#x20;travel&#x20;times&#x20;and&#x20;even&#x20;get&#x20;alerts&#x20;on&#x20;travel&#x20;times&#x20;to&#x20;meetings&#x20;and&#x20;appointment&#x20;where&#x20;location&#x20;information&#x20;is&#x20;supplied.&#x20;For&#x20;the&#x20;purpose&#x20;of&#x20;asset&#x20;management&#x20;and&#x20;time&#x20;and&#x20;log&#x20;management&#x20;with&#x20;mobile&#x20;computers&#x20;location&#x20;services&#x20;simplify&#x20;some&#x20;processes.There&#x20;are&#x20;some&#x20;use&#x20;cases&#x20;where&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;computer&#x20;not&#x20;be&#x20;able&#x20;to&#x20;report&#x20;it&#039;s&#x20;exact&#x20;location.&#x20;While&#x20;the&#x20;general&#x20;use&#x20;case&#x20;is&#x20;to&#x20;enable&#x20;Location&#x20;Services,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;if&#x20;the&#x20;physical&#x20;location&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;the&#x20;user&#x20;should&#x20;not&#x20;be&#x20;public&#x20;knowledge.','Location&#x20;services&#x20;are&#x20;helpful&#x20;in&#x20;most&#x20;use&#x20;cases&#x20;and&#x20;can&#x20;simplify&#x20;log&#x20;and&#x20;time&#x20;management&#x20;where&#x20;computers&#x20;change&#x20;time&#x20;zones.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;location&#x20;services:&#x20;sudo&#x20;launchctl&#x20;load&#x20;/System/Library/LaunchDaemons/com.apple.locationd.plist','[{\"cis\": [\"2.5.6\"]}]'),(17528,'Disable&#x20;sending&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;to&#x20;Apple','Apple&#x20;provides&#x20;a&#x20;mechanism&#x20;to&#x20;send&#x20;diagnostic&#x20;and&#x20;analytics&#x20;data&#x20;back&#x20;to&#x20;Apple&#x20;to&#x20;help&#x20;them&#x20;improve&#x20;the&#x20;platform.&#x20;Information&#x20;sent&#x20;to&#x20;Apple&#x20;may&#x20;contain&#x20;internal&#x20;organizational&#x20;information&#x20;that&#x20;should&#x20;be&#x20;controlled&#x20;and&#x20;not&#x20;available&#x20;for&#x20;processing&#x20;by&#x20;Apple.&#x20;Turn&#x20;off&#x20;all&#x20;Analytics&#x20;and&#x20;Improvements&#x20;sharing.','Organizations&#x20;should&#x20;have&#x20;knowledge&#x20;of&#x20;what&#x20;is&#x20;shared&#x20;with&#x20;the&#x20;vendor&#x20;and&#x20;the&#x20;setting&#x20;automatically&#x20;forwards&#x20;information&#x20;to&#x20;Apple.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"2.5.8\"]}]'),(17530,'Time&#x20;Machine&#x20;Auto-Backup','Backup&#x20;solutions&#x20;are&#x20;only&#x20;effective&#x20;if&#x20;the&#x20;backups&#x20;run&#x20;on&#x20;a&#x20;regular&#x20;basis.&#x20;The&#x20;time&#x20;to&#x20;check&#x20;for&#x20;backups&#x20;is&#x20;before&#x20;the&#x20;hard&#x20;drive&#x20;fails&#x20;or&#x20;the&#x20;computer&#x20;goes&#x20;missing.&#x20;In&#x20;order&#x20;to&#x20;simplify&#x20;the&#x20;user&#x20;experience&#x20;so&#x20;that&#x20;backups&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;occur&#x20;Time&#x20;Machine&#x20;should&#x20;be&#x20;on&#x20;and&#x20;set&#x20;to&#x20;Back&#x20;Up&#x20;Automatically&#x20;whenever&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;available.&#x20;Operational&#x20;staff&#x20;should&#x20;ensure&#x20;that&#x20;backups&#x20;complete&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;the&#x20;backups&#x20;are&#x20;tested&#x20;to&#x20;ensure&#x20;that&#x20;file&#x20;restoration&#x20;from&#x20;backup&#x20;is&#x20;possible&#x20;when&#x20;needed.&#x20;Backup&#x20;dates&#x20;are&#x20;available&#x20;even&#x20;when&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;not&#x20;available&#x20;in&#x20;the&#x20;Time&#x20;Machine&#x20;plist.&#x20;When&#x20;the&#x20;backup&#x20;volume&#x20;is&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;more&#x20;extensive&#x20;information&#x20;is&#x20;available&#x20;through&#x20;tmutil.&#x20;See&#x20;man&#x20;tmutil','Backups&#x20;should&#x20;automatically&#x20;run&#x20;whenever&#x20;the&#x20;backup&#x20;drive&#x20;is&#x20;available.','','Run&#x20;the&#x20;following&#x20;enable&#x20;TimeMachine:&#x20;sudo&#x20;sudo&#x20;tmutil&#x20;setdestination&#x20;-a&#x20;/Volumes/&lt;volumename&gt;&#x20;&amp;&amp;&#x20;sudo&#x20;tmutil&#x20;enable','[{\"cis\": [\"2.7.1\"]}]'),(17531,'Disable&#x20;Wake&#x20;for&#x20;network&#x20;access','This&#x20;feature&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;Theie&#x20;macOS&#x20;feature&#x20;is&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&rsquo;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;unmanaged&#x20;network&#x20;where&#x20;untrusted&#x20;devices&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access:&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0&#x20;','[{\"cis\": [\"2.8\"]}]'),(17532,'Disable&#x20;Power&#x20;Nap','This&#x20;features&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;This&#x20;macOS&#x20;features&#x20;are&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;Power&#x20;Nap&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;stay&#x20;in&#x20;low&#x20;power&#x20;mode,&#x20;especially&#x20;while&#x20;on&#x20;battery&#x20;power&#x20;and&#x20;periodically&#x20;connect&#x20;to&#x20;previously&#x20;named&#x20;networks&#x20;with&#x20;stored&#x20;credentials&#x20;for&#x20;user&#x20;applications&#x20;to&#x20;phone&#x20;home&#x20;and&#x20;get&#x20;updates.&#x20;This&#x20;capability&#x20;requires&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;the&#x20;use&#x20;of&#x20;previously&#x20;joined&#x20;networks&#x20;to&#x20;be&#x20;risk&#x20;accepted&#x20;based&#x20;on&#x20;the&#x20;SSID&#x20;without&#x20;user&#x20;input.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Power&#x20;Nap:&#x20;sudo&#x20;pmset&#x20;-a&#x20;powernap&#x20;0','[{\"cis\": [\"2.9\"]}]'),(17533,'Enable&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;in&#x20;terminal.app','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Terminal&#x20;2.&#x20;Select&#x20;Terminal&#x20;3.&#x20;Select&#x20;Secure&#x20;Keyboard&#x20;Entry','[{\"cis\": [\"2.10\"]}]'),(17534,'Ensure&#x20;EFI&#x20;version&#x20;is&#x20;valid&#x20;and&#x20;being&#x20;regularly&#x20;checked','In&#x20;order&#x20;to&#x20;mitigate&#x20;firmware&#x20;attacks&#x20;Apple&#x20;has&#x20;created&#x20;a&#x20;automated&#x20;Firmware&#x20;check&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;EFI&#x20;version&#x20;running&#x20;is&#x20;a&#x20;known&#x20;good&#x20;version&#x20;from&#x20;Apple.&#x20;There&#x20;is&#x20;also&#x20;an&#x20;automated&#x20;process&#x20;to&#x20;check&#x20;it&#x20;every&#x20;seven&#x20;days.','If&#x20;the&#x20;Firmware&#x20;of&#x20;a&#x20;computer&#x20;has&#x20;been&#x20;compromised&#x20;the&#x20;Operating&#x20;System&#x20;that&#x20;the&#x20;Firmware&#x20;loads&#x20;cannot&#x20;be&#x20;trusted&#x20;either.','','If&#x20;EFI&#x20;does&#x20;not&#x20;pass&#x20;the&#x20;integrity&#x20;check&#x20;you&#x20;may&#x20;send&#x20;a&#x20;report&#x20;to&#x20;Apple.&#x20;Backing&#x20;up&#x20;files&#x20;and&#x20;clean&#x20;installing&#x20;a&#x20;known&#x20;good&#x20;Operating&#x20;System&#x20;and&#x20;Firmware&#x20;is&#x20;recommended.','[{\"cis\": [\"2.12\"]}]'),(17535,'Enable&#x20;security&#x20;auditing','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.1\"]}]'),(17536,'Retain&#x20;install.log&#x20;for&#x20;365&#x20;or&#x20;more&#x20;days&#x20;with&#x20;no&#x20;maximum&#x20;size','macOS&#x20;writes&#x20;information&#x20;pertaining&#x20;to&#x20;system-related&#x20;events&#x20;to&#x20;the&#x20;file&#x20;/var/log/install.log&#x20;and&#x20;has&#x20;a&#x20;configurable&#x20;retention&#x20;policy&#x20;for&#x20;this&#x20;file.&#x20;The&#x20;default&#x20;logging&#x20;setting&#x20;limits&#x20;the&#x20;file&#x20;size&#x20;of&#x20;the&#x20;logs&#x20;and&#x20;the&#x20;maximum&#x20;size&#x20;for&#x20;all&#x20;logs.&#x20;The&#x20;default&#x20;allows&#x20;for&#x20;an&#x20;errant&#x20;application&#x20;to&#x20;fill&#x20;the&#x20;log&#x20;files&#x20;and&#x20;does&#x20;not&#x20;enforce&#x20;sufficient&#x20;log&#x20;retention.&#x20;The&#x20;Benchmark&#x20;recommends&#x20;a&#x20;value&#x20;based&#x20;on&#x20;standard&#x20;use&#x20;cases.&#x20;The&#x20;value&#x20;should&#x20;align&#x20;with&#x20;local&#x20;requirements&#x20;within&#x20;the&#x20;organization.','Archiving&#x20;and&#x20;retaining&#x20;install.log&#x20;for&#x20;at&#x20;least&#x20;a&#x20;year&#x20;is&#x20;beneficial&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;incident&#x20;as&#x20;it&#x20;will&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;view&#x20;the&#x20;various&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;along&#x20;with&#x20;the&#x20;date&#x20;and&#x20;time&#x20;they&#x20;occurred.','','Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;install&#x20;logs&#x20;are&#x20;retained&#x20;for&#x20;at&#x20;least&#x20;365&#x20;days:Edit&#x20;the&#x20;/etc/asl/com.apple.install&#x20;file&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;ttl&#x20;value&#x20;to&#x20;365&#x20;or&#x20;greater&#x20;on&#x20;the&#x20;file&#x20;line.&#x20;Also,&#x20;remove&#x20;the&#x20;all_max=&#x20;setting&#x20;and&#x20;value&#x20;from&#x20;the&#x20;file&#x20;line.','[{\"cis\": [\"3.3\"]}]'),(17537,'Control&#x20;access&#x20;to&#x20;audit&#x20;records','The&#x20;audit&#x20;system&#x20;on&#x20;macOS&#x20;writes&#x20;important&#x20;operational&#x20;and&#x20;security&#x20;information&#x20;that&#x20;can&#x20;be&#x20;both&#x20;useful&#x20;for&#x20;an&#x20;attacker&#x20;and&#x20;a&#x20;place&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;attempt&#x20;to&#x20;obfuscate&#x20;unwanted&#x20;changes&#x20;that&#x20;were&#x20;recorded.&#x20;As&#x20;part&#x20;of&#x20;defense-in-depth&#x20;the&#x20;/etc/security/audit_control&#x20;configuration&#x20;and&#x20;the&#x20;files&#x20;in&#x20;/var/audit&#x20;should&#x20;be&#x20;owned&#x20;only&#x20;by&#x20;root&#x20;with&#x20;group&#x20;wheel&#x20;with&#x20;read&#x20;only&#x20;rights&#x20;and&#x20;no&#x20;other&#x20;access&#x20;allowed.&#x20;macOS&#x20;ACLs&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;these&#x20;files.','Audit&#x20;records&#x20;should&#x20;never&#x20;be&#x20;changed&#x20;except&#x20;by&#x20;the&#x20;system&#x20;daemon&#x20;posting&#x20;events.&#x20;Records&#x20;may&#x20;be&#x20;viewed&#x20;or&#x20;extracts&#x20;manipulated&#x20;but&#x20;the&#x20;authoritative&#x20;files&#x20;should&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes.','','Run&#x20;the&#x20;following&#x20;to&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;root&#x20;user&#x20;and&#x20;wheel&#x20;group:&#x20;&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/etc/security/audit_control&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/var/audit/','[{\"cis\": [\"3.5\"]}]'),(17538,'Ensure&#x20;Firewall&#x20;is&#x20;configured&#x20;to&#x20;log','The&#x20;socketfilter&#x20;firewall&#x20;is&#x20;what&#x20;is&#x20;used&#x20;when&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;on&#x20;in&#x20;the&#x20;Security&#x20;PreferencePane.&#x20;In&#x20;order&#x20;to&#x20;appropriately&#x20;monitor&#x20;what&#x20;access&#x20;is&#x20;allowed&#x20;and&#x20;denied&#x20;logging&#x20;must&#x20;be&#x20;enabled.','In&#x20;order&#x20;to&#x20;troubleshoot&#x20;the&#x20;successes&#x20;and&#x20;failures&#x20;of&#x20;a&#x20;firewall&#x20;logging&#x20;should&#x20;be&#x20;enabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;logging&#x20;of&#x20;the&#x20;firewall:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setloggingmode&#x20;on','[{\"cis\": [\"3.6\"]}]'),(17539,'Disable&#x20;Bonjour&#x20;advertising&#x20;service','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers..&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;stop&#x20;the&#x20;computer&#x20;from&#x20;sending&#x20;out&#x20;service&#x20;discovery&#x20;messages&#x20;when&#x20;looking&#x20;for&#x20;services&#x20;on&#x20;an&#x20;internal&#x20;subnet,&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;looking&#x20;for&#x20;a&#x20;printer&#x20;or&#x20;server&#x20;and&#x20;using&#x20;service&#x20;discovery.&#x20;To&#x20;block&#x20;all&#x20;Bonjour&#x20;traffic&#x20;except&#x20;to&#x20;approved&#x20;devices&#x20;the&#x20;pf&#x20;or&#x20;other&#x20;firewall&#x20;would&#x20;be&#x20;needed.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements&#x20;-bool&#x20;true','[{\"cis\": [\"4.1\"]}]'),(17541,'Ensure&#x20;http&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;Web&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;Web&#x20;Server:&#x20;sudo&#x20;apachectl&#x20;stop&#x20;&#x20;&#x20;&#x20;Ensure&#x20;that&#x20;the&#x20;web&#x20;server&#x20;will&#x20;not&#x20;auto-start&#x20;at&#x20;boot&#x20;sudo:&#x20;defaults&#x20;write&#x20;/System/Library/LaunchDaemons/org.apache.httpd&#x20;Disabled&#x20;-&#x20;bool&#x20;true','[{\"cis\": [\"4.4\"]}]'),(17542,'Ensure&#x20;nfs&#x20;server&#x20;is&#x20;not&#x20;running','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop,&#x20;dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;NFS&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;NFS&#x20;Server:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.nfsd.plist&#x20;&#x20;&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing:&#x20;sudo&#x20;rm&#x20;/etc/export','[{\"cis\": [\"4.5\"]}]'),(17544,'Check&#x20;System&#x20;Wide&#x20;Applications&#x20;for&#x20;appropriate&#x20;permissions','Applications&#x20;in&#x20;the&#x20;System&#x20;Applications&#x20;Directory&#x20;&#40;/Applications&#41;&#x20;should&#x20;be&#x20;world&#x20;executable&#x20;since&#x20;that&#x20;is&#x20;their&#x20;reason&#x20;to&#x20;be&#x20;on&#x20;the&#x20;system.&#x20;They&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable&#x20;and&#x20;allow&#x20;any&#x20;process&#x20;or&#x20;user&#x20;to&#x20;alter&#x20;them&#x20;for&#x20;other&#x20;processes&#x20;or&#x20;users&#x20;to&#x20;then&#x20;execute&#x20;modified&#x20;versions','Unauthorized&#x20;modifications&#x20;of&#x20;applications&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;execution&#x20;of&#x20;malicious&#x20;code.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;permissions&#x20;for&#x20;each&#x20;application&#x20;that&#x20;does&#x20;not&#x20;meet&#x20;the&#x20;requirements:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Applications/&lt;applicationname&gt;','[{\"cis\": [\"5.1.2\"]}]'),(17545,'Check&#x20;System&#x20;folder&#x20;for&#x20;world&#x20;writable&#x20;files','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/System&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world&#x20;writable&#x20;permissions.','Folders&#x20;in&#x20;/System&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;&quot;Drop&#x20;Box&quot;&#x20;folder&#x20;that&#x20;is&#x20;part&#x20;of&#x20;Apple&#039;s&#x20;default&#x20;user&#x20;template.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/System&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Path/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.3\"]}]'),(17546,'Check&#x20;Library&#x20;folder&#x20;for&#x20;world&#x20;writable&#x20;files','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/Library&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world&#x20;writable&#x20;permissions.','Folders&#x20;in&#x20;/Library&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;/Library/Caches&#x20;folder&#x20;where&#x20;the&#x20;sticky&#x20;bit&#x20;is&#x20;set.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/Library&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Library/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.4\"]}]'),(17551,'Reduce&#x20;the&#x20;sudo&#x20;timeout&#x20;period','The&#x20;sudo&#x20;command&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;run&#x20;programs&#x20;as&#x20;the&#x20;root&#x20;user.&#x20;Working&#x20;as&#x20;the&#x20;root&#x20;user&#x20;allows&#x20;the&#x20;user&#x20;an&#x20;extremely&#x20;high&#x20;level&#x20;of&#x20;configurability&#x20;within&#x20;the&#x20;system.','The&#x20;sudo&#x20;command&#x20;stays&#x20;logged&#x20;in&#x20;as&#x20;the&#x20;root&#x20;user&#x20;for&#x20;five&#x20;minutes&#x20;before&#x20;timing&#x20;out&#x20;and&#x20;re-requesting&#x20;a&#x20;password.&#x20;This&#x20;five&#x20;minute&#x20;window&#x20;should&#x20;be&#x20;eliminated&#x20;since&#x20;it&#x20;leaves&#x20;the&#x20;system&#x20;extremely&#x20;vulnerable.&#x20;This&#x20;is&#x20;especially&#x20;true&#x20;if&#x20;an&#x20;exploit&#x20;were&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;since&#x20;they&#x20;would&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;as&#x20;a&#x20;root&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo&#x20;-&gt;&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}]'),(17552,'Use&#x20;a&#x20;separate&#x20;timestamp&#x20;for&#x20;each&#x20;user/tty&#x20;combo','Using&#x20;tty&#x20;tickets&#x20;ensures&#x20;that&#x20;a&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;sudo&#x20;password&#x20;in&#x20;each&#x20;Terminal&#x20;session.&#x20;With&#x20;sudo&#x20;versions&#x20;1.8&#x20;and&#x20;higher,&#x20;introduced&#x20;in&#x20;10.12,&#x20;the&#x20;default&#x20;value&#x20;is&#x20;to&#x20;have&#x20;tty&#x20;tickets&#x20;for&#x20;each&#x20;interface&#x20;so&#x20;that&#x20;root&#x20;access&#x20;is&#x20;limited&#x20;to&#x20;a&#x20;specific&#x20;terminal.&#x20;The&#x20;default&#x20;configuration&#x20;can&#x20;be&#x20;overwritten&#x20;or&#x20;not&#x20;configured&#x20;correctly&#x20;on&#x20;earlier&#x20;versions&#x20;of&#x20;macOS.','In&#x20;combination&#x20;with&#x20;removing&#x20;the&#x20;sudo&#x20;timeout&#x20;grace&#x20;period&#x20;a&#x20;further&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;background&#x20;process&#x20;using&#x20;elevated&#x20;rights&#x20;when&#x20;a&#x20;user&#x20;elevates&#x20;to&#x20;root&#x20;in&#x20;an&#x20;explicit&#x20;context&#x20;or&#x20;tty.&#x20;Additional&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;privilege&#x20;escalation&#x20;of&#x20;background&#x20;processes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo&#x20;-&gt;&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}]'),(17553,'Do&#x20;not&#x20;enable&#x20;the&#x20;&quot;root&quot;&#x20;account','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;Linux&#x20;distros&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;uses&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Open&#x20;System&#x20;Preferences,&#x20;Uses&#x20;&amp;&#x20;Groups.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;In&#x20;the&#x20;Network&#x20;Account&#x20;Server&#x20;section,&#x20;click&#x20;Join&#x20;or&#x20;Edit.&#x20;Click&#x20;Open&#x20;Directory&#x20;Utility.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;Select&#x20;the&#x20;Edit&#x20;menu&#x20;&gt;&#x20;Disable&#x20;Root&#x20;User.','[{\"cis\": [\"5.7\"]}]'),(17554,'Disable&#x20;automatic&#x20;login','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen,&#x20;instead&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.8\"]}]'),(17558,'Create&#x20;a&#x20;custom&#x20;message&#x20;for&#x20;the&#x20;Login&#x20;Screen','An&#x20;access&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only,&#x20;and&#x20;that&#x20;the&#x20;use&#x20;of&#x20;the&#x20;system&#x20;may&#x20;be&#x20;monitored.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;a&#x20;custom&#x20;login&#x20;screen&#x20;message:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;LoginwindowText&#x20;&quot;&lt;custom.message&gt;&quot;','[{\"cis\": [\"5.13\"]}]'),(17559,'Create&#x20;a&#x20;Login&#x20;window&#x20;banner','A&#x20;Login&#x20;window&#x20;banner&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only.&#x20;It&#x20;enforces&#x20;an&#x20;acknowledgment&#x20;by&#x20;the&#x20;user&#x20;that&#x20;they&#x20;have&#x20;been&#x20;informed&#x20;of&#x20;the&#x20;use&#x20;policy&#x20;in&#x20;the&#x20;banner&#x20;if&#x20;required.&#x20;The&#x20;system&#x20;recognizes&#x20;either&#x20;the&#x20;.txt&#x20;and&#x20;the&#x20;.rtf&#x20;formats.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Edit&#x20;&#40;or&#x20;create&#41;&#x20;a&#x20;PolicyBanner.txt&#x20;or&#x20;PolicyBanner.rtf&#x20;file,&#x20;in&#x20;the&#x20;/Library/Security/&#x20;folder,&#x20;to&#x20;include&#x20;the&#x20;required&#x20;login&#x20;window&#x20;banner&#x20;text.','[{\"cis\": [\"5.14\"]}]'),(17560,'Disable&#x20;Fast&#x20;User&#x20;Switching','Fast&#x20;user&#x20;switching&#x20;allows&#x20;a&#x20;person&#x20;to&#x20;quickly&#x20;log&#x20;in&#x20;to&#x20;the&#x20;computer&#x20;with&#x20;a&#x20;different&#x20;account.&#x20;While&#x20;only&#x20;a&#x20;minimal&#x20;security&#x20;risk,&#x20;when&#x20;a&#x20;second&#x20;user&#x20;is&#x20;logged&#x20;in,&#x20;that&#x20;user&#x20;might&#x20;be&#x20;able&#x20;to&#x20;see&#x20;what&#x20;processes&#x20;the&#x20;first&#x20;user&#x20;is&#x20;using,&#x20;or&#x20;possibly&#x20;gain&#x20;other&#x20;information&#x20;about&#x20;the&#x20;first&#x20;user.&#x20;In&#x20;a&#x20;large&#x20;directory&#x20;environment&#x20;where&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;limit&#x20;login&#x20;access&#x20;many&#x20;valid&#x20;users&#x20;can&#x20;login&#x20;to&#x20;other&#x20;user&#039;s&#x20;assigned&#x20;computers.','Fast&#x20;user&#x20;switching&#x20;allows&#x20;multiple&#x20;users&#x20;to&#x20;run&#x20;applications&#x20;simultaneously&#x20;at&#x20;console.&#x20;There&#x20;can&#x20;be&#x20;information&#x20;disclosed&#x20;about&#x20;processes&#x20;running&#x20;under&#x20;a&#x20;different&#x20;user.&#x20;Without&#x20;a&#x20;specific&#x20;configuration&#x20;to&#x20;save&#x20;data&#x20;and&#x20;log&#x20;out&#x20;users&#x20;can&#x20;have&#x20;unsaved&#x20;data&#x20;running&#x20;in&#x20;a&#x20;background&#x20;session&#x20;that&#x20;is&#x20;not&#x20;obvious.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;fast&#x20;user&#x20;switching&#x20;off:&#x20;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/.GlobalPreferences&#x20;MultipleSessionEnabled&#x20;-bool&#x20;false','[{\"cis\": [\"5.16\"]}]'),(17561,'System&#x20;Integrity&#x20;Protection&#x20;status','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;macOS&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;&#x20;&#x20;&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.19\"]}]'),(17562,'Display&#x20;login&#x20;window&#x20;as&#x20;name&#x20;and&#x20;password','The&#x20;login&#x20;window&#x20;prompts&#x20;a&#x20;user&#x20;for&#x20;his/her&#x20;credentials,&#x20;verifies&#x20;their&#x20;authorization&#x20;level&#x20;and&#x20;then&#x20;allows&#x20;or&#x20;denies&#x20;the&#x20;user&#x20;access&#x20;to&#x20;the&#x20;system.','Prompting&#x20;the&#x20;user&#x20;to&#x20;enter&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;makes&#x20;it&#x20;twice&#x20;as&#x20;hard&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;since&#x20;they&#x20;must&#x20;discover&#x20;two&#x20;attributes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;login&#x20;window&#x20;to&#x20;display&#x20;name&#x20;and&#x20;password:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;SHOWFULLNAME&#x20;-bool&#x20;true','[{\"cis\": [\"6.1.1\"]}]'),(17563,'Disable&#x20;&quot;Show&#x20;password&#x20;hints&quot;','Password&#x20;hints&#x20;are&#x20;user&#x20;created&#x20;text&#x20;displayed&#x20;when&#x20;an&#x20;incorrect&#x20;password&#x20;is&#x20;used&#x20;for&#x20;an&#x20;account.','Password&#x20;hints&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;systems&#x20;by&#x20;providing&#x20;information&#x20;to&#x20;anyone&#x20;that&#x20;the&#x20;user&#x20;provided&#x20;to&#x20;assist&#x20;remembering&#x20;the&#x20;password.&#x20;This&#x20;info&#x20;could&#x20;include&#x20;the&#x20;password&#x20;itself&#x20;or&#x20;other&#x20;information&#x20;that&#x20;might&#x20;be&#x20;readily&#x20;discerned&#x20;with&#x20;basic&#x20;knowledge&#x20;of&#x20;the&#x20;end&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;password&#x20;hints:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;RetriesUntilHint&#x20;-int&#x20;0','[{\"cis\": [\"6.1.2\"]}]'),(17564,'Disable&#x20;guest&#x20;account&#x20;login','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes,&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system&#x20;and&#x20;all&#x20;created&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;false','[{\"cis\": [\"6.1.3\"]}]'),(17565,'Disable&#x20;&quot;Allow&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&quot;','Allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;enables&#x20;users&#x20;to&#x20;access&#x20;selected&#x20;shared&#x20;folders&#x20;and&#x20;their&#x20;contents&#x20;from&#x20;different&#x20;computers&#x20;on&#x20;a&#x20;network.','Not&#x20;allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;use&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;false','[{\"cis\": [\"6.1.4\"]}]'),(17566,'Remove&#x20;Guest&#x20;home&#x20;folder','In&#x20;the&#x20;previous&#x20;two&#x20;controls&#x20;the&#x20;guest&#x20;account&#x20;login&#x20;has&#x20;been&#x20;disabled&#x20;and&#x20;sharing&#x20;to&#x20;guests&#x20;has&#x20;been&#x20;disabled&#x20;as&#x20;well.&#x20;There&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folders&#x20;continued&#x20;existence&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;rm&#x20;-R&#x20;/Users/Guest&#x20;&#x20;2.&#x20;Make&#x20;sure&#x20;there&#x20;is&#x20;no&#x20;output','[{\"cis\": [\"6.1.5\"]}]'),(17567,'Turn&#x20;on&#x20;filename&#x20;extensions','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Select&#x20;Finder&#x20;2.&#x20;Select&#x20;Preferences&#x20;3.&#x20;Check&#x20;Show&#x20;all&#x20;filename&#x20;extensions&#x20;&#x20;&#x20;&#x20;Alternatively,&#x20;use&#x20;the&#x20;following&#x20;command:&#x20;defaults&#x20;write&#x20;NSGlobalDomain&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}]'),(17568,'Disable&#x20;the&#x20;automatic&#x20;run&#x20;of&#x20;safe&#x20;files&#x20;in&#x20;Safari','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Safari&#x20;2.&#x20;Select&#x20;Safari&#x20;from&#x20;the&#x20;menu&#x20;bar&#x20;3.&#x20;Select&#x20;Preferences&#x20;4.&#x20;Select&#x20;General&#x20;5.&#x20;Uncheck&#x20;Open&#x20;&quot;safe&quot;&#x20;files&#x20;after&#x20;downloading&#x20;&#x20;&#x20;&#x20;Alternatively&#x20;run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-boolean&#x20;no','[{\"cis\": [\"6.3\"]}]'),(18000,'Verify&#x20;all&#x20;Apple&#x20;provided&#x20;software&#x20;is&#x20;current.','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following:&#x20;softwareupdate&#x20;-i&#x20;-a&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename','[{\"cis\": [\"1.1\"]}, {\"cis_level\": [\"1\"]}]'),(18001,'Enable&#x20;Auto&#x20;Update.','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-bool&#x20;true','[{\"cis\": [\"1.2\"]}, {\"cis_level\": [\"1\"]}]'),(18002,'Enable&#x20;Download&#x20;new&#x20;updates&#x20;when&#x20;available.','In&#x20;the&#x20;GUI&#x20;both&#x20;&quot;Install&#x20;macOS&#x20;updates&quot;&#x20;and&#x20;&quot;Install&#x20;app&#x20;updates&#x20;from&#x20;the&#x20;App&#x20;Store&quot;&#x20;are&#x20;dependent&#x20;on&#x20;whether&#x20;&quot;Download&#x20;new&#x20;updates&#x20;when&#x20;available&quot;&#x20;is&#x20;selected','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;downloaded&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;applied.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticDownload&#x20;-bool&#x20;true','[{\"cis\": [\"1.3\"]}, {\"cis_level\": [\"1\"]}]'),(18003,'Enable&#x20;app&#x20;update&#x20;installs.','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-&#x20;bool&#x20;TRUE','[{\"cis\": [\"1.4\"]}, {\"cis_level\": [\"1\"]}]'),(18004,'Enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;update&#x20;installs.','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper,&#x20;with&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.5\"]}, {\"cis_level\": [\"1\"]}]'),(18005,'Enable&#x20;macOS&#x20;update&#x20;installs.','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticallyInstallMacOSUpdates&#x20;AutoUpdate&#x20;-&#x20;bool&#x20;TRUE','[{\"cis\": [\"1.6\"]}, {\"cis_level\": [\"1\"]}]'),(18006,'Turn&#x20;off&#x20;Bluetooth,&#x20;if&#x20;no&#x20;paired&#x20;devices&#x20;exist.','Bluetooth&#x20;devices&#x20;use&#x20;a&#x20;wireless&#x20;communications&#x20;system&#x20;that&#x20;replaces&#x20;the&#x20;cables&#x20;used&#x20;by&#x20;other&#x20;peripherals&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;system.&#x20;It&#x20;is&#x20;by&#x20;design&#x20;a&#x20;peer-to-peer&#x20;network&#x20;technology&#x20;and&#x20;typically&#x20;lacks&#x20;centralized&#x20;administration&#x20;and&#x20;security&#x20;enforcement&#x20;infrastructure.','Bluetooth&#x20;is&#x20;particularly&#x20;susceptible&#x20;to&#x20;a&#x20;diverse&#x20;set&#x20;of&#x20;security&#x20;vulnerabilities&#x20;involving&#x20;identity&#x20;detection,&#x20;location&#x20;tracking,&#x20;denial&#x20;of&#x20;service,&#x20;unintended&#x20;control&#x20;and&#x20;access&#x20;of&#x20;data&#x20;and&#x20;voice&#x20;channels,&#x20;and&#x20;unauthorized&#x20;device&#x20;control&#x20;and&#x20;data&#x20;access.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;bluetooth:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.Bluetooth&#x20;ControllerPowerState&#x20;-int&#x20;0&#x20;&amp;&amp;&#x20;sudo&#x20;killall&#x20;-HUP&#x20;blued','[{\"cis\": [\"2.1.1\"]}, {\"cis_level\": [\"1\"]}]'),(18007,'Show&#x20;Bluetooth&#x20;status&#x20;in&#x20;menu&#x20;bar.','By&#x20;showing&#x20;the&#x20;Bluetooth&#x20;status&#x20;in&#x20;the&#x20;menu&#x20;bar,&#x20;a&#x20;small&#x20;Bluetooth&#x20;icon&#x20;is&#x20;placed&#x20;in&#x20;the&#x20;menu&#x20;bar.&#x20;This&#x20;icon&#x20;quickly&#x20;shows&#x20;the&#x20;status&#x20;of&#x20;Bluetooth,&#x20;and&#x20;can&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;quickly&#x20;turn&#x20;Bluetooth&#x20;on&#x20;or&#x20;off.','Enabling&#x20;Show&#x20;Bluetooth&#x20;status&#x20;in&#x20;menu&#x20;bar&#x20;is&#x20;a&#x20;security&#x20;awareness&#x20;method&#x20;that&#x20;helps&#x20;understand&#x20;the&#x20;current&#x20;state&#x20;of&#x20;Bluetooth,&#x20;including&#x20;whether&#x20;it&#x20;is&#x20;enabled,&#x20;discoverable,&#x20;what&#x20;paired&#x20;devices&#x20;exist,&#x20;and&#x20;what&#x20;paired&#x20;devices&#x20;are&#x20;currently&#x20;active.&#x20;','','For&#x20;each&#x20;user,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;Bluetooth&#x20;status&#x20;in&#x20;the&#x20;menu&#x20;bar:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;-currentHost&#x20;write&#x20;com.apple.controlcenter.plist&#x20;Bluetooth&#x20;-int&#x20;18','[{\"cis\": [\"2.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(18008,'Enable&#x20;Set&#x20;time&#x20;and&#x20;date&#x20;automatically.','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;&#x20;&#x20;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on','[{\"cis\": [\"2.2.1\"]}, {\"cis_level\": [\"1\"]}]'),(18009,'Ensure&#x20;time&#x20;set&#x20;is&#x20;within&#x20;appropriate&#x20;limits.','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;Ensure&#x20;that&#x20;time&#x20;on&#x20;the&#x20;computer&#x20;is&#x20;within&#x20;acceptable&#x20;limits.&#x20;Truly&#x20;accurate&#x20;time&#x20;is&#x20;measured&#x20;within&#x20;milliseconds,&#x20;for&#x20;this&#x20;audit&#x20;a&#x20;drift&#x20;under&#x20;four&#x20;and&#x20;a&#x20;half&#x20;minutes&#x20;passes&#x20;the&#x20;control&#x20;check.&#x20;Since&#x20;Kerberos&#x20;is&#x20;one&#x20;of&#x20;the&#x20;important&#x20;features&#x20;of&#x20;macOS&#x20;integration&#x20;into&#x20;Directory&#x20;systems&#x20;the&#x20;guidance&#x20;here&#x20;is&#x20;to&#x20;warn&#x20;you&#x20;before&#x20;there&#x20;could&#x20;be&#x20;an&#x20;impact&#x20;to&#x20;operations.&#x20;From&#x20;the&#x20;perspective&#x20;of&#x20;accurate&#x20;time&#x20;this&#x20;check&#x20;is&#x20;not&#x20;strict,&#x20;it&#x20;may&#x20;be&#x20;too&#x20;great&#x20;for&#x20;your&#x20;organization,&#x20;adjust&#x20;to&#x20;a&#x20;smaller&#x20;offset&#x20;value&#x20;as&#x20;needed.&#x20;Note:&#x20;ntpdate&#x20;has&#x20;been&#x20;deprecated&#x20;with&#x20;10.14.&#x20;sntp&#x20;replaces&#x20;that&#x20;command.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.&#x20;Audit&#x20;check&#x20;is&#x20;for&#x20;more&#x20;than&#x20;4&#x20;minutes&#x20;and&#x20;30&#x20;seconds&#x20;ahead&#x20;or&#x20;behind.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;ensure&#x20;your&#x20;time&#x20;is&#x20;set&#x20;within&#x20;an&#x20;appropriate&#x20;limit:&#x20;sudo&#x20;systemsetup&#x20;-getnetworktimeserver&#x20;-&gt;&#x20;Get&#x20;the&#x20;time&#x20;server&#x20;name&#x20;and&#x20;then&#x20;run:&#x20;sudo&#x20;touch&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;root:wheel&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;sntp&#x20;-sS&#x20;&lt;YOUR-TIME-SERVER&gt;&#x20;','[{\"cis\": [\"2.2.2\"]}, {\"cis_level\": [\"1\"]}]'),(18010,'Set&#x20;an&#x20;inactivity&#x20;interval&#x20;of&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;for&#x20;the&#x20;screen&#x20;saver.','A&#x20;locking&#x20;screensaver&#x20;is&#x20;one&#x20;of&#x20;the&#x20;standard&#x20;security&#x20;controls&#x20;to&#x20;limit&#x20;access&#x20;to&#x20;a&#x20;computer&#x20;and&#x20;the&#x20;current&#x20;user&#039;s&#x20;session&#x20;when&#x20;the&#x20;computer&#x20;is&#x20;temporarily&#x20;unused&#x20;or&#x20;unattended.&#x20;In&#x20;macOS&#x20;the&#x20;screensaver&#x20;starts&#x20;after&#x20;a&#x20;value&#x20;selected&#x20;in&#x20;a&#x20;drop&#x20;down&#x20;menu,&#x20;10&#x20;minutes&#x20;and&#x20;20&#x20;minutes&#x20;are&#x20;both&#x20;options&#x20;and&#x20;either&#x20;is&#x20;acceptable.&#x20;Any&#x20;value&#x20;can&#x20;be&#x20;selected&#x20;through&#x20;the&#x20;command&#x20;line&#x20;or&#x20;script&#x20;but&#x20;a&#x20;number&#x20;that&#x20;is&#x20;not&#x20;reflected&#x20;in&#x20;the&#x20;GUI&#x20;can&#x20;be&#x20;problematic.&#x20;20&#x20;minutes&#x20;is&#x20;the&#x20;default&#x20;for&#x20;new&#x20;accounts.','Setting&#x20;an&#x20;inactivity&#x20;interval&#x20;for&#x20;the&#x20;screensaver&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;a&#x20;system&#x20;left&#x20;unattended&#x20;for&#x20;an&#x20;extensive&#x20;period&#x20;of&#x20;time.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;that&#x20;the&#x20;idle&#x20;time&#x20;of&#x20;the&#x20;screen&#x20;saver&#x20;to&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;&#40;&le;1200&#41;:&#x20;sudo&#x20;defaults&#x20;-currentHost&#x20;write&#x20;com.apple.screensaver&#x20;idleTime&#x20;-int&#x20;600&#x20;','[{\"cis\": [\"2.3.1\"]}, {\"cis_level\": [\"1\"]}]'),(18011,'Secure&#x20;screen&#x20;saver&#x20;corners.','Hot&#x20;Corners&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;by&#x20;moving&#x20;the&#x20;mouse&#x20;cursor&#x20;to&#x20;a&#x20;corner&#x20;of&#x20;the&#x20;screen.','Setting&#x20;a&#x20;hot&#x20;corner&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;since&#x20;an&#x20;unauthorized&#x20;person&#x20;could&#x20;use&#x20;this&#x20;to&#x20;bypass&#x20;the&#x20;login&#x20;screen&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Disable&#x20;Screen&#x20;Saver&#x20;for&#x20;a&#x20;Hot&#x20;Corner:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.dock&#x20;&lt;corner&#x20;that&#x20;is&#x20;set&#x20;to&#x20;&#039;6&#039;&gt;&#x20;-int&#x20;0&#x20;','[{\"cis\": [\"2.3.2\"]}, {\"cis_level\": [\"2\"]}]'),(18012,'Disable&#x20;Remote&#x20;Apple&#x20;Events.','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}, {\"cis_level\": [\"1\"]}]'),(18013,'Disable&#x20;Internet&#x20;Sharing.','Internet&#x20;Sharing&#x20;uses&#x20;the&#x20;open&#x20;source&#x20;natd&#x20;process&#x20;to&#x20;share&#x20;an&#x20;internet&#x20;connection&#x20;with&#x20;other&#x20;computers&#x20;and&#x20;devices&#x20;on&#x20;a&#x20;local&#x20;network.&#x20;This&#x20;allows&#x20;the&#x20;Mac&#x20;to&#x20;function&#x20;as&#x20;a&#x20;router&#x20;and&#x20;share&#x20;the&#x20;connection&#x20;to&#x20;other,&#x20;possibly&#x20;unauthorized,&#x20;devices.','Disabling&#x20;Internet&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Internet&#x20;Sharing:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/SystemConfiguration/com.apple.nat&#x20;NAT&#x20;-dict&#x20;Enabled&#x20;-int&#x20;0','[{\"cis\": [\"2.4.2\"]}, {\"cis_level\": [\"1\"]}]'),(18014,'Disable&#x20;Screen&#x20;Sharing.','Screen&#x20;sharing&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;connect&#x20;to&#x20;another&#x20;computer&#x20;on&#x20;a&#x20;network&#x20;and&#x20;display&#x20;the&#x20;computer&#039;s&#x20;screen.&#x20;While&#x20;sharing&#x20;the&#x20;computer&#039;s&#x20;screen,&#x20;the&#x20;user&#x20;can&#x20;control&#x20;what&#x20;happens&#x20;on&#x20;that&#x20;computer,&#x20;such&#x20;as&#x20;opening&#x20;documents&#x20;or&#x20;applications,&#x20;opening,&#x20;moving,&#x20;or&#x20;closing&#x20;windows,&#x20;and&#x20;even&#x20;shutting&#x20;down&#x20;the&#x20;computer.','Disabling&#x20;screen&#x20;sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;remote&#x20;connections&#x20;being&#x20;made&#x20;without&#x20;the&#x20;user&#x20;of&#x20;the&#x20;console&#x20;knowing&#x20;that&#x20;they&#x20;are&#x20;sharing&#x20;the&#x20;computer.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Screen&#x20;Sharing:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/com.apple.screensharing','[{\"cis\": [\"2.4.3\"]}, {\"cis_level\": [\"1\"]}]'),(18015,'Disable&#x20;Printer&#x20;Sharing.','By&#x20;enabling&#x20;Printer&#x20;sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;cupsctl&#x20;--no-share-printers','[{\"cis\": [\"2.4.4\"]}, {\"cis_level\": [\"1\"]}]'),(18016,'Disable&#x20;Remote&#x20;Login.','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.&#x20;macOS&#x20;does&#x20;have&#x20;an&#x20;IP&#x20;based&#x20;firewall&#x20;available&#x20;&#40;pf,&#x20;ipfw&#x20;has&#x20;been&#x20;deprecated&#41;&#x20;that&#x20;is&#x20;not&#x20;enabled&#x20;or&#x20;configured.&#x20;There&#x20;are&#x20;more&#x20;details&#x20;and&#x20;links&#x20;in&#x20;section&#x20;7.5.&#x20;macOS&#x20;no&#x20;longer&#x20;has&#x20;TCP&#x20;Wrappers&#x20;support&#x20;built-in&#x20;and&#x20;does&#x20;not&#x20;have&#x20;strong&#x20;Brute-Force&#x20;password&#x20;guessing&#x20;mitigations,&#x20;or&#x20;frequent&#x20;patching&#x20;of&#x20;openssh&#x20;by&#x20;Apple.&#x20;Most&#x20;macOS&#x20;computers&#x20;are&#x20;mobile&#x20;workstations,&#x20;managing&#x20;IP&#x20;based&#x20;firewall&#x20;rules&#x20;on&#x20;mobile&#x20;devices&#x20;can&#x20;be&#x20;very&#x20;resource&#x20;intensive.&#x20;All&#x20;of&#x20;these&#x20;factors&#x20;can&#x20;be&#x20;parts&#x20;of&#x20;running&#x20;a&#x20;hardened&#x20;SSH&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}, {\"cis_level\": [\"1\"]}]'),(18017,'Disable&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing.','DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;allows&#x20;users&#x20;to&#x20;remotely&#x20;access&#x20;the&#x20;system&#039;s&#x20;optical&#x20;drive.','Disabling&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;the&#x20;optical&#x20;drive&#x20;as&#x20;a&#x20;vector&#x20;for&#x20;attack&#x20;and&#x20;exposure&#x20;of&#x20;sensitive&#x20;data.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;DVD&#x20;or&#x20;CD&#x20;sharing:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/com.apple.ODSAgent&#x20;','[{\"cis\": [\"2.4.6\"]}, {\"cis_level\": [\"1\"]}]'),(18018,'Disable&#x20;Bluetooth&#x20;Sharing&#x20;.','Bluetooth&#x20;Sharing&#x20;allows&#x20;files&#x20;to&#x20;be&#x20;exchanged&#x20;with&#x20;Bluetooth&#x20;enabled&#x20;devices.','Disabling&#x20;Bluetooth&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;Bluetooth&#x20;to&#x20;remotely&#x20;attack&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;Bluetooth&#x20;Sharing:&#x20;Graphical&#x20;Method:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Sharing&#x20;3.&#x20;Uncheck&#x20;Bluetooth&#x20;Sharing','[{\"cis\": [\"2.4.7\"]}, {\"cis_level\": [\"1\"]}]'),(18019,'Disable&#x20;File&#x20;Sharing.','Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;a&#x20;combination&#x20;of&#x20;SMB&#x20;&#40;Windows&#x20;sharing&#41;&#x20;and&#x20;AFP&#x20;&#40;Mac&#x20;sharing&#41;','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal&#x20;to&#x20;turn&#x20;off&#x20;AFP&#x20;and&#x20;SMB&#x20;file&#x20;sharing&#x20;from&#x20;the&#x20;command&#x20;line:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.smbd.plist','[{\"cis\": [\"2.4.8\"]}, {\"cis_level\": [\"1\"]}]'),(18020,'Disable&#x20;Remote&#x20;Management.','Remote&#x20;Management&#x20;is&#x20;the&#x20;client&#x20;portion&#x20;of&#x20;Apple&#x20;Remote&#x20;Desktop&#x20;&#40;ARD&#41;.&#x20;Remote&#x20;Management&#x20;can&#x20;be&#x20;used&#x20;by&#x20;remote&#x20;administrators&#x20;to&#x20;view&#x20;the&#x20;current&#x20;Screen,&#x20;install&#x20;software,&#x20;report&#x20;on,&#x20;and&#x20;generally&#x20;manage&#x20;client&#x20;Macs.&#x20;The&#x20;screen&#x20;sharing&#x20;options&#x20;in&#x20;Remote&#x20;Management&#x20;are&#x20;identical&#x20;to&#x20;those&#x20;in&#x20;the&#x20;Screen&#x20;Sharing&#x20;section.&#x20;In&#x20;fact,&#x20;only&#x20;one&#x20;of&#x20;the&#x20;two&#x20;can&#x20;be&#x20;configured.&#x20;If&#x20;Remote&#x20;Management&#x20;is&#x20;used,&#x20;refer&#x20;to&#x20;the&#x20;Screen&#x20;Sharing&#x20;section&#x20;above&#x20;on&#x20;issues&#x20;regard&#x20;screen&#x20;sharing.&#x20;Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;a&#x20;Directory&#x20;is&#x20;in&#x20;place&#x20;to&#x20;manage&#x20;the&#x20;accounts&#x20;with&#x20;access.&#x20;Computers&#x20;will&#x20;be&#x20;available&#x20;on&#x20;port&#x20;5900&#x20;on&#x20;a&#x20;macOS&#x20;System&#x20;and&#x20;could&#x20;accept&#x20;connections&#x20;from&#x20;untrusted&#x20;hosts&#x20;depending&#x20;on&#x20;the&#x20;configuration,&#x20;definitely&#x20;a&#x20;concern&#x20;for&#x20;mobile&#x20;systems.','Remote&#x20;management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;on&#x20;trusted&#x20;networks&#x20;with&#x20;strong&#x20;user&#x20;controls&#x20;present&#x20;in&#x20;a&#x20;Directory&#x20;system.&#x20;Mobile&#x20;devices&#x20;without&#x20;strict&#x20;controls&#x20;are&#x20;vulnerable&#x20;to&#x20;exploit&#x20;and&#x20;monitoring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;remote&#x20;management:&#x20;sudo&#x20;/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources&#x20;/kickstart&#x20;-deactivate&#x20;-stop','[{\"cis\": [\"2.4.9\"]}, {\"cis_level\": [\"1\"]}]'),(18021,'Disable&#x20;Content&#x20;Caching.','Starting&#x20;with&#x20;10.13&#x20;&#40;macOS&#x20;High&#x20;Sierra&#41;&#x20;Apple&#x20;introduced&#x20;a&#x20;service&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;deploy&#x20;data&#x20;from&#x20;Apple,&#x20;including&#x20;software&#x20;updates,&#x20;where&#x20;there&#x20;are&#x20;bandwidth&#x20;constraints&#x20;to&#x20;the&#x20;Internet&#x20;and&#x20;fewer&#x20;constraints&#x20;and&#x20;greater&#x20;bandwidth&#x20;on&#x20;the&#x20;local&#x20;subnet.&#x20;This&#x20;capability&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;for&#x20;organizations&#x20;that&#x20;have&#x20;throttled&#x20;and&#x20;possibly&#x20;metered&#x20;Internet&#x20;connections.&#x20;In&#x20;heterogeneous&#x20;enterprise&#x20;networks&#x20;with&#x20;multiple&#x20;subnets&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;capability&#x20;would&#x20;be&#x20;determined&#x20;on&#x20;how&#x20;many&#x20;Macs&#x20;were&#x20;on&#x20;each&#x20;subnet&#x20;at&#x20;the&#x20;time&#x20;new&#x20;large&#x20;updates&#x20;were&#x20;made&#x20;available&#x20;upstream.&#x20;This&#x20;capability&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;mac&#x20;OS&#x20;clients&#x20;as&#x20;P2P&#x20;nodes&#x20;for&#x20;updated&#x20;Apple&#x20;content.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;business&#x20;requirement&#x20;to&#x20;manage&#x20;operational&#x20;Internet&#x20;connectivity&#x20;bandwidth&#x20;user&#x20;endpoints&#x20;should&#x20;not&#x20;store&#x20;content&#x20;and&#x20;act&#x20;as&#x20;a&#x20;cluster&#x20;to&#x20;provision&#x20;data.','The&#x20;main&#x20;use&#x20;case&#x20;for&#x20;Mac&#x20;computers&#x20;is&#x20;as&#x20;mobile&#x20;user&#x20;endpoints.&#x20;P2P&#x20;sharing&#x20;services&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;laptops&#x20;that&#x20;are&#x20;using&#x20;untrusted&#x20;networks.&#x20;Content&#x20;Caching&#x20;can&#x20;allow&#x20;a&#x20;computer&#x20;to&#x20;be&#x20;a&#x20;server&#x20;for&#x20;local&#x20;nodes&#x20;on&#x20;an&#x20;untrusted&#x20;network.&#x20;While&#x20;there&#x20;are&#x20;certainly&#x20;logical&#x20;controls&#x20;that&#x20;could&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;risk&#x20;they&#x20;add&#x20;to&#x20;the&#x20;management&#x20;complexity,&#x20;since&#x20;the&#x20;value&#x20;of&#x20;the&#x20;service&#x20;is&#x20;in&#x20;specific&#x20;use&#x20;cases&#x20;organizations&#x20;with&#x20;the&#x20;use&#x20;case&#x20;described&#x20;above&#x20;can&#x20;accept&#x20;risk&#x20;as&#x20;necessary.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;to&#x20;disable&#x20;content&#x20;caching:&#x20;sudo&#x20;AssetCacheManagerUtil&#x20;deactivate','[{\"cis\": [\"2.4.10\"]}, {\"cis_level\": [\"2\"]}]'),(18022,'Disable&#x20;Media&#x20;Sharing.','Starting&#x20;with&#x20;macOS&#x20;10.15&#x20;Apple&#x20;has&#x20;provided&#x20;a&#x20;control&#x20;to&#x20;allow&#x20;a&#x20;user&#x20;to&#x20;share&#x20;Apple&#x20;downloaded&#x20;content&#x20;on&#x20;all&#x20;Apple&#x20;devices&#x20;that&#x20;are&#x20;signed&#x20;in&#x20;with&#x20;the&#x20;same&#x20;Apple&#x20;ID.&#x20;This&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;share&#x20;downloaded&#x20;Movies,&#x20;Music&#x20;or&#x20;TV&#x20;shows&#x20;with&#x20;other&#x20;controlled&#x20;macOS,&#x20;iOS&#x20;and&#x20;iPadOS&#x20;devices&#x20;as&#x20;well&#x20;as&#x20;photos&#x20;with&#x20;Apple&#x20;TVs.&#x20;With&#x20;this&#x20;capability&#x20;guest&#x20;users&#x20;can&#x20;also&#x20;use&#x20;media&#x20;downloaded&#x20;on&#x20;the&#x20;computer.&#x20;Best&#x20;practice&#x20;is&#x20;not&#x20;to&#x20;use&#x20;the&#x20;computer&#x20;as&#x20;a&#x20;server&#x20;but&#x20;to&#x20;utilize&#x20;Apple&#039;s&#x20;cloud&#x20;storage&#x20;to&#x20;download&#x20;and&#x20;use&#x20;content&#x20;stored&#x20;there&#x20;if&#x20;content&#x20;stored&#x20;with&#x20;Apple&#x20;is&#x20;used&#x20;on&#x20;multiple&#x20;devices.','Disabling&#x20;Media&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;to&#x20;disable&#x20;content&#x20;caching:&#x20;sudo&#x20;AssetCacheManagerUtil&#x20;deactivate','[{\"cis\": [\"2.4.11\"]}, {\"cis_level\": [\"2\"]}]'),(18023,'Enable&#x20;FileVault.','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.&#x20;Filevault&#x20;may&#x20;also&#x20;be&#x20;enabled&#x20;using&#x20;command&#x20;line&#x20;using&#x20;the&#x20;fdesetup&#x20;command.&#x20;To&#x20;use&#x20;this&#x20;functionality,&#x20;consult&#x20;the&#x20;Der&#x20;Flounder&#x20;blog&#x20;for&#x20;more&#x20;details:&#x20;','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.5.1.1\"]}, {\"cis_level\": [\"1\"]}]'),(18024,'Enable&#x20;Gatekeeper.','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;white-listing&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;spctl&#x20;--master-enable','[{\"cis\": [\"2.5.1\"]}, {\"cis_level\": [\"1\"]}]'),(18025,'Enable&#x20;Firewall.','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-&#x20;int&#x20;&lt;value&gt;&#x20;&#x20;&#x20;&#x20;Where&#x20;&lt;value&gt;&#x20;is:&#x20;-&#x20;1&#x20;=&#x20;on&#x20;for&#x20;specific&#x20;services&#x20;-&#x20;2&#x20;=&#x20;on&#x20;for&#x20;essential&#x20;services&#x20;','[{\"cis\": [\"2.5.2\"]}, {\"cis_level\": [\"1\"]}]'),(18026,'Enable&#x20;Firewall&#x20;Stealth&#x20;Mode.','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.5.3\"]}, {\"cis_level\": [\"1\"]}]'),(18027,'Enable&#x20;Location&#x20;Services.','macOS&#x20;uses&#x20;location&#x20;information&#x20;gathered&#x20;through&#x20;local&#x20;Wi-Fi&#x20;networks&#x20;to&#x20;enable&#x20;applications&#x20;to&#x20;supply&#x20;relevant&#x20;information&#x20;to&#x20;users.&#x20;Users&#x20;do&#x20;not&#x20;need&#x20;to&#x20;change&#x20;the&#x20;time&#x20;or&#x20;the&#x20;time&#x20;zone,&#x20;the&#x20;computer&#x20;will&#x20;do&#x20;it&#x20;for&#x20;them.&#x20;They&#x20;do&#x20;not&#x20;need&#x20;to&#x20;specify&#x20;their&#x20;location&#x20;for&#x20;weather&#x20;or&#x20;travel&#x20;times&#x20;and&#x20;even&#x20;get&#x20;alerts&#x20;on&#x20;travel&#x20;times&#x20;to&#x20;meetings&#x20;and&#x20;appointment&#x20;where&#x20;location&#x20;information&#x20;is&#x20;supplied.&#x20;For&#x20;the&#x20;purpose&#x20;of&#x20;asset&#x20;management&#x20;and&#x20;time&#x20;and&#x20;log&#x20;management&#x20;with&#x20;mobile&#x20;computers&#x20;location&#x20;services&#x20;simplify&#x20;some&#x20;processes.There&#x20;are&#x20;some&#x20;use&#x20;cases&#x20;where&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;computer&#x20;not&#x20;be&#x20;able&#x20;to&#x20;report&#x20;it&#039;s&#x20;exact&#x20;location.&#x20;While&#x20;the&#x20;general&#x20;use&#x20;case&#x20;is&#x20;to&#x20;enable&#x20;Location&#x20;Services,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;if&#x20;the&#x20;physical&#x20;location&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;the&#x20;user&#x20;should&#x20;not&#x20;be&#x20;public&#x20;knowledge.','Location&#x20;services&#x20;are&#x20;helpful&#x20;in&#x20;most&#x20;use&#x20;cases&#x20;and&#x20;can&#x20;simplify&#x20;log&#x20;and&#x20;time&#x20;management&#x20;where&#x20;computers&#x20;change&#x20;time&#x20;zones.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;location&#x20;services:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.locationd.plist','[{\"cis\": [\"2.5.3\"]}, {\"cis_level\": [\"2\"]}]'),(18028,'Disable&#x20;sending&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;to&#x20;Apple.','Apple&#x20;provides&#x20;a&#x20;mechanism&#x20;to&#x20;send&#x20;diagnostic&#x20;and&#x20;analytics&#x20;data&#x20;back&#x20;to&#x20;Apple&#x20;to&#x20;help&#x20;them&#x20;improve&#x20;the&#x20;platform.&#x20;Information&#x20;sent&#x20;to&#x20;Apple&#x20;may&#x20;contain&#x20;internal&#x20;organizational&#x20;information&#x20;that&#x20;should&#x20;be&#x20;controlled&#x20;and&#x20;not&#x20;available&#x20;for&#x20;processing&#x20;by&#x20;Apple.&#x20;Turn&#x20;off&#x20;all&#x20;Analytics&#x20;and&#x20;Improvements&#x20;sharing.','Organizations&#x20;should&#x20;have&#x20;knowledge&#x20;of&#x20;what&#x20;is&#x20;shared&#x20;with&#x20;the&#x20;vendor&#x20;and&#x20;the&#x20;setting&#x20;automatically&#x20;forwards&#x20;information&#x20;to&#x20;Apple.','','For&#x20;each&#x20;needed&#x20;user,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;limited&#x20;ad&#x20;tracking:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;-currentHost&#x20;write&#x20;/Users/&lt;username&gt;/Library/Preferences/com.apple.Adlib.plist&#x20;allowApplePersonalizedAdvertising&#x20;-bool&#x20;false','[{\"cis\": [\"2.5.5\"]}, {\"cis_level\": [\"2\"]}]'),(18029,'Limit&#x20;Ad&#x20;tracking&#x20;and&#x20;personalized&#x20;Ads.','Apple&#x20;provides&#x20;a&#x20;framework&#x20;that&#x20;allows&#x20;advertisers&#x20;to&#x20;target&#x20;Apple&#x20;users&#x20;and&#x20;end-users&#x20;with&#x20;advertisements.&#x20;While&#x20;many&#x20;people&#x20;prefer&#x20;that&#x20;when&#x20;they&#x20;see&#x20;advertising&#x20;it&#x20;is&#x20;relevant&#x20;to&#x20;them&#x20;and&#x20;their&#x20;interests,&#x20;the&#x20;detailed&#x20;information&#x20;that&#x20;is&#x20;data&#x20;mining&#x20;collected,&#x20;correlated,&#x20;and&#x20;available&#x20;to&#x20;advertisers&#x20;in&#x20;repositories&#x20;is&#x20;often&#x20;disconcerting.&#x20;This&#x20;information&#x20;is&#x20;valuable&#x20;to&#x20;both&#x20;advertisers&#x20;and&#x20;attackers&#x20;and&#x20;has&#x20;been&#x20;used&#x20;with&#x20;other&#x20;metadata&#x20;to&#x20;reveal&#x20;users&#039;&#x20;identities','Organizations&#x20;should&#x20;manage&#x20;user&#x20;privacy&#x20;settings&#x20;on&#x20;managed&#x20;devices&#x20;to&#x20;align&#x20;with&#x20;organizational&#x20;policies&#x20;and&#x20;user&#x20;data&#x20;protection&#x20;requirements.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"2.5.6\"]}, {\"cis_level\": [\"1\"]}]'),(18030,'Time&#x20;Machine&#x20;Auto-Backup.','Backup&#x20;solutions&#x20;are&#x20;only&#x20;effective&#x20;if&#x20;the&#x20;backups&#x20;run&#x20;on&#x20;a&#x20;regular&#x20;basis.&#x20;The&#x20;time&#x20;to&#x20;check&#x20;for&#x20;backups&#x20;is&#x20;before&#x20;the&#x20;hard&#x20;drive&#x20;fails&#x20;or&#x20;the&#x20;computer&#x20;goes&#x20;missing.&#x20;In&#x20;order&#x20;to&#x20;simplify&#x20;the&#x20;user&#x20;experience&#x20;so&#x20;that&#x20;backups&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;occur&#x20;Time&#x20;Machine&#x20;should&#x20;be&#x20;on&#x20;and&#x20;set&#x20;to&#x20;Back&#x20;Up&#x20;Automatically&#x20;whenever&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;available.&#x20;Operational&#x20;staff&#x20;should&#x20;ensure&#x20;that&#x20;backups&#x20;complete&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;the&#x20;backups&#x20;are&#x20;tested&#x20;to&#x20;ensure&#x20;that&#x20;file&#x20;restoration&#x20;from&#x20;backup&#x20;is&#x20;possible&#x20;when&#x20;needed.&#x20;Backup&#x20;dates&#x20;are&#x20;available&#x20;even&#x20;when&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;not&#x20;available&#x20;in&#x20;the&#x20;Time&#x20;Machine&#x20;plist.&#x20;When&#x20;the&#x20;backup&#x20;volume&#x20;is&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;more&#x20;extensive&#x20;information&#x20;is&#x20;available&#x20;through&#x20;tmutil.&#x20;See&#x20;man&#x20;tmutil','Backups&#x20;should&#x20;automatically&#x20;run&#x20;whenever&#x20;the&#x20;backup&#x20;drive&#x20;is&#x20;available.','','Run&#x20;the&#x20;following&#x20;enable&#x20;TimeMachine:&#x20;sudo&#x20;sudo&#x20;tmutil&#x20;setdestination&#x20;-a&#x20;/Volumes/&lt;volumename&gt;&#x20;&amp;&amp;&#x20;sudo&#x20;tmutil&#x20;enable','[{\"cis\": [\"2.7.1\"]}, {\"cis_level\": [\"2\"]}]'),(18031,'Disable&#x20;Wake&#x20;for&#x20;network&#x20;access.','This&#x20;feature&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;Theie&#x20;macOS&#x20;feature&#x20;is&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&#039;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;unmanaged&#x20;network&#x20;where&#x20;untrusted&#x20;devices&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access:&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0&#x20;','[{\"cis\": [\"2.8\"]}, {\"cis_level\": [\"1\"]}]'),(18032,'Disable&#x20;Power&#x20;Nap.','This&#x20;features&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;This&#x20;macOS&#x20;features&#x20;are&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;Power&#x20;Nap&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;stay&#x20;in&#x20;low&#x20;power&#x20;mode,&#x20;especially&#x20;while&#x20;on&#x20;battery&#x20;power&#x20;and&#x20;periodically&#x20;connect&#x20;to&#x20;previously&#x20;named&#x20;networks&#x20;with&#x20;stored&#x20;credentials&#x20;for&#x20;user&#x20;applications&#x20;to&#x20;phone&#x20;home&#x20;and&#x20;get&#x20;updates.&#x20;This&#x20;capability&#x20;requires&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;the&#x20;use&#x20;of&#x20;previously&#x20;joined&#x20;networks&#x20;to&#x20;be&#x20;risk&#x20;accepted&#x20;based&#x20;on&#x20;the&#x20;SSID&#x20;without&#x20;user&#x20;input.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Power&#x20;Nap:&#x20;sudo&#x20;pmset&#x20;-a&#x20;powernap&#x20;0','[{\"cis\": [\"2.9\"]}, {\"cis_level\": [\"1\"]}]'),(18033,'Enable&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;in&#x20;terminal.app.','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Terminal&#x20;2.&#x20;Select&#x20;Terminal&#x20;3.&#x20;Select&#x20;Secure&#x20;Keyboard&#x20;Entry.','[{\"cis\": [\"2.10\"]}, {\"cis_level\": [\"1\"]}]'),(18034,'Ensure&#x20;EFI&#x20;version&#x20;is&#x20;valid&#x20;and&#x20;being&#x20;regularly&#x20;checked.','In&#x20;order&#x20;to&#x20;mitigate&#x20;firmware&#x20;attacks&#x20;Apple&#x20;has&#x20;created&#x20;a&#x20;automated&#x20;Firmware&#x20;check&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;EFI&#x20;version&#x20;running&#x20;is&#x20;a&#x20;known&#x20;good&#x20;version&#x20;from&#x20;Apple.&#x20;There&#x20;is&#x20;also&#x20;an&#x20;automated&#x20;process&#x20;to&#x20;check&#x20;it&#x20;every&#x20;seven&#x20;days.','If&#x20;the&#x20;Firmware&#x20;of&#x20;a&#x20;computer&#x20;has&#x20;been&#x20;compromised&#x20;the&#x20;Operating&#x20;System&#x20;that&#x20;the&#x20;Firmware&#x20;loads&#x20;cannot&#x20;be&#x20;trusted&#x20;either.','','If&#x20;EFI&#x20;does&#x20;not&#x20;pass&#x20;the&#x20;integrity&#x20;check&#x20;you&#x20;may&#x20;send&#x20;a&#x20;report&#x20;to&#x20;Apple.&#x20;Backing&#x20;up&#x20;files&#x20;and&#x20;clean&#x20;installing&#x20;a&#x20;known&#x20;good&#x20;Operating&#x20;System&#x20;and&#x20;Firmware&#x20;is&#x20;recommended.','[{\"cis\": [\"2.11\"]}, {\"cis_level\": [\"1\"]}]'),(18035,'Enable&#x20;security&#x20;auditing.','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.1\"]}, {\"cis_level\": [\"1\"]}]'),(18036,'Retain&#x20;install.log&#x20;for&#x20;365&#x20;or&#x20;more&#x20;days&#x20;with&#x20;no&#x20;maximum&#x20;size.','macOS&#x20;writes&#x20;information&#x20;pertaining&#x20;to&#x20;system-related&#x20;events&#x20;to&#x20;the&#x20;file&#x20;/var/log/install.log&#x20;and&#x20;has&#x20;a&#x20;configurable&#x20;retention&#x20;policy&#x20;for&#x20;this&#x20;file.&#x20;The&#x20;default&#x20;logging&#x20;setting&#x20;limits&#x20;the&#x20;file&#x20;size&#x20;of&#x20;the&#x20;logs&#x20;and&#x20;the&#x20;maximum&#x20;size&#x20;for&#x20;all&#x20;logs.&#x20;The&#x20;default&#x20;allows&#x20;for&#x20;an&#x20;errant&#x20;application&#x20;to&#x20;fill&#x20;the&#x20;log&#x20;files&#x20;and&#x20;does&#x20;not&#x20;enforce&#x20;sufficient&#x20;log&#x20;retention.&#x20;The&#x20;Benchmark&#x20;recommends&#x20;a&#x20;value&#x20;based&#x20;on&#x20;standard&#x20;use&#x20;cases.&#x20;The&#x20;value&#x20;should&#x20;align&#x20;with&#x20;local&#x20;requirements&#x20;within&#x20;the&#x20;organization.','Archiving&#x20;and&#x20;retaining&#x20;install.log&#x20;for&#x20;at&#x20;least&#x20;a&#x20;year&#x20;is&#x20;beneficial&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;incident&#x20;as&#x20;it&#x20;will&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;view&#x20;the&#x20;various&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;along&#x20;with&#x20;the&#x20;date&#x20;and&#x20;time&#x20;they&#x20;occurred.','','Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;install&#x20;logs&#x20;are&#x20;retained&#x20;for&#x20;at&#x20;least&#x20;365&#x20;days:Edit&#x20;the&#x20;/etc/asl/com.apple.install&#x20;file&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;ttl&#x20;value&#x20;to&#x20;365&#x20;or&#x20;greater&#x20;on&#x20;the&#x20;file&#x20;line.&#x20;Also,&#x20;remove&#x20;the&#x20;all_max=&#x20;setting&#x20;and&#x20;value&#x20;from&#x20;the&#x20;file&#x20;line.','[{\"cis\": [\"3.3\"]}, {\"cis_level\": [\"1\"]}]'),(18037,'Control&#x20;access&#x20;to&#x20;audit&#x20;records.','The&#x20;audit&#x20;system&#x20;on&#x20;macOS&#x20;writes&#x20;important&#x20;operational&#x20;and&#x20;security&#x20;information&#x20;that&#x20;can&#x20;be&#x20;both&#x20;useful&#x20;for&#x20;an&#x20;attacker&#x20;and&#x20;a&#x20;place&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;attempt&#x20;to&#x20;obfuscate&#x20;unwanted&#x20;changes&#x20;that&#x20;were&#x20;recorded.&#x20;As&#x20;part&#x20;of&#x20;defense-in-depth&#x20;the&#x20;/etc/security/audit_control&#x20;configuration&#x20;and&#x20;the&#x20;files&#x20;in&#x20;/var/audit&#x20;should&#x20;be&#x20;owned&#x20;only&#x20;by&#x20;root&#x20;with&#x20;group&#x20;wheel&#x20;with&#x20;read&#x20;only&#x20;rights&#x20;and&#x20;no&#x20;other&#x20;access&#x20;allowed.&#x20;macOS&#x20;ACLs&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;these&#x20;files.','Audit&#x20;records&#x20;should&#x20;never&#x20;be&#x20;changed&#x20;except&#x20;by&#x20;the&#x20;system&#x20;daemon&#x20;posting&#x20;events.&#x20;Records&#x20;may&#x20;be&#x20;viewed&#x20;or&#x20;extracts&#x20;manipulated&#x20;but&#x20;the&#x20;authoritative&#x20;files&#x20;should&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes.','','Run&#x20;the&#x20;following&#x20;to&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;root&#x20;user&#x20;and&#x20;wheel&#x20;group:&#x20;&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/etc/security/audit_control&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/var/audit/','[{\"cis\": [\"3.5\"]}, {\"cis_level\": [\"1\"]}]'),(18038,'Ensure&#x20;Firewall&#x20;is&#x20;configured&#x20;to&#x20;log.','The&#x20;socketfilter&#x20;firewall&#x20;is&#x20;what&#x20;is&#x20;used&#x20;when&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;on&#x20;in&#x20;the&#x20;Security&#x20;PreferencePane.&#x20;In&#x20;order&#x20;to&#x20;appropriately&#x20;monitor&#x20;what&#x20;access&#x20;is&#x20;allowed&#x20;and&#x20;denied&#x20;logging&#x20;must&#x20;be&#x20;enabled.','In&#x20;order&#x20;to&#x20;troubleshoot&#x20;the&#x20;successes&#x20;and&#x20;failures&#x20;of&#x20;a&#x20;firewall&#x20;logging&#x20;should&#x20;be&#x20;enabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;logging&#x20;of&#x20;the&#x20;firewall:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setloggingmode&#x20;on','[{\"cis\": [\"3.6\"]}, {\"cis_level\": [\"1\"]}]'),(18039,'Disable&#x20;Bonjour&#x20;advertising&#x20;service.','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers..&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;stop&#x20;the&#x20;computer&#x20;from&#x20;sending&#x20;out&#x20;service&#x20;discovery&#x20;messages&#x20;when&#x20;looking&#x20;for&#x20;services&#x20;on&#x20;an&#x20;internal&#x20;subnet,&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;looking&#x20;for&#x20;a&#x20;printer&#x20;or&#x20;server&#x20;and&#x20;using&#x20;service&#x20;discovery.&#x20;To&#x20;block&#x20;all&#x20;Bonjour&#x20;traffic&#x20;except&#x20;to&#x20;approved&#x20;devices&#x20;the&#x20;pf&#x20;or&#x20;other&#x20;firewall&#x20;would&#x20;be&#x20;needed.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements&#x20;-bool&#x20;true','[{\"cis\": [\"4.1\"]}, {\"cis_level\": [\"2\"]}]'),(18040,'Ensure&#x20;http&#x20;server&#x20;is&#x20;not&#x20;running.','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.&#x20;&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;Web&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;Web&#x20;Server:&#x20;sudo&#x20;apachectl&#x20;stop&#x20;&#x20;&#x20;&#x20;Ensure&#x20;that&#x20;the&#x20;web&#x20;server&#x20;will&#x20;not&#x20;auto-start&#x20;at&#x20;boot&#x20;sudo:&#x20;defaults&#x20;write&#x20;/System/Library/LaunchDaemons/org.apache.httpd&#x20;Disabled&#x20;-&#x20;bool&#x20;true','[{\"cis\": [\"4.4\"]}, {\"cis_level\": [\"1\"]}]'),(18041,'Ensure&#x20;nfs&#x20;server&#x20;is&#x20;not&#x20;running.','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end&#x20;user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop,&#x20;dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Ensure&#x20;that&#x20;the&#x20;NFS&#x20;Server&#x20;is&#x20;not&#x20;running&#x20;and&#x20;is&#x20;not&#x20;set&#x20;to&#x20;start&#x20;at&#x20;boot&#x20;Stop&#x20;the&#x20;NFS&#x20;Server:&#x20;sudo&#x20;launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.nfsd.plist&#x20;&#x20;&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing:&#x20;sudo&#x20;rm&#x20;/etc/export','[{\"cis\": [\"4.5\"]}, {\"cis_level\": [\"1\"]}]'),(18042,'Check&#x20;System&#x20;Wide&#x20;Applications&#x20;for&#x20;appropriate&#x20;permissions.','Applications&#x20;in&#x20;the&#x20;System&#x20;Applications&#x20;Directory&#x20;&#40;/Applications&#41;&#x20;should&#x20;be&#x20;world&#x20;executable&#x20;since&#x20;that&#x20;is&#x20;their&#x20;reason&#x20;to&#x20;be&#x20;on&#x20;the&#x20;system.&#x20;They&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable&#x20;and&#x20;allow&#x20;any&#x20;process&#x20;or&#x20;user&#x20;to&#x20;alter&#x20;them&#x20;for&#x20;other&#x20;processes&#x20;or&#x20;users&#x20;to&#x20;then&#x20;execute&#x20;modified&#x20;versions','Unauthorized&#x20;modifications&#x20;of&#x20;applications&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;execution&#x20;of&#x20;malicious&#x20;code.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;permissions&#x20;for&#x20;each&#x20;application&#x20;that&#x20;does&#x20;not&#x20;meet&#x20;the&#x20;requirements:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Applications/&lt;applicationname&gt;','[{\"cis\": [\"5.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(18043,'Check&#x20;System&#x20;folder&#x20;for&#x20;world&#x20;writable&#x20;files.','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/System&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world&#x20;writable&#x20;permissions.','Folders&#x20;in&#x20;/System&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;&quot;Drop&#x20;Box&quot;&#x20;folder&#x20;that&#x20;is&#x20;part&#x20;of&#x20;Apple&#039;s&#x20;default&#x20;user&#x20;template.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/System&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Path/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.3\"]}, {\"cis_level\": [\"1\"]}]'),(18044,'Check&#x20;Library&#x20;folder&#x20;for&#x20;world&#x20;writable&#x20;files.','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/Library&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world&#x20;writable&#x20;permissions.','Folders&#x20;in&#x20;/Library&#x20;should&#x20;not&#x20;be&#x20;world&#x20;writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;/Library/Caches&#x20;folder&#x20;where&#x20;the&#x20;sticky&#x20;bit&#x20;is&#x20;set.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/Library&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Library/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.4\"]}, {\"cis_level\": [\"2\"]}]'),(18045,'Reduce&#x20;the&#x20;sudo&#x20;timeout&#x20;period.','The&#x20;sudo&#x20;command&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;run&#x20;programs&#x20;as&#x20;the&#x20;root&#x20;user.&#x20;Working&#x20;as&#x20;the&#x20;root&#x20;user&#x20;allows&#x20;the&#x20;user&#x20;an&#x20;extremely&#x20;high&#x20;level&#x20;of&#x20;configurability&#x20;within&#x20;the&#x20;system.','The&#x20;sudo&#x20;command&#x20;stays&#x20;logged&#x20;in&#x20;as&#x20;the&#x20;root&#x20;user&#x20;for&#x20;five&#x20;minutes&#x20;before&#x20;timing&#x20;out&#x20;and&#x20;re-requesting&#x20;a&#x20;password.&#x20;This&#x20;five&#x20;minute&#x20;window&#x20;should&#x20;be&#x20;eliminated&#x20;since&#x20;it&#x20;leaves&#x20;the&#x20;system&#x20;extremely&#x20;vulnerable.&#x20;This&#x20;is&#x20;especially&#x20;true&#x20;if&#x20;an&#x20;exploit&#x20;were&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;since&#x20;they&#x20;would&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;as&#x20;a&#x20;root&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo&#x20;-&gt;&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}, {\"cis_level\": [\"1\"]}]'),(18046,'Use&#x20;a&#x20;separate&#x20;timestamp&#x20;for&#x20;each&#x20;user/tty&#x20;combo.','Using&#x20;tty&#x20;tickets&#x20;ensures&#x20;that&#x20;a&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;sudo&#x20;password&#x20;in&#x20;each&#x20;Terminal&#x20;session.&#x20;With&#x20;sudo&#x20;versions&#x20;1.8&#x20;and&#x20;higher,&#x20;introduced&#x20;in&#x20;10.12,&#x20;the&#x20;default&#x20;value&#x20;is&#x20;to&#x20;have&#x20;tty&#x20;tickets&#x20;for&#x20;each&#x20;interface&#x20;so&#x20;that&#x20;root&#x20;access&#x20;is&#x20;limited&#x20;to&#x20;a&#x20;specific&#x20;terminal.&#x20;The&#x20;default&#x20;configuration&#x20;can&#x20;be&#x20;overwritten&#x20;or&#x20;not&#x20;configured&#x20;correctly&#x20;on&#x20;earlier&#x20;versions&#x20;of&#x20;macOS.','In&#x20;combination&#x20;with&#x20;removing&#x20;the&#x20;sudo&#x20;timeout&#x20;grace&#x20;period&#x20;a&#x20;further&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;background&#x20;process&#x20;using&#x20;elevated&#x20;rights&#x20;when&#x20;a&#x20;user&#x20;elevates&#x20;to&#x20;root&#x20;in&#x20;an&#x20;explicit&#x20;context&#x20;or&#x20;tty.&#x20;Additional&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;privilege&#x20;escalation&#x20;of&#x20;background&#x20;processes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo&#x20;-&gt;&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}, {\"cis_level\": [\"1\"]}]'),(18047,'Do&#x20;not&#x20;enable&#x20;the&#x20;root&#x20;account','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;Linux&#x20;distros&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;uses&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Open&#x20;System&#x20;Preferences,&#x20;Uses&#x20;&amp;&#x20;Groups.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;In&#x20;the&#x20;Network&#x20;Account&#x20;Server&#x20;section,&#x20;click&#x20;Join&#x20;or&#x20;Edit.&#x20;Click&#x20;Open&#x20;Directory&#x20;Utility.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;it.&#x20;Select&#x20;the&#x20;Edit&#x20;menu&#x20;&gt;&#x20;Disable&#x20;Root&#x20;User.&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;root&#x20;user:&#x20;sudo&#x20;dsenableroot&#x20;-d','[{\"cis\": [\"5.7\"]}, {\"cis_level\": [\"1\"]}]'),(18048,'Disable&#x20;automatic&#x20;login.','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen,&#x20;instead&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.8\"]}, {\"cis_level\": [\"1\"]}]'),(18049,'Require&#x20;an&#x20;administrator&#x20;password&#x20;to&#x20;access&#x20;system-wide&#x20;preferences.','System&#x20;Preferences&#x20;controls&#x20;system&#x20;and&#x20;user&#x20;settings&#x20;on&#x20;a&#x20;macOS&#x20;Computer.&#x20;System&#x20;Preferences&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;tailor&#x20;their&#x20;experience&#x20;on&#x20;the&#x20;computer&#x20;as&#x20;well&#x20;as&#x20;allowing&#x20;the&#x20;System&#x20;Administrator&#x20;to&#x20;configure&#x20;global&#x20;security&#x20;settings.&#x20;Some&#x20;of&#x20;the&#x20;settings&#x20;should&#x20;only&#x20;be&#x20;altered&#x20;by&#x20;the&#x20;person&#x20;responsible&#x20;for&#x20;the&#x20;computer.&#x20;','By&#x20;requiring&#x20;a&#x20;password&#x20;to&#x20;unlock&#x20;system-wide&#x20;System&#x20;Preferences&#x20;the&#x20;risk&#x20;is&#x20;mitigated&#x20;of&#x20;a&#x20;user&#x20;changing&#x20;configurations&#x20;that&#x20;affect&#x20;the&#x20;entire&#x20;system&#x20;and&#x20;requires&#x20;an&#x20;admin&#x20;user&#x20;to&#x20;re-authenticate&#x20;to&#x20;make&#x20;changes.','','Perform&#x20;the&#x20;following&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;administrator&#x20;password&#x20;is&#x20;required&#x20;to&#x20;access&#x20;system-wide&#x20;preferences:&#x20;1.&#x20;&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;&#x20;Select&#x20;General&#x20;4.&#x20;&#x20;Select&#x20;Advanced...&#x20;5.&#x20;&#x20;Set&#x20;Require&#x20;an&#x20;administrator&#x20;password&#x20;to&#x20;access&#x20;system-wide&#x20;preferences','[{\"cis\": [\"5.11\"]}, {\"cis_level\": [\"1\"]}]'),(18050,'Ensure&#x20;an&#x20;administrator&#x20;account&#x20;cannot&#x20;login&#x20;to&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session.','macOS&#x20;has&#x20;a&#x20;privilege&#x20;that&#x20;can&#x20;be&#x20;granted&#x20;to&#x20;any&#x20;user&#x20;that&#x20;will&#x20;allow&#x20;that&#x20;user&#x20;to&#x20;unlock&#x20;active&#x20;user&#039;s&#x20;sessions.','Disabling&#x20;the&#x20;admins&#x20;and/or&#x20;user&#039;s&#x20;ability&#x20;to&#x20;log&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;potentially&#x20;sensitive&#x20;and/or&#x20;personal&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;a&#x20;user&#x20;logging&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and/or&#x20;locked&#x20;session:&#x20;$&#x20;sudo&#x20;security&#x20;authorizationdb&#x20;write&#x20;system.login.screensaver&#x20;use-login-window-ui','[{\"cis\": [\"5.12\"]}, {\"cis_level\": [\"1\"]}]'),(18051,'Create&#x20;a&#x20;custom&#x20;message&#x20;for&#x20;the&#x20;Login&#x20;Screen.','An&#x20;access&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only,&#x20;and&#x20;that&#x20;the&#x20;use&#x20;of&#x20;the&#x20;system&#x20;may&#x20;be&#x20;monitored.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;a&#x20;custom&#x20;login&#x20;screen&#x20;message:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;LoginwindowText&#x20;&quot;&lt;custom.message&gt;&quot;','[{\"cis\": [\"5.13\"]}, {\"cis_level\": [\"1\"]}]'),(18052,'Create&#x20;a&#x20;Login&#x20;window&#x20;banner.','A&#x20;Login&#x20;window&#x20;banner&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only.&#x20;It&#x20;enforces&#x20;an&#x20;acknowledgment&#x20;by&#x20;the&#x20;user&#x20;that&#x20;they&#x20;have&#x20;been&#x20;informed&#x20;of&#x20;the&#x20;use&#x20;policy&#x20;in&#x20;the&#x20;banner&#x20;if&#x20;required.&#x20;The&#x20;system&#x20;recognizes&#x20;either&#x20;the&#x20;.txt&#x20;and&#x20;the&#x20;.rtf&#x20;formats.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Edit&#x20;&#40;or&#x20;create&#41;&#x20;a&#x20;PolicyBanner.txt&#x20;or&#x20;PolicyBanner.rtf&#x20;file,&#x20;in&#x20;the&#x20;/Library/Security/&#x20;folder,&#x20;to&#x20;include&#x20;the&#x20;required&#x20;login&#x20;window&#x20;banner&#x20;text.','[{\"cis\": [\"5.14\"]}, {\"cis_level\": [\"1\"]}]'),(18053,'Disable&#x20;Fast&#x20;User&#x20;Switching.','Fast&#x20;user&#x20;switching&#x20;allows&#x20;a&#x20;person&#x20;to&#x20;quickly&#x20;log&#x20;in&#x20;to&#x20;the&#x20;computer&#x20;with&#x20;a&#x20;different&#x20;account.&#x20;While&#x20;only&#x20;a&#x20;minimal&#x20;security&#x20;risk,&#x20;when&#x20;a&#x20;second&#x20;user&#x20;is&#x20;logged&#x20;in,&#x20;that&#x20;user&#x20;might&#x20;be&#x20;able&#x20;to&#x20;see&#x20;what&#x20;processes&#x20;the&#x20;first&#x20;user&#x20;is&#x20;using,&#x20;or&#x20;possibly&#x20;gain&#x20;other&#x20;information&#x20;about&#x20;the&#x20;first&#x20;user.&#x20;In&#x20;a&#x20;large&#x20;directory&#x20;environment&#x20;where&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;limit&#x20;login&#x20;access&#x20;many&#x20;valid&#x20;users&#x20;can&#x20;login&#x20;to&#x20;other&#x20;user&#039;s&#x20;assigned&#x20;computers.','Fast&#x20;user&#x20;switching&#x20;allows&#x20;multiple&#x20;users&#x20;to&#x20;run&#x20;applications&#x20;simultaneously&#x20;at&#x20;console.&#x20;There&#x20;can&#x20;be&#x20;information&#x20;disclosed&#x20;about&#x20;processes&#x20;running&#x20;under&#x20;a&#x20;different&#x20;user.&#x20;Without&#x20;a&#x20;specific&#x20;configuration&#x20;to&#x20;save&#x20;data&#x20;and&#x20;log&#x20;out&#x20;users&#x20;can&#x20;have&#x20;unsaved&#x20;data&#x20;running&#x20;in&#x20;a&#x20;background&#x20;session&#x20;that&#x20;is&#x20;not&#x20;obvious.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;fast&#x20;user&#x20;switching&#x20;off:&#x20;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/.GlobalPreferences&#x20;MultipleSessionEnabled&#x20;-bool&#x20;false','[{\"cis\": [\"5.16\"]}, {\"cis_level\": [\"2\"]}]'),(18054,'System&#x20;Integrity&#x20;Protection&#x20;status.','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;macOS&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;&#x20;&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.18\"]}, {\"cis_level\": [\"1\"]}]'),(18055,'Enable&#x20;Sealed&#x20;System&#x20;Volume&#x20;&#40;SSV&#41;.','SThe&#x20;seal&#x20;is&#x20;verified&#x20;by&#x20;the&#x20;boot&#x20;loader&#x20;at&#x20;startup.&#x20;macOS&#x20;will&#x20;not&#x20;boot&#x20;if&#x20;system&#x20;files&#x20;have&#x20;been&#x20;tampered&#x20;with.&#x20;If&#x20;validation&#x20;fails,&#x20;the&#x20;user&#x20;will&#x20;be&#x20;instructed&#x20;to&#x20;reinstall&#x20;the&#x20;operating&#x20;system.&#x20;During&#x20;read&#x20;operations&#x20;for&#x20;files&#x20;located&#x20;in&#x20;the&#x20;Sealed&#x20;System&#x20;Volume,&#x20;a&#x20;hash&#x20;is&#x20;calculated&#x20;and&#x20;compared&#x20;to&#x20;the&#x20;value&#x20;stored&#x20;in&#x20;the&#x20;Merkle&#x20;tree.','Running&#x20;without&#x20;Sealed&#x20;System&#x20;Volume&#x20;on&#x20;a&#x20;production&#x20;system&#x20;could&#x20;run&#x20;the&#x20;risk&#x20;of&#x20;Apple&#x20;software,&#x20;that&#x20;integrates&#x20;directly&#x20;with&#x20;macOS,&#x20;being&#x20;modified.&#x20;','','Perform&#x20;the&#x20;following&#x20;while&#x20;booted&#x20;in&#x20;macOS&#x20;Recovery&#x20;Partition.&#x20;&#x20;1.&#x20;Select&#x20;Terminal&#x20;from&#x20;the&#x20;Utilities&#x20;menu&#x20;&#x20;&#x20;&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;/usr/bin/csrutil&#x20;enable&#x20;authenticated-root&#x20;3.&#x20;The&#x20;output&#x20;should&#x20;be:&#x20;Successfully&#x20;enabled&#x20;System&#x20;authenticated&#x20;root.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;&#x20;&#x20;&#x20;4.&#x20;Reboot.','[{\"cis\": [\"5.19\"]}, {\"cis_level\": [\"1\"]}]'),(18056,'Enable&#x20;Library&#x20;Validation.','Library&#x20;Validation&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;macOS&#x20;10.10&#x20;Yosemite.&#x20;Library&#x20;Validation&#x20;protects&#x20;processes&#x20;from&#x20;loading&#x20;arbitrary&#x20;libraries.&#x20;This&#x20;stops&#x20;root&#x20;from&#x20;loading&#x20;arbitrary&#x20;libraries&#x20;into&#x20;any&#x20;process&#x20;&#40;depending&#x20;on&#x20;SIP&#x20;status&#41;,and&#x20;keeps&#x20;root&#x20;from&#x20;becoming&#x20;more&#x20;powerful.&#x20;Security&#x20;is&#x20;strengthened,&#x20;because&#x20;some&#x20;user&#x20;processes&#x20;can&#x20;no&#x20;longer&#x20;be&#x20;fooled&#x20;to&#x20;run&#x20;additional&#x20;code&#x20;without&#x20;root&#039;s&#x20;explicit&#x20;request,&#x20;which&#x20;may&#x20;grant&#x20;access&#x20;to&#x20;daemons&#x20;that&#x20;depend&#x20;on&#x20;LibraryValidation&#x20;for&#x20;secure&#x20;validation&#x20;of&#x20;code&#x20;identity.','Running&#x20;without&#x20;Library&#x20;Validation&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;Library&#x20;Validation.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;Library&#x20;Validation:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.security.libraryvalidation.plist&#x20;DisableLibraryValidation&#x20;DisableLibraryValidation&#x20;-bool&#x20;false','[{\"cis\": [\"5.20\"]}, {\"cis_level\": [\"1\"]}]'),(18057,'Display&#x20;login&#x20;window&#x20;as&#x20;name&#x20;and&#x20;password.','The&#x20;login&#x20;window&#x20;prompts&#x20;a&#x20;user&#x20;for&#x20;his/her&#x20;credentials,&#x20;verifies&#x20;their&#x20;authorization&#x20;level&#x20;and&#x20;then&#x20;allows&#x20;or&#x20;denies&#x20;the&#x20;user&#x20;access&#x20;to&#x20;the&#x20;system.','Prompting&#x20;the&#x20;user&#x20;to&#x20;enter&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;makes&#x20;it&#x20;twice&#x20;as&#x20;hard&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;since&#x20;they&#x20;must&#x20;discover&#x20;two&#x20;attributes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;login&#x20;window&#x20;to&#x20;display&#x20;name&#x20;and&#x20;password:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;SHOWFULLNAME&#x20;-bool&#x20;true','[{\"cis\": [\"6.1.1\"]}, {\"cis_level\": [\"1\"]}]'),(18058,'Disable&#x20;Show&#x20;password&#x20;hints.','Password&#x20;hints&#x20;are&#x20;user&#x20;created&#x20;text&#x20;displayed&#x20;when&#x20;an&#x20;incorrect&#x20;password&#x20;is&#x20;used&#x20;for&#x20;an&#x20;account.','Password&#x20;hints&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;systems&#x20;by&#x20;providing&#x20;information&#x20;to&#x20;anyone&#x20;that&#x20;the&#x20;user&#x20;provided&#x20;to&#x20;assist&#x20;remembering&#x20;the&#x20;password.&#x20;This&#x20;info&#x20;could&#x20;include&#x20;the&#x20;password&#x20;itself&#x20;or&#x20;other&#x20;information&#x20;that&#x20;might&#x20;be&#x20;readily&#x20;discerned&#x20;with&#x20;basic&#x20;knowledge&#x20;of&#x20;the&#x20;end&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;password&#x20;hints:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;RetriesUntilHint&#x20;-int&#x20;0','[{\"cis\": [\"6.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(18059,'Disable&#x20;guest&#x20;account&#x20;login.','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes,&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system&#x20;and&#x20;all&#x20;created&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;false','[{\"cis\": [\"6.1.3\"]}, {\"cis_level\": [\"1\"]}]'),(18060,'Disable&#x20;Allow&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders','Allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;enables&#x20;users&#x20;to&#x20;access&#x20;selected&#x20;shared&#x20;folders&#x20;and&#x20;their&#x20;contents&#x20;from&#x20;different&#x20;computers&#x20;on&#x20;a&#x20;network.','Not&#x20;allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;use&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-&#x20;bool&#x20;false','[{\"cis\": [\"6.1.4\"]}, {\"cis_level\": [\"1\"]}]'),(18061,'Remove&#x20;Guest&#x20;home&#x20;folder.','In&#x20;the&#x20;previous&#x20;two&#x20;controls&#x20;the&#x20;guest&#x20;account&#x20;login&#x20;has&#x20;been&#x20;disabled&#x20;and&#x20;sharing&#x20;to&#x20;guests&#x20;has&#x20;been&#x20;disabled&#x20;as&#x20;well.&#x20;There&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folders&#x20;continued&#x20;existence&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','1.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;rm&#x20;-R&#x20;/Users/Guest&#x20;&#x20;2.&#x20;Make&#x20;sure&#x20;there&#x20;is&#x20;no&#x20;output','[{\"cis\": [\"6.1.5\"]}, {\"cis_level\": [\"1\"]}]'),(18062,'Turn&#x20;on&#x20;filename&#x20;extensions.','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Select&#x20;Finder&#x20;2.&#x20;Select&#x20;Preferences&#x20;3.&#x20;Check&#x20;Show&#x20;all&#x20;filename&#x20;extensions&#x20;&#x20;&#x20;&#x20;Alternatively,&#x20;use&#x20;the&#x20;following&#x20;command:&#x20;defaults&#x20;write&#x20;NSGlobalDomain&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}, {\"cis_level\": [\"1\"]}]'),(18063,'Disable&#x20;the&#x20;automatic&#x20;run&#x20;of&#x20;safe&#x20;files&#x20;in&#x20;Safari.','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;prescribed&#x20;state:&#x20;1.&#x20;Open&#x20;Safari&#x20;2.&#x20;Select&#x20;Safari&#x20;from&#x20;the&#x20;menu&#x20;bar&#x20;3.&#x20;Select&#x20;Preferences&#x20;4.&#x20;Select&#x20;General&#x20;5.&#x20;Uncheck&#x20;Open&#x20;&quot;safe&quot;&#x20;files&#x20;after&#x20;downloading&#x20;&#x20;&#x20;&#x20;Alternatively&#x20;run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;defaults&#x20;write&#x20;com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-boolean&#x20;no&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;safe&#x20;files&#x20;from&#x20;not&#x20;opening&#x20;in&#x20;Safari:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;/Users/&lt;username&gt;/LibraryContainers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-bool&#x20;false','[{\"cis\": [\"6.3\"]}, {\"cis_level\": [\"1\"]}]'),(18069,'Ensure&#x20;AirDrop&#x20;Is&#x20;Disabled.','While&#x20;there&#x20;are&#x20;positives&#x20;to&#x20;AirDrop,&#x20;there&#x20;are&#x20;privacy&#x20;concerns&#x20;that&#x20;could&#x20;expose&#x20;personal&#x20;information.&#x20;For&#x20;that&#x20;reason,&#x20;AirDrop&#x20;should&#x20;be&#x20;disabled,&#x20;and&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;needed&#x20;and&#x20;disabled&#x20;afterwards.','AirDrop&#x20;can&#x20;allow&#x20;malicious&#x20;files&#x20;to&#x20;be&#x20;downloaded&#x20;from&#x20;unknown&#x20;sources.&#x20;Contacts&#x20;Only&#x20;limits&#x20;may&#x20;expose&#x20;personal&#x20;information&#x20;to&#x20;devices&#x20;in&#x20;the&#x20;same&#x20;area.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;AirDrop:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.NetworkBrowser&#x20;DisableAirDrop&#x20;-bool&#x20;true','[{\"cis\": [\"2.4.12\"]}, {\"cis_level\": [\"1\"]}]'),(18500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18501,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/freevxfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18502,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/jffs2.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18503,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/hfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18504,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.confExample:&#x20;vi&#x20;/etc/modprobe.d/hfsplus.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18505,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/squashfs.confand&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfsmodule:&#x20;#&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18506,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18507,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/vfat.conf:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18508,'Ensure&#x20;/tmp&#x20;is&#x20;configured.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;or&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;systemctl&#x20;enable&#x20;tmp.mount&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount:&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18509,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodevto&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18510,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuidto&#x20;the&#x20;/tmp&#x20;mount&#x20;options:[Mount]&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18511,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexecto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexecto&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;[Mount]&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18512,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18513,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18514,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18515,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18516,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18517,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18518,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18519,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18520,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18521,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18522,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18523,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2.6\", \"8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18524,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;autofs&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;autofs:&#x20;&#x20;#&#x20;apt&#x20;purge&#x20;autofs','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18525,'Disable&#x20;USB&#x20;Storage.','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/usb_storage.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;#&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;#&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\"]}]'),(18526,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Install&#x20;sudo&#x20;using&#x20;the&#x20;following&#x20;command.&#x20;#&#x20;apt&#x20;install&#x20;sudo&#x20;OR&#x20;#&#x20;apt&#x20;install&#x20;sudo-ldap','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18527,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;froma&#x20;pseudo-pty','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18528,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;&#x20;&#x20;&#x20;Example&#x20;&#x20;&#x20;&#x20;Defaults&#x20;logfile=&quot;/var/log/sudo.log&quot;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18529,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Install&#x20;AIDE:&#x20;#&#x20;apt&#x20;install&#x20;aide&#x20;aide-common.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit&#x20;.&#x20;&#x20;Notes:&#x20;The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;AIDE&#x20;because&#x20;it&#x20;alters&#x20;binaries&#x20;to&#x20;speed&#x20;up&#x20;their&#x20;start&#x20;up&#x20;times.&#x20;Run&#x20;prelink&#x20;-ua&#x20;to&#x20;restore&#x20;the&#x20;binaries&#x20;to&#x20;their&#x20;prelinked&#x20;state,&#x20;thus&#x20;avoiding&#x20;false&#x20;positives&#x20;from&#x20;AIDE.','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18530,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;cp&#x20;./config/aidecheck.service&#x20;/etc/systemd/system/aidecheck.service&#x20;&#x20;#&#x20;cp&#x20;./config/aidecheck.timer&#x20;/etc/systemd/system/aidecheck.timer&#x20;&#x20;&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;#&#x20;systemctl&#x20;reenable&#x20;aidecheck.timer&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;aidecheck.timer&#x20;&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;&#x20;&#x20;&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;&#x20;&#x20;&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18531,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg,&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18532,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2&#x20;:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;&#x20;&#x20;&#x20;&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;PBKDF2&#x20;hash&#x20;of&#x20;your&#x20;password&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;&#x20;&#x20;&#x20;&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;&#x20;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;EOF&#x20;&#x20;&#x20;&#x20;&#x20;The&#x20;superuser/user&#x20;information&#x20;and&#x20;password&#x20;should&#x20;not&#x20;be&#x20;contained&#x20;in&#x20;the&#x20;/etc/grub.d/00_header&#x20;file&#x20;as&#x20;this&#x20;file&#x20;could&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;package&#x20;update.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;requirement&#x20;to&#x20;be&#x20;able&#x20;to&#x20;boot/reboot&#x20;without&#x20;entering&#x20;the&#x20;password,&#x20;edit&#x20;/etc/grub.d/10_linux&#x20;and&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;line&#x20;CLASS=&#x20;&#x20;Example:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18533,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18534,'Ensure&#x20;interactive&#x20;boot&#x20;is&#x20;not&#x20;enabled.','Interactive&#x20;boot&#x20;allows&#x20;console&#x20;users&#x20;to&#x20;interactively&#x20;select&#x20;which&#x20;services&#x20;start&#x20;on&#x20;boot.&#x20;Not&#x20;all&#x20;distributions&#x20;support&#x20;this&#x20;capability.The&#x20;PROMPT_FOR_CONFIRM&#x20;option&#x20;provides&#x20;console&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;interactively&#x20;boot&#x20;the&#x20;system&#x20;and&#x20;select&#x20;which&#x20;services&#x20;to&#x20;start&#x20;on&#x20;boot&#x20;.','&#x20;Turn&#x20;off&#x20;the&#x20;PROMPT_FOR_CONFIRMoption&#x20;on&#x20;the&#x20;console&#x20;to&#x20;prevent&#x20;console&#x20;users&#x20;from&#x20;potentially&#x20;overriding&#x20;established&#x20;security&#x20;settings.','','If&#x20;interactive&#x20;boot&#x20;is&#x20;available&#x20;disable&#x20;it.','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18535,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18536,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18537,'Ensure&#x20;prelink&#x20;is&#x20;disabled.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;Uninstall&#x20;prelink&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;purge&#x20;prelink','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18538,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.6.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18539,'Ensure&#x20;AppArmor&#x20;is&#x20;installed.','AppArmor&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Install&#x20;Apparmor.&#x20;#&#x20;apt&#x20;install&#x20;apparmor&#x20;#&#x20;apt&#x20;install&#x20;apparmor-utils','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18540,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration.','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwrittenby&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;apparmor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration&#x20;#&#x20;update-grub&#x20;&#x20;&#x20;&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18541,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;in&#x20;enforce&#x20;or&#x20;complain&#x20;mode.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;complain&#x20;mode:&#x20;#&#x20;aa-complain&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18542,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18543,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;OR&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(18544,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;,&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(18545,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(18546,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/motd','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18547,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18548,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue.net','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18549,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured.','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add:&#x20;[org/gnome/login-screen],&#x20;banner-message-enable=true,&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;','[{\"cis\": [\"1.8.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18550,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Notes:&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.','[{\"cis\": [\"1.9\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(18551,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed.','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetddaemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;apt&#x20;purge&#x20;xinetd','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18552,'Ensure&#x20;openbsd-inetd&#x20;is&#x20;not&#x20;installed.','The&#x20;inetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;inetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openbsd-inetd:&#x20;apt-get&#x20;remove&#x20;openbsd-inetd','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18553,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available,&#x20;configure&#x20;systemd-timesyncd.&#x20;If&#x20;&quot;full&#x20;featured&quot;&#x20;and/or&#x20;encrypted&#x20;time&#x20;synchronization&#x20;is&#x20;required,&#x20;install&#x20;chrony&#x20;or&#x20;NTP.&#x20;To&#x20;install&#x20;chrony:&#x20;#&#x20;apt&#x20;install&#x20;chrony&#x20;To&#x20;install&#x20;ntp:&#x20;#&#x20;apt&#x20;install&#x20;ntp&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18554,'Ensure&#x20;systemd-timesyncd&#x20;is&#x20;configured.','systemd-timesyncd&#x20;is&#x20;a&#x20;daemon&#x20;that&#x20;has&#x20;been&#x20;added&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.&#x20;It&#x20;implements&#x20;an&#x20;SNTP&#x20;client.&#x20;In&#x20;contrast&#x20;to&#x20;NTP&#x20;implementations&#x20;such&#x20;as&#x20;chrony&#x20;or&#x20;the&#x20;NTP&#x20;reference&#x20;server&#x20;this&#x20;only&#x20;implements&#x20;a&#x20;client&#x20;side,&#x20;and&#x20;does&#x20;not&#x20;bother&#x20;with&#x20;the&#x20;full&#x20;NTP&#x20;complexity,&#x20;focusing&#x20;only&#x20;on&#x20;querying&#x20;time&#x20;from&#x20;one&#x20;remote&#x20;server&#x20;and&#x20;synchronizing&#x20;the&#x20;local&#x20;clock&#x20;to&#x20;it.&#x20;The&#x20;daemon&#x20;runs&#x20;with&#x20;minimal&#x20;privileges,&#x20;and&#x20;has&#x20;been&#x20;hooked&#x20;up&#x20;with&#x20;networkd&#x20;to&#x20;only&#x20;operate&#x20;when&#x20;network&#x20;connectivity&#x20;is&#x20;available.&#x20;The&#x20;daemon&#x20;saves&#x20;the&#x20;current&#x20;clock&#x20;to&#x20;disk&#x20;every&#x20;time&#x20;a&#x20;new&#x20;NTP&#x20;sync&#x20;has&#x20;been&#x20;acquired,&#x20;and&#x20;uses&#x20;this&#x20;to&#x20;possibly&#x20;correct&#x20;the&#x20;system&#x20;clock&#x20;early&#x20;at&#x20;bootup,&#x20;in&#x20;order&#x20;to&#x20;accommodate&#x20;for&#x20;systems&#x20;that&#x20;lack&#x20;an&#x20;RTC&#x20;such&#x20;as&#x20;the&#x20;Raspberry&#x20;Pi&#x20;and&#x20;embedded&#x20;devices,&#x20;and&#x20;make&#x20;sure&#x20;that&#x20;time&#x20;monotonically&#x20;progresses&#x20;on&#x20;these&#x20;systems,&#x20;even&#x20;if&#x20;it&#x20;is&#x20;not&#x20;always&#x20;correct.&#x20;To&#x20;make&#x20;use&#x20;of&#x20;this&#x20;daemon&#x20;a&#x20;new&#x20;system&#x20;user&#x20;and&#x20;group&#x20;&quot;systemd-&#x20;timesync&quot;&#x20;needs&#x20;to&#x20;be&#x20;created&#x20;on&#x20;installation&#x20;of&#x20;systemd.&#x20;Note:&#x20;The&#x20;systemd-timesyncd&#x20;service&#x20;specifically&#x20;implements&#x20;only&#x20;SNTP.&#x20;This&#x20;minimalistic&#x20;service&#x20;will&#x20;set&#x20;the&#x20;system&#x20;clock&#x20;for&#x20;large&#x20;offsets&#x20;or&#x20;slowly&#x20;adjust&#x20;it&#x20;for&#x20;smaller&#x20;deltas.&#x20;More&#x20;complex&#x20;use&#x20;cases&#x20;are&#x20;not&#x20;covered&#x20;by&#x20;systemd-timesyncd.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','Proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;systemd-timesyncd&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;systemd-timesyncd.service&#x20;&#x20;||&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/systemd/timesyncd.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy:&#x20;&#x20;&#x20;&#x20;&#40;1&#41;&#x20;NTP=0.ubuntu.pool.ntp.org&#x20;1.ubuntu.pool.ntp.org&#x20;2.ubuntu.pool.ntp.org&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#40;2&#41;&#x20;FallbackNTP=ntp.ubuntu.com&#x20;3.ubuntu.pool.ntp.org&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#40;3&#41;&#x20;RootDistanceMaxSec=1&#x20;&#x20;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;start&#x20;systemd-timesyncd.service&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;start&#x20;systemd-timesyncd.service&#x20;&#x20;&#x20;#&#x20;timedatectl&#x20;set-ntp&#x20;true&#x20;&#x20;||&#x20;Notes:&#x20;Servers&#x20;listed&#x20;and&#x20;RootDistanceMax&#x20;should&#x20;be&#x20;In&#x20;Accordance&#x20;With&#x20;Local&#x20;Policy&#x20;some&#x20;versions&#x20;of&#x20;systemd&#x20;have&#x20;been&#x20;compiled&#x20;without&#x20;systemd-timesycnd.&#x20;On&#x20;these&#x20;distributions,&#x20;chrony&#x20;or&#x20;NTP&#x20;should&#x20;be&#x20;used&#x20;instead&#x20;of&#x20;systemd-timesycnd.&#x20;Not&#x20;all&#x20;options&#x20;are&#x20;available&#x20;on&#x20;all&#x20;versions&#x20;of&#x20;systemd-timesyncd','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18555,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;chrony&#x20;to&#x20;run&#x20;as&#x20;the&#x20;chrony&#x20;user&#x20;by&#x20;configuring&#x20;the&#x20;appropriate&#x20;startup&#x20;script&#x20;for&#x20;your&#x20;distribution.&#x20;Startup&#x20;scripts&#x20;are&#x20;typically&#x20;stored&#x20;in&#x20;/etc/init.d&#x20;or&#x20;/etc/systemd&#x20;.','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18556,'Ensure&#x20;ntp&#x20;is&#x20;configured.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;RUNASUSER=ntp','[{\"cis\": [\"2.2.1.4\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18557,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt&#x20;purge&#x20;xserver-xorg*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(18558,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attach&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18559,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18560,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;isc-dhcp-server&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;isc-dhcp-server6','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18561,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18562,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;nfs-server&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18563,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;bind9','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18564,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18565,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;apache2','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18566,'Ensure&#x20;email&#x20;services&#x20;are&#x20;not&#x20;enabled.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;mail&#x20;submission&#x20;and&#x20;transport&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;mail&#x20;transport&#x20;services&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;or&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dovecot&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;dovecot','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18567,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smbd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;smbd','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18568,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18569,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18570,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;thefollowing&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;&#x20;&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;&#x20;&#x20;Restart&#x20;postfix:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(18571,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;rsync','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(18572,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;nis:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;nis','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18573,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;nis&#x20;:&#x20;apt&#x20;purge&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18574,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh-client&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Uninstall&#x20;rsh&#x20;:&#x20;apt&#x20;remove&#x20;rsh-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18575,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talkclient,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Uninstall&#x20;talk&#x20;:&#x20;apt&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18576,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Uninstall&#x20;telnet&#x20;:&#x20;#&#x20;apt&#x20;purge&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18577,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Uninstall&#x20;ldap-utils&#x20;:&#x20;#&#x20;apt&#x20;purge&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18578,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled.','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18579,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.ip_forwards*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv6.conf.all.forwardings*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv6.conf.all.forwardings*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18580,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted.','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0&#x20;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18581,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18582,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18583,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18584,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored.','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18585,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18586,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18587,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled.','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18588,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18589,'Install&#x20;TCP&#x20;Wrappers.','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Install&#x20;tcpd&#x20;:&#x20;#&#x20;apt-get&#x20;install&#x20;tcpd&#x20;To&#x20;verify&#x20;if&#x20;a&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;ldd&#x20;&lt;path-to-daemon&gt;&#x20;|&#x20;grep&#x20;libwrap.so&#x20;If&#x20;there&#x20;is&#x20;any&#x20;output,&#x20;then&#x20;the&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers.','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(18590,'Ensure&#x20;/etc/hosts.allow&#x20;is&#x20;configured.','The&#x20;/etc/hosts.allow&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.deny&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;/etc/hosts.allow.&#x20;Where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#x20;&#40;for&#x20;example,&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;represents&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(18591,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured.','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.deny&#x20;file&#x20;serves&#x20;as&#x20;a&#x20;failsafe&#x20;so&#x20;that&#x20;any&#x20;host&#x20;not&#x20;specified&#x20;in&#x20;/etc/hosts.allow&#x20;is&#x20;denied&#x20;access&#x20;to&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(18592,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;are&#x20;configured.','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18593,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;are&#x20;configured.','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18594,'Ensure&#x20;DCCP&#x20;is&#x20;disabled.','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-&#x20;sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18595,'Ensure&#x20;SCTP&#x20;is&#x20;disabled.','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18596,'Ensure&#x20;RDS&#x20;is&#x20;disabled.','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18597,'Ensure&#x20;TIPC&#x20;is&#x20;disabled.','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18598,'Ensure&#x20;a&#x20;Firewall&#x20;package&#x20;is&#x20;installed.','A&#x20;Firewall&#x20;package&#x20;should&#x20;be&#x20;selected.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;nftables&#x20;or&#x20;iptables.','A&#x20;Firewall&#x20;package&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;the&#x20;Firewall&#x20;package&#x20;that&#x20;follows&#x20;local&#x20;site&#x20;policy:&#x20;To&#x20;install&#x20;UFW&#x20;,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;apt&#x20;install&#x20;ufw&#x20;To&#x20;install&#x20;nftables&#x20;,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;apt&#x20;install&#x20;nftables&#x20;To&#x20;install&#x20;iptables&#x20;,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;apt&#x20;install&#x20;iptables','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18599,'Ensure&#x20;ufw&#x20;service&#x20;is&#x20;enabled.','UncomplicatedFirewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;and&#x20;available&#x20;graphical&#x20;user&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.&#x20;Ensure&#x20;that&#x20;the&#x20;ufw&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;protect&#x20;your&#x20;system.','The&#x20;ufw&#x20;service&#x20;must&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;for&#x20;ufw&#x20;to&#x20;protect&#x20;the&#x20;system','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;ufw:&#x20;#&#x20;ufw&#x20;enable','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(18600,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;deny&#x20;policy:&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;incoming&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;outgoing&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;routed','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(18601,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ufw&#x20;allow&#x20;in&#x20;on&#x20;lo&#x20;&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;127.0.0.0/8&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;::1','[{\"cis\": [\"3.5.2.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(18602,'Ensure&#x20;a&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;.Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.5.3.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18603,'Ensure&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.5.3.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18604,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept&#x20;,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;.&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;;&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;and&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.5.3.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18605,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled.','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.3.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18606,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.4.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18607,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.4.1.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18608,'Ensure&#x20;IPv6&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.5.4.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(18609,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.4.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(18610,'Ensure&#x20;wireless&#x20;interfaces&#x20;are&#x20;disabled.','Wireless&#x20;networking&#x20;is&#x20;used&#x20;when&#x20;wired&#x20;networks&#x20;are&#x20;unavailable.&#x20;Ubuntu&#x20;contains&#x20;a&#x20;wireless&#x20;tool&#x20;kit&#x20;to&#x20;allow&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;and&#x20;use&#x20;wireless&#x20;networks.','If&#x20;wireless&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;wireless&#x20;devices&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;any&#x20;wireless&#x20;interfaces:&#x20;#&#x20;nmcli&#x20;radio&#x20;all&#x20;off','[{\"cis\": [\"3.6\"]}, {\"cis_csc\": [\"15.4\", \"15.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.6\"]}]'),(18611,'Disable&#x20;IPv6.','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"3.7\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.6\", \"CC5.2\"]}]'),(18612,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;apt&#x20;install&#x20;auditd&#x20;audispd-plugins','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18613,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled.','Enable&#x20;and&#x20;start&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18614,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"nist_800_53\": [\"AU.2\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18615,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Notes:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18616,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18617,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(18618,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-&#x20;change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]');
INSERT INTO `tsca` VALUES (18619,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18620,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-&#x20;login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/sysconfig/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/system-locale.rules&#x20;&#x20;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18621,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;AppArmor&#x20;mandatory&#x20;access&#x20;control.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','On&#x20;systems&#x20;using&#x20;AppArmor&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;|&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18622,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18623,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;|&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18624,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18625,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/directory&#x20;ending&#x20;in&#x20;.rules&#x20;&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/audit.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;|&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/access.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;|&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;|&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;|&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;toset&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18626,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18627,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"6.2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(18628,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;|&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(18629,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;&lt;Path&#x20;to&#x20;sudo&#x20;logfile&gt;&#x20;-p&#x20;wa&#x20;-k&#x20;actions.&#x20;Notes:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;sudisabled&#x20;&#40;See&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18630,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(18631,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line:&#x20;-e&#x20;2.&#x20;Notes:&#x20;This&#x20;setting&#x20;will&#x20;ensure&#x20;reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18632,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslogsuch&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog:&#x20;#&#x20;apt&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18633,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18634,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(18635,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;one&#x20;of&#x20;the&#x20;following&#x20;lines:&#x20;Newer&#x20;syntax:&#x20;&lt;files&#x20;to&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;log&#x20;server&gt;&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;&lt;FQDN&#x20;or&#x20;ip&#x20;of&#x20;loghost&gt;&quot;&#x20;port=&quot;&lt;port&#x20;number&gt;&quot;&#x20;protocol=&quot;tcp&quot;&#x20;ction.resumeRetryCount=&quot;&lt;number&#x20;of&#x20;re-tries&gt;&quot;&#x20;&#x20;queue.type=&quot;linkList&quot;&#x20;queue.size=&lt;number&#x20;of&#x20;messages&#x20;to&#x20;queue&gt;&quot;&#41;&#x20;Example:&#x20;*.*&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;192.168.2.100&quot;&#x20;port&quot;514&quot;&#x20;protocol=&quot;tcp&quot;&#x20;action.resumeRetryCount=&quot;100&quot;&#x20;queue.type=&quot;linkList&quot;&#x20;queue.size=&quot;1000&quot;&#41;&#x20;Older&#x20;syntax:&#x20;*.*&#x20;@@&lt;FQDN&#x20;or&#x20;ip&#x20;of&#x20;loghost&gt;','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18636,'Ensure&#x20;remote&#x20;rsyslog&#x20;messages&#x20;are&#x20;only&#x20;accepted&#x20;on&#x20;designated&#x20;log&#x20;hosts.','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;$ModLoad&#x20;imtcp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;$InputTCPServerRun&#x20;514.&#x20;For&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;comment&#x20;or&#x20;remove&#x20;the&#x20;following&#x20;lines:&#x20;#&#x20;$ModLoad&#x20;imtcp&#x20;#&#x20;$InputTCPServerRun&#x20;514.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"10.5.1\"]}]'),(18637,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(18638,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18639,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#x20;&#x20;Storage=persistent','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.7\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18640,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured.','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitivebdata&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;&quot;{}&quot;&#x20;+&#x20;-o&#x20;-type&#x20;d&#x20;-exec&#x20;chmod&#x20;g-w,o-rwx&#x20;&quot;{}&quot;&#x20;+','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC7.2\"]}]'),(18641,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron:&#x20;systemctl&#x20;--now&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18642,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(18643,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18644,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18645,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18646,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18647,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18648,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18649,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-&#x20;privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18650,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;0600&#x20;{}&#x20;;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18651,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;public&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;0644&#x20;{}&#x20;;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18652,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;not&#x20;set&#x20;to&#x20;1.','Older&#x20;versions&#x20;of&#x20;SSH&#x20;support&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.&#x20;Notes:&#x20;This&#x20;command&#x20;not&#x20;longer&#x20;exists&#x20;in&#x20;newer&#x20;versions&#x20;of&#x20;SSH.&#x20;This&#x20;check&#x20;is&#x20;still&#x20;being&#x20;included&#x20;for&#x20;systems&#x20;that&#x20;may&#x20;be&#x20;running&#x20;an&#x20;older&#x20;version&#x20;of&#x20;SSH.&#x20;As&#x20;of&#x20;openSSH&#x20;version&#x20;7.4&#x20;this&#x20;parameter&#x20;will&#x20;not&#x20;cause&#x20;an&#x20;issue&#x20;when&#x20;included.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"4.5\", \"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(18653,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;or&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(18654,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18655,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18656,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhostsand&#x20;.shostsfiles&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthenticationor&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(18657,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(18658,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(18659,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(18660,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(18661,'Ensure&#x20;only&#x20;strong&#x20;ciphers&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involving&#x20;LSB&#x20;values,&#x20;aka&#x20;the&#x20;&quot;Bar&#x20;Mitzvah&quot;&#x20;issue&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(18662,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(18663,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(18664,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(18665,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18666,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18667,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18668,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18669,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(18670,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;maxstartups&#x20;10:30:60','[{\"cis\": [\"5.2.22\"]}, {\"cis_csc\": [\"5.1\"]}]'),(18671,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;4','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18672,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options:&#x20;-&#x20;retry=3&#x20;&#40;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure&#41;.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#40;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#41;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt&#x20;install&#x20;libpam-pwquality&#x20;2&#41;&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3&#x20;3&#41;&#x20;Edit&#x20;/etc/security/pwquality.conf&#x20;to&#x20;add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;settings&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;requirements&#x20;only&#x20;cover&#x20;including&#x20;try_first_pass&#x20;and&#x20;minlen&#x20;set&#x20;to&#x20;14&#x20;or&#x20;more.&#x20;Settings&#x20;in&#x20;/etc/security/pwquality.conf&#x20;must&#x20;use&#x20;spaces&#x20;around&#x20;the&#x20;=&#x20;symbol.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18673,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured.','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900.&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;and&#x20;add&#x20;the&#x20;account&#x20;lines&#x20;below:&#x20;account&#x20;&#x20;&#x20;&#x20;requisite&#x20;&#x20;&#x20;&#x20;pam_deny.so&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;account&#x20;&#x20;&#x20;&#x20;required&#x20;&#x20;&#x20;&#x20;pam_tally2.so.&#x20;Note:&#x20;If&#x20;a&#x20;user&#x20;has&#x20;been&#x20;locked&#x20;out&#x20;because&#x20;they&#x20;have&#x20;reached&#x20;the&#x20;maximum&#x20;consecutive&#x20;failure&#x20;count&#x20;defined&#x20;by&#x20;deny=&#x20;in&#x20;the&#x20;pam_tally2.so&#x20;module,&#x20;the&#x20;user&#x20;can&#x20;be&#x20;unlocked&#x20;by&#x20;issuing&#x20;the&#x20;command&#x20;/sbin/pam_tally2&#x20;-u&#x20;&lt;username&gt;&#x20;--reset.&#x20;This&#x20;command&#x20;sets&#x20;the&#x20;failed&#x20;count&#x20;to&#x20;0,&#x20;effectively&#x20;unlocking&#x20;the&#x20;user.&#x20;Notes:BUG&#x20;In&#x20;pam_tally2.so&#x20;To&#x20;work&#x20;around&#x20;this&#x20;issue&#x20;the&#x20;addition&#x20;of&#x20;pam_tally2.so&#x20;in&#x20;the&#x20;accounts&#x20;section&#x20;of&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;audit&#x20;and&#x20;remediation&#x20;sections.&#x20;pam_tally2&#x20;line&#x20;must&#x20;be&#x20;added&#x20;for&#x20;the&#x20;counter&#x20;to&#x20;reset&#x20;to&#x20;0&#x20;when&#x20;using&#x20;sudo.&#x20;&#x20;&#x20;&#x20;&#x20;Use&#x20;of&#x20;the&#x20;&quot;audit&quot;&#x20;keyword&#x20;may&#x20;log&#x20;credentials&#x20;in&#x20;the&#x20;case&#x20;of&#x20;user&#x20;error&#x20;during&#x20;authentication.&#x20;This&#x20;risk&#x20;should&#x20;be&#x20;evaluated&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;site&#x20;policies&#x20;of&#x20;your&#x20;organization.','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18674,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18675,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.14\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(18676,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;5th&#x20;field&#x20;should&#x20;be&#x20;365&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;will&#x20;disable&#x20;password&#x20;expiration.&#x20;Additionally&#x20;the&#x20;password&#x20;expiration&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;the&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;or&#x20;users&#x20;will&#x20;be&#x20;unable&#x20;to&#x20;change&#x20;their&#x20;password.','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18677,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;4th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18678,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;6th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18679,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;7th&#x20;field&#x20;should&#x20;be&#x20;30&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;would&#x20;disable&#x20;this&#x20;setting.','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18680,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18681,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive.','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18682,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less.','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;readonly&#x20;TMOUT=900&#x20;;&#x20;export&#x20;TMOUT&#x20;.&#x20;Note&#x20;that&#x20;setting&#x20;the&#x20;value&#x20;to&#x20;readonly&#x20;prevents&#x20;unwanted&#x20;modification&#x20;during&#x20;runtime.','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(18683,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;sudo&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Create&#x20;an&#x20;empty&#x20;group&#x20;that&#x20;will&#x20;be&#x20;specified&#x20;for&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command.&#x20;The&#x20;group&#x20;should&#x20;be&#x20;named&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example&#x20;#&#x20;groupadd&#x20;sugroup&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file,&#x20;specifying&#x20;the&#x20;empty&#x20;group:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;group=sugroup','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(18684,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18685,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18686,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;one&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18687,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18688,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18689,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18690,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18691,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(18692,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;&lt;username&gt;&lt;/em&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(18693,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18694,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.9\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18695,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(18696,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(18697,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty.','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"6.2.20\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(19000,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/cramfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19001,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/freevxfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs.','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19002,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/jffs2.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2.','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19003,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/hfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs.','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19004,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/hfsplus.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus.','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19005,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','Disabling&#x20;squashfs&#x20;will&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;snap.&#x20;Snap&#x20;is&#x20;a&#x20;package&#x20;manager&#x20;for&#x20;Linux&#x20;for&#x20;installing&#x20;Snap&#x20;packages.&#x20;&quot;Snap&quot;&#x20;application&#x20;packages&#x20;of&#x20;software&#x20;are&#x20;self-contained&#x20;and&#x20;work&#x20;across&#x20;a&#x20;range&#x20;of&#x20;Linux&#x20;distributions.&#x20;This&#x20;is&#x20;unlike&#x20;traditional&#x20;Linux&#x20;package&#x20;management&#x20;approaches,&#x20;like&#x20;APT&#x20;or&#x20;RPM,&#x20;which&#x20;require&#x20;specifically&#x20;adapted&#x20;packages&#x20;per&#x20;Linux&#x20;distribution&#x20;on&#x20;an&#x20;application&#x20;update&#x20;and&#x20;delay&#x20;therefore&#x20;application&#x20;deployment&#x20;from&#x20;developers&#x20;to&#x20;their&#x20;software&#039;s&#x20;end-user.&#x20;Snaps&#x20;themselves&#x20;have&#x20;no&#x20;dependency&#x20;on&#x20;any&#x20;external&#x20;store&#x20;&#40;&quot;App&#x20;store&quot;&#41;,&#x20;can&#x20;be&#x20;obtained&#x20;from&#x20;any&#x20;source&#x20;and&#x20;can&#x20;be&#x20;therefore&#x20;used&#x20;for&#x20;upstream&#x20;software&#x20;deployment.&#x20;When&#x20;snaps&#x20;are&#x20;deployed&#x20;on&#x20;versions&#x20;of&#x20;Linux,&#x20;the&#x20;Ubuntu&#x20;app&#x20;store&#x20;is&#x20;used&#x20;as&#x20;default&#x20;back-end,&#x20;but&#x20;other&#x20;stores&#x20;can&#x20;be&#x20;enabled&#x20;as&#x20;well.','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/squashfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;#&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19006,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19007,'Ensure&#x20;/tmp&#x20;is&#x20;configured.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;Running&#x20;out&#x20;of&#x20;/tmp&#x20;space&#x20;is&#x20;a&#x20;problem&#x20;regardless&#x20;of&#x20;what&#x20;kind&#x20;of&#x20;filesystem&#x20;lies&#x20;under&#x20;it,&#x20;but&#x20;in&#x20;a&#x20;default&#x20;installation&#x20;a&#x20;disk-based&#x20;/tmp&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available,&#x20;as&#x20;it&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;On&#x20;the&#x20;other&#x20;hand,&#x20;a&#x20;RAM-based&#x20;/tmp&#x20;as&#x20;with&#x20;tmpfs&#x20;will&#x20;almost&#x20;certainly&#x20;be&#x20;much&#x20;smaller,&#x20;which&#x20;can&#x20;lead&#x20;to&#x20;applications&#x20;filling&#x20;up&#x20;the&#x20;filesystem&#x20;much&#x20;more&#x20;easily.&#x20;/tmp&#x20;utilizing&#x20;tmpfs&#x20;can&#x20;be&#x20;resized&#x20;using&#x20;the&#x20;size={size}&#x20;parameter&#x20;on&#x20;the&#x20;Options&#x20;line&#x20;on&#x20;the&#x20;tmp.mount&#x20;file.','Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0.&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;systemd&#x20;/tmp&#x20;mounting:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;tmp.mount&#x20;file&#x20;in&#x20;the&#x20;correct&#x20;location:&#x20;#&#x20;cp&#x20;-v&#x20;/usr/share/systemd/tmp.mount&#x20;/etc/systemd/system/.&#x20;Edit&#x20;/etc/systemd/system/tmp.mount&#x20;to&#x20;configure&#x20;the&#x20;/tmp&#x20;mount:&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs&#x20;Options=mode=1777,strictatime,nosuid,nodev,noexec.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;systemd&#x20;daemon&#x20;with&#x20;the&#x20;unpdated&#x20;tmp.mount&#x20;unit&#x20;file:&#x20;#&#x20;systemctl&#x20;daemon-reload.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;tmp.mount&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;tmp.mount.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19008,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;If&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp.&#x20;OR&#x20;If&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;systemctl&#x20;daemon-reload.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount.','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19009,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;OR&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19010,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp.&#x20;OR&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp.','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19011,'Ensure&#x20;/dev/shm&#x20;is&#x20;configured.','/dev/shm&#x20;is&#x20;a&#x20;traditional&#x20;shared&#x20;memory&#x20;concept.&#x20;One&#x20;program&#x20;will&#x20;create&#x20;a&#x20;memory&#x20;portion,&#x20;which&#x20;other&#x20;processes&#x20;&#40;if&#x20;permitted&#41;&#x20;can&#x20;access.&#x20;Mounting&#x20;tmpfs&#x20;at&#x20;/dev/shm&#x20;is&#x20;handled&#x20;automatically&#x20;by&#x20;systemd.','Any&#x20;user&#x20;can&#x20;upload&#x20;and&#x20;execute&#x20;files&#x20;inside&#x20;the&#x20;/dev/shm&#x20;similar&#x20;to&#x20;the&#x20;/tmp&#x20;partition.&#x20;Configuring&#x20;/dev/shm&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/dev/shm&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Edit&#x20;/etc/fstab&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line:&#x20;tmpfs&#x20;/dev/shm&#x20;tmpfs&#x20;defaults,noexec,nodev,nosuid,seclabel&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc_v7\": [\"5.1\", \"13\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19012,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid,nodev,noexec&#x20;/dev/shm.','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19013,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid,nodev,noexec&#x20;/dev/shm.','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19014,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid,nodev,noexec&#x20;/dev/shm.','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19015,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19016,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19017,'Ensure&#x20;/var/tmp&#x20;partition&#x20;includes&#x20;the&#x20;nodev&#x20;option.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid,nodev,noexec&#x20;/var/tmp.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19018,'Ensure&#x20;/var/tmp&#x20;partition&#x20;includes&#x20;the&#x20;nosuid&#x20;option.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid,nodev,noexec&#x20;/var/tmp.','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19019,'Ensure&#x20;/var/tmp&#x20;partition&#x20;includes&#x20;the&#x20;noexec&#x20;option.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid,nodev,noexec&#x20;/var/tmp.','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19020,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-4\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}]'),(19021,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-4\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}]'),(19022,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19023,'Ensure&#x20;/home&#x20;partition&#x20;includes&#x20;the&#x20;nodev&#x20;option.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.18\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19024,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','The&#x20;use&#x20;of&#x20;portable&#x20;hard&#x20;drives&#x20;is&#x20;very&#x20;common&#x20;for&#x20;workstation&#x20;users.&#x20;If&#x20;your&#x20;organization&#x20;allows&#x20;the&#x20;use&#x20;of&#x20;portable&#x20;storage&#x20;or&#x20;media&#x20;on&#x20;workstations&#x20;and&#x20;physical&#x20;access&#x20;controls&#x20;to&#x20;workstations&#x20;is&#x20;considered&#x20;adequate&#x20;there&#x20;is&#x20;little&#x20;value&#x20;add&#x20;in&#x20;turning&#x20;off&#x20;automounting.','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;autofs&#x20;OR&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;autofs:&#x20;#&#x20;apt&#x20;purge&#x20;autofs','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc_v7\": [\"8.4\", \"8.5\"]}, {\"cmmc_v2.0\": [\"SI.1.213\"]}, {\"iso_27001-2013\": [\"A.12.2.1\"]}, {\"mitre_techniques\": [\"T1215\", \"T1027\", \"T1045\", \"T1193\", \"T1194\", \"T1221\", \"T1200\", \"T1091\"]}, {\"nist_sp_800-53\": [\"SI-3\"]}]'),(19025,'Disable&#x20;USB&#x20;Storage.','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.&#x20;Note:&#x20;An&#x20;alternative&#x20;solution&#x20;to&#x20;disabling&#x20;the&#x20;usb-storage&#x20;module&#x20;may&#x20;be&#x20;found&#x20;in&#x20;USBGuard.&#x20;Use&#x20;of&#x20;USBGuard&#x20;and&#x20;construction&#x20;of&#x20;USB&#x20;device&#x20;policies&#x20;should&#x20;be&#x20;done&#x20;in&#x20;alignment&#x20;with&#x20;site&#x20;policy.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/usb_storage.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;usb-storage&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.24\"]}, {\"cis_csc_v7\": [\"8.4\", \"8.5\"]}, {\"cmmc_v2.0\": [\"SI.1.213\"]}, {\"iso_27001-2013\": [\"A.12.2.1\"]}, {\"mitre_techniques\": [\"T1215\", \"T1027\", \"T1045\", \"T1193\", \"T1194\", \"T1221\", \"T1200\", \"T1091\"]}, {\"nist_sp_800-53\": [\"SI-3\"]}]'),(19026,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Install&#x20;AIDE&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;install&#x20;aide&#x20;aide-common&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;initialize&#x20;AIDE:&#x20;#&#x20;aideinit&#x20;#&#x20;mv&#x20;/var/lib/aide/aide.db.new&#x20;/var/lib/aide/aide.db','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AU.3.050\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.1\", \"11.5\"]}]'),(19027,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check&#x20;OR&#x20;If&#x20;aidecheck.service&#x20;and&#x20;aidecheck.timer&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.service&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;[Unit]&#x20;Description=Aide&#x20;Check&#x20;[Service]&#x20;Type=simple&#x20;ExecStart=/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check&#x20;[Install]&#x20;WantedBy=multi-user.target&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.timer&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;[Unit]&#x20;Description=Aide&#x20;check&#x20;every&#x20;day&#x20;at&#x20;5AM&#x20;[Timer]&#x20;OnCalendar=*-*-*&#x20;05:00:00&#x20;Unit=aidecheck.service&#x20;[Install]&#x20;WantedBy=multi-user.target&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/systemd/system/aidecheck.*&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;#&#x20;systemctl&#x20;enable&#x20;aidecheck.service&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;aidecheck.timer','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AU.3.050\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.1\", \"11.5\"]}]'),(19028,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;not&#x20;overridden.','The&#x20;permissions&#x20;on&#x20;/boot/grub/grub.cfg&#x20;are&#x20;changed&#x20;to&#x20;444&#x20;when&#x20;gub.cfg&#x20;is&#x20;updated&#x20;by&#x20;the&#x20;update-grub&#x20;command.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;chmod&#x20;444&#x20;to&#x20;chmod&#x20;400&#x20;in&#x20;/usr/sbin/grub-&#x20;mkconfig:&#x20;#&#x20;sed&#x20;-ri&#x20;&#039;s/chmods+[0-7][0-7][0-7]s+${grub_cfg}.new/chmod&#x20;400&#x20;${grub_cfg}.new/&#039;&#x20;/usr/sbin/grub-mkconfig&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;check&#x20;on&#x20;password&#x20;not&#x20;being&#x20;set&#x20;to&#x20;before&#x20;running&#x20;chmod&#x20;command:&#x20;#&#x20;sed&#x20;-ri&#x20;&#039;s/&#x20;&amp;&amp;&#x20;!&#x20;grep&#x20;&quot;^password&quot;&#x20;${grub_cfg}.new&#x20;&gt;/dev/null//&#039;&#x20;/usr/sbin/grub-mkconfig.','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19029,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;AppArmor&#x20;at&#x20;boot&#x20;time&#41;.','If&#x20;password&#x20;protection&#x20;is&#x20;enabled,&#x20;only&#x20;the&#x20;designated&#x20;superuser&#x20;can&#x20;edit&#x20;a&#x20;Grub&#x20;2&#x20;menu&#x20;item&#x20;by&#x20;pressing&#x20;&quot;e&quot;&#x20;or&#x20;access&#x20;the&#x20;GRUB&#x20;2&#x20;command&#x20;line&#x20;by&#x20;pressing&#x20;&quot;c&quot;&#x20;If&#x20;GRUB&#x20;2&#x20;is&#x20;set&#x20;up&#x20;to&#x20;boot&#x20;automatically&#x20;to&#x20;a&#x20;password-protected&#x20;menu&#x20;entry&#x20;the&#x20;user&#x20;has&#x20;no&#x20;option&#x20;to&#x20;back&#x20;out&#x20;of&#x20;the&#x20;password&#x20;prompt&#x20;to&#x20;select&#x20;another&#x20;menu&#x20;entry.&#x20;Holding&#x20;the&#x20;SHIFT&#x20;key&#x20;will&#x20;not&#x20;display&#x20;the&#x20;menu&#x20;in&#x20;this&#x20;case.&#x20;The&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;correct&#x20;username&#x20;and&#x20;password.&#x20;If&#x20;unable,&#x20;the&#x20;configuration&#x20;files&#x20;will&#x20;have&#x20;to&#x20;be&#x20;edited&#x20;via&#x20;the&#x20;LiveCD&#x20;or&#x20;other&#x20;means&#x20;to&#x20;fix&#x20;the&#x20;problem&#x20;You&#x20;can&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;menu&#x20;entries&#x20;to&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;boot&#x20;without&#x20;entering&#x20;a&#x20;password.&#x20;Password&#x20;will&#x20;still&#x20;be&#x20;required&#x20;to&#x20;edit&#x20;menu&#x20;items.&#x20;More&#x20;Information:&#x20;https://help.ubuntu.com/community/Grub2/Passwords','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;PBKDF2&#x20;hash&#x20;of&#x20;your&#x20;password&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;EOF.&#x20;The&#x20;superuser/user&#x20;information&#x20;and&#x20;password&#x20;should&#x20;not&#x20;be&#x20;contained&#x20;in&#x20;the&#x20;/etc/grub.d/00_header&#x20;file&#x20;as&#x20;this&#x20;file&#x20;could&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;package&#x20;update.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;requirement&#x20;to&#x20;be&#x20;able&#x20;to&#x20;boot/reboot&#x20;without&#x20;entering&#x20;the&#x20;password,&#x20;edit&#x20;/etc/grub.d/10_linux&#x20;and&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;line&#x20;CLASS=&#x20;Example:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19030,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg&#x20;#&#x20;chmod&#x20;u-wx,go-rwx&#x20;/boot/grub/grub.cfg.','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19031,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.4.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19032,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.&#x20;Note:&#x20;Ensure&#x20;your&#x20;system&#x20;supports&#x20;the&#x20;XD&#x20;or&#x20;NX&#x20;bit&#x20;and&#x20;has&#x20;PAE&#x20;support&#x20;before&#x20;implementing&#x20;this&#x20;recommendation&#x20;as&#x20;this&#x20;may&#x20;prevent&#x20;it&#x20;from&#x20;booting&#x20;if&#x20;these&#x20;are&#x20;not&#x20;supported&#x20;by&#x20;your&#x20;hardware.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc_v7\": [\"8.3\"]}, {\"mitre_techniques\": [\"T1189\", \"T1190\", \"T1203\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1117\", \"T1085\", \"T1080\", \"T1131\", \"T1003\", \"T1101\"]}, {\"nist_sp_800-53\": [\"SC-39\", \"SI-16\"]}]'),(19033,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file&#x20;ending&#x20;in&#x20;.conf:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;comment&#x20;out&#x20;entries&#x20;that&#x20;override&#x20;the&#x20;default&#x20;setting&#x20;of&#x20;kernel.randomize_va_space:&#x20;#!/usr/bin/bash&#x20;for&#x20;file&#x20;in&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/usr/local/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf;&#x20;do&#x20;if&#x20;[&#x20;-f&#x20;&quot;$file&quot;&#x20;];&#x20;then&#x20;grep&#x20;-Esq&#x20;&quot;^s*kernel.randomize_va_spaces*=s*&#40;[0-1]|[3-9]|[1-9][0-9]+&#41;&quot;&#x20;&quot;$file&quot;&#x20;&amp;&amp;&#x20;sed&#x20;-ri&#x20;&#039;s/^s*kernel.randomize_va_spaces*=s*&#40;[0-1]|[3-9]|[1-9][0-9]+&#41;/#&#x20;&amp;/gi&#039;&#x20;&quot;$file&quot;&#x20;fi&#x20;done&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc_v7\": [\"8.3\"]}, {\"mitre_techniques\": [\"T1189\", \"T1190\", \"T1203\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1117\", \"T1085\", \"T1080\", \"T1131\", \"T1003\", \"T1101\"]}, {\"nist_sp_800-53\": [\"SC-39\", \"SI-16\"]}]'),(19034,'Ensure&#x20;prelink&#x20;is&#x20;not&#x20;installed.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;Uninstall&#x20;prelink&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;purge&#x20;prelink.','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AU.3.050\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.1\", \"11.5\"]}]'),(19035,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0&#x20;IF&#x20;systemd-coredump&#x20;is&#x20;installed:&#x20;edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;Storage=none&#x20;ProcessSizeMax=0&#x20;Run&#x20;the&#x20;command:&#x20;systemctl&#x20;daemon-reload.','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19036,'Ensure&#x20;AppArmor&#x20;is&#x20;installed.','AppArmor&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Install&#x20;Apparmor.&#x20;#&#x20;apt&#x20;install&#x20;apparmor','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19037,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration.','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;bootloader&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;apparmor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19038,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;in&#x20;enforce&#x20;or&#x20;complain&#x20;mode.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applications&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;complain&#x20;mode:&#x20;#&#x20;aa-complain&#x20;/etc/apparmor.d&#47;&#42;&#x20;Note:&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19039,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applications&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Note:&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19040,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;OR&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.7.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19041,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-&#x20;or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19042,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19043,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/motd&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/motd&#41;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;/etc/motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd.','[{\"cis\": [\"1.7.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19044,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue','[{\"cis\": [\"1.7.5\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19045,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue.net&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue.net&#41;','[{\"cis\": [\"1.7.6\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19046,'Ensure&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;removed.','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;&#40;GDM&#41;&#x20;is&#x20;a&#x20;program&#x20;that&#x20;manages&#x20;graphical&#x20;display&#x20;servers&#x20;and&#x20;handles&#x20;graphical&#x20;user&#x20;logins.','If&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Removing&#x20;the&#x20;GNOME&#x20;Display&#x20;manager&#x20;will&#x20;remove&#x20;the&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;from&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;gdm3:&#x20;#&#x20;apt&#x20;purge&#x20;gdm3','[{\"cis\": [\"1.8.1\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19047,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured.','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;add&#x20;the&#x20;following:&#x20;[org/gnome/login-screen]&#x20;banner-message-enable=true&#x20;banner-message-text=&#039;&lt;banner&#x20;message&gt;&#039;&#x20;disable-user-list=true&#x20;Example&#x20;banner&#x20;message:&#x20;&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;re-load&#x20;GDM&#x20;on&#x20;the&#x20;next&#x20;login&#x20;or&#x20;reboot:&#x20;#&#x20;dpkg-reconfigure&#x20;gdm3','[{\"cis\": [\"1.8.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19048,'Ensure&#x20;disable-user-list&#x20;is&#x20;enabled.','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.&#x20;The&#x20;disable-user-list&#x20;option&#x20;controls&#x20;is&#x20;a&#x20;list&#x20;of&#x20;users&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;login&#x20;screen.','Displaying&#x20;the&#x20;user&#x20;list&#x20;eliminates&#x20;half&#x20;of&#x20;the&#x20;Userid/Password&#x20;equation&#x20;that&#x20;an&#x20;unauthorized&#x20;person&#x20;would&#x20;need&#x20;to&#x20;log&#x20;on.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/gdm3/greeter.dconf-defaults&#x20;and&#x20;edit&#x20;or&#x20;add&#x20;the&#x20;following:&#x20;[org/gnome/login-screen]&#x20;banner-message-enable=true&#x20;banner-message-text=&#039;&lt;banner&#x20;message&gt;&#039;&#x20;disable-user-list=true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;re-load&#x20;GDM&#x20;on&#x20;the&#x20;next&#x20;login&#x20;or&#x20;reboot:&#x20;#&#x20;dpkg-reconfigure&#x20;gdm3','[{\"cis\": [\"1.8.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19049,'Ensure&#x20;XDCMP&#x20;is&#x20;not&#x20;enabled.','X&#x20;Display&#x20;Manager&#x20;Control&#x20;Protocol&#x20;&#40;XDMCP&#41;&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;authenticated&#x20;access&#x20;to&#x20;display&#x20;management&#x20;services&#x20;for&#x20;remote&#x20;displays.','XDMCP&#x20;is&#x20;inherently&#x20;insecure.&#x20;-&#x20;XDMCP&#x20;is&#x20;not&#x20;a&#x20;ciphered&#x20;protocol.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;capture&#x20;keystrokes&#x20;entered&#x20;by&#x20;a&#x20;user.&#x20;-&#x20;XDMCP&#x20;is&#x20;vulnerable&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;steal&#x20;the&#x20;credentials&#x20;of&#x20;legitimate&#x20;users&#x20;by&#x20;impersonating&#x20;the&#x20;XDMCP&#x20;server.','','Edit&#x20;the&#x20;file&#x20;/etc/gdm3/custom.conf&#x20;and&#x20;remove&#x20;the&#x20;line:&#x20;Enable=true','[{\"cis\": [\"1.8.4\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19050,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;following&#x20;local&#x20;site&#x20;policy&#x20;guidance&#x20;on&#x20;applying&#x20;updates&#x20;and&#x20;patches:&#x20;#&#x20;apt&#x20;upgrade&#x20;OR&#x20;#&#x20;apt&#x20;dist-upgrade','[{\"cis\": [\"1.9\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"MA.2.111\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1073\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\", \"T1103\", \"T1017\", \"T1138\"]}]'),(19051,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.&#x20;Notes:&#x20;-&#x20;If&#x20;access&#x20;to&#x20;a&#x20;physical&#x20;host&#039;s&#x20;clock&#x20;is&#x20;available&#x20;and&#x20;configured&#x20;according&#x20;to&#x20;site&#x20;policy,&#x20;this&#x20;section&#x20;can&#x20;be&#x20;skipped.&#x20;-&#x20;Only&#x20;one&#x20;time&#x20;synchronization&#x20;method&#x20;should&#x20;be&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;If&#x20;access&#x20;to&#x20;a&#x20;physical&#x20;host&#039;s&#x20;clock&#x20;is&#x20;available&#x20;and&#x20;configured&#x20;according&#x20;to&#x20;site&#x20;policy,&#x20;systemd-timesyncd&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available,&#x20;configure&#x20;systemd-&#x20;timesyncd.&#x20;If&#x20;&quot;full&#x20;featured&quot;&#x20;and/or&#x20;encrypted&#x20;time&#x20;synchronization&#x20;is&#x20;required,&#x20;install&#x20;chrony&#x20;or&#x20;NTP.&#x20;To&#x20;install&#x20;chrony:&#x20;#&#x20;apt&#x20;install&#x20;chrony&#x20;To&#x20;install&#x20;ntp:&#x20;#&#x20;apt&#x20;install&#x20;ntp&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.1.1.1\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.2.043\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"nist_sp_800-53\": [\"AU-8\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}]'),(19052,'Ensure&#x20;systemd-timesyncd&#x20;is&#x20;configured.','systemd-timesyncd&#x20;is&#x20;a&#x20;daemon&#x20;that&#x20;has&#x20;been&#x20;added&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.&#x20;It&#x20;implements&#x20;an&#x20;SNTP&#x20;client.&#x20;In&#x20;contrast&#x20;to&#x20;NTP&#x20;implementations&#x20;such&#x20;as&#x20;chrony&#x20;or&#x20;the&#x20;NTP&#x20;reference&#x20;server&#x20;this&#x20;only&#x20;implements&#x20;a&#x20;client&#x20;side,&#x20;and&#x20;does&#x20;not&#x20;bother&#x20;with&#x20;the&#x20;full&#x20;NTP&#x20;complexity,&#x20;focusing&#x20;only&#x20;on&#x20;querying&#x20;time&#x20;from&#x20;one&#x20;remote&#x20;server&#x20;and&#x20;synchronizing&#x20;the&#x20;local&#x20;clock&#x20;to&#x20;it.&#x20;The&#x20;daemon&#x20;runs&#x20;with&#x20;minimal&#x20;privileges,&#x20;and&#x20;has&#x20;been&#x20;hooked&#x20;up&#x20;with&#x20;networkd&#x20;to&#x20;only&#x20;operate&#x20;when&#x20;network&#x20;connectivity&#x20;is&#x20;available.&#x20;The&#x20;daemon&#x20;saves&#x20;the&#x20;current&#x20;clock&#x20;to&#x20;disk&#x20;every&#x20;time&#x20;a&#x20;new&#x20;NTP&#x20;sync&#x20;has&#x20;been&#x20;acquired,&#x20;and&#x20;uses&#x20;this&#x20;to&#x20;possibly&#x20;correct&#x20;the&#x20;system&#x20;clock&#x20;early&#x20;at&#x20;bootup,&#x20;in&#x20;order&#x20;to&#x20;accommodate&#x20;for&#x20;systems&#x20;that&#x20;lack&#x20;an&#x20;RTC&#x20;such&#x20;as&#x20;the&#x20;Raspberry&#x20;Pi&#x20;and&#x20;embedded&#x20;devices,&#x20;and&#x20;make&#x20;sure&#x20;that&#x20;time&#x20;monotonically&#x20;progresses&#x20;on&#x20;these&#x20;systems,&#x20;even&#x20;if&#x20;it&#x20;is&#x20;not&#x20;always&#x20;correct.&#x20;To&#x20;make&#x20;use&#x20;of&#x20;this&#x20;daemon&#x20;a&#x20;new&#x20;system&#x20;user&#x20;and&#x20;group&#x20;&quot;systemd-timesync&quot;&#x20;needs&#x20;to&#x20;be&#x20;created&#x20;on&#x20;installation&#x20;of&#x20;systemd.&#x20;Note:&#x20;-&#x20;If&#x20;chrony&#x20;or&#x20;ntp&#x20;are&#x20;used,&#x20;systemd-timesyncd&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked,&#x20;and&#x20;this&#x20;section&#x20;skipped.&#x20;-&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;Only&#x20;one&#x20;time&#x20;synchronization&#x20;method&#x20;should&#x20;be&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','Proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','-&#x20;Remove&#x20;additional&#x20;time&#x20;synchronization&#x20;methods:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;ntp&#x20;and&#x20;chrony:&#x20;#&#x20;apt&#x20;purge&#x20;ntp&#x20;#&#x20;apt&#x20;purge&#x20;chrony&#x20;-&#x20;Configure&#x20;systemd-timesyncd:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;systemd-timesyncd:&#x20;#&#x20;systemctl&#x20;enable&#x20;systemd-timesyncd.service.&#x20;Edit&#x20;the&#x20;file&#x20;/etc/systemd/timesyncd.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;NTP=0.debian.pool.ntp.org&#x20;1.debian.pool.ntp.org&#x20;#Servers&#x20;listed&#x20;should&#x20;be&#x20;In&#x20;Accordence&#x20;With&#x20;Local&#x20;Policy&#x20;FallbackNTP=2.debian.pool.ntp.org&#x20;3.debian.pool.ntp.org&#x20;#Servers&#x20;listed&#x20;should&#x20;be&#x20;In&#x20;Accordence&#x20;With&#x20;Local&#x20;Policy.&#x20;RootDistanceMax=1&#x20;#should&#x20;be&#x20;In&#x20;Accordence&#x20;With&#x20;Local&#x20;Policy.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;start&#x20;systemd-timesyncd.service:&#x20;#&#x20;systemctl&#x20;start&#x20;systemd-timesyncd.service&#x20;#&#x20;timedatectl&#x20;set-ntp&#x20;true','[{\"cis\": [\"2.1.1.2\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.2.043\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"nist_sp_800-53\": [\"AU-8\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}]'),(19053,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;and&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at:&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;Notes:&#x20;-&#x20;If&#x20;ntp&#x20;or&#x20;systemd-timesyncd&#x20;are&#x20;used,&#x20;chrony&#x20;should&#x20;be&#x20;removed&#x20;and&#x20;this&#x20;section&#x20;skipped.&#x20;-&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;Only&#x20;one&#x20;time&#x20;synchronization&#x20;method&#x20;should&#x20;be&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Remove&#x20;and/or&#x20;disable&#x20;additional&#x20;time&#x20;synchronization&#x20;methods:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp:&#x20;#&#x20;apt&#x20;purge&#x20;ntp&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;systemd-timesyncd:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;systemd-timesyncd&#x20;Configure&#x20;chrony:&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;user&#x20;line&#x20;to&#x20;/etc/chrony/chrony.conf:&#x20;user&#x20;_chrony','[{\"cis\": [\"2.1.1.3\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.2.043\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"nist_sp_800-53\": [\"AU-8\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}]'),(19054,'Ensure&#x20;ntp&#x20;is&#x20;configured.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;Notes:&#x20;-&#x20;If&#x20;chrony&#x20;or&#x20;systemd-timesyncd&#x20;are&#x20;used,&#x20;ntp&#x20;should&#x20;be&#x20;removed&#x20;and&#x20;this&#x20;section&#x20;skipped.&#x20;-&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;Only&#x20;one&#x20;time&#x20;synchronization&#x20;method&#x20;should&#x20;be&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','-&#x20;Remove&#x20;and/or&#x20;disable&#x20;additional&#x20;time&#x20;synchronization&#x20;methods:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;chrony:&#x20;#&#x20;apt&#x20;purge&#x20;chrony&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;systemd-timesyncd:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;systemd-timesyncd&#x20;-&#x20;Configure&#x20;ntp:&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;RUNASUSER=ntp.','[{\"cis\": [\"2.1.1.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.2.043\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"nist_sp_800-53\": [\"AU-8\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}]'),(19055,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Many&#x20;Linux&#x20;systems&#x20;run&#x20;applications&#x20;which&#x20;require&#x20;a&#x20;Java&#x20;runtime.&#x20;Some&#x20;Linux&#x20;Java&#x20;packages&#x20;have&#x20;a&#x20;dependency&#x20;on&#x20;specific&#x20;X&#x20;Windows&#x20;xorg-x11-fonts.&#x20;One&#x20;workaround&#x20;to&#x20;avoid&#x20;this&#x20;dependency&#x20;is&#x20;to&#x20;use&#x20;the&#x20;&quot;headless&quot;&#x20;Java&#x20;packages&#x20;for&#x20;your&#x20;specific&#x20;Java&#x20;runtime,&#x20;if&#x20;provided&#x20;by&#x20;your&#x20;distribution.','Remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt&#x20;purge&#x20;xserver-xorg*','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19056,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daaemon.service&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;#&#x20;apt&#x20;purge&#x20;avahi-daemon','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19057,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;cups:&#x20;#&#x20;apt&#x20;purge&#x20;cups','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19058,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;isc-dhcp-server:&#x20;#&#x20;apt&#x20;purge&#x20;isc-dhcp-server','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19059,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;slapd:&#x20;#&#x20;apt&#x20;purge&#x20;slapd','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19060,'Ensure&#x20;NFS&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs:&#x20;#&#x20;apt&#x20;purge&#x20;nfs-kernel-server','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19061,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;DNS&#x20;server:&#x20;#&#x20;apt&#x20;purge&#x20;bind9','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19062,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;SFTP&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;vsftpd:&#x20;#&#x20;apt&#x20;purge&#x20;vsftpd','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19063,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;apache:&#x20;#&#x20;apt&#x20;purge&#x20;apache2','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19064,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;are&#x20;not&#x20;installed.','dovecot-imapd&#x20;and&#x20;dovecot-pop3d&#x20;are&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;dovecot-imapd&#x20;and&#x20;dovecot-pop3d:&#x20;#&#x20;apt&#x20;purge&#x20;dovecot-imapd&#x20;dovecot-pop3d','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19065,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;should&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;samba:&#x20;#&#x20;apt&#x20;purge&#x20;samba','[{\"cis\": [\"2.1.12\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19066,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;squid:&#x20;#&#x20;apt&#x20;purge&#x20;squid','[{\"cis\": [\"2.1.13\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19067,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;installed.','Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;is&#x20;a&#x20;widely&#x20;used&#x20;protocol&#x20;for&#x20;monitoring&#x20;the&#x20;health&#x20;and&#x20;welfare&#x20;of&#x20;network&#x20;equipment,&#x20;computer&#x20;equipment&#x20;and&#x20;devices&#x20;like&#x20;UPSs.&#x20;Net-SNMP&#x20;is&#x20;a&#x20;suite&#x20;of&#x20;applications&#x20;used&#x20;to&#x20;implement&#x20;SNMPv1&#x20;&#40;RFC&#x20;1157&#41;,&#x20;SNMPv2&#x20;&#40;RFCs&#x20;1901-1908&#41;,&#x20;and&#x20;SNMPv3&#x20;&#40;RFCs&#x20;3411-3418&#41;&#x20;using&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6.&#x20;Support&#x20;for&#x20;SNMPv2&#x20;classic&#x20;&#40;a.k.a.&#x20;&quot;SNMPv2&#x20;historic&quot;&#x20;-&#x20;RFCs&#x20;1441-1452&#41;&#x20;was&#x20;dropped&#x20;with&#x20;the&#x20;4.0&#x20;release&#x20;of&#x20;the&#x20;UCD-snmp&#x20;package.&#x20;The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3&#x20;replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2&#x20;with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;required:&#x20;-&#x20;The&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;for&#x20;SNMP&#x20;v3&#x20;only.&#x20;User&#x20;Authentication&#x20;and&#x20;Message&#x20;Encryption&#x20;should&#x20;be&#x20;configured.&#x20;-&#x20;If&#x20;SNMP&#x20;v2&#x20;is&#x20;absolutely&#x20;necessary,&#x20;modify&#x20;the&#x20;community&#x20;strings&#039;&#x20;values.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;snmpd:&#x20;#&#x20;apt&#x20;purge&#x20;snmpd','[{\"cis\": [\"2.1.14\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19068,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;exim4&#x20;mail&#x20;server,&#x20;depending&#x20;on&#x20;your&#x20;environment&#x20;you&#x20;may&#x20;have&#x20;an&#x20;alternative&#x20;MTA&#x20;installed&#x20;such&#x20;as&#x20;sendmail.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case&#x20;consult&#x20;the&#x20;documentation&#x20;for&#x20;your&#x20;installed&#x20;MTA&#x20;to&#x20;configure&#x20;the&#x20;recommended&#x20;state.','','Edit&#x20;/etc/exim4/update-exim4.conf.conf&#x20;and&#x20;and&#x20;or&#x20;modify&#x20;following&#x20;lines&#x20;to&#x20;look&#x20;like&#x20;the&#x20;lines&#x20;below:&#x20;dc_eximconfig_configtype=&#039;local&#039;&#x20;dc_local_interfaces=&#039;127.0.0.1&#x20;;&#x20;::1&#039;&#x20;dc_readhost=&#039;&#039;&#x20;dc_relay_domains=&#039;&#039;&#x20;dc_minimaldns=&#039;false&#039;&#x20;dc_relay_nets=&#039;&#039;&#x20;dc_smarthost=&#039;&#039;&#x20;dc_use_split_config=&#039;false&#039;&#x20;dc_hide_mailname=&#039;&#039;&#x20;dc_mailname_in_oh=&#039;true&#039;&#x20;dc_localdelivery=&#039;mail_spool&#039;&#x20;Restart&#x20;exim4:&#x20;#&#x20;systemctl&#x20;restart&#x20;exim4','[{\"cis\": [\"2.1.15\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19069,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;installed.','The&#x20;rsync&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsync&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.&#x20;The&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;area&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rsync:&#x20;#&#x20;apt&#x20;purge&#x20;rsync','[{\"cis\": [\"2.1.16\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19070,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nis:&#x20;#&#x20;apt&#x20;purge&#x20;nis','[{\"cis\": [\"2.1.17\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19071,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;nis:&#x20;#&#x20;apt&#x20;purge&#x20;nis','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19072,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh-client&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.&quot;','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcp&#x20;and&#x20;rlogin.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;rsh:&#x20;#&#x20;apt&#x20;purge&#x20;rsh-client','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc_v7\": [\"4.5\"]}, {\"cmmc_v2.0\": [\"IA.3.083\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1098\", \"T1017\", \"T1110\", \"T1136\", \"T1530\", \"T1114\", \"T1133\", \"T1040\", \"T1076\", \"T1021\", \"T1539\", \"T1072\", \"T1078\", \"T1134\", \"T1067\", \"T1088\", \"T1175\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"pci_dss_v3.2.1\": [\"2.3\", \"8.3\", \"8.3.1\", \"8.3.2\"]}]'),(19073,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;talk:&#x20;#&#x20;apt&#x20;purge&#x20;talk','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19074,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;telnet:&#x20;#&#x20;apt&#x20;purge&#x20;telnet','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc_v7\": [\"4.5\"]}, {\"cmmc_v2.0\": [\"IA.3.083\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1098\", \"T1017\", \"T1110\", \"T1136\", \"T1530\", \"T1114\", \"T1133\", \"T1040\", \"T1076\", \"T1021\", \"T1539\", \"T1072\", \"T1078\", \"T1134\", \"T1067\", \"T1088\", \"T1175\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"pci_dss_v3.2.1\": [\"2.3\", \"8.3\", \"8.3.1\", \"8.3.2\"]}]'),(19075,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;the&#x20;LDAP&#x20;client&#x20;will&#x20;prevent&#x20;or&#x20;inhibit&#x20;using&#x20;LDAP&#x20;for&#x20;authentication&#x20;in&#x20;your&#x20;environment.','Uninstall&#x20;ldap-utils:&#x20;#&#x20;apt&#x20;purge&#x20;ldap-utils','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.2.063\", \"CM.3.069\", \"CM.4.073\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}, {\"nist_sp_800-53\": [\"CM-11\"]}]'),(19076,'Ensure&#x20;RPC&#x20;is&#x20;not&#x20;installed.','Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;is&#x20;a&#x20;method&#x20;for&#x20;creating&#x20;low&#x20;level&#x20;client&#x20;server&#x20;applications&#x20;across&#x20;different&#x20;system&#x20;architectures.&#x20;It&#x20;requires&#x20;an&#x20;RPC&#x20;compliant&#x20;client&#x20;listening&#x20;on&#x20;a&#x20;network&#x20;port.&#x20;The&#x20;supporting&#x20;package&#x20;is&#x20;rpcbind.','If&#x20;RPC&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;services&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rpcbind:&#x20;#&#x20;apt&#x20;purge&#x20;rpcbind','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19077,'Disable&#x20;IPv6.','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','If&#x20;IPv6&#x20;is&#x20;disabled&#x20;through&#x20;sysctl&#x20;config,&#x20;SSH&#x20;X11forwarding&#x20;may&#x20;no&#x20;longer&#x20;function&#x20;as&#x20;expected.&#x20;We&#x20;recommend&#x20;that&#x20;SSH&#x20;X11fowarding&#x20;be&#x20;disabled,&#x20;but&#x20;if&#x20;required,&#x20;the&#x20;following&#x20;will&#x20;allow&#x20;for&#x20;SSH&#x20;X11forwarding&#x20;with&#x20;IPv6&#x20;disabled&#x20;through&#x20;sysctl&#x20;config:&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file:&#x20;AddressFamily&#x20;inet&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;re-start&#x20;the&#x20;openSSH&#x20;server:&#x20;#&#x20;systemctl&#x20;restart&#x20;sshd','Use&#x20;one&#x20;of&#x20;the&#x20;two&#x20;following&#x20;methods&#x20;to&#x20;disable&#x20;IPv6&#x20;on&#x20;the&#x20;system:&#x20;To&#x20;disable&#x20;IPv6&#x20;through&#x20;the&#x20;GRUB2&#x20;config:&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;OR&#x20;To&#x20;disable&#x20;IPv6&#x20;through&#x20;sysctl&#x20;settings:&#x20;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.disable_ipv6&#x20;=&#x20;1&#x20;net.ipv6.conf.default.disable_ipv6&#x20;=&#x20;1&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.disable_ipv6=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.disable_ipv6=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19078,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled.','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19079,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;net.ipv4.ip_forward&#x20;and&#x20;net.ipv6.conf.all.forwarding&#x20;flags&#x20;are&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv4.ip_forwards*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameter&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;grep&#x20;-Els&#x20;&quot;^s*net.ipv6.conf.all.forwardings*=s*1&quot;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;net.ipv6.conf.all.forwardings*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&quot;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.forwarding=0;&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19080,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted.','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route,&#x20;net.ipv6.conf.all.accept_source_route&#x20;and&#x20;net.ipv6.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_source_route&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1&#x20;','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19081,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;and&#x20;net.ipv6.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19082,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19083,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19084,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored.','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19085,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.6\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19086,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.7\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19087,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled.','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.8\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19088,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;do&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','IF&#x20;IPv6&#x20;is&#x20;enabled:&#x20;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19089,'Ensure&#x20;DCCP&#x20;is&#x20;disabled.','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/dccp.conf&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19090,'Ensure&#x20;SCTP&#x20;is&#x20;disabled.','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19091,'Ensure&#x20;RDS&#x20;is&#x20;disabled.','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/rds.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19092,'Ensure&#x20;TIPC&#x20;is&#x20;disabled.','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/tipc.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19093,'Ensure&#x20;ufw&#x20;is&#x20;installed.','The&#x20;Uncomplicated&#x20;Firewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables&#x20;and&#x20;is&#x20;particularly&#x20;well-suited&#x20;for&#x20;host-based&#x20;firewalls.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x20;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.&#x20;Note:&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x20;UFW&#x20;is&#x20;dependent&#x20;on&#x20;the&#x20;iptables&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;:&#x20;apt&#x20;install&#x20;ufw','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19094,'Ensure&#x20;iptables-persistent&#x20;is&#x20;not&#x20;installed&#x20;with&#x20;ufw.','The&#x20;iptables-persistent&#x20;is&#x20;a&#x20;boot-time&#x20;loader&#x20;for&#x20;netfilter&#x20;rules,&#x20;iptables&#x20;plugin.','Running&#x20;both&#x20;ufw&#x20;and&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-persistent&#x20;package&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;iptables-persistent&#x20;package:&#x20;#&#x20;apt&#x20;purge&#x20;iptables-persistent','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19095,'Ensure&#x20;ufw&#x20;service&#x20;is&#x20;enabled.','UncomplicatedFirewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;and&#x20;available&#x20;graphical&#x20;user&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.&#x20;Notes:&#x20;-&#x20;When&#x20;running&#x20;ufw&#x20;enable&#x20;or&#x20;starting&#x20;ufw&#x20;via&#x20;its&#x20;initscript,&#x20;ufw&#x20;will&#x20;flush&#x20;its&#x20;chains.&#x20;This&#x20;is&#x20;required&#x20;so&#x20;ufw&#x20;can&#x20;maintain&#x20;a&#x20;consistent&#x20;state,&#x20;but&#x20;it&#x20;may&#x20;drop&#x20;existing&#x20;connections&#x20;&#40;eg&#x20;ssh&#41;.&#x20;ufw&#x20;does&#x20;support&#x20;adding&#x20;rules&#x20;before&#x20;enabling&#x20;the&#x20;firewall.&#x20;-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;before&#x20;running&#x20;ufw&#x20;enable.&#x20;#&#x20;ufw&#x20;allow&#x20;proto&#x20;tcp&#x20;from&#x20;any&#x20;to&#x20;any&#x20;port&#x20;22.&#x20;-&#x20;The&#x20;rules&#x20;will&#x20;still&#x20;be&#x20;flushed,&#x20;but&#x20;the&#x20;ssh&#x20;port&#x20;will&#x20;be&#x20;open&#x20;after&#x20;enabling&#x20;the&#x20;firewall.&#x20;Please&#x20;note&#x20;that&#x20;once&#x20;ufw&#x20;is&#x20;&#039;enabled&#039;,&#x20;ufw&#x20;will&#x20;not&#x20;flush&#x20;the&#x20;chains&#x20;when&#x20;adding&#x20;or&#x20;removing&#x20;rules&#x20;&#40;but&#x20;will&#x20;when&#x20;modifying&#x20;a&#x20;rule&#x20;or&#x20;changing&#x20;the&#x20;default&#x20;policy&#41;.&#x20;-&#x20;By&#x20;default,&#x20;ufw&#x20;will&#x20;prompt&#x20;when&#x20;enabling&#x20;the&#x20;firewall&#x20;while&#x20;running&#x20;under&#x20;ssh.&#x20;This&#x20;can&#x20;be&#x20;disabled&#x20;by&#x20;using&#x20;ufw&#x20;--force&#x20;enable.','The&#x20;ufw&#x20;service&#x20;must&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;for&#x20;ufw&#x20;to&#x20;protect&#x20;the&#x20;system.','Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;ufw:&#x20;#&#x20;ufw&#x20;enable','[{\"cis\": [\"3.5.1.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19096,'Ensure&#x20;ufw&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ufw&#x20;allow&#x20;in&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;allow&#x20;out&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;127.0.0.0/8&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;::1','[{\"cis\": [\"3.5.1.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19097,'Ensure&#x20;ufw&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;Any&#x20;port&#x20;or&#x20;protocol&#x20;without&#x20;a&#x20;explicit&#x20;allow&#x20;before&#x20;the&#x20;default&#x20;deny&#x20;will&#x20;be&#x20;blocked.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','Any&#x20;port&#x20;and&#x20;protocol&#x20;not&#x20;explicitly&#x20;allowed&#x20;will&#x20;be&#x20;blocked.&#x20;The&#x20;following&#x20;rules&#x20;should&#x20;be&#x20;considered&#x20;before&#x20;applying&#x20;the&#x20;default&#x20;deny.&#x20;ufw&#x20;allow&#x20;git&#x20;ufw&#x20;allow&#x20;in&#x20;http&#x20;ufw&#x20;allow&#x20;in&#x20;https&#x20;ufw&#x20;allow&#x20;out&#x20;53&#x20;ufw&#x20;logging&#x20;on','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;deny&#x20;policy:&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;incoming&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;outgoing&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;routed','[{\"cis\": [\"3.5.1.7\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19098,'Ensure&#x20;nftables&#x20;is&#x20;installed.','nftables&#x20;provides&#x20;a&#x20;new&#x20;in-kernel&#x20;packet&#x20;classification&#x20;framework&#x20;that&#x20;is&#x20;based&#x20;on&#x20;a&#x20;network-specific&#x20;Virtual&#x20;Machine&#x20;&#40;VM&#41;&#x20;and&#x20;a&#x20;new&#x20;nft&#x20;userspace&#x20;command&#x20;line&#x20;tool.&#x20;nftables&#x20;reuses&#x20;the&#x20;existing&#x20;Netfilter&#x20;subsystems&#x20;such&#x20;as&#x20;the&#x20;existing&#x20;hook&#x20;infrastructure,&#x20;the&#x20;connection&#x20;tracking&#x20;system,&#x20;NAT,&#x20;userspace&#x20;queuing&#x20;and&#x20;logging&#x20;subsystem.&#x20;Notes:&#x20;-&#x20;nftables&#x20;is&#x20;available&#x20;in&#x20;Linux&#x20;kernel&#x20;3.13&#x20;and&#x20;newer.&#x20;-&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;the&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;nftables:&#x20;#&#x20;apt&#x20;install&#x20;nftables','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19099,'Ensure&#x20;ufw&#x20;is&#x20;uninstalled&#x20;or&#x20;disabled&#x20;with&#x20;nftables.','Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;&#x20;is&#x20;a&#x20;program&#x20;for&#x20;managing&#x20;a&#x20;netfilter&#x20;firewall&#x20;designed&#x20;to&#x20;be&#x20;easy&#x20;to&#x20;use.','Running&#x20;both&#x20;the&#x20;nftables&#x20;service&#x20;and&#x20;ufw&#x20;may&#x20;lead&#x20;to&#x20;conflict&#x20;and&#x20;unexpected&#x20;results.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;either&#x20;remove&#x20;ufw&#x20;or&#x20;disable&#x20;ufw&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ufw:&#x20;#&#x20;apt&#x20;purge&#x20;ufw&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ufw:&#x20;#&#x20;ufw&#x20;disable','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19100,'Ensure&#x20;iptables&#x20;are&#x20;flushed&#x20;with&#x20;nftables.','nftables&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;iptables,&#x20;ip6tables,&#x20;ebtables&#x20;and&#x20;arptables.','It&#x20;is&#x20;possible&#x20;to&#x20;mix&#x20;iptables&#x20;and&#x20;nftables.&#x20;However,&#x20;this&#x20;increases&#x20;complexity&#x20;and&#x20;also&#x20;the&#x20;chance&#x20;to&#x20;introduce&#x20;errors.&#x20;For&#x20;simplicity&#x20;flush&#x20;out&#x20;all&#x20;iptables&#x20;rules,&#x20;and&#x20;ensure&#x20;it&#x20;is&#x20;not&#x20;loaded.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;flush&#x20;iptables:&#x20;For&#x20;iptables:&#x20;#&#x20;iptables&#x20;-F&#x20;For&#x20;ip6tables:&#x20;#&#x20;ip6tables&#x20;-F','[{\"cis\": [\"3.5.2.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19101,'Ensure&#x20;a&#x20;nftables&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','Adding&#x20;rules&#x20;to&#x20;a&#x20;running&#x20;nftables&#x20;can&#x20;cause&#x20;loss&#x20;of&#x20;connectivity&#x20;to&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.5.2.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19102,'Ensure&#x20;nftables&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19103,'Ensure&#x20;nftables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;iif&#x20;lo&#x20;accept&#x20;#&#x20;nft&#x20;create&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;saddr&#x20;127.0.0.0/8&#x20;counter&#x20;drop&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled&#x20;on&#x20;the&#x20;system:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;implement&#x20;the&#x20;IPv6&#x20;loopback&#x20;rule:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip6&#x20;saddr&#x20;::1&#x20;counter&#x20;drop','[{\"cis\": [\"3.5.2.6\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19104,'Ensure&#x20;nftables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}','[{\"cis\": [\"3.5.2.8\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19105,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled.','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.2.9\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19106,'Ensure&#x20;iptables&#x20;packages&#x20;are&#x20;installed.','iptables&#x20;is&#x20;a&#x20;utility&#x20;program&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;tables&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall,&#x20;implemented&#x20;as&#x20;different&#x20;Netfilter&#x20;modules,&#x20;and&#x20;the&#x20;chains&#x20;and&#x20;rules&#x20;it&#x20;stores.&#x20;Different&#x20;kernel&#x20;modules&#x20;and&#x20;programs&#x20;are&#x20;used&#x20;for&#x20;different&#x20;protocols;&#x20;iptables&#x20;applies&#x20;to&#x20;IPv4,&#x20;ip6tables&#x20;to&#x20;IPv6,&#x20;arptables&#x20;to&#x20;ARP,&#x20;and&#x20;ebtables&#x20;to&#x20;Ethernet&#x20;frames.','A&#x20;method&#x20;of&#x20;configuring&#x20;and&#x20;maintaining&#x20;firewall&#x20;rules&#x20;is&#x20;necessary&#x20;to&#x20;configure&#x20;a&#x20;Host&#x20;Based&#x20;Firewall.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;and&#x20;iptables-persistent&#x20;#&#x20;apt&#x20;install&#x20;iptables&#x20;iptables-persistent','[{\"cis\": [\"3.5.3.1.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19107,'Ensure&#x20;nftables&#x20;is&#x20;not&#x20;installed&#x20;with&#x20;iptables.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.','Running&#x20;both&#x20;iptables&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:&#x20;#&#x20;apt&#x20;purge&#x20;nftables','[{\"cis\": [\"3.5.3.1.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19108,'Ensure&#x20;ufw&#x20;is&#x20;uninstalled&#x20;or&#x20;disabled&#x20;with&#x20;iptables.','Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;&#x20;is&#x20;a&#x20;program&#x20;for&#x20;managing&#x20;a&#x20;netfilter&#x20;firewall&#x20;designed&#x20;to&#x20;be&#x20;easy&#x20;to&#x20;use.&#x20;-&#x20;Uses&#x20;a&#x20;command-line&#x20;interface&#x20;consisting&#x20;of&#x20;a&#x20;small&#x20;number&#x20;of&#x20;simple&#x20;commands.&#x20;-&#x20;Uses&#x20;iptables&#x20;for&#x20;configuration.','Running&#x20;iptables.persistent&#x20;with&#x20;ufw&#x20;enabled&#x20;may&#x20;lead&#x20;to&#x20;conflict&#x20;and&#x20;unexpected&#x20;results.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;either&#x20;remove&#x20;ufw&#x20;or&#x20;stop&#x20;and&#x20;mask&#x20;ufw&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ufw:&#x20;#&#x20;apt&#x20;purge&#x20;ufw&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;ufw:&#x20;#&#x20;ufw&#x20;disable','[{\"cis\": [\"3.5.3.1.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19109,'Ensure&#x20;iptables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.&#x20;Notes:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.2.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19110,'Ensure&#x20;iptables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Notes:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.2.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19111,'Ensure&#x20;ip6tables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.&#x20;Note:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.3.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19112,'Ensure&#x20;ip6tables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.3.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"CM.3.068\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}]'),(19113,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd:&#x20;#&#x20;apt&#x20;install&#x20;auditd&#x20;audispd-plugins','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19114,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled.','Enable&#x20;and&#x20;start&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19115,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.&#x20;Replace&#x20;/boot/grub/grub.cfg&#x20;with&#x20;the&#x20;appropriate&#x20;grub&#x20;configuration&#x20;file&#x20;for&#x20;your&#x20;environment.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19116,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.&#x20;Notes:&#x20;-&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.&#x20;-&#x20;Other&#x20;methods&#x20;of&#x20;log&#x20;rotation&#x20;may&#x20;be&#x20;appropriate&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;One&#x20;example&#x20;is&#x20;time-based&#x20;rotation&#x20;strategies&#x20;which&#x20;don&#039;t&#x20;have&#x20;native&#x20;support&#x20;in&#x20;auditd&#x20;configurations.&#x20;-&#x20;Manual&#x20;audit&#x20;of&#x20;custom&#x20;configurations&#x20;should&#x20;be&#x20;evaluated&#x20;for&#x20;effectiveness&#x20;and&#x20;completeness.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-4\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}]'),(19117,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-4\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}]'),(19118,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-4\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}]'),(19119,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-time-change.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-time-change.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}, {\"nist_sp_800-53\": [\"CM-6\"]}, {\"pci_dss_v3.2.1\": [\"11.5\"]}]'),(19120,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules:&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-identity.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.5\"]}]'),(19121,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-system-locale.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-system-locale.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}, {\"nist_sp_800-53\": [\"CM-6\"]}, {\"pci_dss_v3.2.1\": [\"11.5\"]}]'),(19122,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;AppArmor&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.&#x20;','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-MAC-policy.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}, {\"nist_sp_800-53\": [\"CM-6\"]}, {\"pci_dss_v3.2.1\": [\"11.5\"]}]'),(19123,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules:&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-logins.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc_v7\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"cmmc_v2.0\": [\"AC.2.010\", \"AC.3.019\", \"IA.3.086\", \"SI.5.223\", \"AC.4.032\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.9.4.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1527\", \"T1176\", \"T1213\", \"T1038\", \"T1482\", \"T1114\", \"T1484\", \"T1161\", \"T1031\", \"T1528\", \"T1197\", \"T1538\", \"T1044\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1050\", \"T1163\", \"T1021\", \"T1023\", \"T1537\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"8.1.8\", \"10.2.4\", \"10.2.5\"]}]'),(19124,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.&#x20;Note:&#x20;-&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;-&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules:&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-session.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc_v7\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"cmmc_v2.0\": [\"AC.2.010\", \"AC.3.019\", \"IA.3.086\", \"SI.5.223\", \"AC.4.032\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.9.4.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1527\", \"T1176\", \"T1213\", \"T1038\", \"T1482\", \"T1114\", \"T1484\", \"T1161\", \"T1031\", \"T1528\", \"T1197\", \"T1538\", \"T1044\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1050\", \"T1163\", \"T1021\", \"T1023\", \"T1537\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"8.1.8\", \"10.2.4\", \"10.2.5\"]}]'),(19125,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules:&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-perm_mod.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-perm_mod.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}, {\"nist_sp_800-53\": [\"CM-6\"]}, {\"pci_dss_v3.2.1\": [\"11.5\"]}]'),(19126,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;creat&#41;,&#x20;opening&#x20;&#40;open,&#x20;openat&#41;&#x20;and&#x20;truncation&#x20;&#40;truncate,&#x20;ftruncate&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-access.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-access.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AU.3.050\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.1\", \"11.5\"]}]'),(19127,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.&#x20;Note:&#x20;-&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;-&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-mounts.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-mounts.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19128,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.&#x20;Note:&#x20;-&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;-&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-delete.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-delete.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19129,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-scope.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.5\"]}]'),(19130,'Ensure&#x20;system&#x20;administrator&#x20;command&#x20;executions&#x20;&#40;sudo&#41;&#x20;are&#x20;collected.','sudo&#x20;provides&#x20;users&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;to&#x20;perform&#x20;operations.&#x20;Monitor&#x20;the&#x20;administrator&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;and&#x20;the&#x20;operation&#40;s&#41;&#x20;they&#x20;performed.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Creating&#x20;an&#x20;audit&#x20;log&#x20;of&#x20;administrators&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;and&#x20;the&#x20;operation&#40;s&#41;&#x20;they&#x20;performed&#x20;is&#x20;essential&#x20;to&#x20;reporting.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;sudo&#x20;logfile&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules:&#x20;Example:&#x20;`vi&#x20;/etc/audit/rules.d/50-actions.rules&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;-a&#x20;exit,always&#x20;-F&#x20;arch=b32&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;euid=0&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-S&#x20;execve&#x20;-k&#x20;actions&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules:&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-actions.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;euid=0&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-S&#x20;execve&#x20;-k&#x20;actions&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;euid=0&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-S&#x20;execve&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc_v7\": [\"4.9\"]}, {\"iso_27001-2013\": [\"A.9.4.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\"]}, {\"nist_sp_800-53\": [\"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.2.4\"]}]'),(19131,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;32&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-modules.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/50-modules.rules&#x20;Add&#x20;the&#x20;following&#x20;lines:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19132,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;is&#x20;a&#x20;recommended&#x20;replacement&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog:&#x20;#&#x20;apt&#x20;install&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19133,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19134,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;every&#x20;instance&#x20;of&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19135,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system&#x20;Note:&#x20;Ensure&#x20;that&#x20;the&#x20;selection&#x20;of&#x20;logfiles&#x20;being&#x20;sent&#x20;follows&#x20;local&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;one&#x20;of&#x20;the&#x20;following&#x20;lines:&#x20;Newer&#x20;syntax:&#x20;&lt;files&#x20;to&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;log&#x20;server&gt;&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;&lt;FQDN&#x20;or&#x20;ip&#x20;of&#x20;loghost&gt;&quot;&#x20;port=&quot;&lt;port&#x20;number&gt;&quot;&#x20;protocol=&quot;tcp&quot;&#x20;action.resumeRetryCount=&quot;&lt;number&#x20;of&#x20;re-tries&gt;&quot;&#x20;queue.type=&quot;LinkedList&quot;&#x20;queue.size=&lt;number&#x20;of&#x20;messages&#x20;to&#x20;queue&gt;&quot;&#41;&#x20;Example:&#x20;*.*&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;192.168.2.100&quot;&#x20;port=&quot;514&quot;&#x20;protocol=&quot;tcp&quot;&#x20;action.resumeRetryCount=&quot;100&quot;&#x20;queue.type=&quot;LinkedList&quot;&#x20;queue.size=&quot;1000&quot;&#41;&#x20;Older&#x20;syntax:&#x20;*.*&#x20;@@&lt;FQDN&#x20;or&#x20;ip&#x20;of&#x20;loghost&gt;&#x20;Example:&#x20;*.*&#x20;@@192.168.2.100&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslog&#x20;configuration:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc_v7\": [\"6.6\", \"6.8\"]}, {\"cmmc_v2.0\": [\"AU.3.051\", \"AU.3.052\", \"AU.4.053\", \"SI.2.214\"]}, {\"pci_dss_v3.2.1\": [\"10.5.3\", \"10.6.1\"]}]'),(19136,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.&#x20;Notes:&#x20;-&#x20;This&#x20;recommendation&#x20;assumes&#x20;that&#x20;recommendation&#x20;4.2.1.5,&#x20;&quot;Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&quot;&#x20;has&#x20;been&#x20;implemented.&#x20;-&#x20;As&#x20;noted&#x20;in&#x20;the&#x20;journald&#x20;man&#x20;pages,&#x20;journald&#x20;logs&#x20;may&#x20;be&#x20;exported&#x20;to&#x20;rsyslog&#x20;either&#x20;through&#x20;the&#x20;process&#x20;mentioned&#x20;here,&#x20;or&#x20;through&#x20;a&#x20;facility&#x20;like&#x20;systemd-&#x20;journald.service.&#x20;There&#x20;are&#x20;trade-offs&#x20;involved&#x20;in&#x20;each&#x20;implementation,&#x20;where&#x20;ForwardToSyslog&#x20;will&#x20;immediately&#x20;capture&#x20;all&#x20;events&#x20;&#40;and&#x20;forward&#x20;to&#x20;an&#x20;external&#x20;log&#x20;server,&#x20;if&#x20;properly&#x20;configured&#41;,&#x20;but&#x20;may&#x20;not&#x20;capture&#x20;all&#x20;boot-up&#x20;activities.&#x20;Mechanisms&#x20;such&#x20;as&#x20;systemd-journald.service,&#x20;on&#x20;the&#x20;other&#x20;hand,&#x20;will&#x20;record&#x20;bootup&#x20;events,&#x20;but&#x20;may&#x20;delay&#x20;sending&#x20;the&#x20;information&#x20;to&#x20;rsyslog,&#x20;leading&#x20;to&#x20;the&#x20;potential&#x20;for&#x20;log&#x20;manipulation&#x20;prior&#x20;to&#x20;export.&#x20;Be&#x20;aware&#x20;of&#x20;the&#x20;limitations&#x20;of&#x20;all&#x20;tools&#x20;employed&#x20;to&#x20;secure&#x20;a&#x20;system.&#x20;-&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc_v7\": [\"6.5\"]}, {\"cmmc_v2.0\": [\"AU.3.048\"]}, {\"pci_dss_v3.2.1\": [\"10.5.3\", \"10.5.4\"]}]'),(19137,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.&#x20;Note:&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-4\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}]'),(19138,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.&#x20;Note:&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19139,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled&#x20;and&#x20;running.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;cron:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc_v7\": [\"6\"]}]'),(19140,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19141,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.hourly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly/','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19142,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.daily&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily/','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19143,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19144,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.monthly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly/','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19145,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.d&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d/','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19146,'Ensure&#x20;cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;this&#x20;service.&#x20;If&#x20;/etc/cron.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;this&#x20;file&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;Notes:&#x20;-&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.&#x20;-&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;-&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow:&#x20;#&#x20;chmod&#x20;g-wx,o-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19147,'Ensure&#x20;at&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;this&#x20;service.&#x20;If&#x20;/etc/at.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;this&#x20;file&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;at&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;at&#x20;jobs.&#x20;Using&#x20;the&#x20;at.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;at&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/at.deny:&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/at.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/at.allow:#&#x20;chmod&#x20;g-wx,o-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.9\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19148,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.&#x20;Note:&#x20;Use&#x20;the&#x20;sudo-ldap&#x20;package&#x20;if&#x20;you&#x20;need&#x20;LDAP&#x20;support&#x20;for&#x20;sudoers.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Install&#x20;sudo&#x20;using&#x20;the&#x20;following&#x20;command.&#x20;#&#x20;apt&#x20;install&#x20;sudo&#x20;OR&#x20;#&#x20;apt&#x20;install&#x20;sudo-ldap','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.2.008\", \"IA.1.076\", \"IA.1.077\", \"SC.3.181\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19149,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty.&#x20;Note:&#x20;visudo&#x20;edits&#x20;the&#x20;sudoers&#x20;file&#x20;in&#x20;a&#x20;safe&#x20;fashion,&#x20;analogous&#x20;to&#x20;vipw&#40;8&#41;.&#x20;visudo&#x20;locks&#x20;the&#x20;sudoers&#x20;file&#x20;against&#x20;multiple&#x20;simultaneous&#x20;edits,&#x20;provides&#x20;basic&#x20;sanity&#x20;checks,&#x20;and&#x20;checks&#x20;or&#x20;parse&#x20;errors.&#x20;If&#x20;the&#x20;sudoers&#x20;file&#x20;is&#x20;currently&#x20;being&#x20;edited&#x20;you&#x20;will&#x20;receive&#x20;a&#x20;message&#x20;to&#x20;try&#x20;again&#x20;later.','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.2.008\", \"IA.1.076\", \"IA.1.077\", \"SC.3.181\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19150,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file.&#x20;Note:&#x20;visudo&#x20;edits&#x20;the&#x20;sudoers&#x20;file&#x20;in&#x20;a&#x20;safe&#x20;fashion,&#x20;analogous&#x20;to&#x20;vipw&#40;8&#41;.&#x20;visudo&#x20;locks&#x20;the&#x20;sudoers&#x20;file&#x20;against&#x20;multiple&#x20;simultaneous&#x20;edits,&#x20;provides&#x20;basic&#x20;sanity&#x20;checks,&#x20;and&#x20;checks&#x20;or&#x20;parse&#x20;errors.&#x20;If&#x20;the&#x20;sudoers&#x20;file&#x20;is&#x20;currently&#x20;being&#x20;edited&#x20;you&#x20;will&#x20;receive&#x20;a&#x20;message&#x20;to&#x20;try&#x20;again&#x20;later.','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands.','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;&#x20;Example:&#x20;Defaults&#x20;logfile=&quot;/var/log/sudo.log&quot;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"cmmc_v2.0\": [\"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.3\"]}]'),(19151,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19152,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions,&#x20;ownership,&#x20;and&#x20;group&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;u-x,go-rwx&#x20;{}&#x20;;','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19153,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;public&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;u-x,go-wx&#x20;{}&#x20;;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19154,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;-&#x20;AllowUsers:&#x20;&gt;&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;AllowGroups:&#x20;&gt;&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;-&#x20;DenyUsers:&#x20;&gt;&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;DenyGroups:&#x20;&gt;&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;OR&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.2.008\", \"IA.1.076\", \"IA.1.077\", \"SC.3.181\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19155,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;OR&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.3.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.2.042\", \"AU.5.055\", \"CM.2.065\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-12\", \"AU-3\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.3\"]}]'),(19156,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;an&#x20;existing&#x20;SSH&#x20;shell&#x20;session&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','X11&#x20;programs&#x20;on&#x20;the&#x20;server&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;be&#x20;forwarded&#x20;to&#x20;a&#x20;ssh-client&#x20;display.','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.3.6\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19157,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.3.7\"]}, {\"cis_csc_v7\": [\"16.13\"]}, {\"cmmc_v2.0\": [\"SI.5.223\", \"AC.4.032\"]}, {\"mitre_techniques\": [\"T1134\", \"T1197\", \"T1538\", \"T1530\", \"T1213\", \"T1089\", \"T1157\", \"T1044\", \"T1484\", \"T1054\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1034\", \"T1163\", \"T1076\", \"T1021\", \"T1053\", \"T1489\", \"T1051\", \"T1023\", \"T1165\", \"T1528\", \"T1501\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}]'),(19158,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.3.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19159,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.3.9\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"mitre_techniques\": [\"T1110\", \"T1098\", \"T1017\", \"T1136\", \"T1530\", \"T1114\", \"T1133\", \"T1040\", \"T1076\", \"T1021\", \"T1539\", \"T1072\", \"T1078\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1089\", \"T1157\", \"T1044\", \"T1484\", \"T1054\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1034\", \"T1163\", \"T1053\", \"T1489\", \"T1051\", \"T1023\", \"T1165\", \"T1528\", \"T1501\", \"T1537\", \"T1047\", \"T1084\", \"T1004\"]}, {\"pci_dss_v3.2.1\": [\"8.3\"]}]'),(19160,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.3.10\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.2.008\", \"IA.1.076\", \"IA.1.077\", \"SC.3.181\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19161,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.3.11\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"mitre_techniques\": [\"T1110\", \"T1098\", \"T1017\", \"T1136\", \"T1530\", \"T1114\", \"T1133\", \"T1040\", \"T1076\", \"T1021\", \"T1539\", \"T1072\", \"T1078\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1089\", \"T1157\", \"T1044\", \"T1484\", \"T1054\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1034\", \"T1163\", \"T1053\", \"T1489\", \"T1051\", \"T1023\", \"T1165\", \"T1528\", \"T1501\", \"T1537\", \"T1047\", \"T1084\", \"T1004\"]}, {\"pci_dss_v3.2.1\": [\"8.3\"]}]'),(19162,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;a&#x20;Trojan&rsquo;s&#x20;programs&#41;.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.3.12\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19163,'Ensure&#x20;only&#x20;strong&#x20;Ciphers&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Note:&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;ciphers.&#x20;Ensure&#x20;that&#x20;ciphers&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.&#x20;-&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack.&#x20;-&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involving&#x20;LSB&#x20;values,&#x20;aka&#x20;the&#x20;&quot;Bar&#x20;Mitzvah&quot;&#x20;issue.&#x20;-&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session.&#x20;-&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.3.13\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"cmmc_v2.0\": [\"SC.3.177\", \"SC.3.185\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1527\", \"T1119\", \"T1530\", \"T1114\", \"T1070\", \"T1208\", \"T1040\", \"T1145\", \"T1492\", \"T1493\"]}, {\"pci_dss_v3.2.1\": [\"4.1\"]}]'),(19164,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;Specifies&#x20;the&#x20;available&#x20;MAC&#x20;&#40;message&#x20;authentication&#x20;code&#41;&#x20;algorithms.&#x20;The&#x20;MAC&#x20;algorithm&#x20;is&#x20;used&#x20;in&#x20;protocol&#x20;version&#x20;2&#x20;for&#x20;data&#x20;integrity&#x20;protection.&#x20;Multiple&#x20;algorithms&#x20;must&#x20;be&#x20;comma-separated.&#x20;Note:&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;MACs.&#x20;Ensure&#x20;that&#x20;MACs&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-&#x20;512,hmac-sha2-256','[{\"cis\": [\"5.3.14\"]}, {\"cis_csc_v7\": [\"14.4\", \"16.5\"]}, {\"cmmc_v2.0\": [\"IA.2.081\", \"SC.3.177\", \"SC.3.185\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1527\", \"T1119\", \"T1530\", \"T1114\", \"T1070\", \"T1208\", \"T1040\", \"T1145\", \"T1492\", \"T1493\"]}, {\"nist_sp_800-53\": [\"IA-5\"]}, {\"pci_dss_v3.2.1\": [\"4.1\", \"8.2.1\"]}]'),(19165,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received&#x20;Note:&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;Key&#x20;Exchange&#x20;algorithms.&#x20;Ensure&#x20;that&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms.&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256','[{\"cis\": [\"5.3.15\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"cmmc_v2.0\": [\"SC.3.177\", \"SC.3.185\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1527\", \"T1119\", \"T1530\", \"T1114\", \"T1070\", \"T1208\", \"T1040\", \"T1145\", \"T1492\", \"T1493\"]}, {\"pci_dss_v3.2.1\": [\"4.1\"]}]'),(19166,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;-&#x20;ClientAliveInterval&#x20;sets&#x20;a&#x20;timeout&#x20;interval&#x20;in&#x20;seconds&#x20;after&#x20;which&#x20;if&#x20;no&#x20;data&#x20;has&#x20;been&#x20;received&#x20;from&#x20;the&#x20;client,&#x20;sshd&#x20;will&#x20;send&#x20;a&#x20;message&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;to&#x20;request&#x20;a&#x20;response&#x20;from&#x20;the&#x20;client.&#x20;The&#x20;default&#x20;is&#x20;0,&#x20;indicating&#x20;that&#x20;these&#x20;messages&#x20;will&#x20;not&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;client.&#x20;-&#x20;ClientAliveCountMax&#x20;sets&#x20;the&#x20;number&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;which&#x20;may&#x20;be&#x20;sent&#x20;without&#x20;sshd&#x20;receiving&#x20;any&#x20;messages&#x20;back&#x20;from&#x20;the&#x20;client.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x20;reached&#x20;while&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;being&#x20;sent,&#x20;sshd&#x20;will&#x20;disconnect&#x20;the&#x20;client,&#x20;terminating&#x20;the&#x20;session.&#x20;The&#x20;default&#x20;value&#x20;is&#x20;3.&#x20;&gt;&#x20;The&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;through&#x20;the&#x20;encrypted&#x20;channel.&#x20;&gt;&#x20;Setting&#x20;ClientAliveCountMax&#x20;to&#x20;0&#x20;disables&#x20;connection&#x20;termination.&#x20;Example:&#x20;If&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;ssh&#x20;session&#x20;to&#x20;remain&#x20;active&#x20;after&#x20;the&#x20;connection&#x20;with&#x20;the&#x20;client&#x20;has&#x20;been&#x20;interrupted.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;this&#x20;risk.&#x20;-&#x20;The&#x20;recommended&#x20;ClientAliveInterval&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;.&#x20;-&#x20;The&#x20;recommended&#x20;ClientAliveCountMax&#x20;setting&#x20;is&#x20;3.&#x20;-&#x20;The&#x20;ssh&#x20;session&#x20;would&#x20;send&#x20;three&#x20;keep&#x20;alive&#x20;messages&#x20;at&#x20;5&#x20;minute&#x20;intervals.&#x20;If&#x20;no&#x20;response&#x20;is&#x20;received&#x20;after&#x20;the&#x20;third&#x20;keep&#x20;alive&#x20;message,&#x20;the&#x20;ssh&#x20;session&#x20;would&#x20;be&#x20;terminated&#x20;after&#x20;15&#x20;minutes.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;This&#x20;should&#x20;include&#x20;ClientAliveInterval&#x20;between&#x20;1&#x20;and&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;between&#x20;1&#x20;and&#x20;3:&#x20;ClientAliveInterval&#x20;300&#x20;ClientAliveCountMax&#x20;3','[{\"cis\": [\"5.3.16\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19167,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.3.17\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19168,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.3.18\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19169,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','If&#x20;UsePAM&#x20;is&#x20;enabled,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;run&#x20;sshd&#40;5&#41;&#x20;as&#x20;a&#x20;non-root&#x20;user.','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.3.19\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19170,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','SSH&#x20;tunnels&#x20;are&#x20;widely&#x20;used&#x20;in&#x20;many&#x20;corporate&#x20;environments&#x20;that&#x20;employ&#x20;mainframe&#x20;systems&#x20;as&#x20;their&#x20;application&#x20;backends.&#x20;In&#x20;those&#x20;environments&#x20;the&#x20;applications&#x20;themselves&#x20;may&#x20;have&#x20;very&#x20;limited&#x20;native&#x20;support&#x20;for&#x20;security.&#x20;By&#x20;utilizing&#x20;tunneling,&#x20;compliance&#x20;with&#x20;SOX,&#x20;HIPAA,&#x20;PCI-DSS,&#x20;and&#x20;other&#x20;standards&#x20;can&#x20;be&#x20;achieved&#x20;without&#x20;having&#x20;to&#x20;modify&#x20;the&#x20;applications.','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.3.20\"]}, {\"cis_csc_v7\": [\"9.2\", \"13,5\"]}, {\"cmmc_v2.0\": [\"AC.3.020\", \"AC.3.022\", \"CM.3.068\", \"SC.5.230\"]}, {\"iso_27001-2013\": [\"A.6.2.1\", \"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1527\", \"T1119\", \"T1530\", \"T1114\", \"T1070\", \"T1208\", \"T1040\", \"T1145\", \"T1492\", \"T1493\"]}, {\"nist_sp_800-53\": [\"SI-4\"]}, {\"pci_dss_v3.2.1\": [\"1.2.1\", \"2.2.2\", \"2.2.5\"]}]'),(19171,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxStartups&#x20;10:30:60','[{\"cis\": [\"5.3.21\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19172,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;limited.','The&#x20;MaxSessions&#x20;parameter&#x20;Specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;per&#x20;network&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;/etc/ssh/sshd_config&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/ssh/sshd_config.d/&#x20;ending&#x20;in&#x20;.conf&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10','[{\"cis\": [\"5.3.22\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19173,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;Password&#x20;Length:&#x20;&gt;&#x20;minlen&#x20;=&#x20;14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more&#x20;-&#x20;Password&#x20;complexity:&#x20;&gt;&#x20;minclass&#x20;=&#x20;4&#x20;-&#x20;The&#x20;minimum&#x20;number&#x20;of&#x20;required&#x20;classes&#x20;of&#x20;characters&#x20;for&#x20;the&#x20;new&#x20;password&#x20;&#40;digits,&#x20;uppercase,&#x20;lowercase,&#x20;others&#41;&#x20;OR&#x20;&gt;&#x20;dcredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit&#x20;&gt;&#x20;ucredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character&#x20;&gt;&#x20;ocredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character&#x20;&gt;&#x20;lcredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character&#x20;The&#x20;following&#x20;is&#x20;set&#x20;in&#x20;the&#x20;/etc/pam.d/common-password&#x20;file:&#x20;-&#x20;retry=3&#x20;-&#x20;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure.&#x20;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#x20;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt&#x20;install&#x20;libpam-pwquality&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;minlen&#x20;=&#x20;14&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;minclass&#x20;=&#x20;4&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19174,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured.','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;-&#x20;deny=n&#x20;-&#x20;n&#x20;represents&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;-&#x20;unlock_time=n&#x20;-&#x20;n&#x20;represents&#x20;the&#x20;number&#x20;of&#x20;seconds&#x20;before&#x20;the&#x20;account&#x20;is&#x20;unlocked.&#x20;-&#x20;audit&#x20;-&#x20;Will&#x20;log&#x20;the&#x20;user&#x20;name&#x20;into&#x20;the&#x20;system&#x20;log&#x20;if&#x20;the&#x20;user&#x20;is&#x20;not&#x20;found.&#x20;-&#x20;silent&#x20;-&#x20;Don&#039;t&#x20;print&#x20;informative&#x20;messages.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;and&#x20;unlock&#x20;time&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-account&#x20;file&#x20;and&#x20;add&#x20;the&#x20;account&#x20;lines&#x20;bellow:&#x20;account&#x20;requisite&#x20;pam_deny.so&#x20;account&#x20;required&#x20;pam_tally2.so','[{\"cis\": [\"5.4.2\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"cmmc_v2.0\": [\"AC.4.025\", \"PS.2.128\", \"IA.3.085\"]}, {\"iso_27001-2013\": [\"A.9.2.6\"]}, {\"mitre_techniques\": [\"T1134\", \"T1197\", \"T1538\", \"T1530\", \"T1213\", \"T1089\", \"T1157\", \"T1044\", \"T1484\", \"T1054\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1034\", \"T1163\", \"T1076\", \"T1021\", \"T1053\", \"T1489\", \"T1051\", \"T1023\", \"T1165\", \"T1528\", \"T1501\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-2\"]}, {\"pci_dss_v3.2.1\": [\"8.1.3\", \"8.1.4\"]}]'),(19175,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc_v7\": [\"16\"]}]'),(19176,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19177,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;configured.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MIN_DAYS&#x20;1&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;1&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.1\"]}, {\"cis_csc_v6\": [\"16\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19178,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;does&#x20;not&#x20;exceed&#x20;365&#x20;days&#x20;and&#x20;is&#x20;greater&#x20;than&#x20;the&#x20;value&#x20;of&#x20;PASS_MIN_DAYS.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;365&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;365&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19179,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_WARN_AGE&#x20;7&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.3\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19180,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;&#x20;','[{\"cis\": [\"5.5.1.4\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19181,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0&#x20;:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19182,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;adding,&#x20;or&#x20;uncommenting,&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;a&#x20;specific&#x20;group&#x20;to&#x20;execute&#x20;su.&#x20;This&#x20;group&#x20;should&#x20;be&#x20;empty&#x20;to&#x20;reinforce&#x20;the&#x20;use&#x20;of&#x20;sudo&#x20;for&#x20;privileged&#x20;access.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Create&#x20;an&#x20;empty&#x20;group&#x20;that&#x20;will&#x20;be&#x20;specified&#x20;for&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command.&#x20;The&#x20;group&#x20;should&#x20;be&#x20;named&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;#&#x20;groupadd&#x20;sugroup&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file,&#x20;specifying&#x20;the&#x20;empty&#x20;group:&#x20;Example:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;group=sugroup','[{\"cis\": [\"5.7\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.1.002\", \"CM.2.061\", \"SC.3.180\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\", \"IA-6\", \"SC-20\", \"SC-21\"]}, {\"pci_dss_v3.2.1\": [\"2.2\"]}]'),(19183,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19184,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd-','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19185,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19186,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group-','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19187,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/shadow&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/shadow:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19188,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/shadow-&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/shadow-:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19189,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/gshadow&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/gshadow:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/gshadow','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19190,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/gshadow-&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/gshadow-:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"IA.2.081\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"nist_sp_800-53\": [\"IA-5\", \"IA-5 (1)\"]}, {\"pci_dss_v3.2.1\": [\"3.2\", \"8.2.1\"]}]'),(19191,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords.','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;The&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;one-way&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;x&#x20;in&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.&#x20;Notes:&#x20;-&#x20;All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x20;-&#x20;A&#x20;user&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd&#x20;allows&#x20;the&#x20;account&#x20;to&#x20;be&#x20;logged&#x20;into&#x20;by&#x20;providing&#x20;only&#x20;the&#x20;username.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:&#x20;#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwd&#x20;Investigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19192,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.2.078\", \"IA.2.079\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}, {\"nist_sp_800-53\": [\"IA-5 (1)\"]}]'),(19193,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.11\"]}, {\"cis_csc_v7\": [\"4.6\"]}, {\"cmmc_v2.0\": [\"AC.2.008\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1019\", \"T1098\", \"T1017\", \"T1043\", \"T1175\", \"T1136\", \"T1094\", \"T1482\", \"T1048\", \"T1190\", \"T1210\", \"T1133\", \"T1046\", \"T1145\", \"T1076\", \"T1494\", \"T1489\", \"T1051\", \"T1095\", \"T1072\", \"T1199\", \"T1065\", \"T1028\", \"T1112\", \"T1058\", \"T1198\", \"T1209\"]}]'),(19194,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty.','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group&#x20;#&#x20;sed&#x20;-ri&#x20;&#039;s/&#40;^shadow:[^:]*:[^:]*:&#41;&#40;[^:]+$&#41;/1/&#039;&#x20;/etc/group&#x20;Change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.&#x20;#&#x20;usermod&#x20;-g&#x20;&lt;primary&#x20;group&gt;&#x20;&lt;user&gt;','[{\"cis\": [\"6.2.17\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.2.007\", \"MP.2.120\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1035\", \"T1489\", \"T1198\", \"T1184\", \"T1165\", \"T1492\", \"T1169\", \"T1501\", \"T1080\", \"T1209\", \"T1134\", \"T1197\", \"T1538\", \"T1213\", \"T1044\", \"T1484\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1053\", \"T1023\", \"T1528\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}, {\"nist_sp_800-53\": [\"AC-3\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}]'),(19500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(19501,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/freevxfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(19502,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/jffs2.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(19503,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/hfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(19504,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.confExample:&#x20;vim&#x20;/etc/modprobe.d/hfsplus.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(19505,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(19506,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19507,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodevto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19508,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19509,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19510,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19511,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19512,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19513,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19514,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19515,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19516,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19517,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition','When&#x20;set&#x20;on&#x20;a&#x20;file&#x20;system,&#x20;this&#x20;option&#x20;prevents&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices&#x20;from&#x20;being&#x20;defined,&#x20;or&#x20;if&#x20;they&#x20;exist,&#x20;from&#x20;being&#x20;used&#x20;as&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19518,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/run/shm&#x20;partition','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/run/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/run/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/run/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/run/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/run/shm','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19519,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/run/shm&#x20;partition','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/run/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/run/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/run/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19520,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/run/shm&#x20;partition','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/run/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/run/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/run/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"2.6\", \"8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19521,'Disable&#x20;Automounting','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/autofs.conf:&#x20;#&#x20;start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"1.1.21\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19522,'Ensure&#x20;AIDE&#x20;is&#x20;installed','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;#&#x20;apt-get&#x20;install&#x20;aide&#x20;aide-common.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19523,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;&#x20;&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19524,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg,&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19525,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/00_header&#x20;or&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;&#x20;&#x20;&#x20;&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;&#x20;EOF&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;&#x20;#&#x20;update-grub','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19526,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19527,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19528,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19529,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19530,'Ensure&#x20;prelink&#x20;is&#x20;disabled','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19531,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/gruband&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19532,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing&#x20;','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19533,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=ubuntu','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19534,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19535,'Ensure&#x20;AppArmor&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwrittenby&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;apparmor=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;pdate&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19536,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19537,'Ensure&#x20;SELinux&#x20;or&#x20;AppArmor&#x20;are&#x20;installed','SELinux&#x20;and&#x20;AppArmor&#x20;provide&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;SELinux&#x20;or&#x20;apparmor:&#x20;#&#x20;apt-get&#x20;install&#x20;selinux&#x20;&#x20;Or:&#x20;#&#x20;apt-get&#x20;install&#x20;apparmor','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19538,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(19539,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(19540,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(19541,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19542,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19543,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19544,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Create&#x20;the&#x20;/etc/dconf/profile/gdm&#x20;file&#x20;with&#x20;the&#x20;following&#x20;contents:&#x20;&#x20;&#x20;&#x20;user-db:user&#x20;&#x20;&#x20;&#x20;system-db:gdm&#x20;&#x20;&#x20;&#x20;&#x20;file-db:/usr/share/gdm/greeter-dconf-defaults&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;banner-message-enable&#x20;and&#x20;banner-message-text&#x20;options&#x20;in&#x20;/etc/dconf/db/gdm.d/01-banner-message:&#x20;&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;system&#x20;databases:&#x20;#&#x20;dconf&#x20;update','[{\"cis\": [\"1.7.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19545,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Notes:&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(19546,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;chargen&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;chargen&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19547,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;daytime&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;daytime&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19548,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled','discard&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;discard&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;discard&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19549,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;echo&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;echo&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19550,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled','time&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;time&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;time&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19551,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;rsh,&#x20;rlogin,&#x20;rexec&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;shell,&#x20;login&#x20;or&#x20;exec&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;shell,&#x20;login&#x20;or&#x20;exec&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19552,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;talk&#x20;or&#x20;ntalk&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;talk&#x20;or&#x20;ntalk&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19553,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecureand&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;telnet&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;telnet&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19554,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;packages&#x20;tftpd&#x20;and&#x20;atftp&#x20;are&#x20;both&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specificneed&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;tftp&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;tftp&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19555,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetddaemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/xinetd.conf:&#x20;#&#x20;start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19556,'Ensure&#x20;openbsd-inetd&#x20;is&#x20;not&#x20;installed','The&#x20;inetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;inetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openbsd-inetd:&#x20;apt-get&#x20;remove&#x20;openbsd-inetd','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19557,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;install&#x20;NTP&#x20;or&#x20;chrony&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;ntp&#x20;#&#x20;apt-get&#x20;install&#x20;chrony&#x20;&#x20;&#x20;&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19558,'Ensure&#x20;ntp&#x20;is&#x20;configured','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;RUNASUSER=ntp','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19559,'Ensure&#x20;chrony&#x20;is&#x20;configured','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19560,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt-get&#x20;remove&#x20;xserver-xorg*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(19561,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attach&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/avahi-daemon.conf:&#x20;#start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19562,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/cups.conf:&#x20;#start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19563,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/isc-dhcp-server.conf&#x20;and&#x20;/etc/init/isc-dhcp-server6.conf:&#x20;#start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19564,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;enabled','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;update-rc.d&#x20;slapd&#x20;disable','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19565,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/rpcbind.conf:&#x20;#&#x20;start&#x20;on&#x20;start-rpcbind&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;nfs-kernel-server:&#x20;#&#x20;update-rc.d&#x20;nfs-kernel-server&#x20;disable','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19566,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;bind9:&#x20;#&#x20;update-rc.d&#x20;bind9&#x20;disable','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19567,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/vsftpd.conf:&#x20;#&#x20;start&#x20;on&#x20;runlevel&#x20;[2345]&#x20;or&#x20;net-device-up&#x20;IFACE!=lo','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19568,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2:&#x20;#&#x20;update-rc.d&#x20;apache2&#x20;disable','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19569,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/dovecot.conf:&#x20;#&#x20;start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19570,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/smbd.conf:&#x20;#&#x20;start&#x20;on&#x20;&#40;local-filesystems&#x20;and&#x20;net-device-up&#41;','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19571,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/squid3.conf:&#x20;#&#x20;start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19572,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;update-rc.d&#x20;snmpd&#x20;disable','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19573,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;&#x20;service&#x20;postfix&#x20;restart','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(19574,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Edit&#x20;the&#x20;/etc/default/rsync&#x20;file&#x20;and&#x20;set&#x20;RSYNC_ENABLE&#x20;to&#x20;false&#x20;:RSYNC_ENABLE=false','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(19575,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Remove&#x20;or&#x20;comment&#x20;out&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/ypserv.conf:&#x20;&#x20;&#x20;&#x20;#start&#x20;on&#x20;&#40;started&#x20;portmap&#x20;ON_BOOT=&#x20;&#x20;&#x20;&#x20;&#x20;#or&#x20;&#40;started&#x20;portmap&#x20;ON_BOOT=y&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#and&#x20;&#40;&#40;filesystem&#x20;and&#x20;static-network-up&#41;&#x20;or&#x20;failsafe-boot&#41;&#41;&#41;','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19576,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;the&#x20;nis&#x20;package:&#x20;#&#x20;apt-get&#x20;remove&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19577,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;rshpackage&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rshpackage&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcpand&#x20;rlogin.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;apt-get&#x20;remove&#x20;rsh-client&#x20;rsh-redone-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2.6\", \"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19578,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;talksoftware&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talkclient,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;apt-get&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19579,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;apt-get&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2.6\", \"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19580,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;apt-get&#x20;remove&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19581,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;s&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19582,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;net.ipv4.conf.all.send_redirects&#x20;and&#x20;net.ipv4.conf.default.send_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19583,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19584,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19585,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19586,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19587,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19588,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19589,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19590,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19591,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19592,'Ensure&#x20;IPv6&#x20;redirects&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;ICMP&#x20;redirects.&#x20;ICMP&#x20;redirects&#x20;tell&#x20;the&#x20;system&#x20;about&#x20;alternate&#x20;routes&#x20;for&#x20;sending&#x20;traffic.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;ICMP&#x20;redirets&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19593,'Ensure&#x20;IPv6&#x20;is&#x20;disabled','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;&#039;``ipv6.disable=1&#039;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19594,'Install&#x20;TCP&#x20;Wrappers','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Install&#x20;tcpd&#x20;:&#x20;#&#x20;apt-get&#x20;install&#x20;tcpd&#x20;To&#x20;verify&#x20;if&#x20;a&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;ldd&#x20;&lt;path-to-daemon&gt;&#x20;|&#x20;grep&#x20;libwrap.so&#x20;If&#x20;there&#x20;is&#x20;any&#x20;output,&#x20;then&#x20;the&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers.','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(19595,'Ensure&#x20;/etc/hosts.allow&#x20;is&#x20;configured','The&#x20;/etc/hosts.allow&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.deny&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;/etc/hosts.allow.&#x20;Where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#x20;&#40;for&#x20;example,&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;represents&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(19596,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.deny&#x20;file&#x20;serves&#x20;as&#x20;a&#x20;failsafe&#x20;so&#x20;that&#x20;any&#x20;host&#x20;not&#x20;specified&#x20;in&#x20;/etc/hosts.allow&#x20;is&#x20;denied&#x20;access&#x20;to&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(19597,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.allow','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19598,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.deny','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19599,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-&#x20;sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.5.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19600,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.5.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19601,'Ensure&#x20;RDS&#x20;is&#x20;disabled','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19602,'Ensure&#x20;TIPC&#x20;is&#x20;disabled','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.5.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19603,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.6.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(19604,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.6.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(19605,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Notes:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.4\"]}]'),(19606,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.4\"]}]'),(19607,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.4\"]}]'),(19608,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;update-rc.d&#x20;auditd&#x20;enable','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\"\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19609,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled','Configure&#x20;grub&#x20;or&#x20;lilo&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','1&#41;&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19610,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-&#x20;change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.3\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19611,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19612,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-&#x20;login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/sysconfig/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;Notes:&#x20;/etc/sysconfig/network&#x20;is&#x20;common&#x20;to&#x20;Red&#x20;Hat&#x20;and&#x20;SUSE&#x20;based&#x20;distributions.&#x20;You&#x20;should&#x20;expand&#x20;or&#x20;replace&#x20;this&#x20;coverage&#x20;to&#x20;any&#x20;network&#x20;configuration&#x20;files&#x20;on&#x20;your&#x20;system&#x20;such&#x20;as&#x20;/etc/network&#x20;on&#x20;Debian&#x20;based&#x20;distributions.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19613,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected','Monitor&#x20;SELinux/AppArmor&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','On&#x20;systems&#x20;using&#x20;SELinux&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;&#x20;|&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;On&#x20;systems&#x20;using&#x20;AppArmor&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;|&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19614,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19615,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;|&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19616,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19617,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19618,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19619,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"6,2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(19620,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;|&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19621,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions.&#x20;Notes:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;sudisabled&#x20;&#40;See&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19622,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(19623,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-e&#x20;2.&#x20;Notes:&#x20;This&#x20;setting&#x20;will&#x20;ensure&#x20;reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\"]}]'),(19624,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Set&#x20;the&#x20;proper&#x20;start&#x20;conditions&#x20;in&#x20;/etc/init/rsyslog.conf:&#x20;start&#x20;on&#x20;filesystem','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19625,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(19626,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;:&#x20;*.*&#x20;@@loghost.example.com.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19627,'Ensure&#x20;remote&#x20;rsyslog&#x20;messages&#x20;are&#x20;only&#x20;accepted&#x20;on&#x20;designated&#x20;log&#x20;hosts','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:$ModLoad&#x20;imtcp&#x20;&amp;&#x20;$InputTCPServerRun&#x20;514.&#x20;For&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;comment&#x20;or&#x20;remove&#x20;the&#x20;following&#x20;lines:&#x20;#&#x20;$ModLoad&#x20;imtcp&#x20;#&#x20;$InputTCPServerRun&#x20;514.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"10.5.1\"]}]'),(19628,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;update-rc.d&#x20;syslog-ng&#x20;enable','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19629,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(19630,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19631,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;rsyslog&#x20;#&#x20;apt-get&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19632,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;start&#x20;lines&#x20;in&#x20;/etc/init/cron.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;start&#x20;on&#x20;runlevel&#x20;[2345]','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19633,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(19634,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19635,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19636,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19637,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19638,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19639,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19640,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-&#x20;privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19641,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.&#x20;Notes:&#x20;This&#x20;command&#x20;not&#x20;longer&#x20;exists&#x20;in&#x20;newer&#x20;versions&#x20;of&#x20;SSH.&#x20;This&#x20;check&#x20;is&#x20;still&#x20;being&#x20;included&#x20;for&#x20;systems&#x20;that&#x20;may&#x20;be&#x20;running&#x20;an&#x20;older&#x20;version&#x20;of&#x20;SSH.&#x20;As&#x20;of&#x20;openSSH&#x20;version&#x20;7.4&#x20;this&#x20;parameter&#x20;will&#x20;not&#x20;cause&#x20;an&#x20;issue&#x20;when&#x20;included.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(19642,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.&#x20;INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(19643,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19644,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19645,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhostsand&#x20;.shostsfiles&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthenticationor&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(19646,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(19647,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(19648,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(19649,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(19650,'Ensure&#x20;only&#x20;approved&#x20;MAC&#x20;algorithms&#x20;are&#x20;used','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-&#x20;512,hmac-sha2-256','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(19651,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(19652,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}]'),(19653,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}]'),(19654,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19655,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options:&#x20;-&#x20;retry=3&#x20;&#40;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure&#41;.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#40;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#41;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt-get&#x20;install&#x20;libpam-pwquality&#x20;2&#41;&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3&#x20;3&#41;&#x20;Edit&#x20;/etc/security/pwquality.conf&#x20;to&#x20;add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;settings&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;requirements&#x20;only&#x20;cover&#x20;including&#x20;try_first_pass&#x20;and&#x20;minlen&#x20;set&#x20;to&#x20;14&#x20;or&#x20;more.&#x20;Settings&#x20;in&#x20;/etc/security/pwquality.conf&#x20;must&#x20;use&#x20;spaces&#x20;around&#x20;the&#x20;=&#x20;symbol.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}]'),(19656,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900.&#x20;','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(19657,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(19658,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(19659,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;5th&#x20;field&#x20;should&#x20;be&#x20;365&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;will&#x20;disable&#x20;password&#x20;expiration.&#x20;Additionally&#x20;the&#x20;password&#x20;expiration&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;the&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;or&#x20;users&#x20;will&#x20;be&#x20;unable&#x20;to&#x20;change&#x20;their&#x20;password.','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2.4\"]}]'),(19660,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;4th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(19661,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;6th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(19662,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;7th&#x20;field&#x20;should&#x20;be&#x20;30&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;would&#x20;disable&#x20;this&#x20;setting.','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(19663,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(19664,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(19665,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;files,&#x20;and&#x20;/etc/profile.d*.sh&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(19666,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','1&#41;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;2&#41;&#x20;Create&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;statement&#x20;in&#x20;the&#x20;/etc/group&#x20;file:&#x20;wheel:x:10:root,&lt;user&#x20;list&gt;&#x20;Notes:&#x20;The&#x20;use_uid&#x20;option&#x20;to&#x20;pam_wheel.so&#x20;is&#x20;a&#x20;no-op&#x20;on&#x20;debian&#x20;based&#x20;systems.&#x20;It&#x20;is&#x20;acceptable&#x20;but&#x20;not&#x20;required&#x20;as&#x20;these&#x20;systems&#x20;use&#x20;its&#x20;behavior&#x20;as&#x20;default.','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(19667,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19668,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;one&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19669,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19670,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19671,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19672,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19673,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19674,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(19675,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;&lt;username&gt;&lt;/em&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}]'),(19676,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19677,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19678,'Ensure&#x20;no&#x20;legacy&#x20;&quot;+&quot;&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(19679,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(19680,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"6.2.20\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(20000,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20001,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20002,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20003,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20004,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20005,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20006,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.7\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20007,'Ensure&#x20;mounting&#x20;of&#x20;FAT&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;FAT&#x20;filesystem&#x20;format&#x20;is&#x20;primarily&#x20;used&#x20;on&#x20;older&#x20;windows&#x20;systems&#x20;and&#x20;portable&#x20;USB&#x20;drives&#x20;or&#x20;flash&#x20;modules.&#x20;It&#x20;comes&#x20;in&#x20;three&#x20;types&#x20;FAT12&#x20;,&#x20;FAT16&#x20;,&#x20;and&#x20;FAT32&#x20;all&#x20;of&#x20;which&#x20;are&#x20;supported&#x20;by&#x20;the&#x20;vfat&#x20;kernel&#x20;module.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;vfat&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;vfat&#x20;module:&#x20;rmmod&#x20;vfat','[{\"cis\": [\"1.1.1.8\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20008,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20009,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstabfile&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20010,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20011,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20012,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20013,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20014,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20015,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20016,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20017,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20018,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20019,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20020,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.14\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20021,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20022,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20023,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20024,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;chkconfig&#x20;autofs&#x20;off','[{\"cis\": [\"1.1.19\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20025,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated.','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(20026,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;aide:&#x20;yum&#x20;install&#x20;aide&#x20;//&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20027,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;//&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20028,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;located&#x20;at&#x20;/boot/grub/menu.lst&#x20;and&#x20;linked&#x20;as&#x20;/boot/grub/grub.conf&#x20;and&#x20;/etc/grub.conf&#x20;.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/menu.lst&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/menu.lst','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20029,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/etc/sysconfig/init&#x20;and&#x20;set&#x20;SINGLE&#x20;to&#x20;&#039;&#x20;/sbin/sulogin&#039;:&#x20;&#x20;SINGLE=/sbin/sulogin','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20030,'Ensure&#x20;interactive&#x20;boot&#x20;is&#x20;not&#x20;enabled.','Interactive&#x20;boot&#x20;allows&#x20;console&#x20;users&#x20;to&#x20;interactively&#x20;select&#x20;which&#x20;services&#x20;start&#x20;on&#x20;boot.&#x20;The&#x20;PROMPT&#x20;option&#x20;provides&#x20;console&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;interactively&#x20;boot&#x20;the&#x20;system&#x20;and&#x20;select&#x20;which&#x20;services&#x20;to&#x20;start&#x20;on&#x20;boot&#x20;.&#x20;','Turn&#x20;off&#x20;the&#x20;PROMPT&#x20;option&#x20;on&#x20;the&#x20;console&#x20;to&#x20;prevent&#x20;console&#x20;users&#x20;from&#x20;potentially&#x20;overriding&#x20;established&#x20;security&#x20;settings.&#x20;','','Edit&#x20;the&#x20;/etc/sysconfig/init&#x20;file&#x20;and&#x20;set&#x20;PROMPT&#x20;to&#x20;&#039;&#x20;no&#x20;&#039;:&#x20;PROMPT=no','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(20031,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;and&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20032,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20033,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20034,'Ensure&#x20;prelink&#x20;is&#x20;disabled.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"3.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20035,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration.','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/boot/grub/menu.lst&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;on&#x20;all&#x20;kernel&#x20;lines','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20036,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing.','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20037,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured.','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.6.1.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20038,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed.','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;yum&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.6.1.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20039,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed.','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;yum&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.6.1.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20040,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist.','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.6\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20041,'Ensure&#x20;SELinux&#x20;is&#x20;installed.','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;libselinux:&#x20;yum&#x20;install&#x20;libselinux','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20042,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(20043,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(20044,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(20045,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20046,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20047,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20048,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.&#x20;The&#x20;audit&#x20;and&#x20;remediation&#x20;here&#x20;only&#x20;cover&#x20;security&#x20;updates.&#x20;Non-security&#x20;updates&#x20;can&#x20;be&#x20;audited&#x20;with&#x20;and&#x20;comparing&#x20;against&#x20;site&#x20;policy:&#x20;#&#x20;yum&#x20;check-update','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(20049,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled.','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;chargen-dgram&#x20;and&#x20;chargen-stream:&#x20;#&#x20;chkconfig&#x20;chargen-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;chargen-stream&#x20;off','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20050,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled.','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;daytime-dgram&#x20;and&#x20;daytime-stream:&#x20;#&#x20;chkconfig&#x20;daytime-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;daytime-stream&#x20;off','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20051,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled.','discardis&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;discard-dgram&#x20;and&#x20;discard-stream:&#x20;#&#x20;chkconfig&#x20;discard-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;discard-stream&#x20;off','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20052,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled.','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;echo-dgram&#x20;and&#x20;echo-stream:&#x20;#&#x20;chkconfig&#x20;echo-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;echo-stream&#x20;off','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20053,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled.','time&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;time-dgram&#x20;and&#x20;time-stream:&#x20;#&#x20;chkconfig&#x20;time-dgram&#x20;off;&#x20;#&#x20;chkconfig&#x20;time-stream&#x20;off','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20054,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;&#x20;rsh&#x20;,&#x20;rlogin&#x20;,&#x20;rexec&#x20;&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;rsh,&#x20;rlogin,&#x20;and&#x20;rexec:&#x20;#&#x20;chkconfig&#x20;rsh&#x20;off&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;rlogin&#x20;off&#x20;&#x20;#&#x20;chkconfig&#x20;rexec&#x20;off','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20055,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;talk:&#x20;#&#x20;chkconfig&#x20;talk&#x20;off','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20056,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;telnet:&#x20;#&#x20;chkconfig&#x20;telnet&#x20;off','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20057,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled.','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;package&#x20;tftp-server&#x20;is&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;tftp:&#x20;#&#x20;chkconfig&#x20;tftp&#x20;off','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20058,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;chkconfig&#x20;rsyncd&#x20;off','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20059,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled.','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;xinetd:&#x20;#&#x20;chkconfig&#x20;xinetd&#x20;off','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20060,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;and&#x20;verify&#x20;either&#x20;ntp&#x20;or&#x20;chrony&#x20;is&#x20;installed:&#x20;#&#x20;rpm&#x20;-q&#x20;ntp&#x20;#&#x20;rpm&#x20;-q&#x20;chrony&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;verify&#x20;that&#x20;host&#x20;based&#x20;synchronization&#x20;is&#x20;in&#x20;use.','[{\"cis\": [\"2.2.2.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20061,'Ensure&#x20;ntp&#x20;is&#x20;configured.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;and&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;daemonline&#x20;in/etc/init.d/ntpd&#x20;to&#x20;include&#x20;&#039;&#x20;-u&#x20;ntp:ntp&#x20;&#039;:&#x20;daemon&#x20;$prog&#x20;-u&#x20;ntp:ntp&#x20;-p&#x20;/var/run/ntpd.pid&#x20;$OPTIONS','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20062,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/chrony.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;chronyd&#039;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20063,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;yum&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20064,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;chkconfig&#x20;avahi-daemon&#x20;off','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20065,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups&#x20;:&#x20;#&#x20;chkconfig&#x20;cups&#x20;off','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20066,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;chkconfig&#x20;dhcpd&#x20;off','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20067,'Ensure&#x20;LDAP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;chkconfig&#x20;slapd&#x20;off','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20068,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs,&#x20;nfs-server&#x20;and&#x20;rpcbind:&#x20;#&#x20;chkconfig&#x20;nfs&#x20;off;&#x20;#&#x20;chkconfig&#x20;rpcbind&#x20;off','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20069,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named&#x20;:&#x20;#&#x20;chkconfig&#x20;named&#x20;off','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20070,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;chkconfig&#x20;vsftpd&#x20;off','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20071,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;enabled.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;httpd:&#x20;#&#x20;chkconfig&#x20;httpd&#x20;off','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20072,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;chkconfig&#x20;dovecot&#x20;off','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20073,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smb:&#x20;#&#x20;chkconfig&#x20;smb&#x20;off','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20074,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;chkconfig&#x20;squid&#x20;off','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20075,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;chkconfig&#x20;snmpd&#x20;off','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20076,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;Restart&#x20;postfix:&#x20;#&#x20;service&#x20;postfix&#x20;restart','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(20077,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ypserv:&#x20;#&#x20;chkconfig&#x20;ypserv&#x20;off','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20078,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;yum&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20079,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;rsh','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20080,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20081,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20082,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20083,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20084,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled.','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20085,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted.','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20086,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20087,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20088,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20089,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored.','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20090,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20091,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20092,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled.','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20093,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;and&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20094,'Ensure&#x20;IPv6&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;ICMP&#x20;redirects.&#x20;ICMP&#x20;redirects&#x20;tell&#x20;the&#x20;system&#x20;about&#x20;alternate&#x20;routes&#x20;for&#x20;sending&#x20;traffic.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;ICMP&#x20;redirects&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;&#x20;||&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20095,'Ensure&#x20;IPv6&#x20;is&#x20;disabled.','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/boot/grub/grub.conf&#x20;to&#x20;include&#x20;ipv6.disable=1&#x20;on&#x20;all&#x20;kernel&#x20;lines.','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20096,'Ensure&#x20;TCP&#x20;Wrappers&#x20;is&#x20;installed.','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;tcp_wrappers:&#x20;yum&#x20;install&#x20;tcp_wrappers','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(20097,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured.','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;echo&#x20;&#039;ALL:&#x20;ALL&#039;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(20098,'Ensure&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;are&#x20;configured..','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;networking&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;and&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(20099,'Ensure&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;are&#x20;configured..','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;and&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20100,'Ensure&#x20;DCCP&#x20;is&#x20;disabled.','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.5.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20101,'Ensure&#x20;SCTP&#x20;is&#x20;disabled.','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.5.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20102,'Ensure&#x20;RDS&#x20;is&#x20;disabled.','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20103,'Ensure&#x20;TIPC&#x20;is&#x20;disabled.','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.5.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20104,'Ensure&#x20;iptables&#x20;is&#x20;installed.','iptables&#x20;allows&#x20;configuration&#x20;of&#x20;the&#x20;IPv4&#x20;tables&#x20;in&#x20;the&#x20;linux&#x20;kernel&#x20;and&#x20;the&#x20;rules&#x20;stored&#x20;within&#x20;them.&#x20;Most&#x20;firewall&#x20;configuration&#x20;utilities&#x20;operate&#x20;as&#x20;a&#x20;front&#x20;end&#x20;to&#x20;iptables&#x20;.','iptables&#x20;is&#x20;required&#x20;for&#x20;firewall&#x20;management&#x20;and&#x20;configuration.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;:&#x20;yum&#x20;install&#x20;iptables','[{\"cis\": [\"3.6.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.1\"]}]'),(20105,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;and&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.6.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20106,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.6.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20107,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(20108,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(20109,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(20110,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd&#x20;:&#x20;#&#x20;chkconfig&#x20;auditd&#x20;on','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20111,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/boot/grub/menu.lst&#x20;to&#x20;include&#x20;audit=1&#x20;on&#x20;all&#x20;kernel&#x20;lines.&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20112,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-Farch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;&#x20;&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20113,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20114,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&#x20;&#x20;&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20115,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;directory.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20116,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;/var/run/failock&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20117,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&#x20;&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&#x20;&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.5\", \"16.10\", \"16.4\"]}, {\"pci_dss\": [\"10.3\"]}]'),(20118,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;500&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"3.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20119,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;500&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20120,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20121,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=500&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete','[{\"cis\": [\"4.1.14\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(20122,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20123,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"5.1\", \"5.5\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20124,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod&#x20;,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20125,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file.&#x20;&#x20;&#x20;-e&#x20;2','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"3\", \"6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20126,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lackblogging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;rsyslog&#x20;on','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20127,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(20128,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20129,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;syslog-ng&#x20;:&#x20;&#x20;&#x20;#&#x20;chkconfig&#x20;syslog-ng&#x20;on','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20130,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured.','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20131,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20132,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;&#x20;#&#x20;yum&#x20;install&#x20;rsyslog&#x20;&#x20;&#x20;#&#x20;yum&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20133,'Ensure&#x20;permissions&#x20;on&#x20;all&#x20;logfiles&#x20;are&#x20;configured.','Log&#x20;files&#x20;stored&#x20;in&#x20;/var/log/&#x20;contain&#x20;logged&#x20;information&#x20;from&#x20;many&#x20;services&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;on&#x20;log&#x20;hosts&#x20;others&#x20;as&#x20;well.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitivebdata&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;all&#x20;existing&#x20;log&#x20;files:&#x20;#&#x20;find&#x20;/var/log&#x20;-type&#x20;f&#x20;-exec&#x20;chmod&#x20;g-wx,o-rwx&#x20;{}&#x20;+','[{\"cis\": [\"4.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20134,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;chkconfig&#x20;crond&#x20;on','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20135,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20136,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20137,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20138,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20139,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20140,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20141,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20142,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20143,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2.','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20144,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO.','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20145,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20146,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}]'),(20147,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"9\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20148,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"5.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20149,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20150,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20151,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20152,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.13\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20153,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;AllowGroups&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;DenyUsers&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;DenyGroups&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;;&#x20;AllowGroups&#x20;&lt;grouplist&gt;;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;and&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\", \"5.8\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20154,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20155,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;try_first_pass&#x20;retry=3&#x20;minlen=14&#x20;dcredit=-1&#x20;ucredit=-1&#x20;ocredit=-1&#x20;lcredit=-1','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20156,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;remember=5&#x20;&#x20;&#x20;or&#x20;&#x20;&#x20;&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20157,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(20158,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20159,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20160,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20161,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20162,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20163,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive.','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]');
INSERT INTO `tsca` VALUES (20164,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less.','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc&#x20;and&#x20;/etc/profile&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20165,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted..','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo&#x20;,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su&#x20;,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20166,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.44\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20167,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20168,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20169,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20170,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20171,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20172,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20173,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20174,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20175,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd.','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20176,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow.','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20177,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group.','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20178,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/directory&#x20;ending&#x20;in&#x20;.conf.&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/cramfs.confand&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20501,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;rmmod&#x20;squashfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20502,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(20503,'Ensure&#x20;/tmp&#x20;is&#x20;configured.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexecoption&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmpuseless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuidprogram&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','','Create&#x20;or&#x20;update&#x20;an&#x20;entry&#x20;for&#x20;/tmp&#x20;in&#x20;either&#x20;/etc/fstab&#x20;&#x20;OR&#x20;&#x20;&#x20;in&#x20;a&#x20;systemd&#x20;tmp.mount&#x20;file:&#x20;&#x20;If&#x20;/etc/fstab&#x20;is&#x20;used:&#x20;&#x20;Configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x20;Example:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;&#x20;&#x20;&#x20;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;&#x20;0&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;systemd&#x20;tmp.mount&#x20;file&#x20;is&#x20;used:&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;file&#x20;/etc/systemd/system/tmp.mount&#x20;if&#x20;it&#x20;doesn&#039;t&#x20;exist:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;[&#x20;!&#x20;-f&#x20;/etc/systemd/system/tmp.mount&#x20;]&#x20;&amp;&amp;&#x20;cp&#x20;-v&#x20;/usr/lib/systemd/system/tmp.mount&#x20;/etc/systemd/system/&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/systemd/system/tmp.mount:&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;What=tmpfs&#x20;&#x20;&#x20;&#x20;Where=/tmp&#x20;&#x20;&#x20;&#x20;Type=tmpfs&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;systemd&#x20;daemon:#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;tmp.mount:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mpunt&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;tmp.mount:&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;--now&#x20;tmp.mount','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"9.4\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20504,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;OR&#x20;&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstabfile&#x20;and&#x20;add&#x20;noexecto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20505,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;&#x20;&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20506,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;&#x20;&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;file:&#x20;&#x20;&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;&#x20;&#x20;&#x20;[Mount]&#x20;&#x20;&#x20;Options=mode=1777,strictatime,noexec,nosuid,nosuid&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20507,'Ensure&#x20;/dev/shm&#x20;is&#x20;configured.','/dev/shm&#x20;is&#x20;a&#x20;traditional&#x20;shared&#x20;memory&#x20;concept.&#x20;One&#x20;program&#x20;will&#x20;create&#x20;a&#x20;memory&#x20;portion,&#x20;which&#x20;other&#x20;processes&#x20;&#40;if&#x20;permitted&#41;&#x20;can&#x20;access.&#x20;Mounting&#x20;tmpfs&#x20;at&#x20;/dev/shm&#x20;is&#x20;handled&#x20;automatically&#x20;by&#x20;systemd.','Any&#x20;user&#x20;can&#x20;upload&#x20;and&#x20;execute&#x20;files&#x20;inside&#x20;the&#x20;/dev/shm&#x20;similar&#x20;to&#x20;the&#x20;/tmp&#x20;partition.&#x20;Configuring&#x20;/dev/shm&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/dev/shm&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','Edit&#x20;/etc/fstab&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line:&#x20;&#x20;tmpfs&#x20;/dev/shm&#x20;tmpfs&#x20;defaults,noexec,nodev,nosuid,seclabel&#x20;0&#x20;0&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20508,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20509,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20510,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20511,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20512,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications&#x20;and&#x20;is&#x20;intended&#x20;for&#x20;temporary&#x20;files&#x20;that&#x20;are&#x20;preserved&#x20;across&#x20;reboots.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20513,'Ensure&#x20;/var/tmp&#x20;partition&#x20;includes&#x20;the&#x20;noexec&#x20;option.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','For&#x20;existing&#x20;/var/tmp&#x20;partitions,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;of&#x20;the&#x20;/var/tmp&#x20;entry.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20514,'Ensure&#x20;/var/tmp&#x20;partition&#x20;includes&#x20;the&#x20;nodev&#x20;option.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20515,'Ensure&#x20;/var/tmp&#x20;partition&#x20;includes&#x20;the&#x20;nosuid&#x20;option.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20516,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data&#x20;.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20517,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\", \"10.7\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20518,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20519,'Ensure&#x20;/home&#x20;partition&#x20;includes&#x20;the&#x20;nodev&#x20;option.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.18\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20520,'Ensure&#x20;sticky&#x20;bit&#x20;is&#x20;set&#x20;on&#x20;all&#x20;world-writable&#x20;directories.','Setting&#x20;the&#x20;sticky&#x20;bit&#x20;on&#x20;world&#x20;writable&#x20;directories&#x20;prevents&#x20;users&#x20;from&#x20;deleting&#x20;or&#x20;renaming&#x20;files&#x20;in&#x20;that&#x20;directory&#x20;that&#x20;are&#x20;not&#x20;owned&#x20;by&#x20;them.','This&#x20;feature&#x20;prevents&#x20;the&#x20;ability&#x20;to&#x20;delete&#x20;or&#x20;rename&#x20;files&#x20;in&#x20;world&#x20;writable&#x20;directories&#x20;&#40;such&#x20;as&#x20;/tmp&#x20;&#41;&#x20;that&#x20;are&#x20;owned&#x20;by&#x20;another&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;sticky&#x20;bit&#x20;on&#x20;all&#x20;world&#x20;writable&#x20;directories:&#x20;#&#x20;df&#x20;--local&#x20;-P&#x20;|&#x20;awk&#x20;&#039;{if&#x20;&#40;NR!=1&#41;&#x20;print&#x20;$6}&#039;&#x20;|&#x20;xargs&#x20;-I&#x20;&#039;{}&#039;&#x20;find&#x20;&#039;{}&#039;&#x20;-xdev&#x20;-type&#x20;d&#x20;&#40;&#x20;-perm&#x20;-0002&#x20;-a&#x20;!&#x20;-perm&#x20;-1000&#x20;&#41;&#x20;2&gt;/dev/null&#x20;|&#x20;xargs&#x20;-I&#x20;&#039;{}&#039;&#x20;chmod&#x20;a+t&#x20;&#039;{}&#039;','[{\"cis\": [\"1.1.22\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20521,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20522,'Disable&#x20;USB&#x20;Storage.','USB&#x20;storage&#x20;provides&#x20;a&#x20;means&#x20;to&#x20;transfer&#x20;and&#x20;store&#x20;files&#x20;insuring&#x20;persistence&#x20;and&#x20;availability&#x20;of&#x20;the&#x20;files&#x20;independent&#x20;of&#x20;network&#x20;connection&#x20;status.&#x20;Its&#x20;popularity&#x20;and&#x20;utility&#x20;has&#x20;led&#x20;to&#x20;USB-based&#x20;malware&#x20;being&#x20;a&#x20;simple&#x20;and&#x20;common&#x20;means&#x20;for&#x20;network&#x20;infiltration&#x20;and&#x20;a&#x20;first&#x20;step&#x20;to&#x20;establishing&#x20;a&#x20;persistent&#x20;threat&#x20;within&#x20;a&#x20;networked&#x20;environment.','Restricting&#x20;USB&#x20;access&#x20;on&#x20;the&#x20;system&#x20;will&#x20;decrease&#x20;the&#x20;physical&#x20;attack&#x20;surface&#x20;for&#x20;a&#x20;device&#x20;and&#x20;diminish&#x20;the&#x20;possible&#x20;vectors&#x20;to&#x20;introduce&#x20;malware.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/usb_storage.conf&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;usb-storage&#x20;/bin/true&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;usb-storage&#x20;module:&#x20;rmmod&#x20;usb-storage','[{\"cis\": [\"1.1.24\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20523,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated.','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/yum.conf&#x20;and&#x20;individual&#x20;/etc/yum/repos.d&#47;&#42;&#x20;files&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/yum.conf&#x20;and&#x20;set&#x20;&#039;&#x20;gpgcheck=1&#x20;&#039;&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;of&#x20;gpgcheck&#x20;to&#x20;&#039;&#x20;1&#x20;&#039;.','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"3.4\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(20524,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;yum&#x20;install&#x20;aide&#x20;//&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;aide&#x20;--init&#x20;&amp;&amp;&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20525,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check&#x20;&#x20;//&#x20;Notes:&#x20;The&#x20;checking&#x20;in&#x20;this&#x20;recommendation&#x20;occurs&#x20;every&#x20;day&#x20;at&#x20;5am.&#x20;Alter&#x20;the&#x20;frequency&#x20;and&#x20;time&#x20;of&#x20;the&#x20;checks&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;If&#x20;aidecheck.service&#x20;and&#x20;aidecheck.timer&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.service&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;&#x20;[Unit]&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Description=Aide&#x20;Check&#x20;&#x20;&#x20;&#x20;[Service]&#x20;&#x20;&#x20;&#x20;&#x20;Type=simpleExecStart=/usr/sbin/aide&#x20;--check&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Install]&#x20;&#x20;&#x20;&#x20;&#x20;WantedBy=multi-user.target&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;&#x20;/etc/systemd/system/aidecheck.timer&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;&#x20;&#x20;[Unit]&#x20;&#x20;&#x20;Description=Aide&#x20;check&#x20;every&#x20;day&#x20;at&#x20;5AM&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Timer]&#x20;&#x20;&#x20;&#x20;&#x20;OnCalendar=*-*-*&#x20;05:00:00&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Unit=aidecheck.service&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;[Install]&#x20;&#x20;&#x20;&#x20;&#x20;WantedBy=multi-user.target&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;aidecheck.service&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;aidecheck.timer&#x20;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20526,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;located&#x20;at&#x20;/boot/grub2/grub.cfg&#x20;and&#x20;linked&#x20;as&#x20;/etc/grub2.cfg&#x20;.&#x20;&#x20;On&#x20;newer&#x20;grub2&#x20;systems&#x20;the&#x20;encrypted&#x20;bootloader&#x20;password&#x20;is&#x20;contained&#x20;in&#x20;/boot/grub2/user.cfg','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/user.cfg&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/user.cfg','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20527,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Edit&#x20;/usr/lib/systemd/system/rescue.service&#x20;and&#x20;/usr/lib/systemd/system/emergency.service&#x20;and&#x20;set&#x20;ExecStart&#x20;to&#x20;use&#x20;/sbin/sulogin&#x20;or&#x20;/usr/sbin/sulogin:&#x20;ExecStart=-/bin/sh&#x20;-c&#x20;&quot;/sbin/sulogin;&#x20;/usr/bin/systemctl&#x20;--fail&#x20;--no-block&#x20;default&quot;&#x20;','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20528,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20529,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;Ensure&#x20;your&#x20;system&#x20;supports&#x20;the&#x20;XD&#x20;or&#x20;NX&#x20;bit&#x20;and&#x20;has&#x20;PAE&#x20;support&#x20;before&#x20;implementing&#x20;this&#x20;recommendation&#x20;as&#x20;this&#x20;may&#x20;prevent&#x20;it&#x20;from&#x20;booting&#x20;if&#x20;these&#x20;are&#x20;not&#x20;supported&#x20;by&#x20;your&#x20;hardware.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20530,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20531,'Ensure&#x20;prelink&#x20;is&#x20;not&#x20;installed.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;prelink:&#x20;#&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20532,'Ensure&#x20;SELinux&#x20;is&#x20;installed.','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;libselinux:&#x20;#&#x20;yum&#x20;install&#x20;libselinux','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20533,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration.','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;||&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20534,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured.','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20535,'Ensure&#x20;the&#x20;SELinux&#x20;mode&#x20;is&#x20;enforcing&#x20;or&#x20;permissive.','SELinux&#x20;can&#x20;run&#x20;in&#x20;one&#x20;of&#x20;three&#x20;modes:&#x20;disabled,&#x20;permissive,&#x20;or&#x20;enforcing:&#x20;Enforcing&#x20;-&#x20;Is&#x20;the&#x20;default,&#x20;and&#x20;recommended,&#x20;mode&#x20;of&#x20;operation;&#x20;in&#x20;enforcing&#x20;mode&#x20;SELinux&#x20;operates&#x20;normally,&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy&#x20;on&#x20;the&#x20;entire&#x20;system.&#x20;Permissive&#x20;-&#x20;The&#x20;system&#x20;acts&#x20;as&#x20;if&#x20;SELinux&#x20;is&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy,&#x20;including&#x20;labeling&#x20;objects&#x20;and&#x20;emitting&#x20;access&#x20;denial&#x20;entries&#x20;in&#x20;the&#x20;logs,&#x20;but&#x20;it&#x20;does&#x20;not&#x20;actually&#x20;deny&#x20;any&#x20;operations.&#x20;While&#x20;not&#x20;recommended&#x20;for&#x20;production&#x20;systems,&#x20;permissive&#x20;mode&#x20;can&#x20;be&#x20;helpful&#x20;for&#x20;SELinux&#x20;policy&#x20;development.&#x20;Disabled&#x20;-&#x20;Is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future&#x20;Note:&#x20;you&#x20;can&#x20;set&#x20;individual&#x20;domains&#x20;to&#x20;permissive&#x20;mode&#x20;while&#x20;the&#x20;system&#x20;runs&#x20;in&#x20;enforcing&#x20;mode.&#x20;For&#x20;example,&#x20;to&#x20;make&#x20;the&#x20;httpd_t&#x20;domain&#x20;permissive:&#x20;#&#x20;semanage&#x20;permissive&#x20;-a&#x20;httpd_t','Running&#x20;SELinux&#x20;in&#x20;disabled&#x20;mode&#x20;is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;SELinux&#039;s&#x20;running&#x20;mode:&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Enforcing:&#x20;#&#x20;setenforce&#x20;1&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Permissive:&#x20;#&#x20;setenforce&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;For&#x20;Enforcing&#x20;mode:&#x20;SELINUX=enforcing&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;For&#x20;Permissive&#x20;mode:&#x20;&#x20;SELINUX=permissive','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20536,'Ensure&#x20;the&#x20;SELinux&#x20;mode&#x20;is&#x20;enforcing.','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing','[{\"cis\": [\"1.6.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20537,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed.','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;yum&#x20;remove&#x20;setroubleshoot','[{\"cis\": [\"1.6.1.7\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20538,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed.','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;yum&#x20;remove&#x20;mcstrans','[{\"cis\": [\"1.6.1.8\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20539,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;v&#x20;&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.7.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(20540,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(20541,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m,&#x20;&#x0d;,&#x20;s,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(20542,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20543,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20544,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20545,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;install&#x20;all&#x20;available&#x20;packages&#x20;#&#x20;yum&#x20;update&#x20;--security&#x20;','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(20546,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','Run&#x20;One&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;chrony&#x20;or&#x20;NTP:&#x20;to&#x20;install&#x20;chrony&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;yum&#x20;install&#x20;chrony&#x20;OR&#x20;to&#x20;install&#x20;ntp:&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;yum&#x20;install&#x20;ntp','[{\"cis\": [\"2.1.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20547,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;and&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include&#x20;&#039;-u&#x20;chrony&#039;:OPTIONS=&quot;&#x20;-u&#x20;chrony&quot;','[{\"cis\": [\"2.1.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20548,'Ensure&#x20;ntp&#x20;is&#x20;configured.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;https://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','1&#41;&#x20;Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;and&#x20;-&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery.&#x20;2&#41;&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;.&#x20;3&#41;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/ntpd&#x20;to&#x20;include&#x20;&#039;&#x20;-u&#x20;ntp:ntp&#x20;&#039;:&#x20;-&#x20;OPTIONS=&#039;-u&#x20;ntp:ntp&#039;','[{\"cis\": [\"2.1.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20549,'&#x20;Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;#&#x20;yum&#x20;remove&#x20;xorg-x11*','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20550,'&#x20;Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;&#x20;#&#x20;systemctl&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20551,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Disabling&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;disable&#x20;cups','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20552,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;dhcp&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dhcp:&#x20;#&#x20;yum&#x20;remove&#x20;dhcp','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20553,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;openldap-servers:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-servers','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20554,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;yum&#x20;remove&#x20;bind','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20555,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','FTP&#x20;&#40;File&#x20;Transfer&#x20;Protocol&#41;&#x20;is&#x20;a&#x20;traditional&#x20;and&#x20;widely&#x20;used&#x20;standard&#x20;tool&#x20;for&#x20;transferring&#x20;files&#x20;between&#x20;a&#x20;server&#x20;and&#x20;clients&#x20;over&#x20;a&#x20;network,&#x20;especially&#x20;where&#x20;no&#x20;authentication&#x20;is&#x20;necessary&#x20;&#40;permits&#x20;anonymous&#x20;users&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#41;','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;vsftpd:&#x20;#&#x20;yum&#x20;remove&#x20;vsftpd','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20556,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;installed.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;httpd:&#x20;#&#x20;yum&#x20;remove&#x20;httpd','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20557,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;installed.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dovecot:&#x20;#&#x20;yum&#x20;remove&#x20;dovecot','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20558,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;package&#x20;can&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;smb:&#x20;#&#x20;yum&#x20;remove&#x20;samba','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20559,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;squid:&#x20;#&#x20;yum&#x20;remove&#x20;squid','[{\"cis\": [\"2.1.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20560,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;snmpd:&#x20;#&#x20;yum&#x20;remove&#x20;snmpd','[{\"cis\": [\"2.1.13\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20561,'Ensure&#x20;NIS&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;ypserv&#x20;package&#x20;provides&#x20;the&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;.&#x20;This&#x20;service,&#x20;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;ypserv&#x20;package&#x20;be&#x20;removed,&#x20;and&#x20;if&#x20;required&#x20;a&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;snmpd:&#x20;#&#x20;yum&#x20;remove&#x20;snmpd','[{\"cis\": [\"2.1.14\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20562,'Ensure&#x20;NIS&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;telnet-server:&#x20;#&#x20;yum&#x20;remove&#x20;telnet-server','[{\"cis\": [\"2.1.15\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20563,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.1.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(20564,'Ensure&#x20;nfs-utils&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;nfs-server&#x20;service&#x20;is&#x20;masked.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs-utils:&#x20;#&#x20;yum&#x20;remove&#x20;nfs-utils&#x20;OR&#x20;If&#x20;the&#x20;nfs-package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;nfs-server&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server','[{\"cis\": [\"2.1.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20565,'Ensure&#x20;rpcbind&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rpcbind&#x20;services&#x20;are&#x20;masked.','The&#x20;rpcbind&#x20;utility&#x20;maps&#x20;RPC&#x20;services&#x20;to&#x20;the&#x20;ports&#x20;on&#x20;which&#x20;they&#x20;listen.&#x20;RPC&#x20;processes&#x20;notify&#x20;rpcbind&#x20;when&#x20;they&#x20;start,&#x20;registering&#x20;the&#x20;ports&#x20;they&#x20;are&#x20;listening&#x20;on&#x20;and&#x20;the&#x20;RPC&#x20;program&#x20;numbers&#x20;they&#x20;expect&#x20;to&#x20;serve.&#x20;The&#x20;client&#x20;system&#x20;then&#x20;contacts&#x20;rpcbind&#x20;on&#x20;the&#x20;server&#x20;with&#x20;a&#x20;particular&#x20;RPC&#x20;program&#x20;number.&#x20;The&#x20;rpcbind&#x20;service&#x20;redirects&#x20;the&#x20;client&#x20;to&#x20;the&#x20;proper&#x20;port&#x20;number&#x20;so&#x20;it&#x20;can&#x20;communicate&#x20;with&#x20;the&#x20;requested&#x20;service&#x20;Portmapper&#x20;is&#x20;an&#x20;RPC&#x20;service,&#x20;which&#x20;always&#x20;listens&#x20;on&#x20;tcp&#x20;and&#x20;udp&#x20;111,&#x20;and&#x20;is&#x20;used&#x20;to&#x20;map&#x20;other&#x20;RPC&#x20;services&#x20;&#40;such&#x20;as&#x20;nfs,&#x20;nlockmgr,&#x20;quotad,&#x20;mountd,&#x20;etc.&#41;&#x20;to&#x20;their&#x20;corresponding&#x20;port&#x20;number&#x20;on&#x20;the&#x20;server.&#x20;When&#x20;a&#x20;remote&#x20;host&#x20;makes&#x20;an&#x20;RPC&#x20;call&#x20;to&#x20;that&#x20;server,&#x20;it&#x20;first&#x20;consults&#x20;with&#x20;portmap&#x20;to&#x20;determine&#x20;where&#x20;the&#x20;RPC&#x20;server&#x20;is&#x20;listening','A&#x20;small&#x20;request&#x20;&#40;~82&#x20;bytes&#x20;via&#x20;UDP&#41;&#x20;sent&#x20;to&#x20;the&#x20;Portmapper&#x20;generates&#x20;a&#x20;large&#x20;response&#x20;&#40;7x&#x20;to&#x20;28x&#x20;amplification&#41;,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;suitable&#x20;tool&#x20;for&#x20;DDoS&#x20;attacks.&#x20;If&#x20;rpcbind&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;rpcbind&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rpcbind:&#x20;#&#x20;yum&#x20;remove&#x20;rpcbind&#x20;OR&#x20;If&#x20;the&#x20;rpcbind&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;rpcbind&#x20;and&#x20;rpcbind.socket&#x20;services:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server&#x20;&amp;&amp;&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rpcbind.socket','[{\"cis\": [\"2.1.18\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20566,'Ensure&#x20;rsync&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;masked.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','Unless&#x20;required,&#x20;the&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;rsync&#x20;package:&#x20;#&#x20;yum&#x20;remove&#x20;rsync&#x20;&#x20;&#x20;&#x20;OR&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;the&#x20;rsyncd&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rsyncd','[{\"cis\": [\"2.1.19\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20567,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;ypbind:&#x20;#&#x20;yum&#x20;remove&#x20;ypbind','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20568,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcp&#x20;and&#x20;rlogin&#x20;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;#&#x20;yum&#x20;remove&#x20;rsh','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20569,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;#&#x20;yum&#x20;remove&#x20;talk','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20570,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;yum&#x20;remove&#x20;telnet','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20571,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients:&#x20;#&#x20;yum&#x20;remove&#x20;openldap-clients','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20572,'Disable&#x20;IPv6.','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;not&#x20;all&#x20;organizations&#x20;have&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;configurations&#x20;implemented.','If&#x20;IPv6&#x20;or&#x20;dual&#x20;stack&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;IPv6&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Use&#x20;one&#x20;of&#x20;the&#x20;two&#x20;following&#x20;methods&#x20;to&#x20;disable&#x20;IPv6&#x20;on&#x20;the&#x20;system:&#x0a;To&#x20;disable&#x20;IPv6&#x20;through&#x20;the&#x20;GRUB2&#x20;config:&#x0a;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;ipv6.disable=1&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX&#x20;parameters:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg&#x0a;OR&#x0a;To&#x20;disable&#x20;IPv6&#x20;through&#x20;sysctl&#x20;settings:&#x0a;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.disable_ipv6&#x20;=&#x20;1&#x20;net.ipv6.conf.default.disable_ipv6&#x20;=&#x20;1&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.disable_ipv6=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.disable_ipv6=1&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1&#x0a;','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20573,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flag&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;the&#x20;default&#x20;parameters&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;grep&#x20;-Els&#x20;&#039;^s*net.ipv4.ip_forwards*=s*1&#039;&#x20;/etc/sysctl.conf&#x20;/etc/sysctl.d&#47;&#42;.conf&#x20;/usr/lib/sysctl.d&#47;&#42;.conf&#x20;/run/sysctl.d&#47;&#42;.conf&#x20;|&#x20;while&#x20;read&#x20;filename;&#x20;do&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;net.ipv4.ip_forwards*&#41;&#40;=&#41;&#40;s*S+&#x08;&#41;.*$/#&#x20;*REMOVED*&#x20;1/&#039;&#x20;$filename;&#x20;done;&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0;&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20574,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled.','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20575,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted.','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route&#x20;and&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20576,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20577,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0;&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20578,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20579,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored.','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20580,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20581,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;server&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1;&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20582,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled.','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1&#x20;and&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.3.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20583,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;and&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Then,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20584,'Ensure&#x20;DCCP&#x20;is&#x20;disabled.','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20585,'Ensure&#x20;SCTP&#x20;is&#x20;disabled.','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20586,'Ensure&#x20;firewalld&#x20;is&#x20;installed.','firewalld&#x20;is&#x20;a&#x20;firewall&#x20;management&#x20;tool&#x20;for&#x20;Linux&#x20;operating&#x20;systems.&#x20;It&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;backend&#x20;or&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;nftables&#x20;utility.&#x20;firewalld&#x20;replaces&#x20;iptables&#x20;as&#x20;the&#x20;default&#x20;firewall&#x20;management&#x20;tool.&#x20;Use&#x20;the&#x20;firewalld&#x20;utility&#x20;to&#x20;configure&#x20;a&#x20;firewall&#x20;for&#x20;less&#x20;complex&#x20;firewalls.&#x20;The&#x20;utility&#x20;is&#x20;easy&#x20;to&#x20;use&#x20;and&#x20;covers&#x20;the&#x20;typical&#x20;use&#x20;cases&#x20;scenario.&#x20;FirewallD&#x20;supports&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6&#x20;networks&#x20;and&#x20;can&#x20;administer&#x20;separate&#x20;firewall&#x20;zones&#x20;with&#x20;varying&#x20;degrees&#x20;of&#x20;trust&#x20;as&#x20;defined&#x20;in&#x20;zone&#x20;profiles.','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x20;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;FirewallD&#x20;and&#x20;iptables:&#x20;#&#x20;yum&#x20;install&#x20;firewalld&#x20;iptables','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20587,'Ensure&#x20;iptables-services&#x20;not&#x20;installed&#x20;with&#x20;firewalld&#x20;or&#x20;nftables.','The&#x20;iptables-services&#x20;package&#x20;contains&#x20;the&#x20;iptables.service&#x20;and&#x20;ip6tables.service.&#x20;These&#x20;services&#x20;allow&#x20;for&#x20;management&#x20;of&#x20;the&#x20;Host&#x20;Based&#x20;Firewall&#x20;provided&#x20;by&#x20;the&#x20;iptables&#x20;package.','The&#x20;iptables-services&#x20;package&#x20;contains&#x20;the&#x20;iptables.service&#x20;and&#x20;ip6tables.service.&#x20;These&#x20;services&#x20;allow&#x20;for&#x20;management&#x20;of&#x20;the&#x20;Host&#x20;Based&#x20;Firewall&#x20;provided&#x20;by&#x20;the&#x20;iptables&#x20;package.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-services&#x20;package&#x20;and&#x20;remove&#x20;the&#x20;iptables-services&#x20;package&#x20;#&#x20;systemctl&#x20;stop&#x20;iptables&#x20;#&#x20;systemctl&#x20;stop&#x20;ip6tables&#x20;#&#x20;yum&#x20;remove&#x20;iptables-services','[{\"cis\": [\"3.5.1.2\", \"3.5.2.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20588,'Ensure&#x20;nftables&#x20;either&#x20;not&#x20;installed&#x20;or&#x20;masked&#x20;with&#x20;firewalld.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.','Running&#x20;both&#x20;firewalld&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:&#x20;#&#x20;yum&#x20;remove&#x20;nftables&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;nftables:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nftables','[{\"cis\": [\"3.5.1.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20589,'Ensure&#x20;firewalld&#x20;service&#x20;enabled&#x20;and&#x20;running.','firewalld.service&#x20;enables&#x20;the&#x20;enforcement&#x20;of&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld','Ensure&#x20;that&#x20;the&#x20;firewalld.service&#x20;is&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;enforce&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;firewalld&#x20;#&#x20;systemctl&#x20;unmask&#x20;firewalld&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;firewalld&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;firewalld','[{\"cis\": [\"3.5.1.4\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20590,'Ensure&#x20;firewalld&#x20;default&#x20;zone&#x20;is&#x20;set.','A&#x20;firewall&#x20;zone&#x20;defines&#x20;the&#x20;trust&#x20;level&#x20;for&#x20;a&#x20;connection,&#x20;interface&#x20;or&#x20;source&#x20;address&#x20;binding.&#x20;This&#x20;is&#x20;a&#x20;one&#x20;to&#x20;many&#x20;relation,&#x20;which&#x20;means&#x20;that&#x20;a&#x20;connection,&#x20;interface&#x20;or&#x20;source&#x20;can&#x20;only&#x20;be&#x20;part&#x20;of&#x20;one&#x20;zone,&#x20;but&#x20;a&#x20;zone&#x20;can&#x20;be&#x20;used&#x20;for&#x20;many&#x20;network&#x20;connections,&#x20;interfaces&#x20;and&#x20;sources.&#x20;1.-&#x20;The&#x20;default&#x20;zone&#x20;is&#x20;the&#x20;zone&#x20;that&#x20;is&#x20;used&#x20;for&#x20;everything&#x20;that&#x20;is&#x20;not&#x20;explicitly&#x20;bound/assigned&#x20;to&#x20;another&#x20;zone.&#x20;2.-&#x20;If&#x20;no&#x20;zone&#x20;assigned&#x20;to&#x20;a&#x20;connection,&#x20;interface&#x20;or&#x20;source,&#x20;only&#x20;the&#x20;default&#x20;zone&#x20;is&#x20;used.&#x20;3.-&#x20;The&#x20;default&#x20;zone&#x20;is&#x20;not&#x20;always&#x20;listed&#x20;as&#x20;being&#x20;used&#x20;for&#x20;an&#x20;interface&#x20;or&#x20;source&#x20;as&#x20;it&#x20;will&#x20;be&#x20;used&#x20;for&#x20;it&#x20;either&#x20;way.&#x20;This&#x20;depends&#x20;on&#x20;the&#x20;manager&#x20;of&#x20;the&#x20;interfaces.&#x20;Connections&#x20;handled&#x20;by&#x20;NetworkManager&#x20;are&#x20;listed&#x20;as&#x20;NetworkManager&#x20;requests&#x20;to&#x20;add&#x20;the&#x20;zone&#x20;binding&#x20;for&#x20;the&#x20;interface&#x20;used&#x20;by&#x20;the&#x20;connection.&#x20;Also&#x20;interfaces&#x20;under&#x20;control&#x20;of&#x20;the&#x20;network&#x20;service&#x20;are&#x20;listed&#x20;also&#x20;because&#x20;the&#x20;service&#x20;requests&#x20;it.','Because&#x20;the&#x20;default&#x20;zone&#x20;is&#x20;the&#x20;zone&#x20;that&#x20;is&#x20;used&#x20;for&#x20;everything&#x20;that&#x20;is&#x20;not&#x20;explicitly&#x20;bound/assigned&#x20;to&#x20;another&#x20;zone,&#x20;it&#x20;is&#x20;important&#x20;for&#x20;the&#x20;default&#x20;zone&#x20;to&#x20;set.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;zone:&#x20;#&#x20;firewall-cmd&#x20;--set-default-zone=&lt;NAME_OF_ZONE&gt;&#x20;Example:&#x20;#&#x20;firewall-cmd&#x20;--set-default-zone=public','[{\"cis\": [\"3.5.1.5\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20591,'Ensure&#x20;nftables&#x20;is&#x20;installed.','nftables&#x20;provides&#x20;a&#x20;new&#x20;in-kernel&#x20;packet&#x20;classification&#x20;framework&#x20;that&#x20;is&#x20;based&#x20;on&#x20;a&#x20;network-specific&#x20;Virtual&#x20;Machine&#x20;&#40;VM&#41;&#x20;and&#x20;a&#x20;new&#x20;nft&#x20;userspace&#x20;command&#x20;line&#x20;tool.&#x20;nftables&#x20;reuses&#x20;the&#x20;existing&#x20;Netfilter&#x20;subsystems&#x20;such&#x20;as&#x20;the&#x20;existing&#x20;hook&#x20;infrastructure,&#x20;the&#x20;connection&#x20;tracking&#x20;system,&#x20;NAT,&#x20;userspace&#x20;queuing&#x20;and&#x20;logging&#x20;subsystem.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;nftables&#x20;#&#x20;yum&#x20;install&#x20;nftables','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20592,'Ensure&#x20;firewalld&#x20;is&#x20;either&#x20;not&#x20;installed&#x20;or&#x20;masked&#x20;with&#x20;nftables.','firewalld&#x20;&#40;Dynamic&#x20;Firewall&#x20;Manager&#41;&#x20;provides&#x20;a&#x20;dynamically&#x20;managed&#x20;firewall&#x20;with&#x20;support&#x20;for&#x20;network/firewall&#x20;&ldquo;zones&rdquo;&#x20;to&#x20;assign&#x20;a&#x20;level&#x20;of&#x20;trust&#x20;to&#x20;a&#x20;network&#x20;and&#x20;its&#x20;associated&#x20;connections,&#x20;interfaces&#x20;or&#x20;sources.&#x20;It&#x20;has&#x20;support&#x20;for&#x20;IPv4,&#x20;IPv6,&#x20;Ethernet&#x20;bridges&#x20;and&#x20;also&#x20;for&#x20;IPSet&#x20;firewall&#x20;settings.&#x20;There&#x20;is&#x20;a&#x20;separation&#x20;of&#x20;the&#x20;runtime&#x20;and&#x20;permanent&#x20;configuration&#x20;options.','Running&#x20;both&#x20;nftables.service&#x20;and&#x20;firewalld.service&#x20;may&#x20;lead&#x20;to&#x20;conflict&#x20;and&#x20;unexpected&#x20;results.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;firewalld&#x20;#&#x20;yum&#x20;remove&#x20;firewalld&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;firewalld&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;firewalld','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20594,'Ensure&#x20;iptables&#x20;are&#x20;flushed&#x20;with&#x20;nftables.','nftables&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;iptables,&#x20;ip6tables,&#x20;ebtables&#x20;and&#x20;arptables','It&#x20;is&#x20;possible&#x20;to&#x20;mix&#x20;iptables&#x20;and&#x20;nftables.&#x20;However,&#x20;this&#x20;increases&#x20;complexity&#x20;and&#x20;also&#x20;the&#x20;chance&#x20;to&#x20;introduce&#x20;errors.&#x20;For&#x20;simplicity&#x20;flush&#x20;out&#x20;all&#x20;iptables&#x20;rules,&#x20;and&#x20;ensure&#x20;it&#x20;is&#x20;not&#x20;loaded','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;flush&#x20;iptables:&#x20;For&#x20;iptables:&#x20;#&#x20;iptables&#x20;-F&#x20;For&#x20;ip6tables:&#x20;#&#x20;ip6tables&#x20;-F','[{\"cis\": [\"3.5.2.4\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20595,'Ensure&#x20;an&#x20;nftables&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20596,'Ensure&#x20;nftables&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.5.2.6\", \"3.5.2.9\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20597,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled.','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables','[{\"cis\": [\"3.5.2.10\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20598,'Ensure&#x20;iptables&#x20;packages&#x20;are&#x20;installed.','iptables&#x20;is&#x20;a&#x20;utility&#x20;program&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;tables&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall,&#x20;implemented&#x20;as&#x20;different&#x20;Netfilter&#x20;modules,&#x20;and&#x20;the&#x20;chains&#x20;and&#x20;rules&#x20;it&#x20;stores.&#x20;Different&#x20;kernel&#x20;modules&#x20;and&#x20;programs&#x20;are&#x20;used&#x20;for&#x20;different&#x20;protocols;&#x20;iptables&#x20;applies&#x20;to&#x20;IPv4,&#x20;ip6tables&#x20;to&#x20;IPv6,&#x20;arptables&#x20;to&#x20;ARP,&#x20;and&#x20;ebtables&#x20;to&#x20;Ethernet&#x20;frames.','A&#x20;method&#x20;of&#x20;configuring&#x20;and&#x20;maintaining&#x20;firewall&#x20;rules&#x20;is&#x20;necessary&#x20;to&#x20;configure&#x20;a&#x20;Host&#x20;Based&#x20;Firewall.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;and&#x20;iptables-services&#x20;#&#x20;yum&#x20;install&#x20;iptables&#x20;iptables-services','[{\"cis\": [\"3.5.3.1.1\", \"3.5.3.1.2\", \"3.5.3.1.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20599,'Ensure&#x20;iptables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.2.4\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20600,'Ensure&#x20;iptables&#x20;is&#x20;enabled&#x20;and&#x20;running.','iptables.service&#x20;is&#x20;a&#x20;utility&#x20;for&#x20;configuring&#x20;and&#x20;maintaining&#x20;iptables.','iptables.service&#x20;will&#x20;load&#x20;the&#x20;iptables&#x20;rules&#x20;saved&#x20;in&#x20;the&#x20;file&#x20;/etc/sysconfig/iptables&#x20;at&#x20;boot,&#x20;otherwise&#x20;the&#x20;iptables&#x20;rules&#x20;will&#x20;be&#x20;cleared&#x20;during&#x20;a&#x20;re-boot&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;iptables:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;iptables','[{\"cis\": [\"3.5.3.2.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20601,'Ensure&#x20;IPv6&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;tothe&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.3.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20602,'Ensure&#x20;ip6tables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP;&#x20;#&#x20;ip6tables&#x20;-PFORWARD&#x20;DROP','[{\"cis\": [\"3.5.3.3.4\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20603,'Ensure&#x20;ip6tables&#x20;is&#x20;enabled&#x20;and&#x20;running.','ip6tables.service&#x20;is&#x20;a&#x20;utility&#x20;for&#x20;configuring&#x20;and&#x20;maintaining&#x20;ip6tables.','ip6tables.service&#x20;will&#x20;load&#x20;the&#x20;iptables&#x20;rules&#x20;saved&#x20;in&#x20;the&#x20;file&#x20;/etc/sysconfig/ip6tables&#x20;at&#x20;boot,&#x20;otherwise&#x20;the&#x20;ip6tables&#x20;rules&#x20;will&#x20;be&#x20;cleared&#x20;during&#x20;a&#x20;re-boot&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;iptables:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;ip6tables','[{\"cis\": [\"3.5.3.3.6\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20604,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;#&#x20;yum&#x20;install&#x20;audit&#x20;audit-libs','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(20605,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20606,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub2&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20607,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(20608,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.4\"]}, {\"pci_dss\": [\"10.7\"]}]'),(20609,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;&#x20;&#x20;action_mail_acct&#x20;=&#x20;root&#x20;&#x20;&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc\": [\"6.4\"\"]}, {\"pci_dss\": [\"10.7\"]}]'),(20610,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change,&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change,&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change,&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;timechange,&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change,&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change,&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20611,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity,&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity,&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity,&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity,&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20612,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;,&#x20;/etc/sysconfig/network&#x20;file&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;directory&#x20;&#40;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;and&#x20;/etc/sysconfig/network-scripts/&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale,&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale,&#x20;-w&#x20;/etc/sysconfig/network-scripts/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20613,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy,&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20614,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;/var/run/faillock/&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins,&#x20;-w&#x20;/var/run/faillock/&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20615,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session,&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins,&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}]'),(20616,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown,&#x20;fchown,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr,&#x20;lsetxattr,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr,&#x20;lremovexattr,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lrem&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20617,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;&#x20;truncate,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20618,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.12\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20619,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;ollowing&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;:&#x20;unlink&#x20;-remove&#x20;a&#x20;file&#x20;&#x20;&#x20;&#x20;&#x20;unlinkat&#x20;-&#x20;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#x20;and&#x20;renameat&#x20;-&#x20;rename&#x20;a&#x20;file&#x20;attribute.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC7.1\", \"CC7.2\", \"CC7.3\", \"CC8.1\"]}]'),(20620,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d&#x20;directory&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file,&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d/&#x20;directory&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&#x20;&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"4.8\", \"6.3\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20621,'Ensure&#x20;system&#x20;administrator&#x20;command&#x20;executions&#x20;&#40;sudo&#41;&#x20;are&#x20;collected.','sudo&#x20;provides&#x20;users&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;to&#x20;perform&#x20;operations.&#x20;Monitor&#x20;the&#x20;administrator&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;and&#x20;the&#x20;operation&#40;s&#41;&#x20;they&#x20;performed.','creating&#x20;an&#x20;audit&#x20;log&#x20;of&#x20;administrators&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;and&#x20;the&#x20;operation&#40;s&#41;&#x20;they&#x20;performed&#x20;is&#x20;essential&#x20;to&#x20;reporting.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;sudo&#x20;logfile&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;-a&#x20;exit,always&#x20;-F&#x20;arch=b32&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;euid=0&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-S&#x20;execve&#x20;-k&#x20;actions&#x20;&#x20;and&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;euid=0&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-S&#x20;execve&#x20;-k&#x20;actions&#x20;.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.9\", \"6.3\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20622,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules&#x20;','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20623,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;&#x20;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/rules.d/audit.rules&#x20;file:&#x20;-e&#x20;2','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20624,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled&#x20;and&#x20;running.','rsyslogneeds&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;perform&#x20;logging','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lackblogging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.2\", \"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20625,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20626,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;*.*&#x20;@@loghost.example.com&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;&#x20;systemctl&#x20;restart&#x20;rsyslog','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20627,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20628,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20629,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20630,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled&#x20;and&#x20;running.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;systemctl&#x20;enable&#x20;crond&#x20;','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20631,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab&#x20;','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20633,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly;&#x20;','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20634,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily;','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20635,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly;','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20636,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly;','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20637,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d/directory&#x20;contains&#x20;system&#x20;cronjobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;:&#x20;&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d;&#x20;&#x20;&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d;','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20638,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.alloware&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allowfile&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cronjobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\", \"5.1.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20639,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo.&#x20;#&#x20;yum&#x20;install&#x20;sudo','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20640,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty.','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;configuring&#x20;sudo&#x20;to&#x20;run&#x20;other&#x20;commands&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty,&#x20;whether&#x20;I/O&#x20;logging&#x20;is&#x20;turned&#x20;on&#x20;or&#x20;not.','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20641,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file.','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands.','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20642,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20643,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;private&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;The&#x20;possession&#x20;of&#x20;the&#x20;private&#x20;key&#x20;is&#x20;proof&#x20;of&#x20;identity.&#x20;Only&#x20;a&#x20;private&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;public&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.&#x20;The&#x20;private&#x20;keys&#x20;need&#x20;to&#x20;be&#x20;stored&#x20;and&#x20;handled&#x20;carefully,&#x20;and&#x20;no&#x20;copies&#x20;of&#x20;the&#x20;private&#x20;key&#x20;should&#x20;be&#x20;distributed.','If&#x20;an&#x20;unauthorized&#x20;user&#x20;obtains&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;file,&#x20;the&#x20;host&#x20;could&#x20;be&#x20;impersonated','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;private&#x20;SSH&#x20;host&#x20;key&#x20;files:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chmod&#x20;0640&#x20;{}&#x20;;&#x20;&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20644,'Ensure&#x20;permissions&#x20;on&#x20;SSH&#x20;private&#x20;host&#x20;key&#x20;files&#x20;are&#x20;configured.','An&#x20;SSH&#x20;public&#x20;key&#x20;is&#x20;one&#x20;of&#x20;two&#x20;files&#x20;used&#x20;in&#x20;SSH&#x20;public&#x20;key&#x20;authentication.&#x20;In&#x20;this&#x20;authentication&#x20;method,&#x20;a&#x20;public&#x20;key&#x20;is&#x20;a&#x20;key&#x20;that&#x20;can&#x20;be&#x20;used&#x20;for&#x20;verifying&#x20;digital&#x20;signatures&#x20;generated&#x20;using&#x20;a&#x20;corresponding&#x20;private&#x20;key.&#x20;Only&#x20;a&#x20;public&#x20;key&#x20;that&#x20;corresponds&#x20;to&#x20;a&#x20;private&#x20;key&#x20;will&#x20;be&#x20;able&#x20;to&#x20;authenticate&#x20;successfully.','If&#x20;a&#x20;public&#x20;host&#x20;key&#x20;file&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user,&#x20;the&#x20;SSH&#x20;service&#x20;may&#x20;be&#x20;compromised.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;on&#x20;the&#x20;SSH&#x20;host&#x20;public&#x20;key:&#x20;#&#x20;find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chmod&#x20;u-x,go-wx&#x20;{}&#x20;;&#x20;&#x20;&#x20;&#x20;#find&#x20;/etc/ssh&#x20;-xdev&#x20;-type&#x20;f&#x20;-name&#x20;&#039;ssh_host_*_key.pub&#039;&#x20;-exec&#x20;chown&#x20;root:root&#x20;{}&#x20;;','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20645,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20646,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.3.6\"]}, {\"pci_dss\": [\"9.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20647,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.3.7\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20648,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.3.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20649,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.3.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20650,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su&#x20;.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.3.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20651,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.3.11\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20652,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.3.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(20653,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.:&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&#039;Sweet32&#039;&#x20;attack;&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involvingLSB&#x20;values,&#x20;aka&#x20;the&#x20;&#039;Bar&#x20;Mitzvah&#039;&#x20;issue;&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session;&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors;&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;login-shell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;add/modify&#x20;the&#x20;Ciphersline&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphersExample:Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.3.13\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20654,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256','[{\"cis\": [\"5.3.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20655,'Ensure&#x20;that&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms.Example:&#039;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256&#039;','[{\"cis\": [\"5.3.15\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20656,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;and&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.3.16\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20657,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.3.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20658,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.3.18\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20659,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.3.19\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20660,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;backdoors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.3.20\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20661,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.&#x20;Not&#x20;implemented,&#x20;requires&#x20;manual&#x20;operation.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;maxstartups&#x20;10:30:60','[{\"cis\": [\"5.3.21\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20662,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;limited.','The&#x20;MaxSessions&#x20;parameter&#x20;Specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;per&#x20;network&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10','[{\"cis\": [\"5.3.22\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20663,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minclass&#x20;=&#x20;4&#x20;&#x20;&#x20;&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:password&#x20;requisite&#x20;pam_pwquality.so&#x20;try_first_pass&#x20;retry=3','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20664,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\", \"8.2.1\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\"]}]'),(20665,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/password-auth&#x20;and&#x20;/etc/pam.d/system-auth&#x20;files&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;sufficient&#x20;pam_unix.so&#x20;remember=5&#x20;&#x20;&#x20;or&#x20;&#x20;&#x20;&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20666,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;90&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20667,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20668,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.3\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20669,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.4\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20670,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20671,'&#x20;Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less.','TMOUT&#x20;is&#x20;an&#x20;environmental&#x20;setting&#x20;that&#x20;determines&#x20;the&#x20;timeout&#x20;of&#x20;a&#x20;shell&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening','','Edit&#x20;the&#x20;/etc/bashrc&#x20;and&#x20;/etc/profile&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.5.4\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(20672,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive.','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umaskcommand&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile,&#x20;.bashrc,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umaskensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umasksetting&#x20;of&#x20;077causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umaskof&#x20;022would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.5.5\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20673,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su&#x20;.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid','[{\"cis\": [\"5.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(20674,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;&#x20;&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20675,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;&#x20;&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/passwd-','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20676,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(20677,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow-&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/shadow-','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(20678,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow-&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(20679,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;000&#x20;/etc/gshadow','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(20680,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/group','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20681,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20682,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;||&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(20683,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty.','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;runa&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(20684,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.9\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21000,'Ensure&#x20;mounting&#x20;of&#x20;squashfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;squashfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems&#x20;&#40;similar&#x20;to&#x20;cramfs&#x20;&#41;.&#x20;A&#x20;squashfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.&#x0a;','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/squashfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;squashfs&#x20;/bin/true&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;squashfs&#x20;module:&#x20;#&#x20;modprobe&#x20;-r&#x20;squashfs&#x0a;','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21001,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.&#x0a;','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vi&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;modprobe&#x20;-r&#x20;udf&#x0a;','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21002,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp&#x20;.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/localfs.target.wants/tmp.mount&#x20;file:&#x0a;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x0a;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/tmp&#x0a;OR&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x0a;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;systemctl&#x20;daemon-reload&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount&#x0a;','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21003,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp&#x20;.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;OR&#x20;the&#x20;/etc/systemd/system/localfs.target.wants/tmp.mount&#x20;file:&#x20;IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp&#x20;OR&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;systemctl&#x20;daemon-reload&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount&#x0a;','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21004,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.&#x0a;','','IF&#x20;/etc/fstab&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp&#x20;Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/tmp&#x0a;OR&#x20;IF&#x20;systemd&#x20;is&#x20;used&#x20;to&#x20;mount&#x20;/tmp:&#x20;Edit&#x20;/etc/systemd/system/local-fs.target.wants/tmp.mount&#x20;to&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;/tmp&#x20;mount&#x20;options:&#x20;[Mount]&#x20;Options=mode=1777,strictatime,noexec,nodev,nosuid&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;systemd&#x20;daemon:&#x20;#&#x20;systemctl&#x20;daemon-reload&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;tmp.mount:&#x20;#&#x20;systemctl&#x20;restart&#x20;tmp.mount&#x0a;','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21005,'Ensure&#x20;/dev/shm&#x20;is&#x20;configured.','/dev/shm&#x20;is&#x20;a&#x20;traditional&#x20;shared&#x20;memory&#x20;concept.&#x20;One&#x20;program&#x20;will&#x20;create&#x20;a&#x20;memory&#x20;portion,&#x20;which&#x20;other&#x20;processes&#x20;&#40;if&#x20;permitted&#41;&#x20;can&#x20;access.&#x20;If&#x20;/dev/shm&#x20;is&#x20;not&#x20;configured,&#x20;tmpfs&#x20;will&#x20;be&#x20;mounted&#x20;to&#x20;/dev/shm&#x20;by&#x20;systemd.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;An&#x20;entry&#x20;for&#x20;/dev/shm&#x20;in&#x20;/etc/fstab&#x20;will&#x20;take&#x20;precedence.&#x0a;&#x20;&#x20;-&#x20;tmpfs&#x20;can&#x20;be&#x20;resized&#x20;using&#x20;the&#x20;size={size}&#x20;parameter&#x20;in&#x20;/etc/fstab.&#x20;If&#x20;we&#x20;don&#039;t&#x20;specify&#x0a;&#x20;&#x20;&#x20;&#x20;the&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;half&#x20;the&#x20;RAM.&#x0a;&#x0a;Resize&#x20;tmpfs&#x20;example:&#x20;tmpfs&#x20;/dev/shm&#x20;tmpfs&#x20;defaults,noexec,nodev,nosuid,size=2G&#x20;0&#x20;0&#x0a;','Any&#x20;user&#x20;can&#x20;upload&#x20;and&#x20;execute&#x20;files&#x20;inside&#x20;the&#x20;/dev/shm&#x20;similar&#x20;to&#x20;the&#x20;/tmp&#x20;partition.&#x20;Configuring&#x20;/dev/shm&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/dev/shm&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x0a;','','Edit&#x20;/etc/fstab&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line:&#x20;tmpfs&#x20;/dev/shm&#x20;tmpfs&#x20;defaults,noexec,nodev,nosuid&#x20;0&#x20;0&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm&#x0a;','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21006,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.&#x20;Note:&#x20;/dev/shm&#x20;is&#x20;mounted&#x20;automatically&#x20;by&#x20;systemd.&#x20;/dev/shm&#x20;needs&#x20;to&#x20;be&#x20;added&#x20;to&#x20;/etc/fstab&#x20;to&#x20;add&#x20;mount&#x20;options&#x20;even&#x20;though&#x20;it&#x20;is&#x20;already&#x20;being&#x20;mounted&#x20;on&#x20;boot.&#x0a;','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm&#x0a;','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"2.6\", \"13\"]}]'),(21007,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.&#x20;Note:&#x20;/dev/shm&#x20;is&#x20;mounted&#x20;automatically&#x20;by&#x20;systemd.&#x20;/dev/shm&#x20;needs&#x20;to&#x20;be&#x20;added&#x20;to&#x20;/etc/fstab&#x20;to&#x20;add&#x20;mount&#x20;options&#x20;even&#x20;though&#x20;it&#x20;is&#x20;already&#x20;being&#x20;mounted&#x20;on&#x20;boot.&#x0a;','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec,nodev,nosuid&#x20;/dev/shm&#x0a;','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21008,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.&#x0a;Note:&#x20;When&#x20;modifying&#x20;/var&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;bring&#x20;the&#x20;system&#x20;to&#x20;emergency&#x20;mode&#x20;&#40;so&#x20;auditd&#x20;is&#x20;not&#x20;running&#41;,&#x20;rename&#x20;the&#x20;existing&#x20;directory,&#x20;mount&#x20;the&#x20;new&#x20;file&#x20;system,&#x20;and&#x20;migrate&#x20;the&#x20;data&#x20;over&#x20;before&#x20;returning&#x20;to&#x20;multiuser&#x20;mode.&#x0a;','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x0a;','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x0a;','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21009,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications&#x20;and&#x20;is&#x20;intended&#x20;for&#x20;temporary&#x20;files&#x20;that&#x20;are&#x20;preserved&#x20;across&#x20;reboots.&#x0a;Note:&#x20;tmpfs&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;/var/tmp/.&#x20;tmpfs&#x20;is&#x20;a&#x20;temporary&#x20;filesystem&#x20;that&#x20;resides&#x20;in&#x20;memory&#x20;and/or&#x20;swap&#x20;partition&#40;s&#41;.&#x20;Files&#x20;in&#x20;tmpfs&#x20;are&#x20;automatically&#x20;cleared&#x20;at&#x20;each&#x20;bootup.&#x0a;','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x0a;','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x0a;','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21010,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp&#x20;.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp&#x0a;','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21011,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp&#x20;.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp&#x0a;','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21012,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp&#x0a;','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21013,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x0a;Note:&#x20;When&#x20;modifying&#x20;/var/log&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;bring&#x20;the&#x20;system&#x20;to&#x20;emergency&#x20;mode&#x20;&#40;so&#x20;auditd&#x20;is&#x20;not&#x20;running&#41;,&#x20;rename&#x20;the&#x20;existing&#x20;directory,&#x20;mount&#x20;the&#x20;new&#x20;file&#x20;system,&#x20;and&#x20;migrate&#x20;the&#x20;data&#x20;over&#x20;before&#x20;returning&#x20;to&#x20;multiuser&#x20;mode.&#x0a;','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x0a;','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21014,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd&#x20;,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.&#x0a;Note:&#x20;When&#x20;modifying&#x20;/var/log/audit&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;bring&#x20;the&#x20;system&#x20;to&#x20;emergency&#x20;mode&#x20;&#40;so&#x20;auditd&#x20;is&#x20;not&#x20;running&#41;,&#x20;rename&#x20;the&#x20;existing&#x20;directory,&#x20;mount&#x20;the&#x20;new&#x20;file&#x20;system,&#x20;and&#x20;migrate&#x20;the&#x20;data&#x20;over&#x20;before&#x20;returning&#x20;to&#x20;multiuser&#x20;mode.&#x0a;','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#x20;&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd&#x20;,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.&#x0a;','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x0a;','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21015,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home&#x20;.&#x0a;','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.&#x0a;','[{\"cis\": [\"1.1.17\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21016,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;this&#x20;recommendation&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.&#x0a;','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x0a;','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home/&#x20;with&#x20;the&#x20;nodev&#x20;mount&#x20;option:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home&#x0a;','[{\"cis\": [\"1.1.18\"]}, {\"cis_csc\": [\"5.1\", \"13\"]}]'),(21017,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.&#x20;Notes:&#x0a;&#x20;&#x20;-&#x20;Additional&#x20;methods&#x20;of&#x20;disabling&#x20;a&#x20;service&#x20;exist.&#x20;Consult&#x20;your&#x20;distribution&#x0a;&#x20;&#x20;&#x20;&#x20;documentation&#x20;for&#x20;appropriate&#x20;methods.&#x0a;&#x20;&#x20;-&#x20;This&#x20;control&#x20;should&#x20;align&#x20;with&#x20;the&#x20;tolerance&#x20;of&#x20;the&#x20;use&#x20;of&#x20;portable&#x20;drives&#x20;and&#x20;optical&#x0a;&#x20;&#x20;&#x20;&#x20;media&#x20;in&#x20;the&#x20;organization.&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;On&#x20;a&#x20;server&#x20;requiring&#x20;an&#x20;admin&#x20;to&#x20;manually&#x20;mount&#x20;media&#x20;can&#x20;be&#x20;part&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;defense-in-depth&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unapproved&#x20;software&#x20;or&#x20;information&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;being&#x20;introduced&#x20;or&#x20;proprietary&#x20;software&#x20;or&#x20;information&#x20;being&#x20;exfiltrated.&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;If&#x20;admins&#x20;commonly&#x20;use&#x20;flash&#x20;drives&#x20;and&#x20;Server&#x20;access&#x20;has&#x20;sufficient&#x20;physical&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;controls,&#x20;requiring&#x20;manual&#x20;mounting&#x20;may&#x20;not&#x20;increase&#x20;security.&#x0a;','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;autofs:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;autofs&#x0a;','[{\"cis\": [\"1.1.23\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}]'),(21018,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.&#x0a;','sudo&#x20;supports&#x20;a&#x20;plugin&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plugins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers.&#x0a;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo.&#x20;#&#x20;zypper&#x20;install&#x20;sudo&#x0a;','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"4\"]}]'),(21019,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty&#x0a;Note:&#x20;visudo&#x20;edits&#x20;the&#x20;sudoers&#x20;file&#x20;in&#x20;a&#x20;safe&#x20;fashion,&#x20;analogous&#x20;to&#x20;vipw&#40;8&#41;.&#x20;visudo&#x20;locks&#x20;the&#x20;sudoers&#x20;file&#x20;against&#x20;multiple&#x20;simultaneous&#x20;edits,&#x20;provides&#x20;basic&#x20;sanity&#x20;checks,&#x20;and&#x20;checks&#x20;for&#x20;parse&#x20;errors.&#x20;If&#x20;the&#x20;sudoers&#x20;file&#x20;is&#x20;currently&#x20;being&#x20;edited&#x20;you&#x20;will&#x20;receive&#x20;a&#x20;message&#x20;to&#x20;try&#x20;again&#x20;later.&#x20;The&#x20;-f&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;tell&#x20;visudo&#x20;which&#x20;file&#x20;to&#x20;edit.&#x0a;','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo,&#x20;which&#x20;would&#x20;again&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;configuring&#x20;sudo&#x20;to&#x20;run&#x20;other&#x20;commands&#x20;only&#x20;from&#x20;a&#x20;pseudo-pty,&#x20;whether&#x20;I/O&#x20;logging&#x20;is&#x20;turned&#x20;on&#x20;or&#x20;not.&#x0a;','','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x0a;Defaults&#x20;use_pty&#x0a;','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"4\"]}]'),(21020,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file&#x0a;Note:&#x20;visudo&#x20;edits&#x20;the&#x20;sudoers&#x20;file&#x20;in&#x20;a&#x20;safe&#x20;fashion,&#x20;analogous&#x20;to&#x20;vipw&#40;8&#41;.&#x20;visudo&#x20;locks&#x20;the&#x20;sudoers&#x20;file&#x20;against&#x20;multiple&#x20;simultaneous&#x20;edits,&#x20;provides&#x20;basic&#x20;sanity&#x20;checks,&#x20;and&#x20;checks&#x20;for&#x20;parse&#x20;errors.&#x20;If&#x20;the&#x20;sudoers&#x20;file&#x20;is&#x20;currently&#x20;being&#x20;edited&#x20;you&#x20;will&#x20;receive&#x20;a&#x20;message&#x20;to&#x20;try&#x20;again&#x20;later.&#x20;The&#x20;-f&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;tell&#x20;visudo&#x20;which&#x20;file&#x20;to&#x20;edit.&#x0a;','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands','','edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;&#x0a;Example&#x20;Defaults&#x20;logfile=&quot;/var/log/sudo.log&quot;&#x0a;','[{\"cis\": [\"1.3.3\"]}, {\"cis_csc\": [\"6.3\"]}]'),(21021,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.&#x0a;Note:&#x20;The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;AIDE&#x20;because&#x20;it&#x20;alters&#x20;binaries&#x20;to&#x20;speed&#x20;up&#x20;their&#x20;start&#x20;up&#x20;times.&#x20;Run&#x20;prelink&#x20;-ua&#x20;to&#x20;restore&#x20;the&#x20;binaries&#x20;to&#x20;their&#x20;prelinked&#x20;state,&#x20;thus&#x20;avoiding&#x20;false&#x20;positives&#x20;from&#x20;AIDE.&#x0a;','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.&#x0a;','','Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;#&#x20;zypper&#x20;install&#x20;aide&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;initialize&#x20;AIDE:&#x20;#&#x20;aide&#x20;--init&#x20;#&#x20;mv&#x20;/var/lib/aide/aide.db.new&#x20;/var/lib/aide/aide.db&#x0a;','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"14.9\"]}]'),(21022,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub2&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x0a;&#x20;&#x20;&#x20;&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.&#x20;Replace&#x0a;&#x20;&#x20;&#x20;&#x20;`/boot/grub2/grub.cfg&#x20;with&#x20;the&#x20;appropriate&#x20;grub&#x20;configuration&#x20;file&#x20;for&#x20;your&#x0a;&#x20;&#x20;&#x20;&#x20;environment&#x0a;&#x20;&#x20;-&#x20;The&#x20;information&#x20;can&#x20;be&#x20;placed&#x20;in&#x20;any&#x20;/etc/grub.d&#x20;file&#x20;as&#x20;long&#x20;as&#x20;that&#x20;file&#x20;is&#x0a;&#x20;&#x20;&#x20;&#x20;incorporated&#x20;into&#x20;grub.cfg&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;superuser/user&#x20;information&#x20;and&#x20;password&#x20;should&#x20;not&#x20;be&#x20;contained&#x20;in&#x20;the&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;/etc/grub.d/00_header&#x20;file.&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;A&#x20;custom&#x20;file,&#x20;such&#x20;as&#x20;/etc/grub.d/40_custom&#x20;should&#x20;be&#x20;used&#x20;so&#x20;it&#x20;is&#x20;not&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;overwritten&#x20;should&#x20;the&#x20;Grub&#x20;package&#x20;be&#x20;updated.&#x0a;','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.&#x0a;','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-mkpasswd-pbkdf2:&#x0a;&#x20;&#x20;#&#x20;grub2-mkpasswd-pbkdf2&#x0a;&#x20;&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x0a;&#x20;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x0a;&#x20;&#x20;Your&#x20;PBKDF2&#x20;is&#x20;&lt;encrypted-password&gt;&#x0a;&#x0a;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/40_custom&#x0a;&#x20;&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x0a;&#x20;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x0a;&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x0a;&#x20;&#x20;#&#x20;grub2-mkconfig&#x20;-o&#x20;/boot/grub2/grub.cfg&#x0a;','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21023,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub2&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub2/.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub2&#x20;bootloader.&#x0a;&#x20;&#x20;-&#x20;If&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment:&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;Enact&#x20;equivalent&#x20;settings&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;Replace&#x20;/boot/grub2/grub.cfg&#x20;and&#x20;/boot/grub2/user.cfg&#x20;with&#x20;the&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;appropriate&#x20;boot&#x20;configuration&#x20;files&#x20;for&#x20;your&#x20;environment&#x0a;','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x0a;','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21024,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.&#x0a;','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;&#40;rescue&#x20;mode&#41;&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.&#x0a;','','Edit&#x20;/usr/lib/systemd/system/rescue.service&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;line:&#x20;ExecStart=-/usr/lib/systemd/systemd-sulogin-shell&#x20;rescue&#x0a;Edit&#x20;/usr/lib/systemd/system/emergency.service&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;line:&#x20;ExecStart=-/usr/lib/systemd/systemd-sulogin-shell&#x20;emergency&#x0a;','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21025,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.&#x0a;','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.&#x0a;','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x0a;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0&#x0a;If&#x20;systemd-coredump&#x20;is&#x20;installed:&#x20;edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;Storage=none&#x20;ProcessSizeMax=0&#x0a;Run&#x20;the&#x20;command:&#x20;systemctl&#x20;daemon-reload&#x0a;','[{\"cis\": [\"1.6.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21026,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.&#x0a;','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x0a;Note:&#x20;Ensure&#x20;your&#x20;system&#x20;supports&#x20;the&#x20;XD&#x20;or&#x20;NX&#x20;bit&#x20;and&#x20;has&#x20;PAE&#x20;support&#x20;before&#x20;implementing&#x20;this&#x20;recommendation&#x20;as&#x20;this&#x20;may&#x20;prevent&#x20;it&#x20;from&#x20;booting&#x20;if&#x20;these&#x20;are&#x20;not&#x20;supported&#x20;by&#x20;your&#x20;hardware.&#x0a;','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.&#x0a;','[{\"cis\": [\"1.6.2\"]}, {\"cis_csc\": [\"8.3\"]}]'),(21027,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.&#x0a;','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2&#x0a;','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"8.3\"]}]'),(21028,'Ensure&#x20;prelink&#x20;is&#x20;disabled.','prelinkis&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.&#x0a;','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;prelink:&#x20;#&#x20;zypper&#x20;remove&#x20;prelink&#x0a;','[{\"cis\": [\"1.6.4\"]}, {\"cis_csc\": [\"14.9\"]}]'),(21029,'Ensure&#x20;AppArmor&#x20;is&#x20;installed.','AppArmor&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AppArmor:&#x20;#&#x20;zypper&#x20;install&#x20;-t&#x20;pattern&#x20;apparmor&#x0a;','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21030,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x0a;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x0a;','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.&#x0a;','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x0a;OR&#x0a;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd&#x0a;','[{\"cis\": [\"1.8.1.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21031,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-&#x20;or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name&#x0a;','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.&#x0a;','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue&#x0a;','[{\"cis\": [\"1.8.1.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21032,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x0a;','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.&#x0a;','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net&#x0a;','[{\"cis\": [\"1.8.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21033,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x0a;','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/motd&#x0a;','[{\"cis\": [\"1.8.1.4\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21034,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x0a;','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue&#x0a;','[{\"cis\": [\"1.8.1.5\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21035,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x0a;','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue.net&#x0a;','[{\"cis\": [\"1.8.1.6\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21036,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;installed.','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;&#x20;xinetd&#x20;&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.&#x0a;','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;are&#x20;of&#x20;the&#x20;system.&#x0a;Note:&#x20;If&#x20;an&#x20;xinetd&#x20;service&#x20;or&#x20;services&#x20;are&#x20;required,&#x20;ensure&#x20;that&#x20;any&#x20;xinetd&#x20;service&#x20;not&#x20;required&#x20;is&#x20;stopped&#x20;and&#x20;disabled&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;xinetd:&#x20;#&#x20;zypper&#x20;remove&#x20;xinetd&#x0a;','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}]'),(21037,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;and&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at:&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x0a;','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x0a;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.&#x20;If&#x20;another&#x20;method&#x20;of&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;this&#x20;recommendation&#x20;can&#x20;be&#x20;skipped.&#x0a;','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x0a;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include&#x20;&#039;-u&#x20;chrony&#039;:&#x20;OPTIONS=&quot;-u&#x20;chrony&quot;&#x0a;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}]'),(21038,'Ensure&#x20;X11&#x20;Server&#x20;components&#x20;are&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.&#x0a;','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;Server&#x20;packages:&#x20;#&#x20;zypper&#x20;remove&#x20;xorg-x11-server*&#x0a;','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21039,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.&#x0a;','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop,&#x20;mask&#x20;and&#x20;remove&#x20;avahi-autoipd&#x20;and&#x20;avahi:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;avahi-daemon.service&#x20;#&#x20;zypper&#x20;remove&#x20;avahi-autoipd&#x20;avahi&#x0a;','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21040,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.&#x0a;','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;Note:&#x20;Removing&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cups:&#x20;#&#x20;zypper&#x20;remove&#x20;cups&#x0a;','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21041,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.&#x0a;','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;dhcp&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dhcp:&#x20;#&#x20;zypper&#x20;remove&#x20;dhcp&#x0a;','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21042,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;installed','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.&#x0a;','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;openldap-servers:&#x20;#&#x20;zypper&#x20;remove&#x20;openldap2&#x0a;','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21043,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.&#x0a;','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;bind:&#x20;#&#x20;zypper&#x20;remove&#x20;bind&#x0a;','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21044,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','FTP&#x20;&#40;File&#x20;Transfer&#x20;Protocol&#41;&#x20;is&#x20;a&#x20;traditional&#x20;and&#x20;widely&#x20;used&#x20;standard&#x20;tool&#x20;for&#x20;transferring&#x20;files&#x20;between&#x20;a&#x20;server&#x20;and&#x20;clients&#x20;over&#x20;a&#x20;network,&#x20;especially&#x20;where&#x20;no&#x20;authentication&#x20;is&#x20;necessary&#x20;&#40;permits&#x20;anonymous&#x20;users&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#41;.&#x0a;','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;SFTP&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;Note:&#x20;Additional&#x20;FTP&#x20;servers&#x20;also&#x20;exist&#x20;and&#x20;should&#x20;be&#x20;removed&#x20;if&#x20;not&#x20;required.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;vsftpd:&#x20;#&#x20;zypper&#x20;remove&#x20;vsftpd&#x0a;','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21045,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;installed.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;Several&#x20;http&#x20;servers&#x20;exist.&#x20;apache,&#x20;apache2,&#x20;lighttpd,&#x20;and&#x20;nginx&#x20;are&#x20;example&#x0a;&#x20;&#x20;&#x20;&#x20;packages&#x20;that&#x20;provide&#x20;an&#x20;HTTP&#x20;server&#x0a;&#x20;&#x20;-&#x20;These&#x20;and&#x20;other&#x20;packages&#x20;should&#x20;also&#x20;be&#x20;audited,&#x20;and&#x20;removed&#x20;if&#x20;not&#x20;required&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;apache2:&#x20;#&#x20;zypper&#x20;remove&#x20;apache2&#x0a;','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21046,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;installed.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;Several&#x20;IMAP/POP3&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;courier-imap&#x20;and&#x0a;&#x20;&#x20;&#x20;&#x20;cyrus-imap&#x20;are&#x20;example&#x20;services&#x20;that&#x20;provide&#x20;a&#x20;mail&#x20;server.&#x0a;&#x20;&#x20;-&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited&#x20;and&#x20;the&#x20;packages&#x20;removed&#x20;if&#x20;not&#x0a;&#x20;&#x20;&#x20;&#x20;required.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dovecot:&#x20;#&#x20;zypper&#x20;remove&#x20;dovecot&#x0a;','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21047,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.&#x0a;','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;package&#x20;can&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;samba:&#x20;#&#x20;zypper&#x20;remove&#x20;samba&#x0a;','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21048,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;Note:&#x20;Several&#x20;HTTP&#x20;proxy&#x20;servers&#x20;exist.&#x20;These&#x20;should&#x20;be&#x20;checked&#x20;and&#x20;removed&#x20;unless&#x20;required.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;squid&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;squid&#x0a;','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21049,'Ensure&#x20;net-snmp&#x20;is&#x20;not&#x20;installed.','Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;is&#x20;a&#x20;widely&#x20;used&#x20;protocol&#x20;for&#x20;monitoring&#x20;the&#x20;health&#x20;and&#x20;welfare&#x20;of&#x20;network&#x20;equipment,&#x20;computer&#x20;equipment&#x20;and&#x20;devices&#x20;like&#x20;UPSs.&#x0a;&#x20;&#x20;-&#x20;Net-SNMP&#x20;is&#x20;a&#x20;suite&#x20;of&#x20;applications&#x20;used&#x20;to&#x20;implement&#x20;SNMPv1&#x20;&#40;RFC&#x20;1157&#41;,&#x0a;&#x20;&#x20;&#x20;&#x20;SNMPv2&#x20;&#40;RFCs&#x20;1901-1908&#41;,&#x20;and&#x20;SNMPv3&#x20;&#40;RFCs&#x20;3411-3418&#41;&#x20;using&#x20;both&#x20;IPv4&#x20;and&#x0a;&#x20;&#x20;&#x20;&#x20;IPv6.&#x0a;&#x20;&#x20;-&#x20;Support&#x20;for&#x20;SNMPv2&#x20;classic&#x20;&#40;a.k.a.&#x20;&quot;SNMPv2&#x20;historic&quot;&#x20;-&#x20;RFCs&#x20;1441-1452&#41;&#x20;was&#x0a;&#x20;&#x20;&#x20;&#x20;dropped&#x20;with&#x20;the&#x20;4.0&#x20;release&#x20;of&#x20;the&#x20;UCD-snmp&#x20;package.&#x0a;&#x20;&#x20;-&#x20;The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x0a;&#x20;&#x20;&#x20;&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x0a;&#x20;&#x20;&#x20;&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.&#x0a;','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3&#x20;replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2&#x20;with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x0a;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;required:&#x0a;&#x20;&#x20;-&#x20;The&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;for&#x20;SNMP&#x20;v3&#x20;only.&#x20;User&#x20;Authentication&#x20;and&#x20;Message&#x0a;&#x20;&#x20;&#x20;&#x20;Encryption&#x20;should&#x20;be&#x20;configured.&#x0a;&#x20;&#x20;-&#x20;If&#x20;SNMP&#x20;v2&#x20;is&#x20;absolutely&#x20;necessary,&#x20;modify&#x20;the&#x20;community&#x20;strings&#039;&#x20;values.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;net-snmpd:&#x20;#&#x20;zypper&#x20;remove&#x20;net-snmp&#x0a;','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}]'),(21050,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.&#x0a;','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.&#x20;Notes:&#x0a;&#x20;&#x20;-&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;postfix&#x20;mail&#x20;server.&#x0a;&#x20;&#x20;-&#x20;Depending&#x20;on&#x20;your&#x20;environment&#x20;you&#x20;may&#x20;have&#x20;an&#x20;alternative&#x20;MTA&#x20;installed&#x20;such&#x20;as&#x0a;&#x20;&#x20;&#x20;&#x20;sendmail.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case&#x20;consult&#x20;the&#x20;documentation&#x20;for&#x20;your&#x20;installed&#x20;MTA&#x20;to&#x0a;&#x20;&#x20;&#x20;&#x20;configure&#x20;the&#x20;recommended&#x20;state.&#x0a;','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x0a;Run&#x20;the&#x20;folloing&#x20;command&#x20;to&#x20;restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix&#x0a;','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21051,'Ensure&#x20;rsync&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;masked.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','Unless&#x20;required,&#x20;the&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x0a;The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.&#x0a;Note:&#x20;If&#x20;a&#x20;required&#x20;dependency&#x20;exists&#x20;for&#x20;the&#x20;rsync&#x20;package,&#x20;but&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;service&#x20;should&#x20;be&#x20;masked.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;rsync&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;rsync&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;the&#x20;rsyncd&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rsyncd&#x0a;','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21052,'Ensure&#x20;NIS&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;ypserv&#x20;package&#x20;provides&#x20;the&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;.&#x20;This&#x20;service,&#x20;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.&#x0a;','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;ypserv&#x20;package&#x20;be&#x20;removed,&#x20;and&#x20;if&#x20;required&#x20;a&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ypserv:&#x20;#&#x20;zypper&#x20;remove&#x20;ypserv&#x0a;','[{\"cis\": [\"2.2.18\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}]'),(21053,'Ensure&#x20;telnet-server&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.&#x0a;','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;telnet-server&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;telnet&#x0a;','[{\"cis\": [\"2.2.19\"]}, {\"cis_csc\": [\"2.6\", \"9.2\"]}]'),(21054,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;&#40;&#x20;ypbind&#x20;&#41;&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.&#x0a;','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;ypbind&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;ypbind&#x0a;','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21055,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh&#x20;,&#x20;rcp&#x20;and&#x20;rlogin.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;rsh&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;rsh&#x0a;','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21056,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.&#x0a;','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;talk&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;talk&#x0a;','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21057,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.&#x0a;','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;telnet&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;telnet&#x0a;','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21058,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.&#x0a;','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;openldap-clients&#x20;package:&#x20;#&#x20;zypper&#x20;remove&#x20;openldap2-clients&#x0a;','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}]'),(21059,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.&#x0a;','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.send_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.send_redirects&#x20;=&#x20;0&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21060,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.&#x0a;','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21061,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.&#x0a;','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;system.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.3.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21062,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.&#x0a;','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.3.5\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21063,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.&#x0a;','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.3.6\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21064,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.&#x0a;','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.3.7\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21065,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.&#x0a;','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x0a;','[{\"cis\": [\"3.3.8\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21066,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted','This&#x20;setting&#x20;disables&#x20;the&#x20;system&#039;s&#x20;ability&#x20;to&#x20;accept&#x20;IPv6&#x20;router&#x20;advertisements.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;do&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.&#x0a;','','IF&#x20;IPv6&#x20;is&#x20;enabled:&#x0a;Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1&#x0a;','[{\"cis\": [\"3.3.9\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21067,'Ensure&#x20;DCCP&#x20;is&#x20;disabled','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;insequence&#x20;delivery.&#x0a;','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/dccp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x0a;install&#x20;dccp&#x20;/bin/true&#x0a;','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21068,'Ensure&#x20;SCTP&#x20;is&#x20;disabled','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.&#x0a;','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/sctp.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x0a;install&#x20;sctp&#x20;/bin/true&#x0a;','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21069,'Ensure&#x20;FirewallD&#x20;is&#x20;installed','firewalld&#x20;is&#x20;a&#x20;firewall&#x20;management&#x20;tool&#x20;for&#x20;Linux&#x20;operating&#x20;systems.&#x20;It&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;backend&#x20;or&#x20;provides&#x20;firewall&#x20;features&#x20;by&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;nftables&#x20;utility.&#x0a;FirewallD&#x20;replaces&#x20;iptables&#x20;as&#x20;the&#x20;default&#x20;firewall&#x20;management&#x20;tool.&#x20;Use&#x20;the&#x20;firewalld&#x20;utility&#x20;to&#x20;configure&#x20;a&#x20;firewall&#x20;for&#x20;less&#x20;complex&#x20;firewalls.&#x20;The&#x20;utility&#x20;is&#x20;easy&#x20;to&#x20;use&#x20;and&#x20;covers&#x20;the&#x20;typical&#x20;use&#x20;cases&#x20;scenario.&#x20;FirewallD&#x20;supports&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6&#x20;networks&#x20;and&#x20;can&#x20;administer&#x20;separate&#x20;firewall&#x20;zones&#x20;with&#x20;varying&#x20;degrees&#x20;of&#x20;trust&#x20;as&#x20;defined&#x20;in&#x20;zone&#x20;profiles.&#x0a;Note:&#x20;Starting&#x20;in&#x20;v0.6.0,&#x20;FirewallD&#x20;added&#x20;support&#x20;for&#x20;acting&#x20;as&#x20;a&#x20;front-end&#x20;for&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;nftables&#x20;userspace&#x20;utility,&#x20;acting&#x20;as&#x20;an&#x20;alternative&#x20;to&#x20;the&#x20;nft&#x20;command&#x20;line&#x20;program.&#x0a;','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x0a;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.&#x0a;Note:&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x20;FirewallD&#x20;is&#x20;dependent&#x20;on&#x20;the&#x20;iptables&#x20;package.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;FirewallD&#x20;and&#x20;iptables:&#x20;#&#x20;zypper&#x20;install&#x20;firewalld&#x20;iptables&#x0a;','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21070,'Ensure&#x20;firewalld&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running','firewalld.service&#x20;enables&#x20;the&#x20;enforcement&#x20;of&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld&#x0a;','Ensure&#x20;that&#x20;the&#x20;firewalld.service&#x20;is&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;enforce&#x20;firewall&#x20;rules&#x20;configured&#x20;through&#x20;firewalld&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;firewalld&#x20;#&#x20;systemctl&#x20;unmask&#x20;firewalld&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;firewalld&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;firewalld&#x0a;','[{\"cis\": [\"3.5.1.3\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21071,'Ensure&#x20;nftables&#x20;is&#x20;installed','nftables&#x20;provides&#x20;a&#x20;new&#x20;in-kernel&#x20;packet&#x20;classification&#x20;framework&#x20;that&#x20;is&#x20;based&#x20;on&#x20;a&#x20;network-specific&#x20;Virtual&#x20;Machine&#x20;&#40;VM&#41;&#x20;and&#x20;a&#x20;new&#x20;nft&#x20;userspace&#x20;command&#x20;line&#x20;tool.&#x20;nftables&#x20;reuses&#x20;the&#x20;existing&#x20;Netfilter&#x20;subsystems&#x20;such&#x20;as&#x20;the&#x20;existing&#x20;hook&#x20;infrastructure,&#x20;the&#x20;connection&#x20;tracking&#x20;system,&#x20;NAT,&#x20;userspace&#x20;queuing&#x20;and&#x20;logging&#x20;subsystem.&#x0a;&#x20;&#x20;Notes:&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;nftables&#x20;is&#x20;available&#x20;in&#x20;Linux&#x20;kernel&#x20;3.13&#x20;and&#x20;newer.&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x0a;','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;nftables&#x20;#&#x20;zypper&#x20;install&#x20;nftables&#x0a;','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21072,'Ensure&#x20;a&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.&#x0a;','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x0a;','[{\"cis\": [\"3.5.2.4\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21073,'Ensure&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.&#x0a;','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x0a;','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21074,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.&#x0a;','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.&#x0a;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x0a;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x0a;','[{\"cis\": [\"3.5.2.8\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21075,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service&#x0a;','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/sysconfig/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables&#x0a;','[{\"cis\": [\"3.5.2.9\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21076,'Ensure&#x20;nftables&#x20;is&#x20;not&#x20;installed','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.&#x0a;','Running&#x20;both&#x20;iptables&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:&#x20;#&#x20;zypper&#x20;remove&#x20;nftables&#x0a;','[{\"cis\": [\"3.5.3.1.2\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21077,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x0a;','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.&#x0a;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP&#x0a;','[{\"cis\": [\"3.5.3.2.1\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21078,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.&#x0a;','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.&#x0a;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP&#x0a;','[{\"cis\": [\"3.5.3.2.2\"]}, {\"cis_csc\": [\"9.4\"]}]'),(21079,'Ensure&#x20;auditd&#x20;is&#x20;installed','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk&#x0a;','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;#&#x20;zypper&#x20;install&#x20;audit&#x0a;','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21080,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;running','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd&#x0a;','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21081,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.&#x0a;&#x20;&#x20;-&#x20;Other&#x20;methods&#x20;of&#x20;log&#x20;rotation&#x20;may&#x20;be&#x20;appropriate&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;One&#x20;example&#x20;is&#x0a;&#x20;&#x20;&#x20;&#x20;time-based&#x20;rotation&#x20;strategies&#x20;which&#x20;don&#039;t&#x20;have&#x20;native&#x20;support&#x20;in&#x20;auditd&#x0a;&#x20;&#x20;&#x20;&#x20;configurations.&#x20;Manual&#x20;audit&#x20;of&#x20;custom&#x20;configurations&#x20;should&#x20;be&#x20;evaluated&#x20;for&#x0a;&#x20;&#x20;&#x20;&#x20;effectiveness&#x20;and&#x20;completeness.&#x0a;','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x0a;','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21082,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.&#x0a;','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs&#x0a;','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc\": [\"6.2\", \"6.4\"]}]'),(21083,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.&#x0a;','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt&#x0a;','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.4\"]}]'),(21084,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.&#x0a;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.&#x0a;','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/identity.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x0a;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x0a;','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"4.8\"]}]'),(21085,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;SELinux&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;If&#x20;a&#x20;different&#x20;Mandatory&#x20;Access&#x20;Control&#x20;method&#x20;is&#x20;used,&#x20;changes&#x20;to&#x20;the&#x20;corresponding&#x0a;&#x20;&#x20;&#x20;&#x20;directories&#x20;should&#x20;be&#x20;audited.&#x0a;&#x20;&#x20;-&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x0a;&#x20;&#x20;&#x20;&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.&#x0a;','Changes&#x20;to&#x20;files&#x20;in&#x20;the&#x20;/etc/selinux/&#x20;and&#x20;/usr/share/selinux/&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/MAC_policy.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x0a;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x0a;','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}]'),(21086,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x0a;&#x20;&#x20;-&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x0a;&#x20;&#x20;-&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x0a;&#x20;&#x20;&#x20;&#x20;logged&#x20;in.&#x0a;&#x20;&#x20;-&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x0a;&#x20;&#x20;&#x20;&#x20;module&#x0a;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.&#x0a;','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/logins.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x0a;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x0a;','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}]'),(21087,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x0a;&#x20;&#x20;&#x20;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;&#x0a;&#x20;&#x20;-&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x0a;&#x20;&#x20;&#x20;&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.&#x0a;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/session.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x0a;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x0a;','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}]'),(21088,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d&#x20;directory&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x0a;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.&#x0a;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file,&#x20;or&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d/&#x20;directory&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.&#x0a;','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory&#x20;ending&#x20;in&#x20;.rules&#x20;Example:&#x20;vi&#x20;/etc/audit/rules.d/scope.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x0a;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x0a;','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"4.8\"]}]'),(21089,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.&#x0a;Note:&#x20;This&#x20;setting&#x20;will&#x20;require&#x20;the&#x20;system&#x20;to&#x20;be&#x20;rebooted&#x20;to&#x20;update&#x20;the&#x20;active&#x20;auditd&#x20;configuration&#x20;settings.&#x0a;','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.&#x0a;','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file:&#x0a;-e&#x20;2&#x0a;','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21090,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;is&#x20;a&#x20;recommended&#x20;replacement&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon.&#x20;rsyslog&#x20;provides&#x20;improvements&#x20;over&#x20;syslogd,&#x20;including:&#x0a;&#x20;&#x20;-&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs&#x0a;&#x20;&#x20;-&#x20;The&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats&#x0a;&#x20;&#x20;-&#x20;Encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#x0a;','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;#&#x20;zypper&#x20;install&#x20;rsyslog&#x0a;','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21091,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled&#x20;and&#x20;running.','rsyslog&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;to&#x20;perform&#x20;logging','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog&#x0a;','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21092,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.&#x20;The&#x20;$FileCreateMode&#x20;parameter&#x20;specifies&#x20;the&#x20;file&#x20;creation&#x20;mode&#x20;with&#x20;which&#x20;rsyslogd&#x20;creates&#x20;new&#x20;files.&#x20;If&#x20;not&#x20;specified,&#x20;the&#x20;value&#x20;0644&#x20;is&#x20;used.&#x20;Notes:&#x0a;&#x20;&#x20;-&#x20;The&#x20;value&#x20;given&#x20;must&#x20;always&#x20;be&#x20;a&#x20;4-digit&#x20;octal&#x20;number,&#x20;with&#x20;the&#x20;initial&#x20;digit&#x20;being&#x0a;&#x20;&#x20;&#x20;&#x20;zero.&#x0a;&#x20;&#x20;-&#x20;This&#x20;setting&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;a&#x20;less&#x20;restrictive&#x20;setting&#x20;in&#x20;any&#x20;file&#x20;ending&#x20;in&#x20;.conf&#x20;in&#x0a;&#x20;&#x20;&#x20;&#x20;the&#x20;/etc/rsyslog.d/&#x20;directory&#x0a;','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.&#x0a;','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x0a;$FileCreateMode&#x20;0640&#x0a;','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21093,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;rsyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;This&#x20;recommendation&#x20;assumes&#x20;that&#x20;recommendation&#x20;4.2.1.5,&#x20;&quot;Ensure&#x20;rsyslog&#x20;is&#x0a;&#x20;&#x20;&#x20;&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&quot;&#x20;has&#x20;been&#x20;implemented.&#x0a;&#x20;&#x20;-&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x0a;&#x20;&#x20;&#x20;&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x0a;&#x20;&#x20;&#x20;&#x20;configuration&#x20;parameters&#x0a;&#x20;&#x20;-&#x20;As&#x20;noted&#x20;in&#x20;the&#x20;journald&#x20;man&#x20;pages:&#x20;journald&#x20;logs&#x20;may&#x20;be&#x20;exported&#x20;to&#x20;rsyslog&#x20;either&#x0a;&#x20;&#x20;&#x20;&#x20;through&#x20;the&#x20;process&#x20;mentioned&#x20;here,&#x20;or&#x20;through&#x20;a&#x20;facility&#x20;like&#x20;systemdjournald.service.&#x20;There&#x20;are&#x20;trade-offs&#x20;involved&#x20;in&#x20;each&#x20;implementation,&#x20;where&#x0a;&#x20;&#x20;&#x20;&#x20;ForwardToSyslog&#x20;will&#x20;immediately&#x20;capture&#x20;all&#x20;events&#x20;&#40;and&#x20;forward&#x20;to&#x20;an&#x20;external&#x20;log&#x0a;&#x20;&#x20;&#x20;&#x20;server,&#x20;if&#x20;properly&#x20;configured&#41;,&#x20;but&#x20;may&#x20;not&#x20;capture&#x20;all&#x20;boot-up&#x20;activities.&#x20;Mechanisms&#x0a;&#x20;&#x20;&#x20;&#x20;such&#x20;as&#x20;systemd-journald.service,&#x20;on&#x20;the&#x20;other&#x20;hand,&#x20;will&#x20;record&#x20;bootup&#x20;events,&#x20;but&#x0a;&#x20;&#x20;&#x20;&#x20;may&#x20;delay&#x20;sending&#x20;the&#x20;information&#x20;to&#x20;rsyslog,&#x20;leading&#x20;to&#x20;the&#x20;potential&#x20;for&#x20;log&#x0a;&#x20;&#x20;&#x20;&#x20;manipulation&#x20;prior&#x20;to&#x20;export.&#x20;Be&#x20;aware&#x20;of&#x20;the&#x20;limitations&#x20;of&#x20;all&#x20;tools&#x20;employed&#x20;to&#x0a;&#x20;&#x20;&#x20;&#x20;secure&#x20;a&#x20;system.&#x0a;','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.&#x0a;','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes&#x0a;','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.5\"]}]'),(21094,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;log&#039;s&#x20;size&#x20;unmanageable.&#x0a;Note:&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters&#x0a;','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.&#x0a;','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes&#x0a;','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21095,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss.&#x0a;Note:&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters&#x0a;','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.&#x0a;','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent&#x0a;','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21096,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled&#x20;and&#x20;running','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run.&#x20;If&#x20;another&#x20;method&#x20;for&#x20;scheduling&#x20;tasks&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them,&#x20;and&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;cron:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;cron&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21097,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.&#x0a;','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;u-x,og-rwx&#x20;/etc/crontab&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21098,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x0a;','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.hourly/&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly/&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21099,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x0a;','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21100,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x0a;','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.&#x0a;','','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.&#x0a;','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21101,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x0a;','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21102,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d/&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab&#x20;,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x0a;','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron:&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21103,'Ensure&#x20;cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','If&#x20;cron&#x20;is&#x20;installed&#x20;in&#x20;the&#x20;system,&#x20;configure&#x20;/etc/cron.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x0a;Note:&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.&#x0a;','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;/etc/cron.deny:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;owner&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.allow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;u-x,og-rwx&#x20;/etc/cron.allow&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cron&#x20;#&#x20;zypper&#x20;remove&#x20;cronie&#x0a;','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}]'),(21104,'Ensure&#x20;at&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','If&#x20;at&#x20;is&#x20;installed&#x20;in&#x20;the&#x20;system,&#x20;configure&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/at.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x0a;Note:&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;at.allow,&#x20;at&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;at.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;at&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;at&#x20;jobs.&#x0a;','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;at&#x20;jobs.&#x20;Using&#x20;the&#x20;at.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;at&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;/etc/at.deny:&#x20;#&#x20;rm&#x20;/etc/at.deny&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/at.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x0a;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;owner&#x20;and&#x20;permissions&#x20;on&#x20;/etc/at.allow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;u-x,og-rwx&#x20;/etc/at.allow&#x0a;OR&#x0a;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;at:&#x20;#&#x20;zypper&#x20;remove&#x20;at&#x0a;','[{\"cis\": [\"5.1.9\"]}, {\"cis_csc\": [\"16\"]}]'),(21114,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.&#x0a;','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;nonprivileged&#x20;users.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x0a;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config&#x0a;','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21115,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x0a;&#x20;&#x20;-&#x20;AllowUsers:&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x0a;&#x20;&#x20;-&#x20;AllowGroups:&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;this&#x20;variable.&#x0a;&#x20;&#x20;-&#x20;DenyUsers:&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;user@host.&#x0a;&#x20;&#x20;-&#x20;DenyGroups:&#x0a;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;this&#x20;variable.&#x0a;','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x0a;OR&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x0a;OR&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x0a;OR&#x20;DenyGroups&#x20;&lt;grouplist&gt;&#x0a;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"4.3\"]}]'),(21116,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x0a;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.&#x0a;','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;OR&#x20;LogLevel&#x20;INFO&#x0a;','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(21117,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.&#x0a;','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no&#x0a;','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21118,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.&#x0a;','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4&#x0a;','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.13\"]}]'),(21119,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.&#x0a;','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes&#x0a;','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21120,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.&#x0a;','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no&#x0a;','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}]'),(21121,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.&#x0a;','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no&#x0a;','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"4.3\"]}]'),(21122,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.&#x0a;','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no&#x0a;','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"16.3\"]}]'),(21123,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.&#x0a;','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;a&#x20;Trojan&rsquo;s&#x20;programs&#41;&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no&#x0a;','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21124,'Ensure&#x20;only&#x20;strong&#x20;Ciphers&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Notes:&#x0a;&#x20;&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;ciphers.&#x20;Ensure&#x20;that&#x0a;&#x20;&#x20;&#x20;&#x20;ciphers&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy&#x0a;&#x20;&#x20;-&#x20;The&#x20;only&#x20;&quot;strong&quot;&#x20;ciphers&#x20;currently&#x20;FIPS&#x20;140-2&#x20;compliant&#x20;are:&#x20;aes256-ctr,aes192-&#x0a;&#x20;&#x20;&#x20;&#x20;ctr,aes128-ctr&#x0a;&#x20;&#x20;-&#x20;CVE-2013-4548&#x20;referenced&#x20;bellow&#x20;applies&#x20;to&#x20;OpenSSH&#x20;versions&#x20;6.2&#x20;and&#x20;6.3.&#x20;If&#x20;running&#x0a;&#x20;&#x20;&#x20;&#x20;these&#x20;versions&#x20;of&#x20;Open&#x20;SSH,&#x20;Please&#x20;upgrade&#x20;to&#x20;version&#x20;6.4&#x20;or&#x20;later&#x20;to&#x20;fix&#x20;the&#x0a;&#x20;&#x20;&#x20;&#x20;vulnerability,&#x20;or&#x20;disable&#x20;AES-GCM&#x20;in&#x20;the&#x20;server&#x20;configuration&#x0a;&#x0a;The&#x20;Following&#x20;are&#x20;the&#x20;supported&#x20;ciphers&#x20;in&#x20;openSSH&#x20;7.9:&#x20;3des-cbc&#x20;aes128-cbc&#x20;aes192-cbc&#x20;aes256-cbc&#x20;aes128-ctr&#x20;aes192-ctr&#x20;aes256-ctr&#x20;aes128-gcm@openssh.com&#x20;aes256-gcm@openssh.com&#x20;chacha20-poly1305@openssh.com&#x0a;','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.&#x0a;&#x20;&#x20;-&#x20;The&#x20;DES,&#x20;Triple&#x20;DES,&#x20;and&#x20;Blowfish&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x0a;&#x20;&#x20;&#x20;&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x0a;&#x20;&#x20;&#x20;&#x20;obtain&#x20;cleartext&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x0a;&#x20;&#x20;&#x20;&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack&#x0a;&#x20;&#x20;-&#x20;The&#x20;RC4&#x20;algorithm,&#x20;as&#x20;used&#x20;in&#x20;the&#x20;TLS&#x20;protocol&#x20;and&#x20;SSL&#x20;protocol,&#x20;does&#x20;not&#x20;properly&#x0a;&#x20;&#x20;&#x20;&#x20;combine&#x20;state&#x20;data&#x20;with&#x20;key&#x20;data&#x20;during&#x20;the&#x20;initialization&#x20;phase,&#x20;which&#x20;makes&#x20;it&#x0a;&#x20;&#x20;&#x20;&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;conduct&#x20;plaintext-recovery&#x20;attacks&#x20;against&#x20;the&#x20;initial&#x0a;&#x20;&#x20;&#x20;&#x20;bytes&#x20;of&#x20;a&#x20;stream&#x20;by&#x20;sniffing&#x20;network&#x20;traffic&#x20;that&#x20;occasionally&#x20;relies&#x20;on&#x20;keys&#x20;affected&#x0a;&#x20;&#x20;&#x20;&#x20;by&#x20;the&#x20;Invariance&#x20;Weakness,&#x20;and&#x20;then&#x20;using&#x20;a&#x20;brute-force&#x20;approach&#x20;involving&#x20;LSB&#x0a;&#x20;&#x20;&#x20;&#x20;values,&#x20;aka&#x20;the&#x20;&quot;Bar&#x20;Mitzvah&quot;&#x20;issue&#x0a;&#x20;&#x20;-&#x20;The&#x20;passwords&#x20;used&#x20;during&#x20;an&#x20;SSH&#x20;session&#x20;encrypted&#x20;with&#x20;RC4&#x20;can&#x20;be&#x20;recovered&#x20;by&#x0a;&#x20;&#x20;&#x20;&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;and&#x20;replay&#x20;the&#x20;session&#x0a;&#x20;&#x20;-&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x0a;&#x20;&#x20;&#x20;&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x0a;&#x20;&#x20;&#x20;&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plaintext&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;ciphertext&#x20;in&#x0a;&#x20;&#x20;&#x20;&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors&#x0a;&#x20;&#x20;-&#x20;The&#x20;mm_newkeys_from_blob&#x20;function&#x20;in&#x20;monitor_wrap.c,&#x20;when&#x20;an&#x20;AES-GCM&#x20;cipher&#x0a;&#x20;&#x20;&#x20;&#x20;is&#x20;used,&#x20;does&#x20;not&#x20;properly&#x20;initialize&#x20;memory&#x20;for&#x20;a&#x20;MAC&#x20;context&#x20;data&#x20;structure,&#x20;which&#x0a;&#x20;&#x20;&#x20;&#x20;allows&#x20;remote&#x20;authenticated&#x20;users&#x20;to&#x20;bypass&#x20;intended&#x20;ForceCommand&#x20;and&#x20;loginshell&#x20;restrictions&#x20;via&#x20;packet&#x20;data&#x20;that&#x20;provides&#x20;a&#x20;crafted&#x20;callback&#x20;address&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers&#x0a;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-&#x20;gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr&#x0a;','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"14.4\"]}]'),(21125,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Notes:&#x0a;&#x20;&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;MACs.&#x20;Ensure&#x20;that&#x0a;&#x20;&#x20;&#x20;&#x20;MACs&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy&#x0a;&#x20;&#x20;-&#x20;The&#x20;only&#x20;&quot;strong&quot;&#x20;MACs&#x20;currently&#x20;FIPS&#x20;140-2&#x20;approved&#x20;are&#x20;hmac-sha2-256&#x20;and&#x20;hmacsha2-512&#x0a;&#x0a;The&#x20;Supported&#x20;MACs&#x20;are:&#x20;hmac-md5&#x20;hmac-md5-96&#x20;hmac-sha1&#x20;hmac-sha1-96&#x20;hmac-sha2-256&#x20;hmac-sha2-512&#x20;umac-64@openssh.com&#x20;umac-128@openssh.com&#x20;hmac-md5-etm@openssh.com&#x20;hmac-md5-96-etm@openssh.com&#x20;hmac-sha1-etm@openssh.com&#x20;hmac-sha1-96-etm@openssh.com&#x20;hmac-sha2-256-etm@openssh.com&#x20;hmac-sha2-512-etm@openssh.com&#x20;umac-64-etm@openssh.com&#x20;umac-128-etm@openssh.com&#x0a;','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x0a;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-&#x20;512,hmac-sha2-256&#x0a;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}]'),(21126,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received&#x0a;Notes:&#x20;Kex&#x20;algorithms&#x20;have&#x20;a&#x20;higher&#x20;preference&#x20;the&#x20;earlier&#x20;they&#x20;appear&#x20;in&#x20;the&#x20;list&#x0a;&#x20;&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;Key&#x20;exchange&#x0a;&#x20;&#x20;&#x20;&#x20;algorithms.&#x20;Ensure&#x20;that&#x20;Key&#x20;exchange&#x20;algorithms&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x0a;&#x20;&#x20;&#x20;&#x20;policy.&#x0a;&#x20;&#x20;-&#x20;The&#x20;only&#x20;Key&#x20;Exchange&#x20;Algorithms&#x20;currently&#x20;FIPS&#x20;140-2&#x20;approved&#x20;are:&#x20;ecdh-sha2-&#x0a;&#x20;&#x20;&#x20;&#x20;nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchangesha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffiehellman-group14-sha256&#x0a;&#x0a;The&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;supported&#x20;by&#x20;OpenSSH&#x20;7.9&#x20;are:&#x20;curve25519-sha256&#x20;curve25519-sha256@libssh.org&#x20;diffie-hellman-group1-sha1&#x20;diffie-hellman-group14-sha1&#x20;diffie-hellman-group14-sha256&#x20;diffie-hellman-group16-sha512&#x20;diffie-hellman-group18-sha512&#x20;diffie-hellman-group-exchange-sha1&#x20;diffie-hellman-group-exchange-sha256&#x20;ecdh-sha2-nistp256&#x20;ecdh-sha2-nistp384&#x20;ecdh-sha2-nistp521&#x0a;','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x0a;Example&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellmangroup14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-&#x20;sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffiehellman-group-exchange-sha256&#x0a;','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"14.4\"]}]'),(21127,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x0a;&#x20;&#x20;-&#x20;ClientAliveInterval&#x20;sets&#x20;a&#x20;timeout&#x20;interval&#x20;in&#x20;seconds&#x20;after&#x20;which&#x20;if&#x20;no&#x20;data&#x20;has&#x0a;&#x20;&#x20;&#x20;&#x20;been&#x20;received&#x20;from&#x20;the&#x20;client,&#x20;sshd&#x20;will&#x20;send&#x20;a&#x20;message&#x20;through&#x20;the&#x20;encrypted&#x0a;&#x20;&#x20;&#x20;&#x20;channel&#x20;to&#x20;request&#x20;a&#x20;response&#x20;from&#x20;the&#x20;client.&#x20;The&#x20;default&#x20;is&#x20;0,&#x20;indicating&#x20;that&#x20;these&#x0a;&#x20;&#x20;&#x20;&#x20;messages&#x20;will&#x20;not&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;client.&#x0a;&#x20;&#x20;-&#x20;ClientAliveCountMax&#x20;sets&#x20;the&#x20;number&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;which&#x20;may&#x20;be&#x20;sent&#x0a;&#x20;&#x20;&#x20;&#x20;without&#x20;sshd&#x20;receiving&#x20;any&#x20;messages&#x20;back&#x20;from&#x20;the&#x20;client.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x0a;&#x20;&#x20;&#x20;&#x20;reached&#x20;while&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;being&#x20;sent,&#x20;sshd&#x20;will&#x20;disconnect&#x20;the&#x20;client,&#x0a;&#x20;&#x20;&#x20;&#x20;terminating&#x20;the&#x20;session.&#x20;The&#x20;default&#x20;value&#x20;is&#x20;3.&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-&#x20;The&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x0a;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-&#x20;Setting&#x20;ClientAliveCountMax&#x20;to&#x20;0&#x20;disables&#x20;connection&#x20;termination&#x0a;&#x0a;Example:&#x20;If&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.&#x0a;','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;this&#x20;risk.&#x20;&#x20;The&#x20;recommended&#x20;ClientAliveInterval&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;&#x20;&#x20;The&#x20;recommended&#x20;ClientAliveCountMax&#x20;setting&#x20;is&#x20;3&#x20;&#x20;The&#x20;ssh&#x20;session&#x20;would&#x20;send&#x20;three&#x20;keep&#x20;alive&#x20;messages&#x20;at&#x20;5&#x20;minute&#x20;intervals.&#x20;If&#x20;no&#x20;response&#x20;is&#x20;received&#x20;after&#x20;the&#x20;third&#x20;keep&#x20;alive&#x20;message,&#x20;the&#x20;ssh&#x20;session&#x20;would&#x20;be&#x20;terminated&#x20;after&#x20;15&#x20;minutes.&#x0a;','','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;this&#x20;risk.&#x0a;&#x20;&#x20;-&#x20;The&#x20;recommended&#x20;ClientAliveInterval&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;&#x0a;&#x20;&#x20;-&#x20;The&#x20;recommended&#x20;ClientAliveCountMax&#x20;setting&#x20;is&#x20;3&#x0a;&#x20;&#x20;-&#x20;The&#x20;ssh&#x20;session&#x20;would&#x20;send&#x20;three&#x20;keep&#x20;alive&#x20;messages&#x20;at&#x20;5&#x20;minute&#x20;intervals.&#x20;If&#x20;no&#x0a;&#x20;&#x20;&#x20;&#x20;response&#x20;is&#x20;received&#x20;after&#x20;the&#x20;third&#x20;keep&#x20;alive&#x20;message,&#x20;the&#x20;ssh&#x20;session&#x20;would&#x20;be&#x0a;&#x20;&#x20;&#x20;&#x20;terminated&#x20;after&#x20;15&#x20;minutes.&#x0a;','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"16.11\"]}]'),(21128,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.&#x0a;','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60&#x0a;','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21129,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.&#x0a;','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x0a;Banner&#x20;/etc/issue.net&#x0a;','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21130,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&ldquo;yes&rdquo;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types&#x0a;','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x0a;UsePAM&#x20;yes&#x0a;','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21131,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines&#x0a;','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;backdoors.&#x0a;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x0a;AllowTcpForwarding&#x20;no&#x0a;','[{\"cis\": [\"5.2.20\"]}, {\"cis_csc\": [\"9.2\"]}]'),(21132,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.&#x0a;','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x0a;maxstartups&#x20;10:30:60&#x0a;','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21133,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;limited.','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.&#x0a;','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.&#x0a;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x0a;MaxSessions&#x20;10&#x0a;','[{\"cis\": [\"5.2.22\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21134,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.&#x0a;Notes:&#x20;-&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.&#x20;-&#x20;This&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;local&#x20;accounts.&#x20;-&#x20;This&#x20;option&#x20;is&#x20;configured&#x20;with&#x20;the&#x20;remember=n&#x20;module&#x20;option&#x20;in&#x20;/etc/pam.d/commonpassword&#x0a;','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x0a;','','Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;pam-config&#x20;-a&#x20;--pwhistory&#x20;--pwhistory-remember=5&#x0a;OR&#x0a;Edit&#x20;the&#x20;file&#x20;/etc/pam.d/common-password&#x20;to&#x20;include&#x20;the&#x20;remember=&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5&#x0a;','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}]'),(21135,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','Login&#x20;passwords&#x20;are&#x20;hashed&#x20;and&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file.&#x0a;Note:&#x20;These&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.&#x0a;','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x0a;','','Edit&#x20;the&#x20;/etc/login.defs&#x20;file&#x20;and&#x20;modify&#x20;ENCRYPT_METHOD&#x20;to&#x20;SHA512:&#x20;ENCRYPT_METHOD&#x20;sha512&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;Any&#x20;system&#x20;accounts&#x20;that&#x20;need&#x20;to&#x20;be&#x20;expired&#x20;should&#x20;be&#x20;carefully&#x20;done&#x20;separately&#x20;by&#x20;the&#x0a;&#x20;&#x20;&#x20;&#x20;system&#x20;administrator&#x20;to&#x20;prevent&#x20;any&#x20;potential&#x20;problems&#x0a;&#x20;&#x20;-&#x20;If&#x20;it&#x20;is&#x20;determined&#x20;that&#x20;the&#x20;password&#x20;algorithm&#x20;being&#x20;used&#x20;is&#x20;not&#x20;SHA-512,&#x20;once&#x20;it&#x20;is&#x0a;&#x20;&#x20;&#x20;&#x20;changed,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;user&#x20;ID&#039;s&#x20;be&#x20;immediately&#x20;expired&#x20;and&#x20;forced&#x20;to&#x0a;&#x20;&#x20;&#x20;&#x20;change&#x20;their&#x20;passwords&#x20;on&#x20;next&#x20;login,&#x20;In&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policies&#x0a;&#x20;&#x20;-&#x20;To&#x20;accomplish&#x20;this,&#x20;the&#x20;following&#x20;command&#x20;can&#x20;be&#x20;used&#x0a;&#x20;&#x20;&#x20;&#x20;#&#x20;awk&#x20;-F:&#x20;&#039;&#40;&#x20;$3&lt;&#039;&quot;$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&quot;&#039;&#x20;&amp;&amp;&#x0a;&#x20;&#x20;&#x20;&#x20;$1&#x20;!=&#x20;&quot;nfsnobody&quot;&#x20;&#41;&#x20;{&#x20;print&#x20;$1&#x20;}&#039;&#x20;/etc/passwd&#x20;|&#x20;xargs&#x20;-n&#x20;1&#x20;chage&#x20;-d&#x20;0&#x0a;','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"16.4\"]}]'),(21136,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.&#x0a;','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.&#x0a;','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0&#x20;:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root&#x0a;','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21137,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.&#x0a;','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;owner,&#x20;group,&#x20;and&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x0a;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/passwd&#x0a;','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21138,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.&#x0a;','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;owner,&#x20;group,&#x20;and&#x20;permissions&#x20;on&#x20;/etc/shadow:&#x0a;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow&#x0a;','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21139,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.&#x0a;','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;owner,&#x20;group,&#x20;and&#x20;permissions&#x20;on&#x20;/etc/group&#x20;:&#x0a;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-wx&#x20;/etc/group&#x0a;','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21140,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;owner,&#x20;group,&#x20;and&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;:&#x0a;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd&#x0a;','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21141,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.&#x0a;','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;owner,&#x20;group,&#x20;and&#x20;permissions&#x20;on&#x20;/etc/shadow-:&#x0a;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow&#x0a;','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21142,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.&#x0a;','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;owner,&#x20;group,&#x20;and&#x20;permissions&#x20;on&#x20;/etc/group-:&#x0a;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group-&#x0a;','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"14.6\"]}]'),(21143,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords.','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;The&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;one-way&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;x&#x20;in&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.&#x0a;','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.&#x0a;Notes:&#x0a;&#x20;&#x20;-&#x20;All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x0a;&#x20;&#x20;&#x20;&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x0a;&#x20;&#x20;-&#x20;A&#x20;user&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd&#x20;allows&#x20;the&#x20;account&#x20;to&#x20;be&#x0a;&#x20;&#x20;&#x20;&#x20;logged&#x20;into&#x20;by&#x20;providing&#x20;only&#x20;the&#x20;username.&#x0a;','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;single&#x20;x&#x20;in&#x20;the&#x20;password&#x20;field,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;these&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:&#x0a;#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwd&#x0a;Investigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.&#x0a;','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}]'),(21144,'Ensure&#x20;/etc/shadow&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.&#x0a;','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x0a;','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x0a;#&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x0a;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.&#x0a;','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"4.4\"]}]'),(21145,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.&#x0a;','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.&#x0a;','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21500,'Ensure&#x20;mounting&#x20;of&#x20;cramfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;cramfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;compressed&#x20;read-only&#x20;Linux&#x20;filesystem&#x20;embedded&#x20;in&#x20;small&#x20;footprint&#x20;systems.&#x20;A&#x20;cramfs&#x20;image&#x20;can&#x20;be&#x20;used&#x20;without&#x20;having&#x20;to&#x20;first&#x20;decompress&#x20;the&#x20;image.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;server.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','1&#41;&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;cramfs&#x20;/bin/true.&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;cramfs&#x20;module:&#x20;#&#x20;rmmod&#x20;cramfs','[{\"cis\": [\"1.1.1.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(21501,'Ensure&#x20;mounting&#x20;of&#x20;freevxfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;freevxfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;free&#x20;version&#x20;of&#x20;the&#x20;Veritas&#x20;type&#x20;filesystem.&#x20;This&#x20;is&#x20;the&#x20;primary&#x20;filesystem&#x20;type&#x20;for&#x20;HP-UX&#x20;operating&#x20;systems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/freevxfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;freevxfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;freevxfs&#x20;module:&#x20;#&#x20;rmmod&#x20;freevxfs','[{\"cis\": [\"1.1.1.2\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(21502,'Ensure&#x20;mounting&#x20;of&#x20;jffs2&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;jffs2&#x20;&#40;journaling&#x20;flash&#x20;filesystem&#x20;2&#41;&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;log-structured&#x20;filesystem&#x20;used&#x20;in&#x20;flash&#x20;memory&#x20;devices.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/jffs2.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;jffs2&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;jffs2&#x20;module:&#x20;#&#x20;rmmod&#x20;jffs2','[{\"cis\": [\"1.1.1.3\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(21503,'Ensure&#x20;mounting&#x20;of&#x20;hfs&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfs&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/hfs.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfs&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfs&#x20;module:&#x20;#&#x20;rmmod&#x20;hfs','[{\"cis\": [\"1.1.1.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(21504,'Ensure&#x20;mounting&#x20;of&#x20;hfsplus&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;hfsplus&#x20;filesystem&#x20;type&#x20;is&#x20;a&#x20;hierarchical&#x20;filesystem&#x20;designed&#x20;to&#x20;replace&#x20;hfs&#x20;that&#x20;allows&#x20;you&#x20;to&#x20;mount&#x20;Mac&#x20;OS&#x20;filesystems.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.confExample:&#x20;vim&#x20;/etc/modprobe.d/hfsplus.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;hfsplus&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;hfsplus&#x20;module:&#x20;#&#x20;rmmod&#x20;hfsplus','[{\"cis\": [\"1.1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(21505,'Ensure&#x20;mounting&#x20;of&#x20;udf&#x20;filesystems&#x20;is&#x20;disabled.','The&#x20;udf&#x20;filesystem&#x20;type&#x20;is&#x20;the&#x20;universal&#x20;disk&#x20;format&#x20;used&#x20;to&#x20;implement&#x20;ISO/IEC&#x20;13346&#x20;and&#x20;ECMA-167&#x20;specifications.&#x20;This&#x20;is&#x20;an&#x20;open&#x20;vendor&#x20;filesystem&#x20;type&#x20;for&#x20;data&#x20;storage&#x20;on&#x20;a&#x20;broad&#x20;range&#x20;of&#x20;media.&#x20;This&#x20;filesystem&#x20;type&#x20;is&#x20;necessary&#x20;to&#x20;support&#x20;writing&#x20;DVDs&#x20;and&#x20;newer&#x20;optical&#x20;disc&#x20;formats.','Removing&#x20;support&#x20;for&#x20;unneeded&#x20;filesystem&#x20;types&#x20;reduces&#x20;the&#x20;local&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;If&#x20;this&#x20;filesystem&#x20;type&#x20;is&#x20;not&#x20;needed,&#x20;disable&#x20;it.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/modprobe.d/&#x20;directory&#x20;ending&#x20;in&#x20;.conf&#x20;Example:&#x20;vim&#x20;/etc/modprobe.d/udf.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;udf&#x20;/bin/true&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unload&#x20;the&#x20;udf&#x20;module:&#x20;#&#x20;rmmod&#x20;udf','[{\"cis\": [\"1.1.1.6\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(21506,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/tmp.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21507,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodevto&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21508,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;set&#x20;userid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;set&#x20;userid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/tmp','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21509,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21510,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;In&#x20;addition,&#x20;making&#x20;/var/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/var/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hardlink&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21511,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/var/tmp','[{\"cis\": [\"1.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21512,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/var/tmp','[{\"cis\": [\"1.1.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21513,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/var/tmp','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc\": [\"2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21514,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;logs&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;logs&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.10\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21515,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','There&#x20;are&#x20;two&#x20;important&#x20;reasons&#x20;to&#x20;ensure&#x20;that&#x20;data&#x20;gathered&#x20;by&#x20;auditd&#x20;is&#x20;stored&#x20;on&#x20;a&#x20;separate&#x20;partition:&#x20;protection&#x20;against&#x20;resource&#x20;exhaustion&#x20;&#40;since&#x20;the&#x20;audit.log&#x20;file&#x20;can&#x20;grow&#x20;quite&#x20;large&#41;&#x20;and&#x20;protection&#x20;of&#x20;audit&#x20;data.&#x20;The&#x20;audit&#x20;daemon&#x20;calculates&#x20;how&#x20;much&#x20;free&#x20;space&#x20;is&#x20;left&#x20;and&#x20;performs&#x20;actions&#x20;based&#x20;on&#x20;the&#x20;results.&#x20;If&#x20;other&#x20;processes&#x20;&#40;such&#x20;as&#x20;syslog&#41;&#x20;consume&#x20;space&#x20;in&#x20;the&#x20;same&#x20;partition&#x20;as&#x20;auditd,&#x20;it&#x20;may&#x20;not&#x20;perform&#x20;as&#x20;desired.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.11\"]}, {\"cis_csc\": [\"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21516,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','If&#x20;the&#x20;system&#x20;is&#x20;intended&#x20;to&#x20;support&#x20;local&#x20;users,&#x20;create&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;the&#x20;/home&#x20;directory&#x20;to&#x20;protect&#x20;against&#x20;resource&#x20;exhaustion&#x20;and&#x20;restrict&#x20;the&#x20;type&#x20;of&#x20;files&#x20;that&#x20;can&#x20;be&#x20;stored&#x20;under&#x20;/home.','','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.12\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21517,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','When&#x20;set&#x20;on&#x20;a&#x20;file&#x20;system,&#x20;this&#x20;option&#x20;prevents&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices&#x20;from&#x20;being&#x20;defined,&#x20;or&#x20;if&#x20;they&#x20;exist,&#x20;from&#x20;being&#x20;used&#x20;as&#x20;character&#x20;and&#x20;block&#x20;special&#x20;devices.','Since&#x20;the&#x20;user&#x20;partitions&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices.&#x20;&#x20;Note:&#x20;The&#x20;actions&#x20;in&#x20;the&#x20;item&#x20;refer&#x20;to&#x20;the&#x20;/home&#x20;partition,&#x20;which&#x20;is&#x20;the&#x20;default&#x20;user&#x20;partition&#x20;that&#x20;is&#x20;defined&#x20;in&#x20;many&#x20;distributions.&#x20;If&#x20;you&#x20;have&#x20;created&#x20;other&#x20;user&#x20;partitions,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;Remediation&#x20;and&#x20;Audit&#x20;steps&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;partitions&#x20;as&#x20;well.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/home','[{\"cis\": [\"1.1.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21518,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/run/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nodev&#x20;/dev/shm','[{\"cis\": [\"1.1.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21519,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,nosuid&#x20;/dev/shm','[{\"cis\": [\"1.1.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21520,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm:&#x20;#&#x20;mount&#x20;-o&#x20;remount,noexec&#x20;/dev/shm','[{\"cis\": [\"1.1.16\"]}, {\"cis_csc\": [\"2.6\", \"8\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21521,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;it&#039;s&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;autofs:&#x20;#&#x20;systemctl&#x20;disable&#x20;autofs','[{\"cis\": [\"1.1.21\"]}, {\"cis_csc\": [\"8.4\", \"8.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21522,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;#&#x20;apt-get&#x20;install&#x20;aide&#x20;aide-common.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;#&#x20;aideinit','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21523,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;&#x20;&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"11.5\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21524,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.&#x20;The&#x20;grub&#x20;configuration&#x20;is&#x20;usually&#x20;grub.cfg&#x20;stored&#x20;in&#x20;/boot/grub.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg,&#x20;chmod&#x20;og-rwx&#x20;/boot/grub/grub.cfg','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21525,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;&#x20;&#x20;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;/etc/grub.d/00_header&#x20;or&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;&#x20;&#x20;&#x20;&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;&#x20;EOF&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;&#x20;#&#x20;update-grub','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21526,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21527,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0','[{\"cis\": [\"1.5.1\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21528,'Ensure&#x20;XD/NX&#x20;support&#x20;is&#x20;enabled.','Recent&#x20;processors&#x20;in&#x20;the&#x20;x86&#x20;family&#x20;support&#x20;the&#x20;ability&#x20;to&#x20;prevent&#x20;code&#x20;execution&#x20;on&#x20;a&#x20;per&#x20;memory&#x20;page&#x20;basis.&#x20;Generically&#x20;and&#x20;on&#x20;AMD&#x20;processors,&#x20;this&#x20;ability&#x20;is&#x20;called&#x20;No&#x20;Execute&#x20;&#40;NX&#41;,&#x20;while&#x20;on&#x20;Intel&#x20;processors&#x20;it&#x20;is&#x20;called&#x20;Execute&#x20;Disable&#x20;&#40;XD&#41;.&#x20;This&#x20;ability&#x20;can&#x20;help&#x20;prevent&#x20;exploitation&#x20;of&#x20;buffer&#x20;overflow&#x20;vulnerabilities&#x20;and&#x20;should&#x20;be&#x20;activated&#x20;whenever&#x20;possible.&#x20;Extra&#x20;steps&#x20;must&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;that&#x20;this&#x20;protection&#x20;is&#x20;enabled,&#x20;particularly&#x20;on&#x20;32-bit&#x20;x86&#x20;systems.&#x20;Other&#x20;processors,&#x20;such&#x20;as&#x20;Itanium&#x20;and&#x20;POWER,&#x20;have&#x20;included&#x20;such&#x20;support&#x20;since&#x20;inception&#x20;and&#x20;the&#x20;standard&#x20;kernel&#x20;for&#x20;those&#x20;platforms&#x20;supports&#x20;the&#x20;feature.','Enabling&#x20;any&#x20;feature&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','On&#x20;32&#x20;bit&#x20;systems&#x20;install&#x20;a&#x20;kernel&#x20;with&#x20;PAE&#x20;support,&#x20;no&#x20;installation&#x20;is&#x20;required&#x20;on&#x20;64&#x20;bit&#x20;systems:&#x20;If&#x20;necessary&#x20;configure&#x20;your&#x20;bootloader&#x20;to&#x20;load&#x20;the&#x20;new&#x20;kernel&#x20;and&#x20;reboot&#x20;the&#x20;system.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;enable&#x20;NX&#x20;or&#x20;XD&#x20;support&#x20;in&#x20;your&#x20;bios.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21529,'Ensure&#x20;address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;enabled.','Address&#x20;space&#x20;layout&#x20;randomization&#x20;&#40;ASLR&#41;&#x20;is&#x20;an&#x20;exploit&#x20;mitigation&#x20;technique&#x20;which&#x20;randomly&#x20;arranges&#x20;the&#x20;address&#x20;space&#x20;of&#x20;key&#x20;data&#x20;areas&#x20;of&#x20;a&#x20;process.','Randomly&#x20;placing&#x20;virtual&#x20;memory&#x20;regions&#x20;will&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;write&#x20;memory&#x20;page&#x20;exploits&#x20;as&#x20;the&#x20;memory&#x20;placement&#x20;will&#x20;be&#x20;consistently&#x20;shifting.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;kernel.randomize_va_space&#x20;=&#x20;2&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;kernel.randomize_va_space=2','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21530,'Ensure&#x20;prelink&#x20;is&#x20;disabled.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal&#x20;and&#x20;uninstall&#x20;prelink:&#x20;prelink&#x20;-ua&#x20;&amp;&amp;&#x20;yum&#x20;remove&#x20;prelink','[{\"cis\": [\"1.5.4\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21531,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration.','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/gruband&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21532,'Ensure&#x20;the&#x20;SELinux&#x20;state&#x20;is&#x20;enforcing.','Set&#x20;SELinux&#x20;to&#x20;enable&#x20;when&#x20;the&#x20;system&#x20;is&#x20;booted.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;in&#x20;effect&#x20;at&#x20;all&#x20;times.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;SELINUX=enforcing&#x20;','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21533,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured.','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=ubuntu','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21534,'Ensure&#x20;no&#x20;unconfined&#x20;daemons&#x20;exist.','Daemons&#x20;that&#x20;are&#x20;not&#x20;defined&#x20;in&#x20;SELinux&#x20;policy&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;of&#x20;their&#x20;parent&#x20;process.','Since&#x20;daemons&#x20;are&#x20;launched&#x20;and&#x20;descend&#x20;from&#x20;the&#x20;init&#x20;process,&#x20;they&#x20;will&#x20;inherit&#x20;the&#x20;security&#x20;context&#x20;label&#x20;initrc_t&#x20;.&#x20;This&#x20;could&#x20;cause&#x20;the&#x20;unintended&#x20;consequence&#x20;of&#x20;giving&#x20;the&#x20;process&#x20;more&#x20;permission&#x20;than&#x20;it&#x20;requires.','','Investigate&#x20;any&#x20;unconfined&#x20;daemons&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21535,'Ensure&#x20;AppArmor&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration.','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwrittenby&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;remove&#x20;all&#x20;instances&#x20;of&#x20;apparmor=0&#x20;from&#x20;all&#x20;CMDLINE_LINUX&#x20;parameters:&#x20;&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX_DEFAULT=&quot;quiet&quot;&#x20;&#x20;&#x20;&#x20;GRUB_CMDLINE_LINUX=&quot;&quot;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;pdate&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"1.6.2.1\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21536,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applicatons&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated..','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.2.2\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21537,'Ensure&#x20;SELinux&#x20;or&#x20;AppArmor&#x20;are&#x20;installed.','SELinux&#x20;and&#x20;AppArmor&#x20;provide&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;install&#x20;SELinux&#x20;or&#x20;apparmor:&#x20;#&#x20;apt-get&#x20;install&#x20;selinux&#x20;&#x20;Or:&#x20;#&#x20;apt-get&#x20;install&#x20;apparmor','[{\"cis\": [\"1.6.3\"]}, {\"cis_csc\": [\"14.6\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21538,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v.','[{\"cis\": [\"1.7.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(21539,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.1.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(21540,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"7.1\"]}]'),(21541,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/motd','[{\"cis\": [\"1.7.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21542,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"1.7.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21543,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue.net','[{\"cis\": [\"1.7.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21544,'Ensure&#x20;GDM&#x20;login&#x20;banner&#x20;is&#x20;configured.','GDM&#x20;is&#x20;the&#x20;GNOME&#x20;Display&#x20;Manager&#x20;which&#x20;handles&#x20;graphical&#x20;login&#x20;for&#x20;GNOME&#x20;based&#x20;systems.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.','','Create&#x20;the&#x20;/etc/dconf/profile/gdm&#x20;file&#x20;with&#x20;the&#x20;following&#x20;contents:&#x20;&#x20;&#x20;&#x20;user-db:user&#x20;&#x20;&#x20;&#x20;system-db:gdm&#x20;&#x20;&#x20;&#x20;&#x20;file-db:/usr/share/gdm/greeter-dconf-defaults&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;banner-message-enable&#x20;and&#x20;banner-message-text&#x20;options&#x20;in&#x20;/etc/dconf/db/gdm.d/01-banner-message:&#x20;&#x20;&#x20;&#x20;[org/gnome/login-screen]&#x20;&#x20;&#x20;&#x20;banner-message-enable=true&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;banner-message-text=&#039;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#039;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;system&#x20;databases:&#x20;#&#x20;dconf&#x20;update','[{\"cis\": [\"1.7.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21545,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Notes:&#x20;Site&#x20;policy&#x20;may&#x20;mandate&#x20;a&#x20;testing&#x20;period&#x20;before&#x20;install&#x20;onto&#x20;production&#x20;systems&#x20;for&#x20;available&#x20;updates.','[{\"cis\": [\"1.8\"]}, {\"cis_csc\": [\"3.4\", \"3.5\"]}, {\"pci_dss\": [\"5.2\"]}, {\"nist_800_53\": [\"AU.6\", \"SI.4\"]}, {\"gpg_13\": [\"4.2\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\"]}]'),(21546,'Ensure&#x20;chargen&#x20;services&#x20;are&#x20;not&#x20;enabled.','chargen&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;0&#x20;to&#x20;512&#x20;ASCII&#x20;characters&#x20;for&#x20;each&#x20;connection&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;chargen&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;chargen&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21547,'Ensure&#x20;daytime&#x20;services&#x20;are&#x20;not&#x20;enabled.','daytime&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;daytime&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;daytime&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21548,'Ensure&#x20;discard&#x20;services&#x20;are&#x20;not&#x20;enabled.','discard&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;simply&#x20;discards&#x20;all&#x20;data&#x20;it&#x20;receives.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;discard&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;discard&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21549,'Ensure&#x20;echo&#x20;services&#x20;are&#x20;not&#x20;enabled.','echo&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;to&#x20;clients&#x20;with&#x20;the&#x20;data&#x20;sent&#x20;to&#x20;it&#x20;by&#x20;the&#x20;client.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled.','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;echo&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;echo&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21550,'Ensure&#x20;time&#x20;services&#x20;are&#x20;not&#x20;enabled.','time&#x20;is&#x20;a&#x20;network&#x20;service&#x20;that&#x20;responds&#x20;with&#x20;the&#x20;server&#039;s&#x20;current&#x20;date&#x20;and&#x20;time&#x20;as&#x20;a&#x20;32&#x20;bit&#x20;integer.&#x20;This&#x20;service&#x20;is&#x20;intended&#x20;for&#x20;debugging&#x20;and&#x20;testing&#x20;purposes.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled','Disabling&#x20;this&#x20;service&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;time&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;time&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.5\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21551,'Ensure&#x20;rsh&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Berkeley&#x20;rsh-server&#x20;&#40;rsh,&#x20;rlogin,&#x20;rexec&#41;&#x20;package&#x20;contains&#x20;legacy&#x20;services&#x20;that&#x20;exchange&#x20;credentials&#x20;in&#x20;clear-text.','These&#x20;legacy&#x20;services&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;shell,&#x20;login&#x20;or&#x20;exec&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;shell,&#x20;login&#x20;or&#x20;exec&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.6\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21552,'Ensure&#x20;talk&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client&#x20;&#40;allows&#x20;initiate&#x20;of&#x20;talk&#x20;sessions&#41;&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;talk&#x20;or&#x20;ntalk&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;talk&#x20;or&#x20;ntalk&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.7\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21553,'Ensure&#x20;telnet&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecureand&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;telnet&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;telnet&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.8\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21554,'Ensure&#x20;tftp&#x20;server&#x20;is&#x20;not&#x20;enabled.','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;file&#x20;transfer&#x20;protocol,&#x20;typically&#x20;used&#x20;to&#x20;automatically&#x20;transfer&#x20;configuration&#x20;or&#x20;boot&#x20;machines&#x20;from&#x20;a&#x20;boot&#x20;server.&#x20;The&#x20;packages&#x20;tftpd&#x20;and&#x20;atftp&#x20;are&#x20;both&#x20;used&#x20;to&#x20;define&#x20;and&#x20;support&#x20;a&#x20;TFTP&#x20;server.','TFTP&#x20;does&#x20;not&#x20;support&#x20;authentication&#x20;nor&#x20;does&#x20;it&#x20;ensure&#x20;the&#x20;confidentiality&#x20;or&#x20;integrity&#x20;of&#x20;data.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;TFTP&#x20;be&#x20;removed,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specificneed&#x20;for&#x20;TFTP.&#x20;In&#x20;that&#x20;case,&#x20;extreme&#x20;caution&#x20;must&#x20;be&#x20;used&#x20;when&#x20;configuring&#x20;the&#x20;services.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;lines&#x20;starting&#x20;with&#x20;tftp&#x20;from&#x20;/etc/inetd.conf&#x20;and&#x20;/etc/inetd.d&#47;&#42;.&#x20;Set&#x20;disable&#x20;=&#x20;yes&#x20;on&#x20;all&#x20;tftp&#x20;services&#x20;in&#x20;/etc/xinetd.conf&#x20;and&#x20;/etc/xinetd.d&#47;&#42;&#x20;','[{\"cis\": [\"2.1.9\"]}, {\"cis_csc\": [\"9.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21555,'Ensure&#x20;xinetd&#x20;is&#x20;not&#x20;enabled.','The&#x20;eXtended&#x20;InterNET&#x20;Daemon&#x20;&#40;xinetd&#41;&#x20;is&#x20;an&#x20;open&#x20;source&#x20;super&#x20;daemon&#x20;that&#x20;replaced&#x20;the&#x20;original&#x20;inetd&#x20;daemon.&#x20;The&#x20;xinetddaemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;xinetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;diable&#x20;xinetd:&#x20;#&#x20;systemctl&#x20;disable&#x20;xinetd','[{\"cis\": [\"2.1.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21556,'Ensure&#x20;openbsd-inetd&#x20;is&#x20;not&#x20;installed.','The&#x20;inetd&#x20;daemon&#x20;listens&#x20;for&#x20;well&#x20;known&#x20;services&#x20;and&#x20;dispatches&#x20;the&#x20;appropriate&#x20;daemon&#x20;to&#x20;properly&#x20;respond&#x20;to&#x20;service&#x20;requests.','If&#x20;there&#x20;are&#x20;no&#x20;inetd&#x20;services&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;daemon&#x20;be&#x20;removed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openbsd-inetd:&#x20;apt-get&#x20;remove&#x20;openbsd-inetd','[{\"cis\": [\"2.1.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21557,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','On&#x20;physical&#x20;systems&#x20;or&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;not&#x20;available&#x20;install&#x20;NTP&#x20;or&#x20;chrony&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;ntp&#x20;#&#x20;apt-get&#x20;install&#x20;chrony&#x20;&#x20;&#x20;&#x20;&#x20;On&#x20;virtual&#x20;systems&#x20;where&#x20;host&#x20;based&#x20;time&#x20;synchronization&#x20;is&#x20;available&#x20;consult&#x20;your&#x20;virtualization&#x20;software&#x20;documentation&#x20;and&#x20;setup&#x20;host&#x20;based&#x20;synchronization.','[{\"cis\": [\"2.2.1.1\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21558,'Ensure&#x20;ntp&#x20;is&#x20;configured.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;.&#x20;It&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;NTP&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://www.ntp.org.&#x20;ntp&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/ntp.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Configure&#x20;ntp&#x20;to&#x20;run&#x20;as&#x20;the&#x20;ntp&#x20;user&#x20;by&#x20;adding&#x20;or&#x20;editing&#x20;the&#x20;/etc/init.d/ntp&#x20;file:&#x20;RUNASUSER=ntp','[{\"cis\": [\"2.2.1.2\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21559,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;','[{\"cis\": [\"2.2.1.3\"]}, {\"cis_csc\": [\"6.1\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21560,'Ensure&#x20;the&#x20;X&#x20;Window&#x20;system&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt-get&#x20;remove&#x20;xserver-xorg*','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.8\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(21561,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attach&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;disable&#x20;avahi-daemon','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21562,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;enabled.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;cups:&#x20;#&#x20;systemctl&#x20;disable&#x20;cups','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21563,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dhcpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;isc-dhcp-server&#x20;#&#x20;systemctl&#x20;disable&#x20;isc-dhcp-server6','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21564,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;slapd:&#x20;#&#x20;systemctl&#x20;disable&#x20;slapd','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21565,'Ensure&#x20;NFS&#x20;and&#x20;RPC&#x20;are&#x20;not&#x20;enabled.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;nfs&#x20;and&#x20;rpcbind:&#x20;#&#x20;systemctl&#x20;disable&#x20;nfs-server&#x20;#&#x20;systemctl&#x20;disable&#x20;rpcbind','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21566,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;named:&#x20;#&#x20;systemctl&#x20;disable&#x20;bind9','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21567,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;sftp&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;vsftpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;vsftpd','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21568,'Ensure&#x20;HTTP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;apache2:&#x20;#&#x20;systemctl&#x20;disable&#x20;apache2','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21569,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;enabled.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;dovecot:&#x20;#&#x20;systemctl&#x20;disable&#x20;dovecot','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21570,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;enabled.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Small&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;can&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;smbd:&#x20;#&#x20;systemctl&#x20;disable&#x20;smbd','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21571,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;enabled.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;squid:&#x20;#&#x20;systemctl&#x20;disable&#x20;squid','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21572,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMP&#x20;v1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;Unless&#x20;absolutely&#x20;necessary,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;SNMP&#x20;service&#x20;not&#x20;be&#x20;used.&#x20;If&#x20;SNMP&#x20;is&#x20;required&#x20;the&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;disallow&#x20;SNMP&#x20;v1.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;snmpd:&#x20;#&#x20;systemctl&#x20;disable&#x20;snmpd','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21573,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;.&#x20;Restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AC.4\", \"SC.7\"]}, {\"tsc\": [\"CC5.2\", \"CC6.4\", \"CC6.6\", \"CC6.7\"]}]'),(21574,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;not&#x20;enabled.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;rsync:&#x20;#&#x20;systemctl&#x20;disable&#x20;rsync','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}]'),(21575,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;enabled.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;disabled&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;nis:&#x20;#&#x20;systemctl&#x20;disable&#x20;nis','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21576,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','','Uninstall&#x20;the&#x20;nis&#x20;package:&#x20;#&#x20;apt-get&#x20;remove&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21577,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rshpackage&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rshpackage&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcpand&#x20;rlogin.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;rsh:&#x20;apt-get&#x20;remove&#x20;rsh-client&#x20;rsh-redone-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"2.6\", \"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21578,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talksoftware&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talkclient,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;talk:&#x20;apt-get&#x20;remove&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21579,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;telnet:&#x20;#&#x20;apt-get&#x20;remove&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"2.6\", \"4.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21580,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;openldap-clients&#x20;:&#x20;#&#x20;apt-get&#x20;remove&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21581,'Ensure&#x20;IP&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;net.ipv4.ip_forward&#x20;flag&#x20;is&#x20;used&#x20;to&#x20;tell&#x20;the&#x20;system&#x20;whether&#x20;it&#x20;can&#x20;forward&#x20;packets&#x20;or&#x20;not.','Setting&#x20;the&#x20;flags&#x20;to&#x20;0&#x20;ensures&#x20;that&#x20;a&#x20;system&#x20;with&#x20;multiple&#x20;interfaces&#x20;&#40;for&#x20;example,&#x20;a&#x20;hard&#x20;proxy&#41;,&#x20;will&#x20;never&#x20;be&#x20;able&#x20;to&#x20;forward&#x20;packets,&#x20;and&#x20;therefore,&#x20;never&#x20;serve&#x20;as&#x20;a&#x20;router.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.ip_forward&#x20;=&#x20;0&#x20;&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.ip_forward=0&#x20;#&#x20;s&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;','[{\"cis\": [\"3.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21582,'Ensure&#x20;packet&#x20;redirect&#x20;sending&#x20;is&#x20;disabled.','ICMP&#x20;Redirects&#x20;are&#x20;used&#x20;to&#x20;send&#x20;routing&#x20;information&#x20;to&#x20;other&#x20;hosts.&#x20;As&#x20;a&#x20;host&#x20;itself&#x20;does&#x20;not&#x20;act&#x20;as&#x20;a&#x20;router&#x20;&#40;in&#x20;a&#x20;host&#x20;only&#x20;configuration&#41;,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;send&#x20;redirects.','An&#x20;attacker&#x20;could&#x20;use&#x20;a&#x20;compromised&#x20;host&#x20;to&#x20;send&#x20;invalid&#x20;ICMP&#x20;redirects&#x20;to&#x20;other&#x20;router&#x20;devices&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;corrupt&#x20;routing&#x20;and&#x20;have&#x20;users&#x20;access&#x20;a&#x20;system&#x20;set&#x20;up&#x20;by&#x20;the&#x20;attacker&#x20;as&#x20;opposed&#x20;to&#x20;a&#x20;valid&#x20;system.','','Set&#x20;the&#x20;net.ipv4.conf.all.send_redirects&#x20;and&#x20;net.ipv4.conf.default.send_redirects&#x20;parameters&#x20;to&#x20;0&#x20;in&#x20;/etc/sysctl.conf:&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;Modify&#x20;active&#x20;kernel&#x20;parameters&#x20;to&#x20;match:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.send_redirects=0&#x20;&#x20;&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21583,'Ensure&#x20;source&#x20;routed&#x20;packets&#x20;are&#x20;not&#x20;accepted.','In&#x20;networking,&#x20;source&#x20;routing&#x20;allows&#x20;a&#x20;sender&#x20;to&#x20;partially&#x20;or&#x20;fully&#x20;specify&#x20;the&#x20;route&#x20;packets&#x20;take&#x20;through&#x20;a&#x20;network.&#x20;In&#x20;contrast,&#x20;non-source&#x20;routed&#x20;packets&#x20;travel&#x20;a&#x20;path&#x20;determined&#x20;by&#x20;routers&#x20;in&#x20;the&#x20;network.&#x20;In&#x20;some&#x20;cases,&#x20;systems&#x20;may&#x20;not&#x20;be&#x20;routable&#x20;or&#x20;reachable&#x20;from&#x20;some&#x20;locations&#x20;&#40;e.g.&#x20;private&#x20;addresses&#x20;vs.&#x20;Internet&#x20;routable&#41;,&#x20;and&#x20;so&#x20;source&#x20;routed&#x20;packets&#x20;would&#x20;need&#x20;to&#x20;be&#x20;used.','Setting&#x20;net.ipv4.conf.all.accept_source_route,&#x20;net.ipv4.conf.default.accept_source_route&#x20;to&#x20;0&#x20;disables&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;source&#x20;routed&#x20;packets.&#x20;Assume&#x20;this&#x20;system&#x20;was&#x20;capable&#x20;of&#x20;routing&#x20;packets&#x20;to&#x20;Internet&#x20;routable&#x20;addresses&#x20;on&#x20;one&#x20;interface&#x20;and&#x20;private&#x20;addresses&#x20;on&#x20;another&#x20;interface.&#x20;Assume&#x20;that&#x20;the&#x20;private&#x20;addresses&#x20;were&#x20;not&#x20;routable&#x20;to&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;and&#x20;vice&#x20;versa.&#x20;Under&#x20;normal&#x20;routing&#x20;circumstances,&#x20;an&#x20;attacker&#x20;from&#x20;the&#x20;Internet&#x20;routable&#x20;addresses&#x20;could&#x20;not&#x20;use&#x20;the&#x20;system&#x20;as&#x20;a&#x20;way&#x20;to&#x20;reach&#x20;the&#x20;private&#x20;address&#x20;systems.&#x20;If,&#x20;however,&#x20;source&#x20;routed&#x20;packets&#x20;were&#x20;allowed,&#x20;they&#x20;could&#x20;be&#x20;used&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;private&#x20;address&#x20;systems&#x20;as&#x20;the&#x20;route&#x20;could&#x20;be&#x20;specified,&#x20;rather&#x20;than&#x20;rely&#x20;on&#x20;routing&#x20;protocols&#x20;that&#x20;did&#x20;not&#x20;allow&#x20;this&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_source_route&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_source_route&#x20;=&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_source_route=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_source_route=0&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;','[{\"cis\": [\"3.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21584,'Ensure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','ICMP&#x20;redirect&#x20;messages&#x20;are&#x20;packets&#x20;that&#x20;convey&#x20;routing&#x20;information&#x20;and&#x20;tell&#x20;your&#x20;host&#x20;&#40;acting&#x20;as&#x20;a&#x20;router&#41;&#x20;to&#x20;send&#x20;packets&#x20;via&#x20;an&#x20;alternate&#x20;path.&#x20;It&#x20;is&#x20;a&#x20;way&#x20;of&#x20;allowing&#x20;an&#x20;outside&#x20;routing&#x20;device&#x20;to&#x20;update&#x20;your&#x20;system&#x20;routing&#x20;tables.&#x20;By&#x20;setting&#x20;net.ipv4.conf.all.accept_redirects&#x20;to&#x20;0,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;accept&#x20;any&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;and&#x20;therefore,&#x20;won&#039;t&#x20;allow&#x20;outsiders&#x20;to&#x20;update&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables.','Attackers&#x20;could&#x20;use&#x20;bogus&#x20;ICMP&#x20;redirect&#x20;messages&#x20;to&#x20;maliciously&#x20;alter&#x20;the&#x20;system&#x20;routing&#x20;tables&#x20;and&#x20;get&#x20;them&#x20;to&#x20;send&#x20;packets&#x20;to&#x20;incorrect&#x20;networks&#x20;and&#x20;allow&#x20;your&#x20;system&#x20;packets&#x20;to&#x20;be&#x20;captured.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.accept_redirects&#x20;=&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.accept_redirects=0&#x20;&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1&#x20;','[{\"cis\": [\"3.2.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21585,'Ensure&#x20;secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','Secure&#x20;ICMP&#x20;redirects&#x20;are&#x20;the&#x20;same&#x20;as&#x20;ICMP&#x20;redirects,&#x20;except&#x20;they&#x20;come&#x20;from&#x20;gateways&#x20;listed&#x20;on&#x20;the&#x20;default&#x20;gateway&#x20;list.&#x20;It&#x20;is&#x20;assumed&#x20;that&#x20;these&#x20;gateways&#x20;are&#x20;known&#x20;to&#x20;your&#x20;system,&#x20;and&#x20;that&#x20;they&#x20;are&#x20;likely&#x20;to&#x20;be&#x20;secure.','It&#x20;is&#x20;still&#x20;possible&#x20;for&#x20;even&#x20;known&#x20;gateways&#x20;to&#x20;be&#x20;compromised.&#x20;Setting&#x20;net.ipv4.conf.all.secure_redirects&#x20;to&#x20;0&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;routing&#x20;table&#x20;updates&#x20;by&#x20;possibly&#x20;compromised&#x20;known&#x20;gateways.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.secure_redirects&#x20;=&#x20;0&#x20;net.ipv4.conf.default.secure_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.secure_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21586,'Ensure&#x20;suspicious&#x20;packets&#x20;are&#x20;logged.','When&#x20;enabled,&#x20;this&#x20;feature&#x20;logs&#x20;packets&#x20;with&#x20;un-routable&#x20;source&#x20;addresses&#x20;to&#x20;the&#x20;kernel&#x20;log.','Enabling&#x20;this&#x20;feature&#x20;and&#x20;logging&#x20;these&#x20;packets&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;investigate&#x20;the&#x20;possibility&#x20;that&#x20;an&#x20;attacker&#x20;is&#x20;sending&#x20;spoofed&#x20;packets&#x20;to&#x20;their&#x20;server.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.log_martians&#x20;=&#x20;1&#x20;net.ipv4.conf.default.log_martians&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.log_martians=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21587,'Ensure&#x20;broadcast&#x20;ICMP&#x20;requests&#x20;are&#x20;ignored.','Setting&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;to&#x20;1&#x20;will&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;ignore&#x20;all&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;to&#x20;broadcast&#x20;and&#x20;multicast&#x20;addresses.','Accepting&#x20;ICMP&#x20;echo&#x20;and&#x20;timestamp&#x20;requests&#x20;with&#x20;broadcast&#x20;or&#x20;multicast&#x20;destinations&#x20;for&#x20;your&#x20;network&#x20;could&#x20;be&#x20;used&#x20;to&#x20;trick&#x20;your&#x20;host&#x20;into&#x20;starting&#x20;&#40;or&#x20;participating&#41;&#x20;in&#x20;a&#x20;Smurf&#x20;attack.&#x20;A&#x20;Smurf&#x20;attack&#x20;relies&#x20;on&#x20;an&#x20;attacker&#x20;sending&#x20;large&#x20;amounts&#x20;of&#x20;ICMP&#x20;broadcast&#x20;messages&#x20;with&#x20;a&#x20;spoofed&#x20;source&#x20;address.&#x20;All&#x20;hosts&#x20;receiving&#x20;this&#x20;message&#x20;and&#x20;responding&#x20;would&#x20;send&#x20;echo-reply&#x20;messages&#x20;back&#x20;to&#x20;the&#x20;spoofed&#x20;address,&#x20;which&#x20;is&#x20;probably&#x20;not&#x20;routable.&#x20;If&#x20;many&#x20;hosts&#x20;respond&#x20;to&#x20;the&#x20;packets,&#x20;the&#x20;amount&#x20;of&#x20;traffic&#x20;on&#x20;the&#x20;network&#x20;could&#x20;be&#x20;significantly&#x20;multiplied.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_echo_ignore_broadcasts&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_echo_ignore_broadcasts=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21588,'Ensure&#x20;bogus&#x20;ICMP&#x20;responses&#x20;are&#x20;ignored.','Setting&#x20;icmp_ignore_bogus_error_responses&#x20;to&#x20;1&#x20;prevents&#x20;the&#x20;kernel&#x20;from&#x20;logging&#x20;bogus&#x20;responses&#x20;&#40;RFC-1122&#x20;non-compliant&#41;&#x20;from&#x20;broadcast&#x20;reframes,&#x20;keeping&#x20;file&#x20;systems&#x20;from&#x20;filling&#x20;up&#x20;with&#x20;useless&#x20;log&#x20;messages.','Some&#x20;routers&#x20;&#40;and&#x20;some&#x20;attackers&#41;&#x20;will&#x20;send&#x20;responses&#x20;that&#x20;violate&#x20;RFC-1122&#x20;and&#x20;attempt&#x20;to&#x20;fill&#x20;up&#x20;a&#x20;log&#x20;file&#x20;system&#x20;with&#x20;many&#x20;useless&#x20;error&#x20;messages.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.icmp_ignore_bogus_error_responses&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.icmp_ignore_bogus_error_responses=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21589,'Ensure&#x20;Reverse&#x20;Path&#x20;Filtering&#x20;is&#x20;enabled.','Setting&#x20;net.ipv4.conf.all.rp_filter&#x20;and&#x20;net.ipv4.conf.default.rp_filter&#x20;to&#x20;1&#x20;forces&#x20;the&#x20;Linux&#x20;kernel&#x20;to&#x20;utilize&#x20;reverse&#x20;path&#x20;filtering&#x20;on&#x20;a&#x20;received&#x20;packet&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;packet&#x20;was&#x20;valid.&#x20;Essentially,&#x20;with&#x20;reverse&#x20;path&#x20;filtering,&#x20;if&#x20;the&#x20;return&#x20;packet&#x20;does&#x20;not&#x20;go&#x20;out&#x20;the&#x20;same&#x20;interface&#x20;that&#x20;the&#x20;corresponding&#x20;source&#x20;packet&#x20;came&#x20;from,&#x20;the&#x20;packet&#x20;is&#x20;dropped&#x20;&#40;and&#x20;logged&#x20;if&#x20;log_martians&#x20;is&#x20;set&#41;.','Setting&#x20;these&#x20;flags&#x20;is&#x20;a&#x20;good&#x20;way&#x20;to&#x20;deter&#x20;attackers&#x20;from&#x20;sending&#x20;your&#x20;system&#x20;bogus&#x20;packets&#x20;that&#x20;cannot&#x20;be&#x20;responded&#x20;to.&#x20;One&#x20;instance&#x20;where&#x20;this&#x20;feature&#x20;breaks&#x20;down&#x20;is&#x20;if&#x20;asymmetrical&#x20;routing&#x20;is&#x20;employed.&#x20;This&#x20;would&#x20;occur&#x20;when&#x20;using&#x20;dynamic&#x20;routing&#x20;protocols&#x20;&#40;bgp,&#x20;ospf,&#x20;etc&#41;&#x20;on&#x20;your&#x20;system.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;asymmetrical&#x20;routing&#x20;on&#x20;your&#x20;system,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;without&#x20;breaking&#x20;the&#x20;routing.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.conf.all.rp_filter&#x20;=&#x20;1&#x20;net.ipv4.conf.default.rp_filter&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.all.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.conf.default.rp_filter=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21590,'Ensure&#x20;TCP&#x20;SYN&#x20;Cookies&#x20;is&#x20;enabled.','When&#x20;tcp_syncookies&#x20;is&#x20;set,&#x20;the&#x20;kernel&#x20;will&#x20;handle&#x20;TCP&#x20;SYN&#x20;packets&#x20;normally&#x20;until&#x20;the&#x20;half-open&#x20;connection&#x20;queue&#x20;is&#x20;full,&#x20;at&#x20;which&#x20;time,&#x20;the&#x20;SYN&#x20;cookie&#x20;functionality&#x20;kicks&#x20;in.&#x20;SYN&#x20;cookies&#x20;work&#x20;by&#x20;not&#x20;using&#x20;the&#x20;SYN&#x20;queue&#x20;at&#x20;all.&#x20;Instead,&#x20;the&#x20;kernel&#x20;simply&#x20;replies&#x20;to&#x20;the&#x20;SYN&#x20;with&#x20;a&#x20;SYN|ACK,&#x20;but&#x20;will&#x20;include&#x20;a&#x20;specially&#x20;crafted&#x20;TCP&#x20;sequence&#x20;number&#x20;that&#x20;encodes&#x20;the&#x20;source&#x20;and&#x20;destination&#x20;IP&#x20;address&#x20;and&#x20;port&#x20;number&#x20;and&#x20;the&#x20;time&#x20;the&#x20;packet&#x20;was&#x20;sent.&#x20;A&#x20;legitimate&#x20;connection&#x20;would&#x20;send&#x20;the&#x20;ACK&#x20;packet&#x20;of&#x20;the&#x20;three&#x20;way&#x20;handshake&#x20;with&#x20;the&#x20;specially&#x20;crafted&#x20;sequence&#x20;number.&#x20;This&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;received&#x20;a&#x20;valid&#x20;response&#x20;to&#x20;a&#x20;SYN&#x20;cookie&#x20;and&#x20;allow&#x20;the&#x20;connection,&#x20;even&#x20;though&#x20;there&#x20;is&#x20;no&#x20;corresponding&#x20;SYN&#x20;in&#x20;the&#x20;queue.','Attackers&#x20;use&#x20;SYN&#x20;flood&#x20;attacks&#x20;to&#x20;perform&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attacked&#x20;on&#x20;a&#x20;system&#x20;by&#x20;sending&#x20;many&#x20;SYN&#x20;packets&#x20;without&#x20;completing&#x20;the&#x20;three&#x20;way&#x20;handshake.&#x20;This&#x20;will&#x20;quickly&#x20;use&#x20;up&#x20;slots&#x20;in&#x20;the&#x20;kernel&#039;s&#x20;half-open&#x20;connection&#x20;queue&#x20;and&#x20;prevent&#x20;legitimate&#x20;connections&#x20;from&#x20;succeeding.&#x20;SYN&#x20;cookies&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;keep&#x20;accepting&#x20;valid&#x20;connections,&#x20;even&#x20;if&#x20;under&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;attack.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv4.tcp_syncookies&#x20;=&#x20;1.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.tcp_syncookies=1&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv4.route.flush=1','[{\"cis\": [\"3.2.8\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21591,'Ensure&#x20;IPv6&#x20;router&#x20;advertisements&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;disables&#x20;the&#x20;systems&#x20;ability&#x20;to&#x20;accept&#x20;router&#x20;advertisements','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;router&#x20;advertisements&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_ra&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_ra&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_ra=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21592,'Ensure&#x20;IPv6&#x20;redirects&#x20;are&#x20;not&#x20;accepted.','This&#x20;setting&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;accepting&#x20;ICMP&#x20;redirects.&#x20;ICMP&#x20;redirects&#x20;tell&#x20;the&#x20;system&#x20;about&#x20;alternate&#x20;routes&#x20;for&#x20;sending&#x20;traffic.','It&#x20;is&#x20;recommended&#x20;that&#x20;systems&#x20;not&#x20;accept&#x20;ICMP&#x20;redirets&#x20;as&#x20;they&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;routing&#x20;traffic&#x20;to&#x20;compromised&#x20;machines.&#x20;Setting&#x20;hard&#x20;routes&#x20;within&#x20;the&#x20;system&#x20;&#40;usually&#x20;a&#x20;single&#x20;default&#x20;route&#x20;to&#x20;a&#x20;trusted&#x20;router&#41;&#x20;protects&#x20;the&#x20;system&#x20;from&#x20;bad&#x20;routes.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;net.ipv6.conf.all.accept_redirects&#x20;=&#x20;0&#x20;net.ipv6.conf.default.accept_redirects&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameters:&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.all.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.conf.default.accept_redirects=0&#x20;#&#x20;sysctl&#x20;-w&#x20;net.ipv6.route.flush=1','[{\"cis\": [\"3.3.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21593,'Ensure&#x20;IPv6&#x20;is&#x20;disabled.','Although&#x20;IPv6&#x20;has&#x20;many&#x20;advantages&#x20;over&#x20;IPv4,&#x20;few&#x20;organizations&#x20;have&#x20;implemented&#x20;IPv6.','If&#x20;IPv6&#x20;is&#x20;not&#x20;to&#x20;be&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;&#039;``ipv6.disable=1&#039;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;ipv6.disable=1&quot;&#x20;&#x20;&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"3.3.3\"]}, {\"cis_csc\": [\"3\", \"11\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21594,'Install&#x20;TCP&#x20;Wrappers.','TCP&#x20;Wrappers&#x20;provides&#x20;a&#x20;simple&#x20;access&#x20;list&#x20;and&#x20;standardized&#x20;logging&#x20;method&#x20;for&#x20;services&#x20;capable&#x20;of&#x20;supporting&#x20;it.&#x20;In&#x20;the&#x20;past,&#x20;services&#x20;that&#x20;were&#x20;called&#x20;from&#x20;inetd&#x20;and&#x20;xinetd&#x20;supported&#x20;the&#x20;use&#x20;of&#x20;tcp&#x20;wrappers.&#x20;As&#x20;inetd&#x20;and&#x20;xinetd&#x20;have&#x20;been&#x20;falling&#x20;in&#x20;disuse,&#x20;any&#x20;service&#x20;that&#x20;can&#x20;support&#x20;tcp&#x20;wrappers&#x20;will&#x20;have&#x20;the&#x20;libwrap.so&#x20;library&#x20;attached&#x20;to&#x20;it.','TCP&#x20;Wrappers&#x20;provide&#x20;a&#x20;good&#x20;simple&#x20;access&#x20;list&#x20;mechanism&#x20;to&#x20;services&#x20;that&#x20;may&#x20;not&#x20;have&#x20;that&#x20;support&#x20;built&#x20;in.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;services&#x20;that&#x20;can&#x20;support&#x20;TCP&#x20;Wrappers,&#x20;use&#x20;it.','','Install&#x20;tcpd&#x20;:&#x20;#&#x20;apt-get&#x20;install&#x20;tcpd&#x20;To&#x20;verify&#x20;if&#x20;a&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;ldd&#x20;&lt;path-to-daemon&gt;&#x20;|&#x20;grep&#x20;libwrap.so&#x20;If&#x20;there&#x20;is&#x20;any&#x20;output,&#x20;then&#x20;the&#x20;service&#x20;supports&#x20;TCP&#x20;Wrappers.','[{\"cis\": [\"3.4.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(21595,'Ensure&#x20;/etc/hosts.allow&#x20;is&#x20;configured.','The&#x20;/etc/hosts.allow&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.deny&#x20;file.','The&#x20;/etc/hosts.allow&#x20;file&#x20;supports&#x20;access&#x20;control&#x20;by&#x20;IP&#x20;and&#x20;helps&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;systems&#x20;can&#x20;connect&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.allow:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;...&quot;&#x20;&gt;/etc/hosts.allow.&#x20;Where&#x20;each&#x20;&lt;net&gt;/&lt;mask&gt;&#x20;combination&#x20;&#x20;&#40;for&#x20;example,&#x20;&quot;192.168.1.0/255.255.255.0&quot;&#41;&#x20;represents&#x20;one&#x20;network&#x20;block&#x20;in&#x20;use&#x20;by&#x20;your&#x20;organization&#x20;that&#x20;requires&#x20;access&#x20;to&#x20;this&#x20;system.','[{\"cis\": [\"3.4.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(21596,'Ensure&#x20;/etc/hosts.deny&#x20;is&#x20;configured.','The&#x20;/etc/hosts.deny&#x20;file&#x20;specifies&#x20;which&#x20;IP&#x20;addresses&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;host.&#x20;It&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;/etc/hosts.allow&#x20;file.','The&#x20;/etc/hosts.deny&#x20;file&#x20;serves&#x20;as&#x20;a&#x20;failsafe&#x20;so&#x20;that&#x20;any&#x20;host&#x20;not&#x20;specified&#x20;in&#x20;/etc/hosts.allow&#x20;is&#x20;denied&#x20;access&#x20;to&#x20;the&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/hosts.deny:&#x20;#&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;&gt;&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(21597,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.allow.','The&#x20;/etc/hosts.allow&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.allow&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.allow&#x20;:&#x20;&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.allow&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.allow','[{\"cis\": [\"3.4.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21598,'Verify&#x20;permissions&#x20;on&#x20;/etc/hosts.deny.','The&#x20;/etc/hosts.deny&#x20;file&#x20;contains&#x20;network&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;applications&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;applications&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/hosts.deny&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/hosts.deny&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/hosts.deny&#x20;&#x20;#&#x20;chmod&#x20;644&#x20;/etc/hosts.deny','[{\"cis\": [\"3.4.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21599,'Ensure&#x20;DCCP&#x20;is&#x20;disabled.','The&#x20;Datagram&#x20;Congestion&#x20;Control&#x20;Protocol&#x20;&#40;DCCP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;that&#x20;supports&#x20;streaming&#x20;media&#x20;and&#x20;telephony.&#x20;DCCP&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;congestion&#x20;control,&#x20;without&#x20;having&#x20;to&#x20;do&#x20;it&#x20;at&#x20;the&#x20;application&#x20;layer,&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;in-&#x20;sequence&#x20;delivery.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;drivers&#x20;not&#x20;be&#x20;installed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;dccp&#x20;/bin/true','[{\"cis\": [\"3.5.1\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21600,'Ensure&#x20;SCTP&#x20;is&#x20;disabled.','The&#x20;Stream&#x20;Control&#x20;Transmission&#x20;Protocol&#x20;&#40;SCTP&#41;&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;used&#x20;to&#x20;support&#x20;message&#x20;oriented&#x20;communication,&#x20;with&#x20;several&#x20;streams&#x20;of&#x20;messages&#x20;in&#x20;one&#x20;connection.&#x20;It&#x20;serves&#x20;a&#x20;similar&#x20;function&#x20;as&#x20;TCP&#x20;and&#x20;UDP,&#x20;incorporating&#x20;features&#x20;of&#x20;both.&#x20;It&#x20;is&#x20;message-oriented&#x20;like&#x20;UDP,&#x20;and&#x20;ensures&#x20;reliable&#x20;in-sequence&#x20;transport&#x20;of&#x20;messages&#x20;with&#x20;congestion&#x20;control&#x20;like&#x20;TCP.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;sctp&#x20;/bin/true','[{\"cis\": [\"3.5.2\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21601,'Ensure&#x20;RDS&#x20;is&#x20;disabled.','The&#x20;Reliable&#x20;Datagram&#x20;Sockets&#x20;&#40;RDS&#41;&#x20;protocol&#x20;is&#x20;a&#x20;transport&#x20;layer&#x20;protocol&#x20;designed&#x20;to&#x20;provide&#x20;low-latency,&#x20;high-bandwidth&#x20;communications&#x20;between&#x20;cluster&#x20;nodes.&#x20;It&#x20;was&#x20;developed&#x20;by&#x20;the&#x20;Oracle&#x20;Corporation.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;rds&#x20;/bin/true','[{\"cis\": [\"3.5.3\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21602,'Ensure&#x20;TIPC&#x20;is&#x20;disabled.','The&#x20;Transparent&#x20;Inter-Process&#x20;Communication&#x20;&#40;TIPC&#41;&#x20;protocol&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;communication&#x20;between&#x20;cluster&#x20;nodes.','If&#x20;the&#x20;protocol&#x20;is&#x20;not&#x20;being&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;kernel&#x20;module&#x20;not&#x20;be&#x20;loaded,&#x20;disabling&#x20;the&#x20;service&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/modprobe.d/CIS.conf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;install&#x20;tipc&#x20;/bin/true','[{\"cis\": [\"3.5.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21603,'Ensure&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP.&#x20;Notes:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','[{\"cis\": [\"3.6.2\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(21604,'Ensure&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP','[{\"cis\": [\"3.6.3\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"1.2.1\"]}, {\"tsc\": [\"CC8.1\"]}]'),(21605,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Notes:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21606,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;admin_space_left_action&#x20;=&#x20;halt','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21607,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc\": [\"6.4\"]}]'),(21608,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;enable&#x20;auditd','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\", \"10.7\"]}, {\"tsc\": [\"CC6.1\"\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21609,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub&#x20;or&#x20;lilo&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','1&#41;&#x20;Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;2&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Notes:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.2.6\", \"10.7\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"35.7.d\", \"32.2\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21610,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;adjtimex&#x20;&#40;tune&#x20;kernel&#x20;clock&#41;,&#x20;settimeofday&#x20;&#40;Set&#x20;time,&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#41;&#x20;stime&#x20;&#40;using&#x20;seconds&#x20;since&#x20;1/1/1970&#41;&#x20;or&#x20;clock_settime&#x20;&#40;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#41;&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed&#x20;and&#x20;always&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;/var/log/audit.log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;the&#x20;identifier&#x20;&quot;time-change&quot;','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','For&#x20;32&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-&#x20;change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change.&#x20;For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex&#x20;-S&#x20;settimeofday&#x20;-S&#x20;stime&#x20;-k&#x20;time-change&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;clock_settime&#x20;-k&#x20;time-change&#x20;|&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.3\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21611,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;group&#x20;,&#x20;passwd&#x20;&#40;user&#x20;IDs&#41;,&#x20;shadow&#x20;and&#x20;gshadow&#x20;&#40;passwords&#41;&#x20;or&#x20;/etc/security/opasswd&#x20;&#40;old&#x20;passwords,&#x20;based&#x20;on&#x20;remember&#x20;parameter&#x20;in&#x20;the&#x20;PAM&#x20;configuration&#41;&#x20;files.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;|&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21612,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitor&#x20;the&#x20;sethostname&#x20;&#40;set&#x20;the&#x20;systems&#x20;host&#x20;name&#41;&#x20;or&#x20;setdomainname&#x20;&#40;set&#x20;the&#x20;systems&#x20;domainname&#41;&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit.&#x20;The&#x20;other&#x20;parameters&#x20;monitor&#x20;the&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;files&#x20;&#40;messages&#x20;displayed&#x20;pre-&#x20;login&#41;,&#x20;/etc/hosts&#x20;&#40;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#41;&#x20;and&#x20;/etc/sysconfig/network&#x20;&#40;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#41;&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;in&#x20;the&#x20;file&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/sysconfig/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;system-locale.&quot;','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname&#x20;-S&#x20;setdomainname&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;|&#x20;-w&#x20;/etc/sysconfig/network&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;Notes:&#x20;/etc/sysconfig/network&#x20;is&#x20;common&#x20;to&#x20;Red&#x20;Hat&#x20;and&#x20;SUSE&#x20;based&#x20;distributions.&#x20;You&#x20;should&#x20;expand&#x20;or&#x20;replace&#x20;this&#x20;coverage&#x20;to&#x20;any&#x20;network&#x20;configuration&#x20;files&#x20;on&#x20;your&#x20;system&#x20;such&#x20;as&#x20;/etc/network&#x20;on&#x20;Debian&#x20;based&#x20;distributions.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21613,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;SELinux/AppArmor&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/selinux&#x20;or&#x20;/etc/apparmor&#x20;and&#x20;/etc/apparmor.d&#x20;directories.','Changes&#x20;to&#x20;files&#x20;in&#x20;these&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','On&#x20;systems&#x20;using&#x20;SELinux&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;&#x20;|&#x20;-w&#x20;/usr/share/selinux/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;On&#x20;systems&#x20;using&#x20;AppArmor&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;|&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21614,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;The&#x20;file&#x20;/var/log/faillog&#x20;tracks&#x20;failed&#x20;events&#x20;from&#x20;login.&#x20;The&#x20;file&#x20;/var/log/lastlog&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;The&#x20;file&#x20;/var/log/tallylog&#x20;maintains&#x20;records&#x20;of&#x20;failures&#x20;via&#x20;the&#x20;pam_tally2&#x20;module','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/faillog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/tallylog&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.2.1\", \"10.2.4\", \"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21615,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;The&#x20;file&#x20;/var/run/utmp&#x20;file&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;&#x20;The&#x20;/var/log/wtmp&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;The&#x20;file&#x20;/var/log/btmp&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp&#x20;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;logins.&quot;','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;|&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;|&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;logins.&#x20;Notes:&#x20;The&#x20;last&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;read&#x20;/var/log/wtmp&#x20;&#40;last&#x20;with&#x20;no&#x20;parameters&#41;&#x20;and&#x20;/var/run/utmp&#x20;&#40;last&#x20;-f&#x20;/var/run/utmp&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"pci_dss\": [\"10.3\"]}, {\"nist_800_53\": [\"AC.7\", \"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21616,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;chmod&#x20;,&#x20;fchmod&#x20;and&#x20;fchmodat&#x20;system&#x20;calls&#x20;affect&#x20;the&#x20;permissions&#x20;associated&#x20;with&#x20;a&#x20;file.&#x20;The&#x20;chown&#x20;,&#x20;fchown&#x20;,&#x20;fchownat&#x20;and&#x20;lchown&#x20;system&#x20;calls&#x20;affect&#x20;owner&#x20;and&#x20;group&#x20;attributes&#x20;on&#x20;a&#x20;file.&#x20;The&#x20;setxattr&#x20;,&#x20;lsetxattr&#x20;,&#x20;fsetxattr&#x20;&#40;set&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;and&#x20;removexattr&#x20;,&#x20;lremovexattr&#x20;,&#x20;fremovexattr&#x20;&#40;remove&#x20;extended&#x20;file&#x20;attributes&#41;&#x20;control&#x20;extended&#x20;file&#x20;attributes.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;&#40;auid&#x20;&gt;=&#x20;1000&#41;&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events&#x20;&#40;auid&#x20;=&#x20;4294967295&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod.&quot;','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod&#x20;-S&#x20;fchmod&#x20;-S&#x20;fchmodat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chown&#x20;-S&#x20;fchown&#x20;-S&#x20;fchownat&#x20;-S&#x20;lchown&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr&#x20;-S&#x20;lsetxattr&#x20;-S&#x20;fsetxattr&#x20;-S&#x20;removexattr&#x20;-S&#x20;lremovexattr&#x20;-S&#x20;fremovexattr&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;perm_mod.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"5.5\"]}, {\"pci_dss\": [\"10.4.2\", \"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21617,'Ensure&#x20;unsuccessful&#x20;unauthorized&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;parameters&#x20;below&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;creation&#x20;&#40;&#x20;creat&#x20;&#41;,&#x20;opening&#x20;&#40;&#x20;open&#x20;,&#x20;openat&#x20;&#41;&#x20;and&#x20;truncation&#x20;&#40;&#x20;truncate&#x20;,&#x20;ftruncate&#x20;&#41;&#x20;of&#x20;files.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;the&#x20;user&#x20;is&#x20;a&#x20;non-&#x20;privileged&#x20;user&#x20;&#40;auid&#x20;&gt;&#x20;=&#x20;1000&#41;,&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295&#41;&#x20;and&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#x20;to&#x20;the&#x20;file&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;access.&quot;','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat&#x20;-S&#x20;open&#x20;-S&#x20;openat&#x20;-S&#x20;truncate&#x20;-S&#x20;ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;access.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"14.9\"]}, {\"pci_dss\": [\"10.2.4\"]}, {\"nist_800_53\": [\"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21618,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open&#x20;,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;mounts.&#x20;Notes:&#x20;This&#x20;tracks&#x20;successful&#x20;and&#x20;unsuccessful&#x20;mount&#x20;commands.&#x20;File&#x20;system&#x20;mounts&#x20;do&#x20;not&#x20;have&#x20;to&#x20;come&#x20;from&#x20;external&#x20;media&#x20;and&#x20;this&#x20;action&#x20;still&#x20;does&#x20;not&#x20;verify&#x20;write&#x20;&#40;e.g.&#x20;CD&#x20;ROMS&#41;.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21619,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for&#x20;the&#x20;unlink&#x20;&#40;remove&#x20;a&#x20;file&#41;,&#x20;unlinkat&#x20;&#40;remove&#x20;a&#x20;file&#x20;attribute&#41;,&#x20;rename&#x20;&#40;rename&#x20;a&#x20;file&#41;&#x20;and&#x20;renameat&#x20;&#40;rename&#x20;a&#x20;file&#x20;attribute&#41;&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;unlink&#x20;-S&#x20;unlinkat&#x20;-S&#x20;rename&#x20;-S&#x20;renameat&#x20;-F&#x20;auid&gt;=1000&#x20;-F&#x20;auid!=4294967295&#x20;-k&#x20;delete.&#x20;Notes:&#x20;At&#x20;a&#x20;minimum,&#x20;configure&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;collect&#x20;file&#x20;deletion&#x20;events&#x20;for&#x20;all&#x20;users&#x20;and&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"6,2\", \"13\"]}, {\"pci_dss\": [\"10.5.5\"]}, {\"nist_800_53\": [\"AU.14\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(21620,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrations.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;|&#x20;-w&#x20;/etc/sudoers.d/&#x20;-p&#x20;wa&#x20;-k&#x20;scope.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.15\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21621,'Ensure&#x20;system&#x20;administrator&#x20;actions&#x20;&#40;sudolog&#41;&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;sudo&#x20;log&#x20;file.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command&#x20;and&#x20;force&#x20;all&#x20;administrators&#x20;to&#x20;have&#x20;to&#x20;log&#x20;in&#x20;first&#x20;and&#x20;then&#x20;use&#x20;sudo&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;then&#x20;all&#x20;administrator&#x20;commands&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;/var/log/sudo.log&#x20;.&#x20;Any&#x20;time&#x20;a&#x20;command&#x20;is&#x20;executed,&#x20;an&#x20;audit&#x20;event&#x20;will&#x20;be&#x20;triggered&#x20;as&#x20;the&#x20;/var/log/sudo.log&#x20;file&#x20;will&#x20;be&#x20;opened&#x20;for&#x20;write&#x20;and&#x20;the&#x20;executed&#x20;administration&#x20;command&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.','Changes&#x20;in&#x20;/var/log/sudo.log&#x20;indicate&#x20;that&#x20;an&#x20;administrator&#x20;has&#x20;executed&#x20;a&#x20;command&#x20;or&#x20;the&#x20;log&#x20;file&#x20;itself&#x20;has&#x20;been&#x20;tampered&#x20;with.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;/var/log/sudo.log&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/var/log/sudo.log&#x20;-p&#x20;wa&#x20;-k&#x20;actions.&#x20;Notes:&#x20;The&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;with&#x20;sudisabled&#x20;&#40;See&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted&#41;&#x20;to&#x20;force&#x20;all&#x20;command&#x20;execution&#x20;through&#x20;sudo.&#x20;This&#x20;will&#x20;not&#x20;be&#x20;effective&#x20;on&#x20;the&#x20;console,&#x20;as&#x20;administrators&#x20;can&#x20;log&#x20;in&#x20;as&#x20;root.&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.16\"]}, {\"cis_csc\": [\"4.9\"]}, {\"pci_dss\": [\"10.2.2\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.6\", \"AC.7\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21622,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;and&#x20;unloading&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;The&#x20;programs&#x20;insmod&#x20;&#40;install&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;rmmod&#x20;&#40;remove&#x20;a&#x20;kernel&#x20;module&#41;,&#x20;and&#x20;modprobe&#x20;&#40;a&#x20;more&#x20;sophisticated&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules,&#x20;as&#x20;well&#x20;as&#x20;some&#x20;other&#x20;features&#41;&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;The&#x20;init_module&#x20;&#40;load&#x20;a&#x20;module&#41;&#x20;and&#x20;delete_module&#x20;&#40;delete&#x20;a&#x20;module&#41;&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;&quot;modules&quot;.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;insmod,&#x20;rmmod&#x20;and&#x20;modprobe&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;loaded&#x20;or&#x20;unloaded&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;Monitoring&#x20;of&#x20;the&#x20;init_module&#x20;and&#x20;delete_module&#x20;system&#x20;calls&#x20;would&#x20;reflect&#x20;an&#x20;unauthorized&#x20;user&#x20;attempting&#x20;to&#x20;use&#x20;a&#x20;different&#x20;program&#x20;to&#x20;load&#x20;and&#x20;unload&#x20;modules.','','For&#x20;64&#x20;bit&#x20;systems&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-w&#x20;/sbin/insmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/rmmod&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-w&#x20;/sbin/modprobe&#x20;-p&#x20;x&#x20;-k&#x20;modules&#x20;|&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module&#x20;-S&#x20;delete_module&#x20;-k&#x20;modules.&#x20;Notes:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.17\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.7\"]}, {\"nist_800_53\": [\"AU.14\", \"AU.6\"]}, {\"gpg_13\": [\"7.9\"]}, {\"gdpr_IV\": [\"32.2\", \"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}]'),(21623,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;/etc/audit/audit.rules&#x20;file:&#x20;-e&#x20;2.&#x20;Notes:&#x20;This&#x20;setting&#x20;will&#x20;ensure&#x20;reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;a&#x20;system&#x20;reboot.','[{\"cis\": [\"4.1.18\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.5\"]}, {\"nist_800_53\": [\"AU.9\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC7.2\"]}]'),(21624,'Ensure&#x20;rsyslog&#x20;Service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;will&#x20;not&#x20;have&#x20;a&#x20;syslog&#x20;service&#x20;running.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21625,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;$FileCreateMode&#x20;0640','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(21626,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;rsyslog&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;running&#x20;syslogd&#40;8&#41;&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;:&#x20;*.*&#x20;@@loghost.example.com.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21627,'Ensure&#x20;remote&#x20;rsyslog&#x20;messages&#x20;are&#x20;only&#x20;accepted&#x20;on&#x20;designated&#x20;log&#x20;hosts.','By&#x20;default,&#x20;rsyslog&#x20;does&#x20;not&#x20;listen&#x20;for&#x20;log&#x20;messages&#x20;coming&#x20;in&#x20;from&#x20;remote&#x20;systems.&#x20;The&#x20;ModLoad&#x20;tells&#x20;rsyslog&#x20;to&#x20;load&#x20;the&#x20;imtcp.so&#x20;module&#x20;so&#x20;it&#x20;can&#x20;listen&#x20;over&#x20;a&#x20;network&#x20;via&#x20;TCP.&#x20;The&#x20;InputTCPServerRun&#x20;option&#x20;instructs&#x20;rsyslogd&#x20;to&#x20;listen&#x20;on&#x20;the&#x20;specified&#x20;TCP&#x20;port.','The&#x20;guidance&#x20;in&#x20;the&#x20;section&#x20;ensures&#x20;that&#x20;remote&#x20;log&#x20;hosts&#x20;are&#x20;configured&#x20;to&#x20;only&#x20;accept&#x20;rsyslog&#x20;data&#x20;from&#x20;hosts&#x20;within&#x20;the&#x20;specified&#x20;domain&#x20;and&#x20;that&#x20;those&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;designed&#x20;to&#x20;be&#x20;log&#x20;hosts&#x20;do&#x20;not&#x20;accept&#x20;any&#x20;remote&#x20;rsyslog&#x20;messages.&#x20;This&#x20;provides&#x20;protection&#x20;from&#x20;spoofed&#x20;log&#x20;data&#x20;and&#x20;ensures&#x20;that&#x20;system&#x20;administrators&#x20;are&#x20;reviewing&#x20;reasonably&#x20;complete&#x20;syslog&#x20;data&#x20;in&#x20;a&#x20;central&#x20;location.','','For&#x20;hosts&#x20;that&#x20;are&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;un-comment&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:$ModLoad&#x20;imtcp&#x20;&amp;&#x20;$InputTCPServerRun&#x20;514.&#x20;For&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;designated&#x20;as&#x20;log&#x20;hosts,&#x20;edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;file&#x20;and&#x20;comment&#x20;or&#x20;remove&#x20;the&#x20;following&#x20;lines:&#x20;#&#x20;$ModLoad&#x20;imtcp&#x20;#&#x20;$InputTCPServerRun&#x20;514.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;rsyslogd','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"10.5.1\"]}]'),(21628,'Ensure&#x20;syslog-ng&#x20;service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;syslog-ng&#x20;package&#x20;is&#x20;installed&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;activated.','If&#x20;the&#x20;syslog-ng&#x20;service&#x20;is&#x20;not&#x20;activated&#x20;the&#x20;system&#x20;may&#x20;default&#x20;to&#x20;the&#x20;syslogd&#x20;service&#x20;or&#x20;lack&#x20;logging&#x20;instead.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog&#x20;:&#x20;&#x20;&#x20;#&#x20;systemctl&#x20;enable&#x20;syslog-ng','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21629,'Ensure&#x20;syslog-ng&#x20;default&#x20;file&#x20;permissions&#x20;configured.','syslog-ng&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;syslog-ng&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;and&#x20;set&#x20;perm&#x20;option&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;&#x20;&#x20;&#x20;&#x20;options&#x20;{&#x20;chain_hostnames&#40;off&#41;;&#x20;flush_lines&#40;0&#41;;&#x20;perm&#40;0640&#41;;&#x20;stats_freq&#40;3600&#41;;&#x20;threaded&#40;yes&#41;;&#x20;};','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.5.1\", \"10.5.2\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.9\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC7.2\", \"CC.7.3\", \"CC7.4\"]}]'),(21630,'Ensure&#x20;syslog-ng&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','The&#x20;syslog-ng&#x20;utility&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;logs&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;reducing&#x20;administrative&#x20;overhead.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/syslog-ng/syslog-ng.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines&#x20;&#40;where&#x20;logfile.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;&#x20;&#x20;&#x20;destination&#x20;logserver&#x20;{&#x20;tcp&#40;&quot;logfile.example.com&quot;&#x20;port&#40;514&#41;&#41;;&#x20;};&#x20;&#x20;&#x20;&#x20;log&#x20;{&#x20;source&#40;src&#41;;&#x20;destination&#40;logserver&#41;;&#x20;};&#x20;&#x20;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;pkill&#x20;-HUP&#x20;syslog-ng','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc\": [\"6.6\", \"6.8\"]}, {\"pci_dss\": [\"10.5.3\"]}, {\"nist_800_53\": [\"CM.1\", \"AU.4\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21631,'Ensure&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;software&#x20;are&#x20;recommended&#x20;replacements&#x20;to&#x20;the&#x20;original&#x20;syslogd&#x20;daemon&#x20;which&#x20;provide&#x20;improvements&#x20;over&#x20;syslogd&#x20;,&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;and&#x20;syslog-ng&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Install&#x20;rsyslog&#x20;or&#x20;syslog-ng&#x20;using&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;apt-get&#x20;install&#x20;rsyslog&#x20;#&#x20;apt-get&#x20;install&#x20;syslog-ng','[{\"cis\": [\"4.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"10.1\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21632,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron:&#x20;systemctl&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21633,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(21634,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21635,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21636,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21637,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;and&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21638,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow&#x20;,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;rm&#x20;/etc/cron.deny;rm&#x20;/etc/at.deny;touch&#x20;/etc/cron.allow;&#x20;touch&#x20;/etc/at.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow;&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow;&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;and&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21639,'Ensure&#x20;at/cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;these&#x20;services.&#x20;If&#x20;/etc/cron.allow&#x20;or&#x20;/etc/at.allow&#x20;do&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;and&#x20;/etc/cron.deny&#x20;are&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;those&#x20;files&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;files,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at&#x20;and&#x20;cron.&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cronjobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny&#x20;and&#x20;/etc/at.deny&#x20;and&#x20;create&#x20;and&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow&#x20;and&#x20;/etc/at.allow:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21640,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-&#x20;privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21641,'Ensure&#x20;SSH&#x20;Protocol&#x20;is&#x20;set&#x20;to&#x20;2.','SSH&#x20;supports&#x20;two&#x20;different&#x20;and&#x20;incompatible&#x20;protocols:&#x20;SSH1&#x20;and&#x20;SSH2.&#x20;SSH1&#x20;was&#x20;the&#x20;original&#x20;protocol&#x20;and&#x20;was&#x20;subject&#x20;to&#x20;security&#x20;issues.&#x20;SSH2&#x20;is&#x20;more&#x20;advanced&#x20;and&#x20;secure.','SSH&#x20;v1&#x20;suffers&#x20;from&#x20;insecurities&#x20;that&#x20;do&#x20;not&#x20;affect&#x20;SSH&#x20;v2.&#x20;Notes:&#x20;This&#x20;command&#x20;not&#x20;longer&#x20;exists&#x20;in&#x20;newer&#x20;versions&#x20;of&#x20;SSH.&#x20;This&#x20;check&#x20;is&#x20;still&#x20;being&#x20;included&#x20;for&#x20;systems&#x20;that&#x20;may&#x20;be&#x20;running&#x20;an&#x20;older&#x20;version&#x20;of&#x20;SSH.&#x20;As&#x20;of&#x20;openSSH&#x20;version&#x20;7.4&#x20;this&#x20;parameter&#x20;will&#x20;not&#x20;cause&#x20;an&#x20;issue&#x20;when&#x20;included.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Protocol&#x20;2','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"14.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(21642,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;set&#x20;to&#x20;INFO.','The&#x20;INFO&#x20;parameter&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;will&#x20;be&#x20;logged.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.&#x20;INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(21643,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_configfile&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21644,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"16.13\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21645,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhostsand&#x20;.shostsfiles&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthenticationor&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(21646,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(21647,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh&#40;1&#41;.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;server&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(21648,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"16.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\"]}]'),(21649,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(21650,'Ensure&#x20;only&#x20;approved&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-&#x20;512,hmac-sha2-256','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"14.4\", \"16.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.7\", \"CC6.1\", \"CC7.2\"]}]'),(21651,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;ssh&#x20;sessions.&#x20;When&#x20;the&#x20;ClientAliveInterval&#x20;variable&#x20;is&#x20;set,&#x20;ssh&#x20;sessions&#x20;that&#x20;have&#x20;no&#x20;activity&#x20;for&#x20;the&#x20;specified&#x20;length&#x20;of&#x20;time&#x20;are&#x20;terminated.&#x20;When&#x20;the&#x20;ClientAliveCountMax&#x20;variable&#x20;is&#x20;set,&#x20;sshd&#x20;will&#x20;send&#x20;client&#x20;alive&#x20;messages&#x20;at&#x20;every&#x20;ClientAliveInterval&#x20;interval.&#x20;When&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;with&#x20;no&#x20;response&#x20;from&#x20;the&#x20;client,&#x20;the&#x20;ssh&#x20;session&#x20;is&#x20;terminated.&#x20;For&#x20;example,&#x20;if&#x20;the&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15&#x20;seconds&#x20;and&#x20;the&#x20;ClientAliveCountMax&#x20;is&#x20;set&#x20;to&#x20;3,&#x20;the&#x20;client&#x20;ssh&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;45&#x20;seconds&#x20;of&#x20;idle&#x20;time.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;connection&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;ssh&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;300&#x20;seconds&#x20;&#40;5&#x20;minutes&#41;,&#x20;set&#x20;this&#x20;timeout&#x20;value&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;The&#x20;recommended&#x20;setting&#x20;for&#x20;ClientAliveCountMax&#x20;is&#x20;0.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;client&#x20;session&#x20;will&#x20;be&#x20;terminated&#x20;after&#x20;5&#x20;minutes&#x20;of&#x20;idle&#x20;time&#x20;and&#x20;no&#x20;keepalive&#x20;messages&#x20;will&#x20;be&#x20;sent.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy:&#x20;ClientAliveInterval&#x20;300&#x20;&#x20;&#x20;&#x20;ClientAliveCountMax&#x20;0','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(21652,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}]'),(21653,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;AllowUsers,&#x20;AllowGroups,&#x20;DenyUsers,&#x20;DenyGroups.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;&#x20;&#x20;&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;&#x20;&#x20;&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"8.1\"]}]'),(21654,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21655,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options:&#x20;-&#x20;retry=3&#x20;&#40;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure&#41;.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1&#x20;&#40;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#41;','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','1&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;apt-get&#x20;install&#x20;libpam-pwquality&#x20;2&#41;&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;appropriate&#x20;options&#x20;for&#x20;pam_pwquality.so&#x20;and&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;password&#x20;requisite&#x20;pam_pwquality.so&#x20;retry=3&#x20;3&#41;&#x20;Edit&#x20;/etc/security/pwquality.conf&#x20;to&#x20;add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;settings&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;requirements&#x20;only&#x20;cover&#x20;including&#x20;try_first_pass&#x20;and&#x20;minlen&#x20;set&#x20;to&#x20;14&#x20;or&#x20;more.&#x20;Settings&#x20;in&#x20;/etc/security/pwquality.conf&#x20;must&#x20;use&#x20;spaces&#x20;around&#x20;the&#x20;=&#x20;symbol.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2.3\"]}]'),(21656,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured.','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;to&#x20;the&#x20;policy&#x20;in&#x20;effect&#x20;at&#x20;your&#x20;site.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Edit&#x20;the&#x20;/etc/pam.d/common-auth&#x20;file&#x20;and&#x20;add&#x20;the&#x20;auth&#x20;line&#x20;below:&#x20;auth&#x20;required&#x20;pam_tally2.so&#x20;onerr=fail&#x20;audit&#x20;silent&#x20;deny=5&#x20;unlock_time=900.&#x20;','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"16.7\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(21657,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5.&#x20;Notes:&#x20;Additional&#x20;module&#x20;options&#x20;may&#x20;be&#x20;set,&#x20;recommendation&#x20;only&#x20;covers&#x20;those&#x20;listed&#x20;here.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"8.2.5\"]}]'),(21658,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;from&#x20;md5&#x20;to&#x20;sha512&#x20;&#40;a&#x20;much&#x20;stronger&#x20;hashing&#x20;algorithm&#41;.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;MD5,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note&#x20;that&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;sha512&#x20;option&#x20;for&#x20;pam_unix.so&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;sha512','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(21659,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MAX_DAYS&#x20;90.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;90&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;5th&#x20;field&#x20;should&#x20;be&#x20;365&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;will&#x20;disable&#x20;password&#x20;expiration.&#x20;Additionally&#x20;the&#x20;password&#x20;expiration&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;the&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;or&#x20;users&#x20;will&#x20;be&#x20;unable&#x20;to&#x20;change&#x20;their&#x20;password.','[{\"cis\": [\"5.4.1.1\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"8.2.4\"]}]'),(21660,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;4th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.2\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(21661,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;6th&#x20;field&#x20;should&#x20;be&#x20;7&#x20;or&#x20;more&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.','[{\"cis\": [\"5.4.1.3\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(21662,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30.&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.&#x20;Notes:&#x20;You&#x20;can&#x20;also&#x20;check&#x20;this&#x20;setting&#x20;in&#x20;/etc/shadow&#x20;directly.&#x20;The&#x20;7th&#x20;field&#x20;should&#x20;be&#x20;30&#x20;or&#x20;less&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password.&#x20;A&#x20;value&#x20;of&#x20;-1&#x20;would&#x20;disable&#x20;this&#x20;setting.','[{\"cis\": [\"5.4.1.4\"]}, {\"cis_csc\": [\"4.4\", \"16\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(21663,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(21664,'Ensure&#x20;default&#x20;user&#x20;umask&#x20;is&#x20;027&#x20;or&#x20;more&#x20;restrictive.','The&#x20;default&#x20;umask&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;&#x20;.profile&#x20;,&#x20;.bashrc&#x20;,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/bash.bashrc&#x20;,&#x20;/etc/profile&#x20;and&#x20;/etc/profile.d&#47;&#42;.sh&#x20;files&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;umask&#x20;027','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc\": [\"13\"]}, {\"pci_dss\": [\"3.6.1\"]}]'),(21665,'Ensure&#x20;default&#x20;user&#x20;shell&#x20;timeout&#x20;is&#x20;900&#x20;seconds&#x20;or&#x20;less.','The&#x20;default&#x20;TMOUT&#x20;determines&#x20;the&#x20;shell&#x20;timeout&#x20;for&#x20;users.&#x20;The&#x20;TMOUT&#x20;value&#x20;is&#x20;measured&#x20;in&#x20;seconds.','Having&#x20;no&#x20;timeout&#x20;value&#x20;associated&#x20;with&#x20;a&#x20;shell&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;shell&#x20;session&#x20;&#40;e.g.&#x20;user&#x20;walks&#x20;away&#x20;from&#x20;their&#x20;computer&#x20;and&#x20;doesn&#039;t&#x20;lock&#x20;the&#x20;screen&#41;.&#x20;Setting&#x20;a&#x20;timeout&#x20;value&#x20;at&#x20;least&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;this&#x20;happening.','','Edit&#x20;the&#x20;/etc/bashrc,&#x20;/etc/profile&#x20;files,&#x20;and&#x20;/etc/profile.d*.sh&#x20;&#40;and&#x20;the&#x20;appropriate&#x20;files&#x20;for&#x20;any&#x20;other&#x20;shell&#x20;supported&#x20;on&#x20;your&#x20;system&#41;&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;any&#x20;umask&#x20;parameters&#x20;as&#x20;follows:&#x20;TMOUT=600','[{\"cis\": [\"5.4.5\"]}, {\"cis_csc\": [\"16.11\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(21666,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;group&#x20;to&#x20;execute&#x20;su.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','1&#41;&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;2&#41;&#x20;Create&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;users&#x20;in&#x20;the&#x20;wheel&#x20;statement&#x20;in&#x20;the&#x20;/etc/group&#x20;file:&#x20;wheel:x:10:root,&lt;user&#x20;list&gt;&#x20;Notes:&#x20;The&#x20;use_uid&#x20;option&#x20;to&#x20;pam_wheel.so&#x20;is&#x20;a&#x20;no-op&#x20;on&#x20;debian&#x20;based&#x20;systems.&#x20;It&#x20;is&#x20;acceptable&#x20;but&#x20;not&#x20;required&#x20;as&#x20;these&#x20;systems&#x20;use&#x20;its&#x20;behavior&#x20;as&#x20;default.','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(21667,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21668,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;one&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;o-rwx,g-wx&#x20;/etc/shadow','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21669,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21670,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21671,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/passwd-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21672,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;one&#x20;of&#x20;the&#x20;following&#x20;chown&#x20;commands&#x20;as&#x20;appropriate&#x20;and&#x20;the&#x20;chmod&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/shadow-','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21673,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;644&#x20;/etc/group-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21674,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;o-rwx,g-rw&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"16.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(21675,'Ensure&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;&lt;username&gt;&lt;/em&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"4.4\"]}, {\"pci_dss\": [\"8.2\"]}]'),(21676,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/passwd.','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/passwd&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21677,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/shadow','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/shadow&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21678,'Ensure&#x20;no&#x20;legacy&#x20;+&#x20;entries&#x20;exist&#x20;in&#x20;/etc/group','The&#x20;character&#x20;+&#x20;in&#x20;various&#x20;files&#x20;used&#x20;to&#x20;be&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;These&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;most&#x20;systems,&#x20;but&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.','These&#x20;entries&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Remove&#x20;any&#x20;legacy&#x20;+&#x20;entries&#x20;from&#x20;/etc/group&#x20;if&#x20;they&#x20;exist.','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"16.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}]'),(21679,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"5.1\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(21680,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty.','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group,&#x20;and&#x20;change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.','[{\"cis\": [\"6.2.20\"]}, {\"cis_csc\": [\"16\"]}, {\"pci_dss\": [\"10.2.5\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"nist_800_53\": [\"AU.14\", \"AC.7\"]}, {\"tsc\": [\"CC7.2\", \"CC6.1\", \"CC6.8\", \"CC7.3\", \"CC7.4\"]}, {\"gpg_13\": [\"7.8\"]}, {\"gdpr_IV\": [\"35.7\", \"32.2\"]}]'),(22000,'Ensure&#x20;web&#x20;content&#x20;is&#x20;on&#x20;non-system&#x20;partition','Web&#x20;resources&#x20;published&#x20;through&#x20;IIS&#x20;are&#x20;mapped,&#x20;via&#x20;Virtual&#x20;Directories,&#x20;to&#x20;physical&#x20;locations&#x20;on&#x20;disk.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;map&#x20;all&#x20;Virtual&#x20;Directories&#x20;to&#x20;a&#x20;non-system&#x20;disk&#x20;volume.','Isolating&#x20;web&#x20;content&#x20;from&#x20;system&#x20;files&#x20;may&#x20;reduce&#x20;the&#x20;probability&#x20;of:&#x20;-&#x20;Web&#x20;sites/applications&#x20;exhausting&#x20;system&#x20;disk&#x20;space&#x20;-&#x20;File&#x20;IO&#x20;vulnerability&#x20;in&#x20;the&#x20;web&#x20;site/application&#x20;from&#x20;affecting&#x20;the&#x20;confidentiality&#x20;and/or&#x20;integrity&#x20;of&#x20;system&#x20;files','','1.&#x20;Browse&#x20;to&#x20;web&#x20;content&#x20;in&#x20;C:inetpubwwwroot&#x20;2.&#x20;Copy&#x20;or&#x20;cut&#x20;content&#x20;onto&#x20;a&#x20;dedicated&#x20;and&#x20;restricted&#x20;web&#x20;folder&#x20;on&#x20;a&#x20;non-systemdrive&#x20;such&#x20;as&#x20;D:webroot&#x20;3.&#x20;Change&#x20;mappings&#x20;for&#x20;any&#x20;applications&#x20;or&#x20;Virtual&#x20;Directories&#x20;to&#x20;reflect&#x20;the&#x20;new&#x20;location&#x20;To&#x20;change&#x20;the&#x20;mapping&#x20;for&#x20;the&#x20;application&#x20;named&#x20;app1&#x20;which&#x20;resides&#x20;under&#x20;the&#x20;Default&#x20;Web&#x20;Site,&#x20;open&#x20;IIS&#x20;Manager:&#x20;1.&#x20;Expand&#x20;the&#x20;server&#x20;node&#x20;2.&#x20;Expand&#x20;Sites&#x20;3.&#x20;Expand&#x20;Default&#x20;Web&#x20;Site&#x20;4.&#x20;Click&#x20;on&#x20;app1&#x20;5.&#x20;In&#x20;the&#x20;Actions&#x20;pane,&#x20;select&#x20;Basic&#x20;Settings&#x20;6.&#x20;In&#x20;the&#x20;Physical&#x20;path&#x20;text&#x20;box,&#x20;put&#x20;the&#x20;new&#x20;location&#x20;of&#x20;the&#x20;application,&#x20;D:wwwrootapp1&#x20;in&#x20;the&#x20;example&#x20;above','[{\"cis\": [\"1.1\"]}, {\"cis_csc\": [\"14\"]}]'),(22001,'Ensure&#x20;&#039;directory&#x20;browsing&#039;&#x20;is&#x20;set&#x20;to&#x20;disabled','Directory&#x20;browsing&#x20;allows&#x20;the&#x20;contents&#x20;of&#x20;a&#x20;directory&#x20;to&#x20;be&#x20;displayed&#x20;upon&#x20;request&#x20;from&#x20;a&#x20;web&#x20;client.&#x20;If&#x20;directory&#x20;browsing&#x20;is&#x20;enabled&#x20;for&#x20;a&#x20;directory&#x20;in&#x20;Internet&#x20;Information&#x20;Services,&#x20;users&#x20;receive&#x20;a&#x20;page&#x20;that&#x20;lists&#x20;the&#x20;contents&#x20;of&#x20;the&#x20;directory&#x20;when&#x20;the&#x20;following&#x20;two&#x20;conditions&#x20;are&#x20;met:&#x20;1.&#x20;No&#x20;specific&#x20;file&#x20;is&#x20;requested&#x20;in&#x20;the&#x20;URL&#x20;2.&#x20;The&#x20;Default&#x20;Documents&#x20;feature&#x20;is&#x20;disabled&#x20;in&#x20;IIS,&#x20;or&#x20;if&#x20;it&#x20;is&#x20;enabled,&#x20;IIS&#x20;is&#x20;unable&#x20;to&#x20;locate&#x20;a&#x20;file&#x20;in&#x20;the&#x20;directory&#x20;that&#x20;matches&#x20;a&#x20;name&#x20;specified&#x20;in&#x20;the&#x20;IIS&#x20;default&#x20;document&#x20;list','Ensuring&#x20;that&#x20;directory&#x20;browsing&#x20;is&#x20;disabled&#x20;may&#x20;reduce&#x20;the&#x20;probability&#x20;of&#x20;disclosing&#x20;sensitive&#x20;content&#x20;that&#x20;is&#x20;inadvertently&#x20;accessible&#x20;via&#x20;IIS.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:directoryBrowse&#x20;/enabled:false','[{\"cis\": [\"1.3\"]}, {\"cis_csc\": [\"14\"]}]'),(22002,'Ensure&#x20;&#039;application&#x20;pool&#x20;identity&#039;&#x20;is&#x20;configured&#x20;for&#x20;all&#x20;application&#x20;pools','Application&#x20;Pool&#x20;Identities&#x20;are&#x20;the&#x20;actual&#x20;users/authorities&#x20;that&#x20;will&#x20;run&#x20;the&#x20;worker&#x20;process&#x20;-&#x20;w3wp.exe.&#x20;Assigning&#x20;the&#x20;correct&#x20;user&#x20;authority&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;applications&#x20;can&#x20;function&#x20;properly,&#x20;while&#x20;not&#x20;giving&#x20;overly&#x20;permissive&#x20;permissions&#x20;on&#x20;the&#x20;system.&#x20;These&#x20;identities&#x20;can&#x20;further&#x20;be&#x20;used&#x20;in&#x20;ACLs&#x20;to&#x20;protect&#x20;system&#x20;content.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;each&#x20;Application&#x20;Pool&#x20;run&#x20;under&#x20;a&#x20;unique&#x20;identity.&#x20;IIS&#x20;has&#x20;additional&#x20;built-in&#x20;least&#x20;privilege&#x20;identities&#x20;intended&#x20;for&#x20;use&#x20;by&#x20;Application&#x20;Pools.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;default&#x20;Application&#x20;Pool&#x20;Identity&#x20;be&#x20;changed&#x20;to&#x20;a&#x20;least&#x20;privilege&#x20;principle&#x20;other&#x20;than&#x20;Network&#x20;Service.&#x20;Furthermore,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;application&#x20;pool&#x20;identities&#x20;be&#x20;assigned&#x20;a&#x20;unique&#x20;least&#x20;privilege&#x20;principal.&#x20;To&#x20;achieve&#x20;isolation&#x20;in&#x20;IIS,&#x20;application&#x20;pools&#x20;can&#x20;be&#x20;run&#x20;as&#x20;separate&#x20;identities.&#x20;IIS&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;automatically&#x20;use&#x20;the&#x20;application&#x20;pool&#x20;identity&#x20;if&#x20;no&#x20;anonymous&#x20;user&#x20;account&#x20;is&#x20;configured&#x20;for&#x20;a&#x20;Web&#x20;site.&#x20;This&#x20;can&#x20;greatly&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;accounts&#x20;needed&#x20;for&#x20;Web&#x20;sites&#x20;and&#x20;make&#x20;management&#x20;of&#x20;the&#x20;accounts&#x20;easier.&#x20;It&#x20;is&#x20;recommended&#x20;the&#x20;Application&#x20;Pool&#x20;Identity&#x20;be&#x20;set&#x20;as&#x20;the&#x20;Anonymous&#x20;User&#x20;Identity.&#x20;The&#x20;name&#x20;of&#x20;the&#x20;Application&#x20;Pool&#x20;account&#x20;corresponds&#x20;to&#x20;the&#x20;name&#x20;of&#x20;the&#x20;Application&#x20;Pool.&#x20;Application&#x20;Pool&#x20;Identities&#x20;were&#x20;introduced&#x20;in&#x20;Windows&#x20;Server&#x20;2008&#x20;SP2.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;Application&#x20;Pools&#x20;be&#x20;set&#x20;to&#x20;run&#x20;as&#x20;ApplicationPoolIdentity&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;underlying&#x20;reason&#x20;that&#x20;the&#x20;application&#x20;pool&#x20;needs&#x20;to&#x20;run&#x20;as&#x20;a&#x20;specified&#x20;end&#x20;user&#x20;account.&#x20;One&#x20;example&#x20;where&#x20;this&#x20;is&#x20;needed&#x20;is&#x20;for&#x20;web&#x20;farms&#x20;using&#x20;Kerberos&#x20;authentication','Setting&#x20;Application&#x20;Pools&#x20;to&#x20;use&#x20;unique&#x20;least&#x20;privilege&#x20;identities&#x20;such&#x20;as&#x20;ApplicationPoolIdentity&#x20;reduces&#x20;the&#x20;potential&#x20;harm&#x20;the&#x20;identity&#x20;could&#x20;cause&#x20;should&#x20;the&#x20;application&#x20;ever&#x20;become&#x20;compromised.&#x20;Additionally,&#x20;it&#x20;will&#x20;simplify&#x20;application&#x20;pools&#x20;configuration&#x20;and&#x20;account&#x20;management.','','To&#x20;change&#x20;the&#x20;ApplicationPool&#x20;identity&#x20;to&#x20;the&#x20;built-in&#x20;ApplicationPoolIdentity&#x20;using&#x20;AppCmd.exe,&#x20;run&#x20;the&#x20;following&#x20;from&#x20;a&#x20;command&#x20;prompt:&#x20;Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:applicationPools&#x20;/[name=&#039;&lt;apppool&#x20;name&gt;&#039;].processModel.identityType:ApplicationPoolIdentity&#x20;','[{\"cis\": [\"1.4\"]}, {\"cis_csc\": [\"18\"]}]'),(22003,'Ensure&#x20;&#039;unique&#x20;application&#x20;pools&#039;&#x20;is&#x20;set&#x20;for&#x20;sites','IIS&#x20;introduced&#x20;a&#x20;new&#x20;security&#x20;feature&#x20;called&#x20;Application&#x20;Pool&#x20;Identities&#x20;that&#x20;allows&#x20;Application&#x20;Pools&#x20;to&#x20;be&#x20;run&#x20;under&#x20;unique&#x20;accounts&#x20;without&#x20;the&#x20;need&#x20;to&#x20;create&#x20;and&#x20;manage&#x20;local&#x20;or&#x20;domain&#x20;accounts.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;Sites&#x20;run&#x20;under&#x20;unique,&#x20;dedicated&#x20;Application&#x20;Pools.','By&#x20;setting&#x20;sites&#x20;to&#x20;run&#x20;under&#x20;unique&#x20;Application&#x20;Pools,&#x20;resource-intensive&#x20;applications&#x20;can&#x20;be&#x20;assigned&#x20;to&#x20;their&#x20;own&#x20;application&#x20;pools&#x20;which&#x20;could&#x20;improve&#x20;server&#x20;and&#x20;application&#x20;performance.In&#x20;addition,&#x20;it&#x20;can&#x20;help&#x20;maintain&#x20;application&#x20;availability:&#x20;if&#x20;an&#x20;application&#x20;in&#x20;one&#x20;pool&#x20;fails,&#x20;applications&#x20;in&#x20;other&#x20;pools&#x20;are&#x20;not&#x20;affected.Last,&#x20;isolating&#x20;applications&#x20;helps&#x20;mitigate&#x20;the&#x20;potential&#x20;risk&#x20;of&#x20;one&#x20;application&#x20;being&#x20;allowed&#x20;access&#x20;to&#x20;the&#x20;resources&#x20;of&#x20;another&#x20;application.&#x20;It&#x20;is&#x20;also&#x20;recommended&#x20;to&#x20;stop&#x20;any&#x20;application&#x20;pool&#x20;that&#x20;is&#x20;not&#x20;in&#x20;use&#x20;or&#x20;was&#x20;created&#x20;by&#x20;an&#x20;installation&#x20;such&#x20;as&#x20;.Net&#x20;4.0.','','The&#x20;following&#x20;appcmd.exe&#x20;command&#x20;will&#x20;set&#x20;the&#x20;application&#x20;pool&#x20;for&#x20;a&#x20;given&#x20;application:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;app&#x20;&#039;&lt;website&#x20;name&gt;/&#039;&#x20;/applicationpool:&lt;apppool&#x20;name&gt;','[{\"cis\": [\"1.5\"]}, {\"cis_csc\": [\"14.6\"]}]'),(22004,'Ensure&#x20;&#039;application&#x20;pool&#x20;identity&#039;&#x20;is&#x20;configured&#x20;for&#x20;anonymous&#x20;user&#x20;identity','To&#x20;achieve&#x20;isolation&#x20;in&#x20;IIS,&#x20;application&#x20;pools&#x20;can&#x20;be&#x20;run&#x20;as&#x20;separate&#x20;identities.&#x20;IIS&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;automatically&#x20;use&#x20;the&#x20;application&#x20;pool&#x20;identity&#x20;if&#x20;no&#x20;anonymous&#x20;user&#x20;account&#x20;is&#x20;configured&#x20;for&#x20;a&#x20;Web&#x20;site.&#x20;This&#x20;can&#x20;greatly&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;accounts&#x20;needed&#x20;for&#x20;Web&#x20;sites&#x20;and&#x20;make&#x20;management&#x20;of&#x20;the&#x20;accounts&#x20;easier.&#x20;It&#x20;is&#x20;recommended&#x20;the&#x20;Application&#x20;Pool&#x20;Identity&#x20;be&#x20;set&#x20;as&#x20;the&#x20;Anonymous&#x20;User&#x20;Identity.','Configuring&#x20;the&#x20;anonymous&#x20;user&#x20;identity&#x20;to&#x20;use&#x20;the&#x20;application&#x20;pool&#x20;identity&#x20;will&#x20;help&#x20;ensure&#x20;site&#x20;isolation&#x20;-&#x20;provided&#x20;sites&#x20;are&#x20;set&#x20;to&#x20;use&#x20;the&#x20;application&#x20;pool&#x20;identity.&#x20;Since&#x20;a&#x20;unique&#x20;principal&#x20;will&#x20;run&#x20;each&#x20;application&#x20;pool,&#x20;it&#x20;will&#x20;ensure&#x20;the&#x20;identity&#x20;is&#x20;least&#x20;privilege.&#x20;Additionally,&#x20;it&#x20;will&#x20;simplify&#x20;Site&#x20;management.','','To&#x20;use&#x20;AppCmd.exe&#x20;to&#x20;configure&#x20;anonymousAuthenticationat&#x20;the&#x20;server&#x20;level,&#x20;the&#x20;command&#x20;would&#x20;look&#x20;like&#x20;this:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-section:anonymousAuthentication&#x20;/username:&quot;&quot;&#x20;--password','[{\"cis\": [\"1.6\"]}, {\"cis_csc\": [\"14.6\"]}]'),(22005,'&#x20;Ensure&#x20;WebDav&#x20;feature&#x20;is&#x20;disabled','WebDAV&#x20;is&#x20;an&#x20;extension&#x20;to&#x20;the&#x20;HTTP&#x20;protocol&#x20;which&#x20;allows&#x20;clients&#x20;to&#x20;create,&#x20;move,&#x20;and&#x20;delete&#x20;files&#x20;and&#x20;resources&#x20;on&#x20;the&#x20;web&#x20;server.&#x20;This&#x20;functionality&#x20;is&#x20;available&#x20;in&#x20;IIS&#x20;when&#x20;the&#x20;WebDAV&#x20;feature&#x20;is&#x20;enabled.','WebDAV&#x20;is&#x20;not&#x20;widely&#x20;used,&#x20;and&#x20;it&#x20;has&#x20;serious&#x20;security&#x20;concerns&#x20;because&#x20;it&#x20;may&#x20;allow&#x20;clients&#x20;to&#x20;modify&#x20;unauthorized&#x20;files&#x20;on&#x20;the&#x20;web&#x20;server.&#x20;Therefore,&#x20;the&#x20;WebDav&#x20;feature&#x20;should&#x20;be&#x20;disabled.','','To&#x20;disable&#x20;this&#x20;feature&#x20;using&#x20;PowerShell,&#x20;enter&#x20;the&#x20;following&#x20;command:&#x20;Remove-WindowsFeature&#x20;Web-DAV-Publishing&#x20;Verify&#x20;that&#x20;Success&#x20;is&#x20;True','[{\"cis\": [\"1.7\"]}, {\"cis_csc\": [\"9.2\"]}]'),(22006,'Ensure&#x20;&#039;global&#x20;authorization&#x20;rule&#039;&#x20;is&#x20;set&#x20;to&#x20;restrict&#x20;access','IIS&#x20;introduced&#x20;URL&#x20;Authorization,&#x20;which&#x20;allows&#x20;the&#x20;addition&#x20;of&#x20;Authorization&#x20;rules&#x20;to&#x20;the&#x20;actual&#x20;URL,&#x20;instead&#x20;of&#x20;the&#x20;underlying&#x20;file&#x20;system&#x20;resource,&#x20;as&#x20;a&#x20;way&#x20;to&#x20;protect&#x20;it.&#x20;Authorization&#x20;rules&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;server,&#x20;web&#x20;site,&#x20;folder&#x20;&#40;including&#x20;Virtual&#x20;Directories&#41;,&#x20;or&#x20;file&#x20;level.&#x20;The&#x20;native&#x20;URL&#x20;Authorization&#x20;module&#x20;applies&#x20;to&#x20;all&#x20;requests,&#x20;whether&#x20;they&#x20;are&#x20;.NET&#x20;managed&#x20;or&#x20;other&#x20;types&#x20;of&#x20;files&#x20;&#40;e.g.&#x20;static&#x20;files&#x20;or&#x20;ASP&#x20;files&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;URL&#x20;Authorization&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;grant&#x20;access&#x20;to&#x20;the&#x20;necessary&#x20;security&#x20;principals.','Configuring&#x20;a&#x20;global&#x20;Authorization&#x20;rule&#x20;that&#x20;restricts&#x20;access&#x20;will&#x20;ensure&#x20;inheritance&#x20;of&#x20;the&#x20;settings&#x20;down&#x20;through&#x20;the&#x20;hierarchy&#x20;of&#x20;web&#x20;directories;&#x20;if&#x20;that&#x20;content&#x20;is&#x20;copied&#x20;elsewhere,&#x20;the&#x20;authorization&#x20;rules&#x20;flow&#x20;with&#x20;it.&#x20;This&#x20;will&#x20;ensure&#x20;access&#x20;to&#x20;current&#x20;and&#x20;future&#x20;content&#x20;is&#x20;only&#x20;granted&#x20;to&#x20;the&#x20;appropriate&#x20;principals,&#x20;mitigating&#x20;risk&#x20;of&#x20;accidental&#x20;or&#x20;unauthorized&#x20;access.','','To&#x20;configure&#x20;URL&#x20;Authorization&#x20;at&#x20;the&#x20;server&#x20;level&#x20;using&#x20;command&#x20;line&#x20;utilities:Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-section:system.webServer/security/authorization&#x20;/-&quot;[users=&#039;*&#039;,roles=&#039;&#039;,verbs=&#039;&#039;]&quot;;&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-section:system.webServer/security/authorization&#x20;/+&quot;[accessType=&#039;Allow&#039;,roles=&#039;Administrators&#039;]&quot;','[{\"cis\": [\"2.1\"]}, {\"cis_csc\": [\"18\"]}]'),(22007,'Ensure&#x20;access&#x20;to&#x20;sensitive&#x20;site&#x20;features&#x20;is&#x20;restricted&#x20;to&#x20;authenticated&#x20;principals&#x20;only','IIS&#x20;supports&#x20;both&#x20;challenge-based&#x20;and&#x20;login&#x20;redirection-based&#x20;authentication&#x20;methods.&#x20;Challenge-based&#x20;authentication&#x20;methods,&#x20;such&#x20;as&#x20;Integrated&#x20;Windows&#x20;Authentication,&#x20;require&#x20;a&#x20;client&#x20;to&#x20;respond&#x20;correctly&#x20;to&#x20;a&#x20;server-initiated&#x20;challenge.&#x20;A&#x20;login&#x20;redirection&#x20;based&#x20;authentication&#x20;method&#x20;such&#x20;as&#x20;Forms&#x20;Authentication&#x20;relies&#x20;on&#x20;redirection&#x20;to&#x20;a&#x20;login&#x20;page&#x20;to&#x20;determine&#x20;the&#x20;identity&#x20;of&#x20;the&#x20;principal.&#x20;Challenge-based&#x20;authentication&#x20;and&#x20;login&#x20;redirection-based&#x20;authentication&#x20;methods&#x20;cannot&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;one&#x20;another.&#x20;Public&#x20;servers/sites&#x20;are&#x20;typically&#x20;configured&#x20;to&#x20;use&#x20;Anonymous&#x20;Authentication.&#x20;This&#x20;method&#x20;typically&#x20;works,&#x20;provided&#x20;the&#x20;content&#x20;or&#x20;services&#x20;is&#x20;intended&#x20;for&#x20;use&#x20;by&#x20;the&#x20;public.&#x20;When&#x20;sites,&#x20;applications,&#x20;or&#x20;specific&#x20;content&#x20;containers&#x20;are&#x20;not&#x20;intended&#x20;for&#x20;anonymous&#x20;public&#x20;use,&#x20;an&#x20;appropriate&#x20;authentication&#x20;mechanism&#x20;should&#x20;be&#x20;utilized.&#x20;Authentication&#x20;will&#x20;help&#x20;confirm&#x20;the&#x20;identity&#x20;of&#x20;clients&#x20;who&#x20;request&#x20;access&#x20;to&#x20;sites,&#x20;application,&#x20;and&#x20;content.&#x20;IIS&#x20;provides&#x20;the&#x20;following&#x20;authentication&#x20;modules&#x20;by&#x20;default:&#x20;Anonymous&#x20;Authentication&#x20;-&#x20;allows&#x20;anonymous&#x20;users&#x20;to&#x20;access&#x20;sites,&#x20;applications,&#x20;and/or&#x20;content&#x20;Integrated&#x20;Windows&#x20;Authentication&#x20;-&#x20;authenticates&#x20;users&#x20;using&#x20;the&#x20;NTLM&#x20;or&#x20;Kerberos&#x20;protocols;&#x20;Kerberos&#x20;v5&#x20;requires&#x20;a&#x20;connection&#x20;to&#x20;Active&#x20;Directory&#x20;ASP.NET&#x20;Impersonation&#x20;-&#x20;allows&#x20;ASP.NET&#x20;applications&#x20;to&#x20;run&#x20;under&#x20;a&#x20;security&#x20;context&#x20;different&#x20;from&#x20;the&#x20;default&#x20;security&#x20;context&#x20;for&#x20;an&#x20;application&#x20;Forms&#x20;Authentication&#x20;-&#x20;enables&#x20;a&#x20;user&#x20;to&#x20;login&#x20;to&#x20;the&#x20;configured&#x20;space&#x20;with&#x20;a&#x20;valid&#x20;user&#x20;name&#x20;and&#x20;password&#x20;which&#x20;is&#x20;then&#x20;validated&#x20;against&#x20;a&#x20;database&#x20;or&#x20;other&#x20;credentials&#x20;store&#x20;Basic&#x20;authentication&#x20;-&#x20;requires&#x20;a&#x20;valid&#x20;user&#x20;name&#x20;and&#x20;password&#x20;to&#x20;access&#x20;content&#x20;Client&#x20;Certificate&#x20;Mapping&#x20;Authentication&#x20;-&#x20;allows&#x20;automatic&#x20;authentication&#x20;of&#x20;users&#x20;who&#x20;log&#x20;on&#x20;with&#x20;client&#x20;certificates&#x20;that&#x20;have&#x20;been&#x20;configured;&#x20;requires&#x20;SSL&#x20;Digest&#x20;Authentication&#x20;-&#x20;uses&#x20;Windows&#x20;domain&#x20;controller&#x20;to&#x20;authenticate&#x20;users&#x20;who&#x20;request&#x20;accessNote&#x20;that&#x20;none&#x20;of&#x20;the&#x20;challenge-based&#x20;authentication&#x20;modules&#x20;can&#x20;be&#x20;used&#x20;at&#x20;the&#x20;same&#x20;time&#x20;Forms&#x20;Authentication&#x20;is&#x20;enabled&#x20;for&#x20;certain&#x20;applications/content.&#x20;Forms&#x20;Authentication&#x20;does&#x20;not&#x20;rely&#x20;on&#x20;IIS&#x20;authentication,&#x20;so&#x20;anonymous&#x20;access&#x20;for&#x20;the&#x20;ASP.NET&#x20;application&#x20;can&#x20;be&#x20;configured&#x20;if&#x20;Forms&#x20;Authentication&#x20;will&#x20;be&#x20;used.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;sites&#x20;containing&#x20;sensitive&#x20;information,&#x20;confidential&#x20;data,&#x20;or&#x20;non&#x20;public&#x20;web&#x20;services&#x20;be&#x20;configured&#x20;with&#x20;a&#x20;credentials-based&#x20;authentication&#x20;mechanism','Configuring&#x20;authentication&#x20;will&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;users&#x20;accessing&#x20;data&#x20;and/or&#x20;services,&#x20;and&#x20;in&#x20;some&#x20;cases&#x20;reduce&#x20;the&#x20;potential&#x20;harm&#x20;that&#x20;can&#x20;be&#x20;done&#x20;to&#x20;a&#x20;system.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-&#x20;section:system.web/authentication&#x20;/mode:&lt;Windows|Passport|Forms&gt;','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"14.6\"]}]'),(22008,'Ensure&#x20;&#039;forms&#x20;authentication&#039;&#x20;require&#x20;SSL','Forms-based&#x20;authentication&#x20;can&#x20;pass&#x20;credentials&#x20;across&#x20;the&#x20;network&#x20;in&#x20;clear&#x20;text.&#x20;It&#x20;is&#x20;therefore&#x20;imperative&#x20;that&#x20;the&#x20;traffic&#x20;between&#x20;client&#x20;and&#x20;server&#x20;be&#x20;encrypted&#x20;using&#x20;SSL,&#x20;especially&#x20;in&#x20;cases&#x20;where&#x20;the&#x20;site&#x20;is&#x20;publicly&#x20;accessible.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;communications&#x20;with&#x20;any&#x20;portion&#x20;of&#x20;a&#x20;site&#x20;using&#x20;Forms&#x20;Authentication&#x20;be&#x20;encrypted&#x20;using&#x20;SSL.','Requiring&#x20;SSL&#x20;for&#x20;Forms&#x20;Authentication&#x20;will&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;credentials&#x20;during&#x20;the&#x20;login&#x20;process,&#x20;helping&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;stolen&#x20;user&#x20;information.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-&#x20;section:system.web/authentication&#x20;/mode:Forms','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22009,'Ensure&#x20;&#039;forms&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;use&#x20;cookies','Forms&#x20;Authentication&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;maintain&#x20;the&#x20;site&#x20;visitor&#039;s&#x20;session&#x20;identifier&#x20;in&#x20;either&#x20;a&#x20;URI&#x20;or&#x20;cookie.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;Forms&#x20;Authentication&#x20;be&#x20;set&#x20;to&#x20;use&#x20;cookies.','Using&#x20;cookies&#x20;to&#x20;manage&#x20;session&#x20;state&#x20;may&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;session&#x20;hi-jacking&#x20;attempts&#x20;by&#x20;preventing&#x20;ASP.NET&#x20;from&#x20;having&#x20;to&#x20;move&#x20;session&#x20;information&#x20;to&#x20;the&#x20;URL.&#x20;Moving&#x20;session&#x20;information&#x20;identifiers&#x20;into&#x20;the&#x20;URL&#x20;may&#x20;cause&#x20;session&#x20;IDs&#x20;to&#x20;show&#x20;up&#x20;in&#x20;proxy&#x20;logs,&#x20;browsing&#x20;history,&#x20;and&#x20;be&#x20;accessible&#x20;to&#x20;client&#x20;scripting&#x20;via&#x20;document.location.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-&#x20;section:system.web/authentication&#x20;/forms.cookieless:&quot;UseCookies&quot;','[{\"cis\": [\"2.4\"]}, {\"cis_csc\": [\"18\"]}]'),(22010,'Ensure&#x20;&#039;MachineKey&#x20;validation&#x20;method&#x20;-&#x20;.Net&#x20;3.5&#039;&#x20;is&#x20;configured','The&#x20;machineKey&#x20;element&#x20;of&#x20;the&#x20;ASP.NET&#x20;web.config&#x20;specifies&#x20;the&#x20;algorithm&#x20;and&#x20;keys&#x20;that&#x20;ASP.NET&#x20;will&#x20;use&#x20;for&#x20;encryption.&#x20;The&#x20;Machine&#x20;Key&#x20;feature&#x20;can&#x20;be&#x20;managed&#x20;to&#x20;specify&#x20;hashing&#x20;and&#x20;encryption&#x20;settings&#x20;for&#x20;application&#x20;services&#x20;such&#x20;as&#x20;view&#x20;state,&#x20;Forms&#x20;authentication,&#x20;membership&#x20;and&#x20;roles,&#x20;and&#x20;anonymous&#x20;identification.','Setting&#x20;the&#x20;validation&#x20;property&#x20;to&#x20;AES&#x20;will&#x20;provide&#x20;confidentiality&#x20;and&#x20;integrity&#x20;protection&#x20;to&#x20;the&#x20;viewstate.&#x20;AES&#x20;is&#x20;the&#x20;strongest&#x20;encryption&#x20;algorithm&#x20;supported&#x20;by&#x20;the&#x20;validation&#x20;property.&#x20;Setting&#x20;the&#x20;validation&#x20;property&#x20;to&#x20;SHA1&#x20;will&#x20;provide&#x20;integrity&#x20;protection&#x20;to&#x20;the&#x20;viewstate.&#x20;SHA1&#x20;is&#x20;the&#x20;strongest&#x20;hashing&#x20;algorithm&#x20;supported&#x20;by&#x20;the&#x20;validation&#x20;property.','','To&#x20;set&#x20;the&#x20;Machine&#x20;Key&#x20;encryption&#x20;at&#x20;the&#x20;global&#x20;level&#x20;using&#x20;an&#x20;appcmd.exe&#x20;command:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/commit:WEBROOT&#x20;/section:machineKey&#x20;/validation:SHA1','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22011,'Ensure&#x20;&#039;MachineKey&#x20;validation&#x20;method&#x20;-&#x20;.Net&#x20;4.5&#039;&#x20;is&#x20;configured','The&#x20;machineKey&#x20;element&#x20;of&#x20;the&#x20;ASP.NET&#x20;web.config&#x20;specifies&#x20;the&#x20;algorithm&#x20;and&#x20;keys&#x20;that&#x20;ASP.NET&#x20;will&#x20;use&#x20;for&#x20;encryption.&#x20;The&#x20;Machine&#x20;Key&#x20;feature&#x20;can&#x20;be&#x20;managed&#x20;to&#x20;specify&#x20;hashing&#x20;and&#x20;encryption&#x20;settings&#x20;for&#x20;application&#x20;services&#x20;such&#x20;as&#x20;view&#x20;state,&#x20;Forms&#x20;authentication,&#x20;membership&#x20;and&#x20;roles,&#x20;and&#x20;anonymous&#x20;identification.','SHA-2&#x20;is&#x20;the&#x20;strongest&#x20;hashing&#x20;algorithm&#x20;supported&#x20;by&#x20;the&#x20;validation&#x20;property&#x20;so&#x20;it&#x20;should&#x20;be&#x20;used&#x20;as&#x20;the&#x20;validation&#x20;method&#x20;for&#x20;the&#x20;MachineKey&#x20;in&#x20;.Net&#x20;4.5.','','To&#x20;set&#x20;the&#x20;Machine&#x20;Key&#x20;encryption&#x20;at&#x20;the&#x20;global&#x20;level&#x20;using&#x20;an&#x20;appcmd.exe&#x20;command:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/commit:WEBROOT&#x20;/section:machineKey&#x20;/validation:HMACSHA256','[{\"cis\": [\"3.9\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22012,'&#x20;Ensure&#x20;global&#x20;.NET&#x20;trust&#x20;level&#x20;is&#x20;configured','This&#x20;only&#x20;applies&#x20;to&#x20;.Net&#x20;2.0.&#x20;Future&#x20;versions&#x20;have&#x20;stopped&#x20;supporting&#x20;this&#x20;feature.&#x20;An&#x20;application&#039;s&#x20;trust&#x20;level&#x20;determines&#x20;the&#x20;permissions&#x20;that&#x20;are&#x20;granted&#x20;by&#x20;the&#x20;ASP.NET&#x20;code&#x20;access&#x20;security&#x20;&#40;CAS&#41;&#x20;policy.&#x20;CAS&#x20;defines&#x20;two&#x20;trust&#x20;categories:&#x20;full&#x20;trust&#x20;and&#x20;partial&#x20;trust.&#x20;An&#x20;application&#x20;that&#x20;has&#x20;full&#x20;trust&#x20;permissions&#x20;may&#x20;access&#x20;all&#x20;resource&#x20;types&#x20;on&#x20;a&#x20;server&#x20;and&#x20;perform&#x20;privileged&#x20;operations,&#x20;while&#x20;applications&#x20;that&#x20;run&#x20;with&#x20;partial&#x20;trust&#x20;have&#x20;varying&#x20;levels&#x20;of&#x20;operating&#x20;permissions&#x20;and&#x20;access&#x20;to&#x20;resources.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;global&#x20;.NET&#x20;Trust&#x20;Level&#x20;be&#x20;set&#x20;to&#x20;Medium&#x20;or&#x20;lower.','The&#x20;CAS&#x20;determines&#x20;the&#x20;permissions&#x20;that&#x20;are&#x20;granted&#x20;to&#x20;the&#x20;application&#x20;on&#x20;the&#x20;server.&#x20;Setting&#x20;a&#x20;minimal&#x20;level&#x20;of&#x20;trust&#x20;that&#x20;is&#x20;compatible&#x20;with&#x20;the&#x20;applications&#x20;will&#x20;limit&#x20;the&#x20;potential&#x20;harm&#x20;that&#x20;a&#x20;compromised&#x20;application&#x20;could&#x20;cause&#x20;to&#x20;a&#x20;system.','','To&#x20;set&#x20;the&#x20;.Net&#x20;Trust&#x20;Level&#x20;to&#x20;Medium&#x20;at&#x20;the&#x20;server&#x20;level&#x20;using&#x20;an&#x20;appcmd.exe&#x20;command:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/commit:WEBROOT&#x20;/section:trust&#x20;/level:Medium','[{\"cis\": [\"3.10\"]}, {\"cis_csc\": [\"14.6\"]}]'),(22013,'Ensure&#x20;X-Powered-By&#x20;Header&#x20;is&#x20;removed','The&#x20;x-powered-by&#x20;headers&#x20;may&#x20;specify&#x20;the&#x20;underlying&#x20;technology&#x20;used&#x20;by&#x20;an&#x20;application.&#x20;Attackers&#x20;are&#x20;able&#x20;to&#x20;conduct&#x20;reconnaissance&#x20;on&#x20;a&#x20;website&#x20;using&#x20;these&#x20;response&#x20;headers.&#x20;This&#x20;header&#x20;could&#x20;be&#x20;used&#x20;to&#x20;target&#x20;attacks&#x20;for&#x20;specific&#x20;known&#x20;vulnerabilities&#x20;associated&#x20;with&#x20;the&#x20;underlying&#x20;technology.&#x20;Removing&#x20;this&#x20;header&#x20;will&#x20;prevent&#x20;targeting&#x20;of&#x20;your&#x20;application&#x20;for&#x20;specific&#x20;exploits&#x20;by&#x20;non-determined&#x20;attackers.','While&#x20;this&#x20;is&#x20;not&#x20;the&#x20;only&#x20;way&#x20;to&#x20;fingerprint&#x20;a&#x20;site&#x20;through&#x20;the&#x20;response&#x20;headers,&#x20;it&#x20;makes&#x20;it&#x20;harder&#x20;and&#x20;prevents&#x20;some&#x20;potential&#x20;attackers.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.webServer/httpProtocol&#x20;/-&quot;customHeaders.[name=&#039;X-Powered-By&#039;]&quot;&#x20;/commit:apphost','[{\"cis\": [\"3.11\"]}, {\"cis_csc\": [\"5.1\"]}]'),(22014,'Ensure&#x20;Server&#x20;Header&#x20;is&#x20;removed','The&#x20;server&#x20;header&#x20;may&#x20;specify&#x20;the&#x20;underlying&#x20;technology&#x20;used&#x20;by&#x20;an&#x20;application.&#x20;Attackers&#x20;are&#x20;able&#x20;to&#x20;conduct&#x20;reconnaissance&#x20;on&#x20;a&#x20;website&#x20;using&#x20;these&#x20;response&#x20;headers.&#x20;This&#x20;header&#x20;could&#x20;be&#x20;used&#x20;to&#x20;target&#x20;attacks&#x20;for&#x20;specific&#x20;known&#x20;vulnerabilities&#x20;associated&#x20;with&#x20;the&#x20;underlying&#x20;technology.&#x20;Removing&#x20;this&#x20;header&#x20;will&#x20;prevent&#x20;targeting&#x20;of&#x20;your&#x20;application&#x20;for&#x20;specific&#x20;exploits&#x20;by&#x20;non-determined&#x20;attackers.','While&#x20;this&#x20;is&#x20;not&#x20;the&#x20;only&#x20;way&#x20;to&#x20;fingerprint&#x20;a&#x20;site&#x20;through&#x20;the&#x20;response&#x20;headers,&#x20;it&#x20;makes&#x20;it&#x20;harder&#x20;and&#x20;prevents&#x20;some&#x20;potential&#x20;attackers.&#x20;The&#x20;server&#x20;header&#x20;removal&#x20;directive&#x20;is&#x20;a&#x20;new&#x20;feature&#x20;in&#x20;IIS&#x20;10&#x20;that&#x20;can&#x20;assist&#x20;in&#x20;mitigating&#x20;this&#x20;risk.','','Enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;use&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.webServer/security/requestFiltering&#x20;/removeServerHeader:&quot;True&quot;&#x20;/commit:apphost','[{\"cis\": [\"3.12\"]}, {\"cis_csc\": [\"5.1\"]}]'),(22015,'Ensure&#x20;&#039;maxAllowedContentLength&#039;&#x20;is&#x20;configured','The&#x20;maxAllowedContentLength&#x20;Request&#x20;Filter&#x20;is&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;http&#x20;request,&#x20;measured&#x20;in&#x20;bytes,&#x20;which&#x20;can&#x20;be&#x20;sent&#x20;from&#x20;a&#x20;client&#x20;to&#x20;the&#x20;server.&#x20;Configuring&#x20;this&#x20;value&#x20;enables&#x20;the&#x20;total&#x20;request&#x20;size&#x20;to&#x20;be&#x20;restricted&#x20;to&#x20;a&#x20;configured&#x20;value.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;overall&#x20;size&#x20;of&#x20;requests&#x20;be&#x20;restricted&#x20;to&#x20;a&#x20;maximum&#x20;value&#x20;appropriate&#x20;for&#x20;the&#x20;server,&#x20;site,&#x20;or&#x20;application.','Setting&#x20;an&#x20;appropriate&#x20;value&#x20;that&#x20;has&#x20;been&#x20;tested&#x20;for&#x20;the&#x20;maxAllowedContentLength&#x20;filter&#x20;will&#x20;lower&#x20;the&#x20;impact&#x20;an&#x20;abnormally&#x20;large&#x20;request&#x20;would&#x20;otherwise&#x20;have&#x20;on&#x20;IIS&#x20;and/or&#x20;web&#x20;applications.&#x20;This&#x20;helps&#x20;to&#x20;ensure&#x20;availability&#x20;of&#x20;web&#x20;content&#x20;and&#x20;services,&#x20;and&#x20;may&#x20;also&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;buffer&#x20;overflow&#x20;type&#x20;attacks&#x20;in&#x20;unmanaged&#x20;components.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/requestLimits.maxAllowedContentLength:30000000','[{\"cis\": [\"4.1\"]}, {\"cis_csc\": [\"18\"]}]'),(22016,'Ensure&#x20;&#039;maxURL&#x20;request&#x20;filter&#039;&#x20;is&#x20;configured','The&#x20;maxURL&#x20;attribute&#x20;of&#x20;the&#x20;&lt;requestLimits&gt;&#x20;property&#x20;is&#x20;the&#x20;maximum&#x20;length&#x20;&#40;in&#x20;Bytes&#41;&#x20;in&#x20;which&#x20;a&#x20;requested&#x20;URL&#x20;can&#x20;be&#x20;&#40;excluding&#x20;query&#x20;string&#41;&#x20;in&#x20;order&#x20;for&#x20;IIS&#x20;to&#x20;accept.&#x20;Configuring&#x20;this&#x20;Request&#x20;Filter&#x20;enables&#x20;administrators&#x20;to&#x20;restrict&#x20;the&#x20;length&#x20;of&#x20;the&#x20;requests&#x20;that&#x20;the&#x20;server&#x20;will&#x20;accept.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;a&#x20;limit&#x20;be&#x20;put&#x20;on&#x20;the&#x20;length&#x20;of&#x20;URL.','With&#x20;a&#x20;properly&#x20;configured&#x20;Request&#x20;Filter&#x20;limiting&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;accepted&#x20;in&#x20;the&#x20;URL,&#x20;chances&#x20;of&#x20;undesired&#x20;application&#x20;behaviors&#x20;affecting&#x20;the&#x20;availability&#x20;of&#x20;content&#x20;and&#x20;services&#x20;are&#x20;reduced.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/requestLimits.maxURL:4096','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"18\"]}]'),(22017,'Ensure&#x20;&#039;MaxQueryString&#x20;request&#x20;filter&#039;&#x20;is&#x20;configured','The&#x20;MaxQueryString&#x20;Request&#x20;Filter&#x20;describes&#x20;the&#x20;upper&#x20;limit&#x20;on&#x20;the&#x20;length&#x20;of&#x20;the&#x20;query&#x20;string&#x20;that&#x20;the&#x20;configured&#x20;IIS&#x20;server&#x20;will&#x20;allow&#x20;for&#x20;websites&#x20;or&#x20;applications.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;values&#x20;always&#x20;be&#x20;established&#x20;to&#x20;limit&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;will&#x20;can&#x20;be&#x20;accepted&#x20;in&#x20;the&#x20;query&#x20;string.','With&#x20;a&#x20;properly&#x20;configured&#x20;Request&#x20;Filter&#x20;limiting&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;accepted&#x20;in&#x20;the&#x20;query&#x20;string,&#x20;chances&#x20;of&#x20;undesired&#x20;application&#x20;behaviors&#x20;such&#x20;as&#x20;app&#x20;pool&#x20;failures&#x20;are&#x20;reduced.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/requestLimits.maxQueryString:2048','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"18\"]}]'),(22018,'maxQueryString','This&#x20;feature&#x20;is&#x20;used&#x20;to&#x20;allow&#x20;or&#x20;reject&#x20;all&#x20;requests&#x20;to&#x20;IIS&#x20;that&#x20;contain&#x20;non-ASCII&#x20;characters.&#x20;When&#x20;using&#x20;this&#x20;feature,&#x20;Request&#x20;Filtering&#x20;will&#x20;deny&#x20;the&#x20;request&#x20;if&#x20;high-bit&#x20;characters&#x20;are&#x20;present&#x20;in&#x20;the&#x20;URL.&#x20;The&#x20;UrlScan&#x20;equivalent&#x20;is&#x20;AllowHighBitCharacters.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;requests&#x20;containing&#x20;non-ASCII&#x20;characters&#x20;be&#x20;rejected,&#x20;where&#x20;possible.','This&#x20;feature&#x20;can&#x20;help&#x20;defend&#x20;against&#x20;canonicalization&#x20;attacks,&#x20;reducing&#x20;the&#x20;potential&#x20;attack&#x20;surface&#x20;of&#x20;servers,&#x20;sites,&#x20;and/or&#x20;applications.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/allowHighBitCharacters:false','[{\"cis\": [\"4.4\"]}, {\"cis_csc\": [\"18\"]}]'),(22019,'Ensure&#x20;Double-Encoded&#x20;requests&#x20;will&#x20;be&#x20;rejected','This&#x20;Request&#x20;Filter&#x20;feature&#x20;prevents&#x20;attacks&#x20;that&#x20;rely&#x20;on&#x20;double-encoded&#x20;requests&#x20;and&#x20;applies&#x20;if&#x20;an&#x20;attacker&#x20;submits&#x20;a&#x20;double-encoded&#x20;request&#x20;to&#x20;IIS.&#x20;When&#x20;the&#x20;double-encoded&#x20;requests&#x20;filter&#x20;is&#x20;enabled,&#x20;IIS&#x20;will&#x20;go&#x20;through&#x20;a&#x20;two&#x20;iteration&#x20;process&#x20;of&#x20;normalizing&#x20;the&#x20;request.&#x20;If&#x20;the&#x20;first&#x20;normalization&#x20;differs&#x20;from&#x20;the&#x20;second,&#x20;the&#x20;request&#x20;is&#x20;rejected&#x20;and&#x20;the&#x20;error&#x20;code&#x20;is&#x20;logged&#x20;as&#x20;a&#x20;404.11.&#x20;The&#x20;double-encoded&#x20;requests&#x20;filter&#x20;was&#x20;the&#x20;VerifyNormalization&#x20;option&#x20;in&#x20;UrlScan.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;double-encoded&#x20;requests&#x20;be&#x20;rejected.','This&#x20;feature&#x20;will&#x20;help&#x20;prevent&#x20;attacks&#x20;that&#x20;rely&#x20;on&#x20;URLs&#x20;that&#x20;have&#x20;been&#x20;crafted&#x20;to&#x20;contain&#x20;double-encoded&#x20;request&#40;s&#41;.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/allowDoubleEscaping:false','[{\"cis\": [\"4.5\"]}, {\"cis_csc\": [\"18\"]}]'),(22020,'Ensure&#x20;&#039;HTTP&#x20;Trace&#x20;Method&#039;&#x20;is&#x20;disabled','The&#x20;HTTP&#x20;TRACE&#x20;method&#x20;returns&#x20;the&#x20;contents&#x20;of&#x20;client&#x20;HTTP&#x20;requests&#x20;in&#x20;the&#x20;entity-body&#x20;of&#x20;the&#x20;TRACE&#x20;response.&#x20;Attackers&#x20;could&#x20;leverage&#x20;this&#x20;behavior&#x20;to&#x20;access&#x20;sensitive&#x20;information,&#x20;such&#x20;as&#x20;authentication&#x20;data&#x20;or&#x20;cookies,&#x20;contained&#x20;in&#x20;the&#x20;HTTP&#x20;headers&#x20;of&#x20;the&#x20;request.&#x20;One&#x20;such&#x20;way&#x20;to&#x20;mitigate&#x20;this&#x20;is&#x20;by&#x20;using&#x20;the&#x20;&lt;verbs&gt;element&#x20;of&#x20;the&#x20;&lt;requestFiltering&gt;collection.&#x20;The&#x20;&lt;verbs&gt;&#x20;element&#x20;replaces&#x20;the&#x20;[AllowVerbs]&#x20;and&#x20;[DenyVerbs]&#x20;features&#x20;in&#x20;UrlScan.&#x20;It&#x20;is&#x20;recommended&#x20;the&#x20;HTTP&#x20;TRACE&#x20;method&#x20;be&#x20;denied.','Attackers&#x20;may&#x20;abuse&#x20;HTTP&#x20;TRACE&#x20;functionality&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;in&#x20;HTTP&#x20;headers&#x20;such&#x20;as&#x20;cookies&#x20;and&#x20;authentication&#x20;data.&#x20;This&#x20;risk&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;not&#x20;allowing&#x20;the&#x20;TRACE&#x20;verb.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/+verbs.[verb=&#039;TRACE&#039;,allowed=&#039;false&#039;]','[{\"cis\": [\"4.6\"]}, {\"cis_csc\": [\"18\"]}]'),(22021,'Ensure&#x20;Unlisted&#x20;File&#x20;Extensions&#x20;are&#x20;not&#x20;allowed','The&#x20;FileExtensions&#x20;Request&#x20;Filter&#x20;allows&#x20;administrators&#x20;to&#x20;define&#x20;specific&#x20;extensions&#x20;their&#x20;web&#x20;server&#40;s&#41;&#x20;will&#x20;allow&#x20;and&#x20;disallow.&#x20;The&#x20;property&#x20;allowUnlisted&#x20;will&#x20;cover&#x20;all&#x20;other&#x20;file&#x20;extensions&#x20;not&#x20;explicitly&#x20;allowed&#x20;or&#x20;denied.&#x20;Often&#x20;times,&#x20;extensions&#x20;such&#x20;as&#x20;.config,&#x20;.bat,&#x20;.exe,&#x20;to&#x20;name&#x20;a&#x20;few,&#x20;should&#x20;never&#x20;be&#x20;served.&#x20;The&#x20;AllowExtensions&#x20;and&#x20;DenyExtensionsoptions&#x20;are&#x20;the&#x20;UrlScan&#x20;equivalents.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;extensions&#x20;be&#x20;unallowed&#x20;at&#x20;the&#x20;most&#x20;global&#x20;level&#x20;possible,&#x20;with&#x20;only&#x20;those&#x20;necessary&#x20;being&#x20;allowed.','Disallowing&#x20;all&#x20;but&#x20;the&#x20;necessary&#x20;file&#x20;extensions&#x20;can&#x20;greatly&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;applications&#x20;and&#x20;servers.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:requestfiltering&#x20;/fileExtensions.allowunlisted:false','[{\"cis\": [\"4.7\"]}, {\"cis_csc\": [\"18\"]}]'),(22022,'Ensure&#x20;Handler&#x20;is&#x20;not&#x20;granted&#x20;Write&#x20;and&#x20;Script/Execute','Handler&#x20;mappings&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;give&#x20;permissions&#x20;to&#x20;Read,&#x20;Write,&#x20;Script,&#x20;or&#x20;Execute&#x20;depending&#x20;on&#x20;what&#x20;the&#x20;use&#x20;is&#x20;for&#x20;-&#x20;reading&#x20;static&#x20;content,&#x20;uploading&#x20;files,&#x20;executing&#x20;scripts,&#x20;etc.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;grant&#x20;a&#x20;handler&#x20;either&#x20;Execute/Scriptor&#x20;Write&#x20;permissions,&#x20;but&#x20;not&#x20;both.','By&#x20;allowing&#x20;both&#x20;Execute/Scriptand&#x20;Write&#x20;permissions,&#x20;a&#x20;handler&#x20;can&#x20;run&#x20;malicious&#x20;code&#x20;on&#x20;the&#x20;target&#x20;server.&#x20;Ensuring&#x20;these&#x20;two&#x20;permissions&#x20;are&#x20;never&#x20;together&#x20;will&#x20;help&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;malicious&#x20;code&#x20;being&#x20;executed&#x20;on&#x20;the&#x20;server.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;/section:handlers&#x20;/accessPolicy:Read,Script','[{\"cis\": [\"4.8\"]}, {\"cis_csc\": [\"18\"]}]'),(22023,'Ensure&#x20;&#039;notListedIsapisAllowed&#039;&#x20;is&#x20;set&#x20;to&#x20;false','The&#x20;notListedIsapisAllowedattribute&#x20;is&#x20;a&#x20;server-level&#x20;setting&#x20;that&#x20;is&#x20;located&#x20;in&#x20;the&#x20;ApplicationHost.configfile&#x20;in&#x20;the&#x20;&lt;isapiCgiRestriction&gt;element&#x20;of&#x20;the&#x20;&lt;system.webServer&gt;section&#x20;under&#x20;&lt;security&gt;.&#x20;This&#x20;element&#x20;ensures&#x20;that&#x20;malicious&#x20;users&#x20;cannot&#x20;copy&#x20;unauthorized&#x20;ISAPI&#x20;binaries&#x20;to&#x20;the&#x20;Web&#x20;server&#x20;and&#x20;then&#x20;run&#x20;them.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;notListedIsapisAllowedbe&#x20;set&#x20;to&#x20;false.','Restricting&#x20;this&#x20;attribute&#x20;to&#x20;falsewill&#x20;help&#x20;prevent&#x20;potentially&#x20;malicious&#x20;ISAPI&#x20;extensions&#x20;from&#x20;being&#x20;run.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.webServer/security/isapiCgiRestriction&#x20;/notListedIsapisAllowed:false','[{\"cis\": [\"4.9\"]}, {\"cis_csc\": [\"18\"]}]'),(22024,'Ensure&#x20;&#039;notListedCgisAllowed&#039;&#x20;is&#x20;set&#x20;to&#x20;false','The&#x20;notListedCgisAllowed&#x20;attribute&#x20;is&#x20;a&#x20;server-level&#x20;setting&#x20;that&#x20;is&#x20;located&#x20;in&#x20;the&#x20;ApplicationHost.configfile&#x20;in&#x20;the&#x20;&lt;isapiCgiRestriction&gt;element&#x20;of&#x20;the&#x20;&lt;system.webServer&gt;section&#x20;under&#x20;&lt;security&gt;.&#x20;This&#x20;element&#x20;ensures&#x20;that&#x20;malicious&#x20;users&#x20;cannot&#x20;copy&#x20;unauthorized&#x20;CGI&#x20;binaries&#x20;to&#x20;the&#x20;Web&#x20;server&#x20;and&#x20;then&#x20;run&#x20;them.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;notListedCgisAllowedbe&#x20;set&#x20;to&#x20;false.','Restricting&#x20;this&#x20;attribute&#x20;to&#x20;falsewill&#x20;help&#x20;prevent&#x20;unlisted&#x20;CGI&#x20;extensions,&#x20;including&#x20;potentially&#x20;malicious&#x20;CGI&#x20;scripts&#x20;from&#x20;being&#x20;run.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.webServer/security/isapiCgiRestriction&#x20;/notListedCgisAllowed:false','[{\"cis\": [\"4.10\"]}, {\"cis_csc\": [\"18\"]}]'),(22025,'Ensure&#x20;&#039;Dynamic&#x20;IP&#x20;Address&#x20;Restrictions&#039;&#x20;is&#x20;enabled','IIS&#x20;Dynamic&#x20;IP&#x20;Address&#x20;Restrictions&#x20;capability&#x20;can&#x20;be&#x20;used&#x20;to&#x20;thwart&#x20;DDos&#x20;attacks.&#x20;This&#x20;is&#x20;complimentary&#x20;to&#x20;the&#x20;IP&#x20;Addresses&#x20;and&#x20;Domain&#x20;names&#x20;Restrictions&#x20;lists&#x20;that&#x20;can&#x20;be&#x20;manually&#x20;maintained&#x20;within&#x20;IIS.&#x20;In&#x20;contrast,&#x20;Dynamic&#x20;IP&#x20;address&#x20;filtering&#x20;allows&#x20;administrators&#x20;to&#x20;configure&#x20;the&#x20;server&#x20;to&#x20;block&#x20;access&#x20;for&#x20;IPs&#x20;that&#x20;exceed&#x20;the&#x20;specified&#x20;request&#x20;threshold.&#x20;The&#x20;default&#x20;action&#x20;Deny&#x20;action&#x20;for&#x20;restrictions&#x20;is&#x20;to&#x20;return&#x20;a&#x20;Forbidden&#x20;response&#x20;to&#x20;the&#x20;client.','Dynamic&#x20;IP&#x20;address&#x20;filtering&#x20;allows&#x20;administrators&#x20;to&#x20;configure&#x20;the&#x20;server&#x20;to&#x20;block&#x20;access&#x20;for&#x20;IPs&#x20;that&#x20;exceed&#x20;the&#x20;specified&#x20;number&#x20;of&#x20;requests&#x20;or&#x20;requests&#x20;frequency.&#x20;Ensure&#x20;that&#x20;you&#x20;receive&#x20;the&#x20;Forbidden&#x20;page&#x20;once&#x20;the&#x20;block&#x20;has&#x20;been&#x20;enforced.','','Enter&#x20;the&#x20;following&#x20;commands&#x20;in&#x20;powershell.exe&#x20;to&#x20;configure:&#x20;Set-WebConfigurationProperty&#x20;-pspath&#x20;&#039;MACHINE/WEBROOT/APPHOST&#039;&#x20;-filter&#x20;&quot;system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests&quot;&#x20;-name&quot;enabled&quot;&#x20;-value&#x20;&quot;True&quot;Set-WebConfigurationProperty&#x20;-pspath&#x20;&#039;MACHINE/WEBROOT/APPHOST&#039;&#x20;-filter&#x20;&quot;system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests&quot;&#x20;-name&#x20;&quot;maxConcurrentRequests&quot;&#x20;-value&#x20;&lt;number&#x20;of&#x20;requests&gt;','[{\"cis\": [\"4.11\"]}, {\"cis_csc\": [\"9.5\"]}]'),(22026,'Ensure&#x20;Default&#x20;IIS&#x20;web&#x20;log&#x20;location&#x20;is&#x20;moved','IIS&#x20;will&#x20;log&#x20;relatively&#x20;detailed&#x20;information&#x20;on&#x20;every&#x20;request.&#x20;These&#x20;logs&#x20;are&#x20;usually&#x20;the&#x20;first&#x20;item&#x20;looked&#x20;at&#x20;in&#x20;a&#x20;security&#x20;response,&#x20;and&#x20;can&#x20;be&#x20;the&#x20;most&#x20;valuable.&#x20;Malicious&#x20;users&#x20;are&#x20;aware&#x20;of&#x20;this,&#x20;and&#x20;will&#x20;often&#x20;try&#x20;to&#x20;remove&#x20;evidence&#x20;of&#x20;their&#x20;activities.&#x20;It&#x20;is&#x20;therefore&#x20;recommended&#x20;that&#x20;the&#x20;default&#x20;location&#x20;for&#x20;IIS&#x20;log&#x20;files&#x20;be&#x20;changed&#x20;to&#x20;a&#x20;restricted,&#x20;non&#x20;system&#x20;drive','Moving&#x20;IIS&#x20;logging&#x20;to&#x20;a&#x20;restricted,&#x20;non-system&#x20;drive&#x20;will&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;logs&#x20;being&#x20;maliciously&#x20;altered,&#x20;removed,&#x20;or&#x20;lost&#x20;in&#x20;the&#x20;event&#x20;of&#x20;system&#x20;drive&#x20;failure&#40;s&#41;.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd&#x20;set&#x20;config&#x20;-section:sites&#x20;-siteDefaults.logfile.directory:&lt;new&#x20;log&#x20;location&gt;&#x20;','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.4\"]}]'),(22027,'Ensure&#x20;FTP&#x20;requests&#x20;are&#x20;encrypted','The&#x20;new&#x20;FTP&#x20;Publishing&#x20;Service&#x20;for&#x20;IIS&#x20;supports&#x20;adding&#x20;an&#x20;SSL&#x20;certificate&#x20;to&#x20;an&#x20;FTP&#x20;site.&#x20;Using&#x20;an&#x20;SSL&#x20;certificate&#x20;with&#x20;an&#x20;FTP&#x20;site&#x20;is&#x20;also&#x20;known&#x20;as&#x20;FTP-S&#x20;or&#x20;FTP&#x20;over&#x20;Secure&#x20;Socket&#x20;Layers&#x20;&#40;SSL&#41;.&#x20;FTP-S&#x20;is&#x20;an&#x20;RFC&#x20;standard&#x20;&#40;RFC&#x20;4217&#41;&#x20;where&#x20;an&#x20;SSL&#x20;certificate&#x20;is&#x20;added&#x20;to&#x20;an&#x20;FTP&#x20;site&#x20;and&#x20;thereby&#x20;making&#x20;it&#x20;possible&#x20;to&#x20;perform&#x20;secure&#x20;file&#x20;transfers.','By&#x20;using&#x20;SSL,&#x20;the&#x20;FTP&#x20;transmission&#x20;is&#x20;encrypted&#x20;and&#x20;secured&#x20;from&#x20;point&#x20;to&#x20;point&#x20;and&#x20;all&#x20;FTP&#x20;traffic&#x20;as&#x20;well&#x20;as&#x20;credentials&#x20;are&#x20;thereby&#x20;guarded&#x20;against&#x20;interception.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.applicationHost/sites&#x20;/siteDefaults.ftpServer.security.ssl.controlChannelPolicy:&quot;SslRequire&quot;&#x20;/siteDefaults.ftpServer.security.ssl.dataChannelPolicy:&quot;SslRequire&quot;&#x20;/commit:apphost','[{\"cis\": [\"6.1\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22028,'Ensure&#x20;FTP&#x20;Logon&#x20;attempt&#x20;restrictions&#x20;is&#x20;enabled','IIS&#x20;introduced&#x20;a&#x20;built-in&#x20;network&#x20;security&#x20;feature&#x20;to&#x20;automatically&#x20;block&#x20;brute&#x20;force&#x20;FTP&#x20;attacks.&#x20;This&#x20;can&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;a&#x20;malicious&#x20;client&#x20;from&#x20;attempting&#x20;a&#x20;brute-force&#x20;attack&#x20;on&#x20;a&#x20;discovered&#x20;account,&#x20;such&#x20;as&#x20;the&#x20;local&#x20;administrator&#x20;account.','Successful&#x20;brute&#x20;force&#x20;FTP&#x20;attacks&#x20;can&#x20;allow&#x20;an&#x20;otherwise&#x20;unauthorized&#x20;user&#x20;to&#x20;make&#x20;changes&#x20;to&#x20;data&#x20;that&#x20;should&#x20;not&#x20;be&#x20;made.&#x20;This&#x20;could&#x20;allow&#x20;the&#x20;unauthorized&#x20;user&#x20;to&#x20;modify&#x20;website&#x20;code&#x20;by&#x20;uploading&#x20;malicious&#x20;software&#x20;or&#x20;even&#x20;changing&#x20;functionality&#x20;for&#x20;items&#x20;such&#x20;as&#x20;online&#x20;payments.','','Enter&#x20;the&#x20;following&#x20;command&#x20;in&#x20;AppCmd.exe&#x20;to&#x20;configure:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.ftpServer/security/authentication&#x20;/denyByFailure.enabled:&quot;True&quot;&#x20;/commit:apphost','[{\"cis\": [\"6.2\"]}, {\"cis_csc\": [\"9.1\"]}]'),(22029,'Ensure&#x20;HSTS&#x20;Header&#x20;is&#x20;set','HTTP&#x20;Strict&#x20;Transport&#x20;Security&#x20;&#40;HSTS&#41;&#x20;allows&#x20;a&#x20;site&#x20;to&#x20;inform&#x20;the&#x20;user&#x20;agent&#x20;to&#x20;communicate&#x20;with&#x20;the&#x20;site&#x20;only&#x20;over&#x20;HTTPS.&#x20;This&#x20;header&#x20;takes&#x20;two&#x20;parameters:&#x20;max-age,&#x20;&quot;specifies&#x20;the&#x20;number&#x20;of&#x20;seconds,&#x20;after&#x20;the&#x20;reception&#x20;of&#x20;the&#x20;STS&#x20;header&#x20;field,&#x20;during&#x20;whichthe&#x20;user&#x20;agent&#x20;regards&#x20;the&#x20;host&#x20;&#40;from&#x20;whom&#x20;the&#x20;message&#x20;was&#x20;received&#41;&#x20;as&#x20;a&#x20;Known&#x20;HSTSHost&#x20;[speaks&#x20;only&#x20;HTTPS]&quot;;&#x20;and&#x20;includeSubDomains.&#x20;includeSubDomains&#x20;is&#x20;an&#x20;optionaldirective&#x20;that&#x20;defines&#x20;how&#x20;this&#x20;policy&#x20;is&#x20;applied&#x20;to&#x20;subdomains.&#x20;If&#x20;includeSubDomains&#x20;isincluded&#x20;in&#x20;the&#x20;header,&#x20;it&#x20;provides&#x20;the&#x20;following&#x20;definition:&#x20;this&#x20;HSTS&#x20;Policy&#x20;also&#x20;applies&#x20;toany&#x20;hosts&#x20;whose&#x20;domain&#x20;names&#x20;are&#x20;subdomains&#x20;of&#x20;the&#x20;Known&#x20;HSTS&#x20;Host&#039;s&#x20;domain&#x20;name.','HTTP&#x20;Strict&#x20;Transport&#x20;Security&#x20;&#40;HSTS&#41;&#x20;is&#x20;a&#x20;simple&#x20;and&#x20;widely&#x20;supported&#x20;standard&#x20;to&#x20;protect&#x20;visitors&#x20;by&#x20;ensuring&#x20;that&#x20;their&#x20;browsers&#x20;always&#x20;connect&#x20;to&#x20;a&#x20;website&#x20;over&#x20;HTTPS.&#x20;HSTS&#x20;exists&#x20;to&#x20;remove&#x20;the&#x20;need&#x20;for&#x20;the&#x20;common,&#x20;insecure&#x20;practice&#x20;of&#x20;redirecting&#x20;users&#x20;from&#x20;http://&#x20;to&#x20;https://&#x20;URLs.&#x20;HSTS&#x20;relies&#x20;on&#x20;the&#x20;User&#x20;Agent/Browser&#x20;to&#x20;enforce&#x20;the&#x20;required&#x20;behavior.&#x20;All&#x20;major&#x20;browsers&#x20;support&#x20;it.&#x20;If&#x20;the&#x20;browser&#x20;doesn&#039;t&#x20;support&#x20;HSTS,&#x20;it&#x20;will&#x20;be&#x20;ignored.When&#x20;a&#x20;browser&#x20;knows&#x20;that&#x20;a&#x20;domain&#x20;has&#x20;enabled&#x20;HSTS,&#x20;it&#x20;does&#x20;two&#x20;things:1.&#x20;Always&#x20;uses&#x20;an&#x20;https://&#x20;connection,&#x20;even&#x20;when&#x20;clicking&#x20;on&#x20;an&#x20;http://&#x20;link&#x20;or&#x20;after&#x20;typing&#x20;a&#x20;domain&#x20;into&#x20;the&#x20;location&#x20;bar&#x20;without&#x20;specifying&#x20;a&#x20;protocol.2.&#x20;Removes&#x20;the&#x20;ability&#x20;for&#x20;users&#x20;to&#x20;click&#x20;through&#x20;warnings&#x20;about&#x20;invalid&#x20;certificates.A&#x20;domain&#x20;instructs&#x20;browsers&#x20;that&#x20;it&#x20;has&#x20;enabled&#x20;HSTS&#x20;by&#x20;returning&#x20;an&#x20;HTTP&#x20;header&#x20;over&#x20;an&#x20;HTTPS&#x20;connection.','','To&#x20;set&#x20;the&#x20;HTTP&#x20;Header&#x20;at&#x20;the&#x20;server&#x20;level&#x20;using&#x20;an&#x20;AppCmd.exe&#x20;command,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;from&#x20;an&#x20;elevated&#x20;command&#x20;prompt:&#x20;%systemroot%system32inetsrvappcmd.exe&#x20;set&#x20;config&#x20;-section:system.webServer/httpProtocol&#x20;/+&quot;customHeaders.[name=&#039;Strict-Transport-Security&#039;,value=&#039;max-age=480;&#x20;preload&#039;]&quot;','[{\"cis\": [\"7.1\"]}, {\"cis_csc\": [\"18\"]}]'),(22030,'Ensure&#x20;SSLv2&#x20;is&#x20;Disabled','This&#x20;protocol&#x20;is&#x20;not&#x20;considered&#x20;cryptographically&#x20;secure.','Disabling&#x20;weak&#x20;protocols&#x20;will&#x20;help&#x20;ensure&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;in-transit&#x20;data.','','Set&#x20;the&#x20;following&#x20;key&#x20;is&#x20;set&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;2.0Server:Enabled&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;2.0Client:Enabled.&#x20;Set&#x20;the&#x20;following&#x20;key&#x20;is&#x20;set&#x20;to&#x20;1:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;2.0Server:DisabledByDefault&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;2.0Client:DisabledByDefault','[{\"cis\": [\"7.2\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22031,'Ensure&#x20;SSLv3&#x20;is&#x20;Disabled','This&#x20;protocol&#x20;is&#x20;not&#x20;considered&#x20;cryptographically&#x20;secure.&#x20;Disabling&#x20;it&#x20;is&#x20;recommended.','Disabling&#x20;weak&#x20;protocols&#x20;will&#x20;help&#x20;ensure&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;in-transit&#x20;data.','','Set&#x20;the&#x20;following&#x20;keys&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;3.0Server:Enabled&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;3.0Client:Enabled.&#x20;Set&#x20;the&#x20;following&#x20;keys&#x20;to&#x20;1:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;3.0Server:DisabledByDefault&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsSSL&#x20;3.0Client:DisabledByDefault','[{\"cis\": [\"7.3\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22032,'Ensure&#x20;TLS&#x20;1.0&#x20;is&#x20;Disabled','The&#x20;PCI&#x20;Data&#x20;Security&#x20;Standard&#x20;3.1&#x20;recommends&#x20;disabling&#x20;&quot;early&#x20;TLS&quot;&#x20;along&#x20;with&#x20;SSL:&#x20;SSL&#x20;and&#x20;early&#x20;TLS&#x20;are&#x20;not&#x20;considered&#x20;strong&#x20;cryptography&#x20;and&#x20;cannot&#x20;be&#x20;used&#x20;as&#x20;a&#x20;security&#x20;control&#x20;after&#x20;June&#x20;30,&#x20;2016.','Disabling&#x20;weak&#x20;protocols&#x20;will&#x20;help&#x20;ensure&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;in-transit&#x20;data.','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.0Server:Enabled&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.0Client:Enabled.&#x20;Set&#x20;the&#x20;following&#x20;key&#x20;is&#x20;set&#x20;to&#x20;1:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.0Server:DisabledByDefault&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.0Client:DisabledByDefault','[{\"cis\": [\"7.4\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22033,'Ensure&#x20;TLS&#x20;1.1&#x20;is&#x20;Disabled','TLS&#x20;1.1&#x20;is&#x20;required&#x20;for&#x20;backward&#x20;compatibility.&#x20;Ensure&#x20;you&#x20;fully&#x20;test&#x20;your&#x20;application&#x20;to&#x20;ensure&#x20;that&#x20;backwards&#x20;compatibility&#x20;is&#x20;not&#x20;needed.&#x20;If&#x20;it&#x20;is,&#x20;build&#x20;in&#x20;exceptions&#x20;as&#x20;necessary&#x20;for&#x20;backwards&#x20;compatibility','Disabling&#x20;weak&#x20;protocols&#x20;will&#x20;help&#x20;ensure&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;in-transit&#x20;data','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.1Server:Enabled&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.1Client:Enabled.&#x20;Set&#x20;the&#x20;following&#x20;key&#x20;is&#x20;set&#x20;to&#x20;1:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.1Server:DisabledByDefault&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.1Client:DisabledByDefault','[{\"cis\": [\"7.5\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22034,'Ensure&#x20;TLS&#x20;1.2&#x20;is&#x20;Enabled','TLS&#x20;1.2&#x20;is&#x20;the&#x20;most&#x20;recent&#x20;and&#x20;mature&#x20;protocol&#x20;for&#x20;protecting&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;HTTP&#x20;traffic.','Enabling&#x20;this&#x20;protocol&#x20;will&#x20;help&#x20;ensure&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;data&#x20;in&#x20;transit.','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;1:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.2Server:Enabled.&#x20;Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELProtocolsTLS&#x20;1.2Server:DisabledByDefault','[{\"cis\": [\"7.6\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22035,'Ensure&#x20;NULL&#x20;Cipher&#x20;Suites&#x20;is&#x20;Disabled','The&#x20;NULL&#x20;cipher&#x20;does&#x20;not&#x20;provide&#x20;data&#x20;confidentiality&#x20;or&#x20;integrity.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;NULL&#x20;cipher&#x20;be&#x20;disabled.','By&#x20;disabling&#x20;the&#x20;NULL&#x20;cipher,&#x20;there&#x20;is&#x20;a&#x20;better&#x20;chance&#x20;of&#x20;maintaining&#x20;data&#x20;confidentiality&#x20;and&#x20;integrity.','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersNULL:Enabled','[{\"cis\": [\"7.7\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22036,'Ensure&#x20;DES&#x20;Cipher&#x20;Suites&#x20;is&#x20;Disabled','DES&#x20;is&#x20;a&#x20;weak&#x20;symmetric-key&#x20;cipher.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;disabled.','By&#x20;disabling&#x20;DES,&#x20;there&#x20;is&#x20;a&#x20;better&#x20;chance&#x20;of&#x20;maintaining&#x20;data&#x20;confidentiality&#x20;and&#x20;integrity.','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersDES&#x20;56/56:Enabled','[{\"cis\": [\"7.8\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22037,'Ensure&#x20;RC4&#x20;Cipher&#x20;Suites&#x20;is&#x20;Disabled','RC4&#x20;is&#x20;a&#x20;stream&#x20;cipher&#x20;that&#x20;has&#x20;known&#x20;practical&#x20;attacks.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;RC4&#x20;be&#x20;disabled.&#x20;The&#x20;only&#x20;RC4&#x20;cipher&#x20;enabled&#x20;by&#x20;default&#x20;on&#x20;Server&#x20;2012&#x20;and&#x20;2012&#x20;R2&#x20;is&#x20;RC4&#x20;128/128.','The&#x20;use&#x20;of&#x20;RC4&#x20;may&#x20;increase&#x20;an&#x20;adversaries&#x20;ability&#x20;to&#x20;read&#x20;sensitive&#x20;information&#x20;sent&#x20;over&#x20;SSL/TLS.','','Set&#x20;the&#x20;following&#x20;keys&#x20;to&#x20;0&#x20;to&#x20;disable&#x20;RC4&#x20;40/128,&#x20;RC4&#x20;56/128,&#x20;RC4&#x20;64/128,&#x20;RC4&#x20;128/128&#x20;ciphers:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersRC4&#x20;40/128:Enabled,&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersRC4&#x20;56/128:Enabled,&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersRC4&#x20;64/128:Enabled,HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersRC4&#x20;128/128:Enabled.','[{\"cis\": [\"7.9\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22038,'Ensure&#x20;AES&#x20;128/128&#x20;Cipher&#x20;Suite&#x20;is&#x20;Disabled','Enabling&#x20;AES&#x20;128/128&#x20;may&#x20;be&#x20;required&#x20;for&#x20;client&#x20;compatibility.&#x20;Enable&#x20;or&#x20;disable&#x20;this&#x20;cipher&#x20;suite&#x20;accordingly.','This&#x20;item&#x20;is&#x20;Scored&#x20;for&#x20;the&#x20;following&#x20;reasons&#x20;and&#x20;should&#x20;be&#x20;disabled:&#x20;Enabling&#x20;AES&#x20;256/256&#x20;is&#x20;recommended.&#x20;This&#x20;cipher&#x20;does&#x20;not&#x20;suffer&#x20;from&#x20;known&#x20;practical&#x20;attacks.','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;0:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersAES&#x20;128/128:Enabled','[{\"cis\": [\"7.10\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22039,'Ensure&#x20;AES&#x20;256/256&#x20;Cipher&#x20;Suite&#x20;is&#x20;Enabled','AES&#x20;256/256&#x20;is&#x20;the&#x20;most&#x20;recent&#x20;and&#x20;mature&#x20;cipher&#x20;suite&#x20;for&#x20;protecting&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;HTTP&#x20;traffic.&#x20;Enabling&#x20;AES&#x20;256/256&#x20;is&#x20;recommended.&#x20;This&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;on&#x20;Server&#x20;2012&#x20;and&#x20;2012&#x20;R2.','Enabling&#x20;this&#x20;cipher&#x20;will&#x20;help&#x20;ensure&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;data&#x20;in&#x20;transit.','','Set&#x20;the&#x20;following&#x20;key&#x20;to&#x20;1:&#x20;HKLMSYSTEMCurrentControlSetControlSecurityProvidersSCHANNELCiphersAES&#x20;128/128:Enabled','[{\"cis\": [\"7.11\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22040,'Ensure&#x20;TLS&#x20;Cipher&#x20;Suite&#x20;ordering&#x20;is&#x20;Configured','Cipher&#x20;suites&#x20;are&#x20;a&#x20;named&#x20;combination&#x20;of&#x20;authentication,&#x20;encryption,&#x20;message&#x20;authentication&#x20;code,&#x20;and&#x20;key&#x20;exchange&#x20;algorithms&#x20;used&#x20;for&#x20;the&#x20;security&#x20;settings&#x20;of&#x20;a&#x20;network&#x20;connection&#x20;using&#x20;TLS&#x20;protocol.&#x20;Clients&#x20;send&#x20;a&#x20;cipher&#x20;list&#x20;and&#x20;a&#x20;list&#x20;of&#x20;ciphers&#x20;that&#x20;it&#x20;supports&#x20;in&#x20;order&#x20;of&#x20;preference&#x20;to&#x20;a&#x20;server.&#x20;The&#x20;server&#x20;then&#x20;replies&#x20;with&#x20;the&#x20;cipher&#x20;suite&#x20;that&#x20;it&#x20;selects&#x20;from&#x20;the&#x20;client&#x20;cipher&#x20;suite&#x20;list','Cipher&#x20;suites&#x20;should&#x20;be&#x20;ordered&#x20;from&#x20;strongest&#x20;to&#x20;weakest&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;more&#x20;secure&#x20;configuration&#x20;is&#x20;used&#x20;for&#x20;encryption&#x20;between&#x20;the&#x20;server&#x20;and&#x20;client.','','Set&#x20;HKLMSOFTWAREPoliciesMicrosoftCryptographyConfigurationSSL&#x00;0010002:Functions&#x20;to&#x20;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256.','[{\"cis\": [\"7.12\"]}, {\"cis_csc\": [\"14.4\"]}]'),(22500,'Ensure&#x20;Authentication&#x20;is&#x20;configured.','This&#x20;setting&#x20;ensures&#x20;that&#x20;all&#x20;clients,&#x20;users,&#x20;servers&#x20;are&#x20;required&#x20;to&#x20;authenticate&#x20;before&#x20;being&#x20;granted&#x20;access&#x20;to&#x20;the&#x20;MongoDB&#x20;database.&#x20;Authentication&#x20;is&#x20;the&#x20;process&#x20;of&#x20;verifying&#x20;the&#x20;identity&#x20;of&#x20;a&#x20;client.&#x20;When&#x20;access&#x20;control,&#x20;i.e.&#x20;authorization,&#x20;is&#x20;enabled,&#x20;MongoDB&#x20;requires&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;themselves&#x20;in&#x20;order&#x20;to&#x20;determine&#x20;their&#x20;access.&#x20;To&#x20;authenticate&#x20;as&#x20;a&#x20;user,&#x20;you&#x20;must&#x20;provide&#x20;a&#x20;username,&#x20;password,&#x20;and&#x20;the&#x20;authentication&#x20;database&#x20;associated&#x20;with&#x20;that&#x20;user.','Failure&#x20;to&#x20;authenticate&#x20;clients,&#x20;users,&#x20;servers&#x20;can&#x20;enable&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;MongoDB&#x20;database&#x20;and&#x20;can&#x20;prevent&#x20;tracing&#x20;actions&#x20;back&#x20;to&#x20;their&#x20;sources.','','The&#x20;authentication&#x20;mechanism&#x20;should&#x20;be&#x20;implemented&#x20;before&#x20;anyone&#x20;accesses&#x20;the&#x20;MongoDB&#x20;Server.&#x20;To&#x20;enable&#x20;the&#x20;authentication&#x20;mechanism:&#x20;Start&#x20;the&#x20;MongoDB&#x20;instance&#x20;without&#x20;authentication.&#x20;Create&#x20;the&#x20;system&#x20;user&#x20;administrator,&#x20;ensuring&#x20;that&#x20;its&#x20;password&#x20;meets&#x20;organizationally-defined&#x20;password&#x20;complexity&#x20;requirements.&#x20;Open&#x20;mongod.conf&#x20;and&#x20;change&#x20;for&#x20;authorization&#x20;value&#x20;to&#x20;enabled.&#x20;Restart&#x20;the&#x20;MongoDB&#x20;instance.','[{\"cis\": [\"1.2\"]}, {\"cis_csc\": [\"16\", \"16.3\"]}]'),(22501,'Ensure&#x20;that&#x20;MongoDB&#x20;does&#x20;not&#x20;bypass&#x20;authentication&#x20;via&#x20;the&#x20;localhost&#x20;exception.','MongoDB&#x20;should&#x20;not&#x20;be&#x20;set&#x20;to&#x20;bypass&#x20;authentication&#x20;via&#x20;the&#x20;localhost&#x20;exception.&#x20;The&#x20;localhost&#x20;exception&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;enable&#x20;authorization&#x20;before&#x20;creating&#x20;the&#x20;first&#x20;user&#x20;in&#x20;the&#x20;system.&#x20;When&#x20;active,&#x20;the&#x20;localhost&#x20;exception&#x20;allows&#x20;all&#x20;connections&#x20;from&#x20;the&#x20;localhost&#x20;interface&#x20;to&#x20;have&#x20;full&#x20;access&#x20;to&#x20;that&#x20;instance.&#x20;The&#x20;exception&#x20;applies&#x20;only&#x20;when&#x20;there&#x20;are&#x20;no&#x20;users&#x20;created&#x20;in&#x20;the&#x20;MongoDB&#x20;instance.&#x20;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;when&#x20;there&#x20;are&#x20;no&#x20;users&#x20;created&#x20;in&#x20;the&#x20;MongoDB&#x20;instance.','Disabling&#x20;this&#x20;exception&#x20;will&#x20;prevent&#x20;unauthorized&#x20;local&#x20;access&#x20;to&#x20;the&#x20;MongoDB&#x20;database.&#x20;It&#x20;will&#x20;also&#x20;ensure&#x20;the&#x20;traceability&#x20;of&#x20;each&#x20;database&#x20;activity&#x20;to&#x20;a&#x20;specific&#x20;user.&#x20;Localhost&#x20;Exception&#x20;allows&#x20;direct&#x20;connect&#x20;to&#x20;Mongod&rsquo;s&#x20;without&#x20;any&#x20;UN/PW.','','To&#x20;disable&#x20;local&#x20;authentication&#x20;on&#x20;the&#x20;MongoDB&#x20;database,&#x20;type&#x20;OS&#x20;Console&#x20;Command:&#x20;mongod&#x20;--setParameter&#x20;enableLocalhostAuthBypass=0,&#x20;or&#x20;manually&#x20;configure&#x20;use&#x20;the&#x20;setParameter&#x20;option&#x20;in&#x20;the&#x20;mongo&#x20;configuration&#x20;file&#x20;to&#x20;set&#x20;it&#x20;to&#x20;false&#x20;.','[{\"cis\": [\"2.2\"]}, {\"cis_csc\": [\"16\", \"16.3\"]}]'),(22502,'Ensure&#x20;authentication&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;sharded&#x20;cluster.','Authentication&#x20;is&#x20;enabled&#x20;in&#x20;a&#x20;sharded&#x20;cluster&#x20;when&#x20;the&#x20;certificate&#x20;or&#x20;key&#x20;files&#x20;are&#x20;created&#x20;and&#x20;configured&#x20;for&#x20;all&#x20;components.&#x20;This&#x20;ensures&#x20;that&#x20;every&#x20;client&#x20;that&#x20;accesses&#x20;the&#x20;cluster&#x20;must&#x20;provide&#x20;credentials,&#x20;to&#x20;include&#x20;MongoDB&#x20;instances&#x20;that&#x20;access&#x20;each&#x20;other&#x20;within&#x20;the&#x20;cluster.&#x20;With&#x20;keyfile&#x20;authentication,&#x20;each&#x20;mongod&#x20;or&#x20;mongos&#x20;instance&#x20;in&#x20;the&#x20;sharded&#x20;cluster&#x20;uses&#x20;the&#x20;contents&#x20;of&#x20;the&#x20;keyfile&#x20;as&#x20;the&#x20;shared&#x20;password&#x20;for&#x20;authenticating&#x20;other&#x20;members&#x20;in&#x20;the&#x20;deployment.&#x20;Only&#x20;mongod&#x20;or&#x20;mongos&#x20;instances&#x20;with&#x20;the&#x20;correct&#x20;keyfile&#x20;can&#x20;join&#x20;the&#x20;sharded&#x20;cluster.&#x20;For&#x20;Production&#x20;Environment:&#x20;x.509&#x20;certificate&#x20;authentication&#x20;with&#x20;secure&#x20;TSL/SSL&#x20;connection&#x20;must&#x20;be&#x20;used&#x20;for&#x20;authentication.&#x20;For&#x20;Development&#x20;Purpose:&#x20;Key&#x20;file&#x20;can&#x20;be&#x20;used&#x20;as&#x20;an&#x20;authentication&#x20;mechanism&#x20;between&#x20;the&#x20;shared&#x20;cluster.&#x20;Keyfiles&#x20;are&#x20;bare-minimum&#x20;forms&#x20;of&#x20;security&#x20;and&#x20;are&#x20;best&#x20;suited&#x20;for&#x20;testing&#x20;or&#x20;development&#x20;environments.','Enforcing&#x20;a&#x20;key&#x20;or&#x20;certificate&#x20;on&#x20;a&#x20;sharded&#x20;cluster&#x20;prevents&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;MongoDB&#x20;database&#x20;and&#x20;provides&#x20;traceability&#x20;of&#x20;database&#x20;activities&#x20;to&#x20;a&#x20;specific&#x20;user&#x20;or&#x20;component.&#x20;A&#x20;MongoDB&#x20;sharded&#x20;cluster&#x20;can&#x20;enforce&#x20;user&#x20;authentication&#x20;as&#x20;well&#x20;as&#x20;internal&#x20;authentication&#x20;of&#x20;its&#x20;components&#x20;to&#x20;secure&#x20;against&#x20;unauthorized&#x20;access.','','To&#x20;authenticate&#x20;to&#x20;servers,&#x20;clients&#x20;can&#x20;use&#x20;x.509&#x20;certificates&#x20;instead&#x20;of&#x20;usernames&#x20;and&#x20;passwords.&#x20;MongoDB&#x20;supports&#x20;x.509&#x20;certificate&#x20;authentication&#x20;for&#x20;use&#x20;with&#x20;a&#x20;secure&#x20;TLS/SSL&#x20;connection.&#x20;The&#x20;x.509&#x20;client&#x20;authentication&#x20;allows&#x20;clients&#x20;to&#x20;authenticate&#x20;to&#x20;servers&#x20;with&#x20;certificates&#x20;rather&#x20;than&#x20;with&#x20;a&#x20;username&#x20;and&#x20;password.','[{\"cis\": [\"2.3\"]}, {\"cis_csc\": [\"16\", \"1.8\"]}]'),(22503,'Ensure&#x20;that&#x20;MongoDB&#x20;only&#x20;listens&#x20;for&#x20;network&#x20;connections&#x20;on&#x20;authorized&#x20;interfaces.','Ensuring&#x20;that&#x20;MongoDB&#x20;runs&#x20;in&#x20;a&#x20;trusted&#x20;network&#x20;environment&#x20;involves&#x20;limiting&#x20;the&#x20;network&#x20;interfaces&#x20;on&#x20;which&#x20;MongoDB&#x20;instances&#x20;listen&#x20;for&#x20;incoming&#x20;connections.&#x20;Any&#x20;untrusted&#x20;network&#x20;connections&#x20;should&#x20;be&#x20;dropped&#x20;by&#x20;MongoDB.&#x20;Firewalls&#x20;allow&#x20;administrators&#x20;to&#x20;filter&#x20;and&#x20;control&#x20;access&#x20;to&#x20;a&#x20;system&#x20;by&#x20;providing&#x20;granular&#x20;control&#x20;over&#x20;network&#x20;communications.&#x20;For&#x20;administrators&#x20;of&#x20;MongoDB,&#x20;the&#x20;following&#x20;capabilities&#x20;are&#x20;important:&#x20;1.&#x20;Limiting&#x20;incoming&#x20;traffic&#x20;on&#x20;a&#x20;specific&#x20;port&#x20;to&#x20;specific&#x20;systems,&#x20;2.&#x20;Limiting&#x20;incoming&#x20;traffic&#x20;from&#x20;untrusted&#x20;hosts.&#x20;On&#x20;Linux&#x20;systems,&#x20;the&#x20;iptables&#x20;interface&#x20;provides&#x20;access&#x20;to&#x20;the&#x20;underlying&#x20;netfilter&#x20;firewall.&#x20;On&#x20;Windows&#x20;systems,&#x20;netsh&#x20;command&#x20;line&#x20;interface&#x20;provides&#x20;access&#x20;to&#x20;the&#x20;underlying&#x20;Windows&#x20;Firewall.','This&#x20;configuration&#x20;blocks&#x20;connections&#x20;from&#x20;untrusted&#x20;networks,&#x20;leaving&#x20;only&#x20;systems&#x20;on&#x20;authorized&#x20;and&#x20;trusted&#x20;networks&#x20;able&#x20;to&#x20;attempt&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;MongoDB.&#x20;If&#x20;not&#x20;configured,&#x20;this&#x20;may&#x20;lead&#x20;to&#x20;unauthorized&#x20;connections&#x20;from&#x20;untrusted&#x20;networks&#x20;to&#x20;MongoDB.','','Configure&#x20;the&#x20;MongoDB&#x20;configuration&#x20;file&#x20;to&#x20;limit&#x20;its&#x20;exposure&#x20;to&#x20;only&#x20;the&#x20;network&#x20;interfaces&#x20;on&#x20;which&#x20;MongoDB&#x20;instances&#x20;should&#x20;listen&#x20;for&#x20;incoming&#x20;connections.','[{\"cis\": [\"3.2\"]}, {\"cis_csc\": [\"9.1\", \"9.2\"]}]'),(22504,'Ensure&#x20;that&#x20;MongoDB&#x20;is&#x20;run&#x20;using&#x20;a&#x20;Least&#x20;Privileges,&#x20;dedicated&#x20;service&#x20;account.','The&#x20;MongoDB&#x20;service&#x20;should&#x20;not&#x20;be&#x20;run&#x20;using&#x20;a&#x20;privileged&#x20;account&#x20;such&#x20;as&#x20;&#039;root&#039;&#x20;because&#x20;this&#x20;unnecessarily&#x20;exposes&#x20;the&#x20;operating&#x20;system&#x20;to&#x20;high&#x20;risk.&#x20;This&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;monogd&#x20;service&#x20;runs&#x20;as&#x20;a&#x20;least-privileged&#x20;user.','Using&#x20;a&#x20;non-privileged,&#x20;dedicated&#x20;service&#x20;account&#x20;restricts&#x20;the&#x20;database&#x20;from&#x20;accessing&#x20;the&#x20;critical&#x20;areas&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;which&#x20;are&#x20;not&#x20;required&#x20;by&#x20;MongoDB.&#x20;This&#x20;will&#x20;also&#x20;mitigate&#x20;the&#x20;potential&#x20;for&#x20;unauthorized&#x20;access&#x20;via&#x20;a&#x20;compromised,&#x20;privileged&#x20;account&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Anyone&#x20;who&#x20;has&#x20;been&#x20;a&#x20;victim&#x20;of&#x20;viruses,&#x20;worms,&#x20;and&#x20;other&#x20;malicious&#x20;software&#x20;&#40;malware&#41;&#x20;will&#x20;appreciate&#x20;the&#x20;security&#x20;principle&#x20;of&#x20;&ldquo;least&#x20;privilege.&rdquo;&#x20;If&#x20;all&#x20;processes&#x20;ran&#x20;with&#x20;the&#x20;minial&#x20;set&#x20;of&#x20;privileges&#x20;needed&#x20;to&#x20;perform&#x20;the&#x20;user&#039;s&#x20;tasks,&#x20;it&#x20;would&#x20;be&#x20;more&#x20;difficult&#x20;for&#x20;malware&#x20;to&#x20;infect&#x20;a&#x20;machine&#x20;and&#x20;propagate&#x20;to&#x20;other&#x20;machines.','','1.&#x20;Create&#x20;a&#x20;user&#x20;which&#x20;is&#x20;only&#x20;used&#x20;for&#x20;running&#x20;Mongodb&#x20;and&#x20;directly&#x20;related&#x20;processes.&#x20;This&#x20;user&#x20;must&#x20;not&#x20;have&#x20;administrative&#x20;rights&#x20;to&#x20;the&#x20;system.&#x20;Steps&#x20;to&#x20;create&#x20;user.&#x20;2.&#x20;Set&#x20;the&#x20;Database&#x20;data&#x20;files,&#x20;the&#x20;keyfile,&#x20;and&#x20;the&#x20;SSL&#x20;private&#x20;key&#x20;files&#x20;to&#x20;only&#x20;be&#x20;readable&#x20;by&#x20;the&#x20;mongod/mongos&#x20;user&#x20;and&#x20;then&#x20;set&#x20;ownership&#x20;to&#x20;mongodb&#x20;user&#x20;only.&#x20;3.&#x20;Set&#x20;the&#x20;log&#x20;files&#x20;to&#x20;only&#x20;be&#x20;writable&#x20;by&#x20;the&#x20;mongod/mongos&#x20;user&#x20;and&#x20;readable&#x20;only&#x20;by&#x20;root.','[{\"cis\": [\"3.3\"]}, {\"cis_csc\": [\"5.1\", \"4.3\"]}]'),(22505,'Ensure&#x20;Encryption&#x20;of&#x20;Data&#x20;in&#x20;Transit&#x20;TLS/SSL&#x20;&#40;Transport&#x20;Encryption&#41;.','Use&#x20;TLS&#x20;or&#x20;SSL&#x20;to&#x20;protect&#x20;all&#x20;incoming&#x20;and&#x20;outgoing&#x20;connections.&#x20;This&#x20;should&#x20;include&#x20;using&#x20;TLS&#x20;or&#x20;SSL&#x20;to&#x20;encrypt&#x20;communication&#x20;between&#x20;the&#x20;mongod&#x20;and&#x20;mongos&#x20;components&#x20;of&#x20;a&#x20;MongoDB&#x20;client&#x20;as&#x20;well&#x20;as&#x20;between&#x20;all&#x20;applications&#x20;and&#x20;MongoDB.&#x20;MongoDB&#x20;supports&#x20;TLS/SSL&#x20;&#40;Transport&#x20;Layer&#x20;Security/Secure&#x20;Sockets&#x20;Layer&#41;&#x20;to&#x20;encrypt&#x20;all&#x20;of&#x20;MongoDB&rsquo;s&#x20;network&#x20;traffic.&#x20;TLS/SSL&#x20;ensures&#x20;that&#x20;MongoDB&#x20;network&#x20;traffic&#x20;is&#x20;only&#x20;readable&#x20;by&#x20;the&#x20;intended&#x20;client.','This&#x20;prevents&#x20;sniffing&#x20;of&#x20;cleartext&#x20;traffic&#x20;between&#x20;MongoDB&#x20;components&#x20;or&#x20;performing&#x20;a&#x20;man-in-the-middle&#x20;attack&#x20;for&#x20;MongoDB.','','Configure&#x20;MongoDB&#x20;servers&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;SSL&#x20;or&#x20;TLS&#x20;to&#x20;encrypt&#x20;all&#x20;MongoDB&#x20;network&#x20;communications.&#x20;To&#x20;implement&#x20;SSL&#x20;or&#x20;TLS&#x20;to&#x20;encrypt&#x20;all&#x20;MongoDB&#x20;network&#x20;communication,&#x20;perform&#x20;the&#x20;following&#x20;steps:&#x20;For&#x20;mongod&#x20;&#40;&ldquo;Primary&#x20;daemon&#x20;process&#x20;for&#x20;the&#x20;MongoDB&#x20;system&rdquo;&#41;&#x20;In&#x20;the&#x20;configuration&#x20;file&#x20;/etc/mongod.conf&#x20;,&#x20;set&#x20;the&#x20;PEMKeyFile&#x20;option&#x20;to&#x20;the&#x20;certificate&#x20;file&rsquo;s&#x20;path&#x20;and&#x20;then&#x20;start&#x20;the&#x20;component','[{\"cis\": [\"4.1\"]}, {\"cis_csc\": [\"14.2\", \"14.4\"]}]'),(22506,'Ensure&#x20;Federal&#x20;Information&#x20;Processing&#x20;Standard&#x20;&#40;FIPS&#41;&#x20;is&#x20;enabled.','The&#x20;Federal&#x20;Information&#x20;Processing&#x20;Standard&#x20;&#40;FIPS&#41;&#x20;is&#x20;a&#x20;computer&#x20;security&#x20;standard&#x20;used&#x20;to&#x20;certify&#x20;software&#x20;modules&#x20;and&#x20;libraries&#x20;that&#x20;encrypt&#x20;and&#x20;decrypt&#x20;data&#x20;securely.&#x20;You&#x20;can&#x20;configure&#x20;MongoDB&#x20;to&#x20;run&#x20;with&#x20;a&#x20;FIPS&#x20;140-2&#x20;certified&#x20;library&#x20;for&#x20;OpenSSL.&#x20;FIPS&#x20;is&#x20;a&#x20;property&#x20;of&#x20;the&#x20;encryption&#x20;system&#x20;and&#x20;not&#x20;the&#x20;access&#x20;control&#x20;system.&#x20;However,&#x20;the&#x20;environment&#x20;requires&#x20;FIPS&#x20;compliant&#x20;encryption&#x20;and&#x20;access&#x20;control.&#x20;Organizations&#x20;must&#x20;ensure&#x20;that&#x20;the&#x20;access&#x20;control&#x20;system&#x20;uses&#x20;only&#x20;FIPS-compliant&#x20;encryption.','FIPS&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;which&#x20;dictates&#x20;how&#x20;data&#x20;should&#x20;be&#x20;encrypted&#x20;at&#x20;rest&#x20;and&#x20;during&#x20;transmission.','','Configuring&#x20;FIPS&#x20;mode,&#x20;ensure&#x20;that&#x20;your&#x20;certificate&#x20;is&#x20;FIPS&#x20;compliant.&#x20;Run&#x20;mongod&#x20;or&#x20;mongos&#x20;instance&#x20;in&#x20;FIPS&#x20;mode.&#x20;Make&#x20;changes&#x20;to&#x20;configuration&#x20;file,&#x20;to&#x20;configure&#x20;your&#x20;mongod&#x20;or&#x20;mongos&#x20;instance&#x20;to&#x20;use&#x20;FIPS&#x20;mode,&#x20;shut&#x20;down&#x20;the&#x20;instance&#x20;and&#x20;update&#x20;the&#x20;configuration&#x20;file','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"14.2\", \"14.5\", \"14.4\", \"14.8\"]}]'),(22507,'Ensure&#x20;that&#x20;system&#x20;activity&#x20;is&#x20;audited.','Track&#x20;access&#x20;and&#x20;changes&#x20;to&#x20;database&#x20;configurations&#x20;and&#x20;data.&#x20;MongoDB&#x20;Enterprise&#x20;includes&#x20;a&#x20;system&#x20;auditing&#x20;facility&#x20;that&#x20;can&#x20;record&#x20;system&#x20;events&#x20;&#40;e.g.&#x20;user&#x20;operations,&#x20;connection&#x20;events&#41;&#x20;on&#x20;a&#x20;MongoDB&#x20;instance.&#x20;These&#x20;audit&#x20;records&#x20;permit&#x20;forensic&#x20;analysis&#x20;and&#x20;allow&#x20;administrators&#x20;to&#x20;verify&#x20;proper&#x20;controls.','System&#x20;level&#x20;logs&#x20;can&#x20;be&#x20;handy&#x20;while&#x20;troubleshooting&#x20;an&#x20;operational&#x20;problem&#x20;or&#x20;handling&#x20;a&#x20;security&#x20;incident.','','Set&#x20;the&#x20;value&#x20;of&#x20;auditLog.destination&#x20;to&#x20;the&#x20;appropriate&#x20;value','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(22508,'Ensure&#x20;that&#x20;system&#x20;activity&#x20;is&#x20;audited.','MongoDB&#x20;Enterprise&#x20;supports&#x20;auditing&#x20;of&#x20;various&#x20;operations.&#x20;When&#x20;enabled,&#x20;the&#x20;audit&#x20;facility,&#x20;by&#x20;default,&#x20;records&#x20;all&#x20;auditable&#x20;operations&#x20;as&#x20;detailed&#x20;in&#x20;Audit&#x20;Event&#x20;Actions,&#x20;Details,&#x20;and&#x20;Results.&#x20;To&#x20;specify&#x20;which&#x20;events&#x20;to&#x20;record,&#x20;the&#x20;audit&#x20;feature&#x20;includes&#x20;the&#x20;--auditFilter&#x20;option.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;Enterprise&#x20;editions.','All&#x20;operations&#x20;carried&#x20;out&#x20;on&#x20;the&#x20;database&#x20;are&#x20;logged.&#x20;This&#x20;helps&#x20;in&#x20;backtracking&#x20;and&#x20;tracing&#x20;any&#x20;incident&#x20;that&#x20;occurs.','','Set&#x20;the&#x20;audit&#x20;filters&#x20;based&#x20;on&#x20;the&#x20;organization&rsquo;s&#x20;requirements.','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(22509,'Ensure&#x20;that&#x20;audit&#x20;filters&#x20;are&#x20;configured&#x20;properly.','The&#x20;SystemLog.quiet&#x20;option&#x20;stops&#x20;logging&#x20;of&#x20;information&#x20;such&#x20;as:connection&#x20;events,&#x20;authentication&#x20;events,&#x20;replication&#x20;sync&#x20;activitie,&#x20;evidence&#x20;of&#x20;some&#x20;potentially&#x20;impactful&#x20;commands&#x20;being&#x20;run&#x20;&#40;eg:&#x20;drop&#x20;,&#x20;dropIndexes&#x20;,&#x20;validate&#x20;&#41;.&#x20;This&#x20;information&#x20;should&#x20;be&#x20;logged&#x20;whenever&#x20;possible.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;Enterprise&#x20;editions.','The&#x20;use&#x20;of&#x20;SystemLog.quiet&#x20;makes&#x20;troubleshooting&#x20;problems&#x20;and&#x20;investigating&#x20;possible&#x20;security&#x20;incidents&#x20;much&#x20;more&#x20;difficult.','','Set&#x20;SystemLog.quiet&#x20;to&#x20;false&#x20;in&#x20;the&#x20;/etc/mongod.conf&#x20;file&#x20;to&#x20;disable&#x20;it.','[{\"cis\": [\"5.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(22510,'Ensure&#x20;that&#x20;new&#x20;entries&#x20;are&#x20;appended&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;log&#x20;file.','By&#x20;default,&#x20;new&#x20;log&#x20;entries&#x20;will&#x20;overwrite&#x20;old&#x20;entries&#x20;after&#x20;a&#x20;restart&#x20;of&#x20;the&#x20;mongod&#x20;or&#x20;mongos&#x20;service.&#x20;Enabling&#x20;the&#x20;systemLog.logAppend&#x20;setting&#x20;causes&#x20;new&#x20;entries&#x20;to&#x20;be&#x20;appended&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;log&#x20;file&#x20;rather&#x20;than&#x20;overwriting&#x20;the&#x20;existing&#x20;content&#x20;of&#x20;the&#x20;log&#x20;when&#x20;the&#x20;mongod&#x20;or&#x20;mongos&#x20;instance&#x20;restarts.','Allowing&#x20;old&#x20;entries&#x20;to&#x20;be&#x20;overwritten&#x20;by&#x20;new&#x20;entries&#x20;instead&#x20;of&#x20;appending&#x20;new&#x20;entries&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;log&#x20;may&#x20;destroy&#x20;old&#x20;log&#x20;data&#x20;that&#x20;is&#x20;needed&#x20;for&#x20;a&#x20;variety&#x20;of&#x20;purposes.','','Set&#x20;systemLog.logAppend&#x20;to&#x20;true&#x20;in&#x20;the&#x20;/etc/mongod.conf&#x20;file.','[{\"cis\": [\"5.4\"]}, {\"cis_csc\": [\"6.3\", \"6.4\"]}]'),(22511,'Ensure&#x20;that&#x20;MongoDB&#x20;uses&#x20;a&#x20;non-default&#x20;port.','Changing&#x20;the&#x20;default&#x20;port&#x20;used&#x20;by&#x20;MongoDB&#x20;makes&#x20;it&#x20;harder&#x20;for&#x20;attackers&#x20;to&#x20;find&#x20;the&#x20;database&#x20;and&#x20;target&#x20;it.','Standard&#x20;ports&#x20;are&#x20;used&#x20;in&#x20;automated&#x20;attacks&#x20;and&#x20;by&#x20;attackers&#x20;to&#x20;verify&#x20;which&#x20;applications&#x20;are&#x20;running&#x20;on&#x20;a&#x20;server.','','Change&#x20;the&#x20;port&#x20;for&#x20;MongoDB&#x20;server&#x20;to&#x20;a&#x20;number&#x20;other&#x20;than&#x20;27017.','[{\"cis\": [\"6.1\"]}, {\"cis_csc\": [\"9.2\"]}]'),(22512,'Ensure&#x20;that&#x20;server-side&#x20;scripting&#x20;is&#x20;disabled&#x20;if&#x20;not&#x20;needed.','MongoDB&#x20;supports&#x20;the&#x20;execution&#x20;of&#x20;JavaScript&#x20;code&#x20;for&#x20;certain&#x20;server-side&#x20;operations:&#x20;mapReduce&#x20;,&#x20;group&#x20;,&#x20;and&#x20;$where&#x20;.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;use&#x20;these&#x20;operations,&#x20;server-side&#x20;scripting&#x20;should&#x20;be&#x20;disabled.','If&#x20;server-side&#x20;scripting&#x20;is&#x20;not&#x20;needed&#x20;and&#x20;is&#x20;not&#x20;disabled,&#x20;this&#x20;introduces&#x20;unnecessary&#x20;risk&#x20;which&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;insecure&#x20;coding.','','If&#x20;server-side&#x20;scripting&#x20;is&#x20;not&#x20;required,&#x20;disable&#x20;it&#x20;by&#x20;using&#x20;the&#x20;--noscripting&#x20;option&#x20;on&#x20;the&#x20;command&#x20;line.','[{\"cis\": [\"6.3\"]}, {\"cis_csc\": [\"18.9\", \"9.2\"]}]'),(23000,'Ensure&#x20;HTTP&#x20;WebDAV&#x20;module&#x20;is&#x20;not&#x20;installed','The&#x20;http_dav_module&#x20;enables&#x20;HTTP&#x20;Extensions&#x20;for&#x20;Web&#x20;Distributed&#x20;Authoring&#x20;and&#x20;Versioning&#x20;&#40;WebDAV&#41;&#x20;as&#x20;defined&#x20;by&#x20;RFC&#x20;4918.&#x20;This&#x20;enables&#x20;file-based&#x20;operations&#x20;on&#x20;your&#x20;web&#x20;server,&#x20;such&#x20;as&#x20;the&#x20;ability&#x20;to&#x20;create,&#x20;delete,&#x20;change&#x20;and&#x20;move&#x20;files&#x20;on&#x20;your&#x20;server.&#x20;Most&#x20;modern&#x20;architectures&#x20;have&#x20;replaced&#x20;this&#x20;functionality&#x20;with&#x20;cloud-based&#x20;object&#x20;storage,&#x20;in&#x20;which&#x20;case&#x20;the&#x20;module&#x20;should&#x20;not&#x20;be&#x20;installed.','WebDAV&#x20;functionality&#x20;opens&#x20;up&#x20;an&#x20;unnecessary&#x20;path&#x20;for&#x20;exploiting&#x20;your&#x20;web&#x20;server.&#x20;Through&#x20;misconfigurations&#x20;of&#x20;WebDAV&#x20;operations,&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;able&#x20;to&#x20;access&#x20;and&#x20;manipulate&#x20;files&#x20;on&#x20;the&#x20;server.','','To&#x20;remove&#x20;the&#x20;http_dav_module,&#x20;recompile&#x20;nginx&#x20;from&#x20;source&#x20;without&#x20;the&#x20;--withhttp_dav_module&#x20;flag.','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23001,'Ensure&#x20;modules&#x20;with&#x20;gzip&#x20;functionality&#x20;are&#x20;disabled','gzip&#x20;is&#x20;used&#x20;for&#x20;compression.&#x20;Compression&#x20;functionality&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;certain&#x20;types&#x20;of&#x20;attacks&#x20;from&#x20;being&#x20;performed&#x20;successfully.','Compression&#x20;has&#x20;been&#x20;linked&#x20;with&#x20;the&#x20;Breach&#x20;attack&#x20;and&#x20;others.&#x20;While&#x20;the&#x20;Breach&#x20;attack&#x20;has&#x20;been&#x20;mitigated&#x20;with&#x20;modern&#x20;usages&#x20;of&#x20;the&#x20;HTTP&#x20;protocol,&#x20;disabling&#x20;the&#x20;use&#x20;of&#x20;compression&#x20;is&#x20;considered&#x20;a&#x20;defense-in-depth&#x20;strategy&#x20;to&#x20;mitigate&#x20;other&#x20;attacks.','','In&#x20;order&#x20;to&#x20;disable&#x20;the&#x20;http_gzip_module,&#x20;nginx&#x20;must&#x20;be&#x20;recompiled&#x20;from&#x20;source.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;using&#x20;the&#x20;below&#x20;command&#x20;in&#x20;the&#x20;folder&#x20;you&#x20;used&#x20;during&#x20;your&#x20;original&#x20;compilation.&#x20;This&#x20;must&#x20;be&#x20;done&#x20;without&#x20;the&#x20;--with-http_gzip_static_module&#x20;configuration&#x20;directive.&#x20;&#039;./configure&#x20;--without-http_gzip_module&#039;','[{\"cis\": [\"2.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23002,'Ensure&#x20;the&#x20;autoindex&#x20;module&#x20;is&#x20;disabled','The&#x20;autoindex&#x20;module&#x20;processes&#x20;requests&#x20;ending&#x20;with&#x20;the&#x20;slash&#x20;character.&#x20;This&#x20;feature&#x20;enables&#x20;directory&#x20;listing,&#x20;which&#x20;could&#x20;be&#x20;useful&#x20;in&#x20;attacker&#x20;reconnaissance,&#x20;so&#x20;it&#x20;should&#x20;be&#x20;disabled.','Automated&#x20;directory&#x20;listings&#x20;may&#x20;reveal&#x20;information&#x20;helpful&#x20;to&#x20;an&#x20;attacker,&#x20;such&#x20;as&#x20;naming&#x20;conventions&#x20;and&#x20;directory&#x20;paths.&#x20;Directory&#x20;listings&#x20;may&#x20;also&#x20;reveal&#x20;files&#x20;that&#x20;were&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;revealed.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;autoindex&#x20;module:&#x20;1.&#x20;Search&#x20;the&#x20;NGINX&#x20;configuration&#x20;files&#x20;&#40;nginx.conf&#x20;and&#x20;any&#x20;included&#x20;configuration&#x20;files&#41;&#x20;to&#x20;find&#x20;autoindex&#x20;directives.&#x20;&#039;egrep&#x20;-i&#x20;&#039;^s*autoindexs+&#039;&#x20;/etc/nginx/nginx.conf&#039;.&#x20;&#039;egrep&#x20;-i&#x20;&#039;^s*autoindexs+&#039;&#x20;/etc/nginx/conf.d&#47;&#42;&#039;.&#x20;2.&#x20;Set&#x20;the&#x20;value&#x20;for&#x20;all&#x20;autoindex&#x20;directives&#x20;to&#x20;off,&#x20;or&#x20;remove&#x20;those&#x20;directives.','[{\"cis\": [\"2.1.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23003,'Ensure&#x20;that&#x20;NGINX&#x20;is&#x20;run&#x20;using&#x20;a&#x20;non-privileged,&#x20;dedicated&#x20;service&#x20;account','The&#x20;nginx&#x20;user&#x20;directive&#x20;designates&#x20;which&#x20;user&#x20;account&#x20;nginx&#x20;worker&#x20;processes&#x20;run&#x20;under.&#x20;Ensuring&#x20;a&#x20;non-privileged,&#x20;dedicated&#x20;service&#x20;account&#x20;is&#x20;used&#x20;is&#x20;a&#x20;defense&#x20;in&#x20;depth&#x20;measure&#x20;to&#x20;limit&#x20;what&#x20;an&#x20;attacker&#x20;who&#x20;compromises&#x20;the&#x20;account&#x20;can&#x20;do.','Running&#x20;a&#x20;web&#x20;server&#x20;under&#x20;a&#x20;non-privileged,&#x20;dedicated&#x20;service&#x20;account&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;lateral&#x20;movement&#x20;to&#x20;other&#x20;services&#x20;or&#x20;processes&#x20;in&#x20;the&#x20;event&#x20;the&#x20;user&#x20;account&#x20;running&#x20;the&#x20;web&#x20;services&#x20;is&#x20;compromised.&#x20;The&#x20;default&#x20;user&#x20;nobody&#x20;is&#x20;typically&#x20;used&#x20;for&#x20;several&#x20;processes,&#x20;and&#x20;if&#x20;this&#x20;is&#x20;compromised,&#x20;it&#x20;could&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;have&#x20;access&#x20;to&#x20;all&#x20;processes&#x20;running&#x20;as&#x20;that&#x20;user.','','Add&#x20;a&#x20;system&#x20;account&#x20;for&#x20;the&#x20;nginx&#x20;user&#x20;with&#x20;a&#x20;home&#x20;directory&#x20;of&#x20;/var/cache/nginx&#x20;and&#x20;a&#x20;shell&#x20;of&#x20;/sbin/nologin&#x20;so&#x20;it&#x20;does&#x20;not&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;log&#x20;in,&#x20;then&#x20;add&#x20;the&#x20;nginx&#x20;user&#x20;to&#x20;be&#x20;used&#x20;by&#x20;nginx:&#x20;&#039;user&#x20;add&#x20;nginx&#x20;-r&#x20;-g&#x20;nginx&#x20;-d&#x20;/var/cache/nginx&#x20;-s&#x20;/sbin/nologin&#039;.&#x20;Then&#x20;add&#x20;the&#x20;nginx&#x20;user&#x20;to&#x20;/etc/nginx/nginx.conf&#x20;by&#x20;adding&#x20;the&#x20;user&#x20;directive&#x20;as&#x20;shown&#x20;below:&#x20;&#039;user&#x20;nginx;&#039;','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23004,'Ensure&#x20;the&#x20;NGINX&#x20;service&#x20;account&#x20;is&#x20;locked','The&#x20;nginx&#x20;user&#x20;account&#x20;should&#x20;have&#x20;a&#x20;valid&#x20;password,&#x20;but&#x20;the&#x20;account&#x20;should&#x20;be&#x20;locked.&#x20;NOTE:&#x20;If&#x20;a&#x20;different&#x20;account&#x20;is&#x20;used&#x20;to&#x20;run&#x20;nginx,&#x20;that&#x20;account&#039;s&#x20;name&#x20;should&#x20;be&#x20;substituted&#x20;for&#x20;nginx&#x20;in&#x20;the&#x20;audit&#x20;and&#x20;remediation&#x20;procedures.','As&#x20;a&#x20;defense-in-depth&#x20;measure,&#x20;the&#x20;nginx&#x20;user&#x20;account&#x20;should&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;logins&#x20;and&#x20;to&#x20;prevent&#x20;someone&#x20;from&#x20;switching&#x20;users&#x20;to&#x20;nginx&#x20;using&#x20;the&#x20;password.&#x20;In&#x20;general,&#x20;there&#x20;shouldn&#039;t&#x20;be&#x20;a&#x20;need&#x20;for&#x20;anyone&#x20;to&#x20;have&#x20;to&#x20;su&#x20;as&#x20;nginx,&#x20;and&#x20;when&#x20;there&#x20;is&#x20;a&#x20;need,&#x20;sudo&#x20;should&#x20;be&#x20;used&#x20;instead,&#x20;which&#x20;would&#x20;not&#x20;require&#x20;the&#x20;nginx&#x20;account&#x20;password.','','Use&#x20;the&#x20;passwd&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;nginx&#x20;service&#x20;account:&#x20;&#039;passwd&#x20;-l&#x20;nginx&#039;','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23005,'Ensure&#x20;the&#x20;NGINX&#x20;service&#x20;account&#x20;has&#x20;an&#x20;invalid&#x20;shell','The&#x20;nginx&#x20;account&#x20;should&#x20;not&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;log&#x20;in,&#x20;so&#x20;the&#x20;/sbin/nologin&#x20;shell&#x20;should&#x20;be&#x20;set&#x20;for&#x20;the&#x20;account.','The&#x20;account&#x20;used&#x20;for&#x20;nginx&#x20;should&#x20;only&#x20;be&#x20;used&#x20;for&#x20;the&#x20;nginx&#x20;service&#x20;and&#x20;does&#x20;not&#x20;need&#x20;to&#x20;have&#x20;the&#x20;ability&#x20;to&#x20;log&#x20;in.&#x20;This&#x20;prevents&#x20;an&#x20;attacker&#x20;who&#x20;compromises&#x20;the&#x20;account&#x20;to&#x20;log&#x20;in&#x20;with&#x20;it.','','Change&#x20;the&#x20;login&#x20;shell&#x20;for&#x20;the&#x20;nginx&#x20;account&#x20;to&#x20;/sbin/nologin&#x20;by&#x20;using&#x20;the&#x20;following&#x20;command:&#x20;&#039;chsh&#x20;-s&#x20;/sbin/nologin&#x20;nginx&#039;','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23006,'Ensure&#x20;NGINX&#x20;directories&#x20;and&#x20;files&#x20;are&#x20;owned&#x20;by&#x20;root','The&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;/etc/nginx&#x20;directory&#x20;and&#x20;its&#x20;files&#x20;should&#x20;be&#x20;root.','Setting&#x20;ownership&#x20;to&#x20;only&#x20;those&#x20;users&#x20;in&#x20;the&#x20;root&#x20;group&#x20;and&#x20;the&#x20;root&#x20;user&#x20;will&#x20;reduce&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;modifications&#x20;to&#x20;the&#x20;nginx&#x20;configuration&#x20;files.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;ensure&#x20;ownership&#x20;and&#x20;group&#x20;ownership&#x20;is&#x20;set&#x20;to&#x20;root:&#x20;&#039;chown&#x20;-R&#x20;root:root&#x20;/etc/nginx&#039;','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23007,'Ensure&#x20;access&#x20;to&#x20;NGINX&#x20;directories&#x20;and&#x20;files&#x20;is&#x20;restricted','Permissions&#x20;on&#x20;the&#x20;/etc/nginx&#x20;directory&#x20;should&#x20;enforce&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privilege.','This&#x20;ensures&#x20;that&#x20;only&#x20;users&#x20;who&#x20;need&#x20;access&#x20;to&#x20;configuration&#x20;files&#x20;are&#x20;able&#x20;to&#x20;view&#x20;them,&#x20;thus&#x20;preventing&#x20;unauthorized&#x20;access.&#x20;Other&#x20;users&#x20;will&#x20;need&#x20;to&#x20;use&#x20;sudo&#x20;in&#x20;order&#x20;to&#x20;access&#x20;these&#x20;files.','','To&#x20;set&#x20;permissions&#x20;to&#x20;least&#x20;privilege&#x20;on&#x20;the&#x20;nginx&#x20;configuration&#x20;files,&#x20;issue&#x20;these&#x20;commands:&#x20;&#039;find&#x20;/etc/nginx&#x20;-type&#x20;d&#x20;|&#x20;xargs&#x20;chmod&#x20;750&#039;.&#x20;&#039;find&#x20;/etc/nginx&#x20;-type&#x20;f&#x20;|&#x20;xargs&#x20;chmod&#x20;640&#039;','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc\": [\"14\"]}]'),(23008,'Ensure&#x20;the&#x20;NGINX&#x20;process&#x20;ID&#x20;&#40;PID&#41;&#x20;file&#x20;is&#x20;secured','The&#x20;PID&#x20;file&#x20;stores&#x20;the&#x20;main&#x20;process&#x20;ID&#x20;of&#x20;the&#x20;nginx&#x20;process.&#x20;This&#x20;file&#x20;should&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;modification.','The&#x20;PID&#x20;file&#x20;should&#x20;be&#x20;owned&#x20;by&#x20;root&#x20;and&#x20;the&#x20;group&#x20;root.&#x20;It&#x20;should&#x20;also&#x20;be&#x20;readable&#x20;to&#x20;everyone,&#x20;but&#x20;only&#x20;writable&#x20;by&#x20;root&#x20;&#40;permissions&#x20;644&#41;.&#x20;This&#x20;will&#x20;prevent&#x20;unauthorized&#x20;modification&#x20;of&#x20;the&#x20;PID&#x20;file,&#x20;which&#x20;could&#x20;cause&#x20;a&#x20;denial&#x20;of&#x20;service.','','If&#x20;the&#x20;PID&#x20;file&#x20;is&#x20;not&#x20;owned&#x20;by&#x20;root,&#x20;issue&#x20;this&#x20;command:&#x20;&#039;chown&#x20;root:root&#x20;/var/run/nginx.pid&#039;.&#x20;If&#x20;the&#x20;PID&#x20;file&#x20;has&#x20;permissions&#x20;greater&#x20;than&#x20;644,&#x20;issue&#x20;this&#x20;command:&#x20;&#039;chown&#x20;644&#x20;/var/run/nginx.pid&#039;','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23009,'Ensure&#x20;the&#x20;core&#x20;dump&#x20;directory&#x20;is&#x20;secured','Core&#x20;dumps&#x20;are&#x20;snapshots&#x20;of&#x20;memory.&#x20;The&#x20;working_directorydirective&#x20;is&#x20;used&#x20;to&#x20;specify&#x20;the&#x20;directory&#x20;NGINX&#x20;attempts&#x20;to&#x20;create&#x20;core&#x20;dumps&#x20;in.&#x20;Core&#x20;dumps&#x20;will&#x20;be&#x20;disabled&#x20;if&#x20;the&#x20;directory&#x20;is&#x20;not&#x20;writable&#x20;by&#x20;the&#x20;NGINX&#x20;user.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;working_directory&#x20;directive&#x20;be&#x20;set&#x20;to&#x20;a&#x20;directory&#x20;that&#x20;is&#x20;owned&#x20;by&#x20;the&#x20;root&#x20;user&#x20;and&#x20;the&#x20;group&#x20;the&#x20;NGINX&#x20;process&#x20;executes&#x20;as,&#x20;and&#x20;is&#x20;inaccessible&#x20;to&#x20;other&#x20;users.&#x20;Usually,&#x20;production&#x20;systems&#x20;should&#x20;not&#x20;have&#x20;this&#x20;enabled.','Core&#x20;dumps&#x20;may&#x20;contain&#x20;sensitive&#x20;information&#x20;that&#x20;should&#x20;not&#x20;be&#x20;accessible&#x20;by&#x20;other&#x20;accounts&#x20;on&#x20;the&#x20;system.','','Either&#x20;remove&#x20;the&#x20;working_directory&#x20;directive&#x20;from&#x20;the&#x20;NGINX&#x20;configuration&#x20;files&#x20;or&#x20;ensure&#x20;that&#x20;the&#x20;configured&#x20;directory&#x20;meets&#x20;the&#x20;following&#x20;requirements:&#x20;1.&#x20;It&#x20;is&#x20;not&#x20;within&#x20;the&#x20;NGINX&#x20;web&#x20;document&#x20;root.&#x20;2.&#x20;It&#x20;is&#x20;owned&#x20;by&#x20;root&#x20;and&#x20;has&#x20;a&#x20;group&#x20;ownership&#x20;of&#x20;the&#x20;NGINX&#x20;group:&#x20;&#039;chown&#x20;root:nginx&#x20;/var/log/nginx&#039;.&#x20;3.&#x20;It&#x20;has&#x20;no&#x20;read-write-search&#x20;access&#x20;permission&#x20;for&#x20;other&#x20;users:&#x20;&#039;chmod&#x20;o-rwx&#x20;/var/log/nginx&#039;','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23010,'Ensure&#x20;NGINX&#x20;only&#x20;listens&#x20;for&#x20;network&#x20;connections&#x20;on&#x20;authorized&#x20;ports','NGINX&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;listen&#x20;on&#x20;any&#x20;port,&#x20;but&#x20;it&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;listen&#x20;on&#x20;authorized&#x20;ports&#x20;only.','Limiting&#x20;the&#x20;listening&#x20;ports&#x20;to&#x20;only&#x20;those&#x20;that&#x20;are&#x20;authorized&#x20;helps&#x20;to&#x20;ensure&#x20;no&#x20;unauthorized&#x20;services&#x20;are&#x20;running&#x20;through&#x20;the&#x20;use&#x20;of&#x20;nginx.','','If&#x20;any&#x20;ports&#x20;are&#x20;listening&#x20;that&#x20;are&#x20;not&#x20;authorized,&#x20;comment&#x20;out&#x20;or&#x20;delete&#x20;the&#x20;associated&#x20;configuration&#x20;for&#x20;that&#x20;listener.','[{\"cis\": [\"2.4.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23011,'Ensure&#x20;keepalive_timeout&#x20;is&#x20;10&#x20;seconds&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;0','Persistent&#x20;connections&#x20;are&#x20;leveraged&#x20;by&#x20;all&#x20;modern&#x20;browsers&#x20;to&#x20;facilitate&#x20;greater&#x20;web&#x20;performance.&#x20;The&#x20;keep-alive&#x20;timeout&#x20;limits&#x20;the&#x20;time&#x20;a&#x20;persistent&#x20;connection&#x20;may&#x20;remain&#x20;open.&#x20;Setting&#x20;the&#x20;keep-alive&#x20;timeout&#x20;allows&#x20;this&#x20;timeout&#x20;to&#x20;be&#x20;controlled&#x20;on&#x20;the&#x20;server&#x20;side.','Setting&#x20;a&#x20;keep-alive&#x20;timeout&#x20;on&#x20;the&#x20;server&#x20;side&#x20;helps&#x20;mitigate&#x20;denial&#x20;of&#x20;service&#x20;attacks&#x20;that&#x20;establish&#x20;too&#x20;many&#x20;persistent&#x20;connections,&#x20;exhausting&#x20;server&#x20;resources.','','Find&#x20;the&#x20;HTTP&#x20;or&#x20;server&#x20;block&#x20;of&#x20;your&#x20;nginx&#x20;configuration,&#x20;and&#x20;add&#x20;the&#x20;keepalive_timeout&#x20;directive.&#x20;Set&#x20;it&#x20;to&#x20;10&#x20;seconds&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;0.&#x20;This&#x20;example&#x20;command&#x20;sets&#x20;it&#x20;to&#x20;10&#x20;seconds:&#x20;&#039;keepalive_timeout&#x20;10;&#039;','[{\"cis\": [\"2.4.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23012,'Ensure&#x20;send_timeout&#x20;is&#x20;set&#x20;to&#x20;10&#x20;seconds&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;0','The&#x20;send_timeout&#x20;directive&#x20;sets&#x20;a&#x20;timeout&#x20;for&#x20;transmitting&#x20;a&#x20;response&#x20;to&#x20;the&#x20;client&#x20;between&#x20;two&#x20;successive&#x20;write&#x20;operations.','Setting&#x20;the&#x20;send_timeout&#x20;directive&#x20;on&#x20;the&#x20;server&#x20;side&#x20;helps&#x20;mitigate&#x20;slow&#x20;HTTP&#x20;denial&#x20;of&#x20;service&#x20;attacks&#x20;by&#x20;ensuring&#x20;write&#x20;operations&#x20;taking&#x20;up&#x20;large&#x20;amounts&#x20;of&#x20;time&#x20;are&#x20;closed.','','Find&#x20;the&#x20;HTTP&#x20;or&#x20;server&#x20;block&#x20;of&#x20;your&#x20;nginx&#x20;configuration,&#x20;and&#x20;add&#x20;the&#x20;send_timeout&#x20;directive.&#x20;Set&#x20;it&#x20;to&#x20;10&#x20;seconds&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;0.&#x20;&#039;send_timeout&#x20;10;&#039;','[{\"cis\": [\"2.4.4\"]}]'),(23013,'Ensure&#x20;server_tokens&#x20;directive&#x20;is&#x20;set&#x20;to&#x20;`off`','The&#x20;server_tokens&#x20;directive&#x20;is&#x20;responsible&#x20;for&#x20;displaying&#x20;the&#x20;NGINX&#x20;version&#x20;number&#x20;and&#x20;operating&#x20;system&#x20;version&#x20;on&#x20;error&#x20;pages&#x20;and&#x20;in&#x20;the&#x20;Server&#x20;HTTP&#x20;response&#x20;header&#x20;field.&#x20;This&#x20;information&#x20;should&#x20;not&#x20;be&#x20;displayed.','Attackers&#x20;can&#x20;conduct&#x20;reconnaissance&#x20;on&#x20;a&#x20;website&#x20;using&#x20;these&#x20;response&#x20;headers,&#x20;then&#x20;target&#x20;attacks&#x20;for&#x20;specific&#x20;known&#x20;vulnerabilities&#x20;associated&#x20;with&#x20;the&#x20;underlying&#x20;technologies.&#x20;Hiding&#x20;the&#x20;version&#x20;will&#x20;slow&#x20;down&#x20;and&#x20;deter&#x20;some&#x20;potential&#x20;attackers.','','To&#x20;disable&#x20;the&#x20;server_tokens&#x20;directive,&#x20;set&#x20;it&#x20;to&#x20;off&#x20;inside&#x20;a&#x20;server&#x20;block&#x20;in&#x20;your&#x20;nginx.conf:&#x20;&#039;server&#x20;{...server_tokens&#x20;off;...}&#039;','[{\"cis\": [\"2.5.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23014,'Ensure&#x20;default&#x20;error&#x20;and&#x20;index.html&#x20;pages&#x20;do&#x20;not&#x20;reference&#x20;NGINX','The&#x20;default&#x20;error&#x20;and&#x20;index.html&#x20;pages&#x20;for&#x20;NGINX&#x20;reveal&#x20;that&#x20;the&#x20;server&#x20;is&#x20;NGINX.&#x20;These&#x20;default&#x20;pages&#x20;should&#x20;be&#x20;removed&#x20;or&#x20;modified&#x20;so&#x20;they&#x20;do&#x20;not&#x20;advertise&#x20;the&#x20;underlying&#x20;infrastructure&#x20;of&#x20;the&#x20;server.','By&#x20;gathering&#x20;information&#x20;about&#x20;the&#x20;server,&#x20;attackers&#x20;can&#x20;target&#x20;attacks&#x20;against&#x20;its&#x20;known&#x20;vulnerabilities.&#x20;Removing&#x20;pages&#x20;that&#x20;disclose&#x20;the&#x20;server&#x20;runs&#x20;NGINX&#x20;helps&#x20;reduce&#x20;targeted&#x20;attacks&#x20;on&#x20;the&#x20;server.','','Edit&#x20;/usr/share/nginx/html/index.html&#x20;andusr/share/nginx/html/50x.html&#x20;and&#x20;remove&#x20;any&#x20;lines&#x20;that&#x20;reference&#x20;NGINX.','[{\"cis\": [\"2.5.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23015,'Ensure&#x20;hidden&#x20;file&#x20;serving&#x20;is&#x20;disabled','Disabling&#x20;hidden&#x20;files&#x20;is&#x20;a&#x20;defense-in-depth&#x20;mechanism&#x20;to&#x20;help&#x20;prevent&#x20;accidentally&#x20;exposing&#x20;sensitive&#x20;information.','Disabling&#x20;hidden&#x20;files&#x20;prevents&#x20;an&#x20;attacker&#x20;from&#x20;being&#x20;able&#x20;to&#x20;reference&#x20;a&#x20;hidden&#x20;file&#x20;that&#x20;may&#x20;be&#x20;put&#x20;in&#x20;your&#x20;location&#x20;and&#x20;have&#x20;sensitive&#x20;information,&#x20;like&#x20;.git&#x20;files.','','Edit&#x20;the&#x20;nginx.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;&#039;location&#x20;~&#x20;/.&#x20;{&#x20;deny&#x20;all;&#x20;return&#x20;404;&#x20;}&#039;','[{\"cis\": [\"2.5.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23016,'Ensure&#x20;the&#x20;NGINX&#x20;reverse&#x20;proxy&#x20;does&#x20;not&#x20;enable&#x20;information&#x20;disclosure','The&#x20;server&#x20;and&#x20;x-powered-by&#x20;header&#x20;may&#x20;specify&#x20;the&#x20;underlying&#x20;technology&#x20;used&#x20;by&#x20;an&#x20;application.&#x20;The&#x20;NGINX&#x20;reverse&#x20;proxy&#x20;may&#x20;pass&#x20;these&#x20;headers&#x20;if&#x20;not&#x20;explicitly&#x20;directed&#x20;to&#x20;remove&#x20;them.','Attackers&#x20;can&#x20;conduct&#x20;reconnaissance&#x20;on&#x20;a&#x20;website&#x20;using&#x20;these&#x20;response&#x20;headers,&#x20;then&#x20;target&#x20;attacks&#x20;for&#x20;specific&#x20;known&#x20;vulnerabilities&#x20;associated&#x20;with&#x20;the&#x20;underlying&#x20;technologies.&#x20;Removing&#x20;these&#x20;headers&#x20;will&#x20;reduce&#x20;the&#x20;likelihood&#x20;of&#x20;targeted&#x20;attacks.','','Implement&#x20;the&#x20;below&#x20;directives&#x20;as&#x20;part&#x20;of&#x20;your&#x20;location&#x20;block.&#x20;Edit&#x20;/etc/nginx/nginx.conf&#x20;and&#x20;add&#x20;the&#x20;following:&#x20;&#039;location&#x20;/docs&#x20;{....proxy_hide_header&#x20;X-Powered-By;proxy_hide_header&#x20;Server;....}&#039;','[{\"cis\": [\"2.5.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23017,'Ensure&#x20;detailed&#x20;logging&#x20;is&#x20;enabled','System&#x20;logging&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;meet&#x20;your&#x20;organizational&#x20;security&#x20;and&#x20;privacy&#x20;policies.&#x20;Enabling&#x20;detailed&#x20;logging&#x20;to&#x20;include&#x20;information&#x20;about&#x20;events,&#x20;event&#x20;sources,&#x20;timestamps,&#x20;and&#x20;users&#x20;may&#x20;assist&#x20;in&#x20;incident&#x20;response&#x20;activities.&#x20;NOTE:&#x20;Aim&#x20;to&#x20;keep&#x20;sensitive&#x20;information&#x20;out&#x20;of&#x20;logs.&#x20;For&#x20;example,&#x20;keep&#x20;sensitive&#x20;information&#x20;out&#x20;of&#x20;query&#x20;strings&#x20;and&#x20;URIs&#x20;to&#x20;avoid&#x20;this.','Performing&#x20;detailed&#x20;logging&#x20;ensures&#x20;that&#x20;incident&#x20;responders,&#x20;auditors,&#x20;and&#x20;others&#x20;are&#x20;able&#x20;to&#x20;clearly&#x20;view&#x20;the&#x20;activity&#x20;that&#x20;has&#x20;occurred&#x20;on&#x20;your&#x20;server.','','Edit&#x20;the&#x20;log&#x20;format&#x20;directive&#x20;in&#x20;/etc/nginx/nginx.conf&#x20;so&#x20;it&#x20;logs&#x20;everything&#x20;needed&#x20;to&#x20;meet&#x20;your&#x20;organizational&#x20;policies.&#x20;The&#x20;following&#x20;variables&#x20;may&#x20;be&#x20;considered&#x20;as&#x20;useful&#x20;examples&#x20;include&#x20;in&#x20;your&#x20;log_format&#x20;with&#x20;descriptive&#x20;logging.&#x20;You&#x20;should&#x20;consult&#x20;the&#x20;NGINX&#x20;documentation&#x20;and&#x20;your&#x20;organizational&#x20;policy&#x20;to&#x20;ensure&#x20;you&#x20;are&#x20;logging&#x20;sufficient&#x20;information&#x20;and&#x20;removing&#x20;sensitive&#x20;information&#x20;where&#x20;needed.&#x20;&#039;$remote_addr&#x20;-&#x20;client&#x20;address&#039;.&#x20;&#039;$remote_user&#x20;-&#x20;the&#x20;user&#x20;if&#x20;basic&#x20;authentication&#x20;is&#x20;used&#039;.&#x20;&#039;$status&#x20;-&#x20;the&#x20;HTTP&#x20;response&#x20;status&#039;.&#x20;&#039;$content_type&#x20;-&#x20;Content-Type&#x20;request&#x20;header&#x20;field&#039;.&#x20;&#039;$time_local&#x20;-&#x20;local&#x20;time&#x20;in&#x20;the&#x20;Common&#x20;Log&#x20;Format&#039;.&#x20;&#039;$request_method&#x20;-&#x20;request&#x20;method,&#x20;usually&#x20;GET&#x20;or&#x20;POST&#039;.&#x20;&#039;$request&#x20;-&#x20;full&#x20;original&#x20;request&#x20;line&#039;.&#x20;&#039;$uri&#x20;-&#x20;normalized&#x20;URI&#x20;in&#x20;request&#039;.&#x20;&#039;$server_port&#x20;-&#x20;port&#x20;of&#x20;the&#x20;server&#x20;which&#x20;accepted&#x20;a&#x20;request&#039;.&#x20;&#039;$server_name&#x20;-&#x20;name&#x20;of&#x20;the&#x20;server&#x20;which&#x20;accepted&#x20;a&#x20;request&#039;.&#x20;&#039;$http_user_agent&#x20;-&#x20;user&#x20;agent&#x20;of&#x20;the&#x20;client&#x20;requesting&#x20;access&#039;.&#x20;&#039;$http_x_forwarded_for&#x20;-&#x20;client&#x20;address&#x20;a&#x20;proxy&#x20;or&#x20;load&#x20;balancer&#x20;is&#x20;forwarding&#x20;traffic&#x20;for&#039;','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"6.3\"]}]'),(23018,'Ensure&#x20;access&#x20;logging&#x20;is&#x20;enabled','The&#x20;access_log&#x20;directive&#x20;should&#x20;be&#x20;on&#x20;for&#x20;every&#x20;core&#x20;site.&#x20;It&#x20;is&#x20;enabled&#x20;by&#x20;default.','Access&#x20;logging&#x20;allows&#x20;incident&#x20;responders&#x20;and&#x20;auditors&#x20;to&#x20;investigate&#x20;access&#x20;to&#x20;a&#x20;system&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;incident.','','Ensure&#x20;the&#x20;access_log&#x20;directive&#x20;is&#x20;configured&#x20;for&#x20;every&#x20;core&#x20;site&#x20;your&#x20;organization&#x20;requires&#x20;logging&#x20;for.&#x20;This&#x20;should&#x20;look&#x20;similar&#x20;to&#x20;the&#x20;below&#x20;configuration&#x20;snippet.&#x20;You&#x20;may&#x20;use&#x20;different&#x20;log&#x20;file&#x20;locations&#x20;based&#x20;on&#x20;your&#x20;needs.&#x20;&#039;access_log&#x20;/var/log/nginx/host.access.log&#x20;main;&#039;','[{\"cis\": [\"3.2\"]}, {\"cis_csc\": [\"6.3\"]}]'),(23019,'Ensure&#x20;error&#x20;logging&#x20;is&#x20;enabled&#x20;and&#x20;set&#x20;to&#x20;the&#x20;info&#x20;logging&#x20;level','All&#x20;errors&#x20;for&#x20;applications&#x20;should&#x20;be&#x20;logged.','Error&#x20;logging&#x20;can&#x20;be&#x20;useful&#x20;in&#x20;identifying&#x20;an&#x20;attacker&#x20;attempting&#x20;to&#x20;exploit&#x20;a&#x20;system&#x20;and&#x20;recreating&#x20;an&#x20;attacker&#039;s&#x20;steps.&#x20;Error&#x20;logging&#x20;also&#x20;helps&#x20;with&#x20;identifying&#x20;possible&#x20;issues&#x20;with&#x20;an&#x20;application.','','Edit&#x20;/etc/nginx/nginx.conf&#x20;so&#x20;the&#x20;error_log&#x20;directive&#x20;is&#x20;present&#x20;and&#x20;not&#x20;commented&#x20;out.&#x20;The&#x20;error_log&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;the&#x20;logging&#x20;location&#x20;of&#x20;your&#x20;choice.&#x20;The&#x20;configuration&#x20;should&#x20;look&#x20;similar&#x20;to&#x20;the&#x20;below:&#x20;&#039;error_log&#x20;/var/log/nginx/error.log&#x20;info;&#039;','[{\"cis\": [\"3.3\"]}, {\"cis_csc\": [\"6.3\"]}]'),(23020,'Ensure&#x20;log&#x20;files&#x20;are&#x20;rotated','Log&#x20;rotation&#x20;ensures&#x20;log&#x20;files&#x20;do&#x20;not&#x20;consume&#x20;excessive&#x20;disk&#x20;space,&#x20;potentially&#x20;causing&#x20;a&#x20;denial&#x20;of&#x20;service.','Log&#x20;files&#x20;are&#x20;important&#x20;to&#x20;track&#x20;activity&#x20;that&#x20;occurs&#x20;on&#x20;your&#x20;server,&#x20;but&#x20;they&#x20;take&#x20;up&#x20;significant&#x20;amounts&#x20;of&#x20;space.&#x20;Log&#x20;rotation&#x20;should&#x20;be&#x20;configured&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;the&#x20;logs&#x20;do&#x20;not&#x20;consume&#x20;so&#x20;much&#x20;disk&#x20;space&#x20;that&#x20;logging&#x20;becomes&#x20;unavailable.','','Follow&#x20;the&#x20;below&#x20;procedure&#x20;to&#x20;change&#x20;the&#x20;default&#x20;configuration&#x20;to&#x20;the&#x20;recommended&#x20;log&#x20;rotation&#x20;configuration.&#x20;You&#x20;may&#x20;need&#x20;to&#x20;manually&#x20;edit&#x20;or&#x20;change&#x20;the&#x20;below&#x20;command&#x20;if&#x20;the&#x20;configuration&#x20;is&#x20;not&#x20;the&#x20;default.&#x20;To&#x20;change&#x20;log&#x20;compression&#x20;from&#x20;daily&#x20;to&#x20;weekly:&#x20;&#039;sed&#x20;-i&#x20;s/daily/weekly/&#x20;/etc/logrotate.d/nginx&#039;.&#x20;To&#x20;change&#x20;log&#x20;rotation&#x20;from&#x20;every&#x20;year&#x20;to&#x20;every&#x20;13&#x20;weeks:&#x20;&#039;sed&#x20;-i&#x20;&quot;s/rotate&#x20;52/rotate&#x20;13/&quot;&#x20;/etc/logrotate.d/nginx&#039;','[{\"cis\": [\"3.4\"]}, {\"cis_csc\": [\"6.3\", \"6.4\"]}]'),(23021,'Ensure&#x20;error&#x20;logs&#x20;are&#x20;sent&#x20;to&#x20;a&#x20;remote&#x20;syslog&#x20;server','Centralized&#x20;log&#x20;management&#x20;helps&#x20;ensure&#x20;logs&#x20;are&#x20;forensically&#x20;sound&#x20;and&#x20;are&#x20;available&#x20;at&#x20;a&#x20;central&#x20;location&#x20;for&#x20;auditing&#x20;and&#x20;incident&#x20;investigation.','A&#x20;centralized&#x20;logging&#x20;solution&#x20;aggregates&#x20;logs&#x20;from&#x20;multiple&#x20;systems&#x20;to&#x20;ensure&#x20;logs&#x20;can&#x20;be&#x20;referenced&#x20;in&#x20;the&#x20;event&#x20;systems&#x20;are&#x20;thought&#x20;to&#x20;be&#x20;compromised.&#x20;Centralized&#x20;log&#x20;servers&#x20;are&#x20;also&#x20;often&#x20;used&#x20;to&#x20;correlate&#x20;logs&#x20;for&#x20;potential&#x20;patterns&#x20;of&#x20;attack.&#x20;If&#x20;a&#x20;centralized&#x20;logging&#x20;solution&#x20;is&#x20;not&#x20;used&#x20;and&#x20;systems&#x20;&#40;and&#x20;their&#x20;logs&#41;&#x20;are&#x20;believed&#x20;to&#x20;be&#x20;compromised,&#x20;then&#x20;logs&#x20;may&#x20;not&#x20;be&#x20;permitted&#x20;to&#x20;be&#x20;used&#x20;as&#x20;evidence.','','To&#x20;enable&#x20;central&#x20;logging&#x20;for&#x20;your&#x20;error&#x20;logs,&#x20;add&#x20;the&#x20;below&#x20;line&#x20;to&#x20;your&#x20;server&#x20;block&#x20;in&#x20;your&#x20;server&#x20;configuration&#x20;file.&#x20;192.168.2.1&#x20;should&#x20;be&#x20;replaced&#x20;with&#x20;the&#x20;location&#x20;of&#x20;your&#x20;central&#x20;log&#x20;server.&#x20;&#039;error_log&#x20;syslog:server=192.168.2.1&#x20;info;&#039;','[{\"cis\": [\"3.5\"]}, {\"cis_csc\": [\"6.5\"]}]'),(23022,'Ensure&#x20;access&#x20;logs&#x20;are&#x20;sent&#x20;to&#x20;a&#x20;remote&#x20;syslog&#x20;server','Centralized&#x20;log&#x20;management&#x20;helps&#x20;ensure&#x20;logs&#x20;are&#x20;forensically&#x20;sound&#x20;and&#x20;are&#x20;available&#x20;at&#x20;a&#x20;central&#x20;location&#x20;for&#x20;auditing&#x20;and&#x20;incident&#x20;investigation.','A&#x20;centralized&#x20;logging&#x20;solution&#x20;aggregates&#x20;logs&#x20;from&#x20;multiple&#x20;systems&#x20;to&#x20;ensure&#x20;logs&#x20;can&#x20;be&#x20;referenced&#x20;in&#x20;the&#x20;event&#x20;systems&#x20;are&#x20;thought&#x20;to&#x20;be&#x20;compromised.&#x20;Centralized&#x20;log&#x20;servers&#x20;are&#x20;also&#x20;often&#x20;used&#x20;to&#x20;correlate&#x20;logs&#x20;for&#x20;potential&#x20;patterns&#x20;of&#x20;attack.&#x20;If&#x20;a&#x20;centralized&#x20;logging&#x20;solution&#x20;is&#x20;not&#x20;used&#x20;and&#x20;systems&#x20;&#40;and&#x20;their&#x20;logs&#41;&#x20;are&#x20;believed&#x20;to&#x20;be&#x20;compromised,&#x20;then&#x20;logs&#x20;may&#x20;not&#x20;be&#x20;permitted&#x20;to&#x20;be&#x20;used&#x20;as&#x20;evidence.','','To&#x20;enable&#x20;central&#x20;logging&#x20;for&#x20;your&#x20;access&#x20;logs,&#x20;add&#x20;the&#x20;below&#x20;line&#x20;to&#x20;your&#x20;server&#x20;block&#x20;in&#x20;your&#x20;server&#x20;configuration&#x20;file.&#x20;192.168.2.1&#x20;should&#x20;be&#x20;replaced&#x20;with&#x20;the&#x20;location&#x20;of&#x20;your&#x20;central&#x20;log&#x20;server.&#x20;The&#x20;local&#x20;logging&#x20;facility&#x20;may&#x20;be&#x20;changed&#x20;to&#x20;any&#x20;unconfigured&#x20;facility&#x20;on&#x20;your&#x20;server.&#x20;&#039;access_log&#x20;syslog:server=192.168.2.1,facility=local7,tag=nginx,severity=info&#x20;combined;&#039;','[{\"cis\": [\"3.6\"]}, {\"cis_csc\": [\"6.5\"]}]'),(23023,'Ensure&#x20;proxies&#x20;pass&#x20;source&#x20;IP&#x20;information','The&#x20;x-forwarded-for&#x20;and&#x20;remote&#x20;address&#x20;headers&#x20;help&#x20;identify&#x20;and&#x20;separate&#x20;the&#x20;originating&#x20;client&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;user&#x20;agent&#x20;and&#x20;the&#x20;proxy&#x20;IP&#x20;address.&#x20;The&#x20;two&#x20;types&#x20;of&#x20;addresses&#x20;are&#x20;the&#x20;same,&#x20;and&#x20;one&#x20;should&#x20;always&#x20;be&#x20;present.','Being&#x20;able&#x20;to&#x20;identify&#x20;the&#x20;originating&#x20;client&#x20;IP&#x20;address&#x20;can&#x20;help&#x20;auditors&#x20;or&#x20;incident&#x20;responders&#x20;identify&#x20;where&#x20;the&#x20;corresponding&#x20;user&#x20;came&#x20;from.&#x20;This&#x20;may&#x20;be&#x20;useful&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;attack&#x20;to&#x20;analyze&#x20;if&#x20;the&#x20;IP&#x20;address&#x20;is&#x20;a&#x20;good&#x20;candidate&#x20;for&#x20;blocking.&#x20;It&#x20;may&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;correlate&#x20;an&#x20;attacker&#039;s&#x20;actions.','','To&#x20;ensure&#x20;your&#x20;proxy&#x20;or&#x20;load&#x20;balancer&#x20;will&#x20;forward&#x20;information&#x20;about&#x20;the&#x20;client&#x20;and&#x20;the&#x20;proxy&#x20;to&#x20;the&#x20;application,&#x20;you&#x20;must&#x20;set&#x20;the&#x20;below&#x20;headers&#x20;in&#x20;your&#x20;location&#x20;block.&#x20;Edit&#x20;your&#x20;location&#x20;block&#x20;so&#x20;it&#x20;shows&#x20;the&#x20;proxy_set_header&#x20;directives&#x20;for&#x20;the&#x20;client&#x20;and&#x20;the&#x20;proxy&#x20;as&#x20;shown&#x20;below.&#x20;These&#x20;headers&#x20;are&#x20;the&#x20;exact&#x20;same&#x20;and&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;have&#x20;both&#x20;present.&#x20;&#039;server&#x20;{...location&#x20;/&#x20;{proxy_pass&#x20;&#40;Insert&#x20;Application&#x20;URL&#x20;here&#41;;proxy_set_header&#x20;X-Real-IP&#x20;$remote_addr;proxy_set_header&#x20;X-Forwarded-For&#x20;$proxy_add_x_forwarded_for;}}&#039;','[{\"cis\": [\"3.7\"]}, {\"cis_csc\": [\"6.4\", \"6.7\"]}]'),(23024,'Ensure&#x20;HTTP&#x20;is&#x20;redirected&#x20;to&#x20;HTTPS','Browsers&#x20;and&#x20;clients&#x20;establish&#x20;encrypted&#x20;connections&#x20;with&#x20;servers&#x20;by&#x20;leveraging&#x20;HTTPS.&#x20;Requests&#x20;leveraging&#x20;HTTP&#x20;are&#x20;unencrypted.&#x20;Unencrypted&#x20;requests&#x20;should&#x20;be&#x20;redirected&#x20;so&#x20;they&#x20;are&#x20;encrypted.&#x20;Any&#x20;listening&#x20;HTTP&#x20;port&#x20;on&#x20;your&#x20;web&#x20;server&#x20;should&#x20;redirect&#x20;to&#x20;a&#x20;server&#x20;profile&#x20;that&#x20;uses&#x20;encryption.&#x20;The&#x20;default&#x20;HTTP&#x20;&#40;unencrypted&#41;&#x20;port&#x20;is&#x20;80.','Redirecting&#x20;user&#x20;agent&#x20;traffic&#x20;to&#x20;HTTPS&#x20;helps&#x20;to&#x20;ensure&#x20;all&#x20;user&#x20;traffic&#x20;is&#x20;encrypted.&#x20;Modern&#x20;browsers&#x20;alert&#x20;users&#x20;that&#x20;your&#x20;website&#x20;is&#x20;insecure&#x20;when&#x20;HTTPS&#x20;is&#x20;not&#x20;used.&#x20;This&#x20;can&#x20;decrease&#x20;user&#x20;trust&#x20;in&#x20;your&#x20;website&#x20;and&#x20;ultimately&#x20;result&#x20;in&#x20;decreased&#x20;use&#x20;of&#x20;your&#x20;web&#x20;services.&#x20;Redirection&#x20;from&#x20;HTTP&#x20;to&#x20;HTTPS&#x20;couples&#x20;security&#x20;with&#x20;usability;&#x20;users&#x20;are&#x20;able&#x20;to&#x20;access&#x20;your&#x20;website&#x20;even&#x20;if&#x20;they&#x20;lack&#x20;the&#x20;security&#x20;awareness&#x20;to&#x20;use&#x20;HTTPS&#x20;over&#x20;HTTP&#x20;when&#x20;requesting&#x20;your&#x20;website.','','Edit&#x20;your&#x20;web&#x20;server&#x20;or&#x20;proxy&#x20;configuration&#x20;file&#x20;to&#x20;redirect&#x20;all&#x20;unencrypted&#x20;listening&#x20;ports,&#x20;such&#x20;as&#x20;port&#x20;80,&#x20;using&#x20;a&#x20;redirection&#x20;through&#x20;the&#x20;return&#x20;directive&#x20;&#40;cisecurity.org&#x20;is&#x20;used&#x20;as&#x20;an&#x20;example&#x20;server&#x20;name&#41;.&#x20;&#039;server&#x20;{listen&#x20;80;server_name&#x20;cisecurity.org;return&#x20;301&#x20;https://$host$request_uri;}&#039;','[{\"cis\": [\"4.1.1\"]}, {\"cis_csc\": [\"5.1\", \"14.4\"]}]'),(23025,'Ensure&#x20;a&#x20;trusted&#x20;certificate&#x20;and&#x20;trust&#x20;chain&#x20;is&#x20;installed','Certificates&#x20;and&#x20;their&#x20;trust&#x20;chains&#x20;are&#x20;needed&#x20;to&#x20;establish&#x20;the&#x20;identity&#x20;of&#x20;a&#x20;web&#x20;server&#x20;as&#x20;legitimate&#x20;and&#x20;trusted.&#x20;Certificate&#x20;authorities&#x20;validate&#x20;a&#x20;web&#x20;server&#039;s&#x20;identity&#x20;and&#x20;that&#x20;you&#x20;are&#x20;the&#x20;owner&#x20;of&#x20;that&#x20;web&#x20;server&#x20;domain&#x20;name.','Without&#x20;a&#x20;certificate&#x20;and&#x20;full&#x20;trust&#x20;chain&#x20;installed&#x20;on&#x20;your&#x20;web&#x20;server,&#x20;modern&#x20;browsers&#x20;will&#x20;flag&#x20;your&#x20;web&#x20;server&#x20;as&#x20;untrusted.','','Use&#x20;the&#x20;following&#x20;procedure&#x20;to&#x20;install&#x20;a&#x20;certificate&#x20;and&#x20;its&#x20;signing&#x20;certificate&#x20;chain&#x20;onto&#x20;your&#x20;web&#x20;server,&#x20;load&#x20;balancer,&#x20;or&#x20;proxy.&#x20;Step&#x20;1:&#x20;Create&#x20;the&#x20;server&#039;s&#x20;private&#x20;key&#x20;and&#x20;a&#x20;certificate&#x20;signing&#x20;request.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;create&#x20;your&#x20;certificate&#039;s&#x20;private&#x20;key&#x20;with&#x20;2048-bit&#x20;key&#x20;strength.&#x20;Optionally,&#x20;this&#x20;parameter&#x20;may&#x20;be&#x20;changed&#x20;to&#x20;4096&#x20;for&#x20;greater&#x20;security.&#x20;It&#x20;will&#x20;also&#x20;output&#x20;your&#x20;certificate&#x20;signing&#x20;request&#x20;to&#x20;the&#x20;nginx.csr&#x20;file&#x20;in&#x20;your&#x20;present&#x20;working&#x20;directory.&#x20;Step&#x20;2:&#x20;Obtain&#x20;a&#x20;signed&#x20;certificate&#x20;from&#x20;your&#x20;certificate&#x20;authority.&#x20;Provide&#x20;your&#x20;chosen&#x20;certificate&#x20;authority&#x20;with&#x20;your&#x20;certificate&#x20;signing&#x20;request.&#x20;Follow&#x20;your&#x20;certificate&#x20;authority&#039;s&#x20;signing&#x20;procedures&#x20;in&#x20;order&#x20;to&#x20;obtain&#x20;a&#x20;certificate&#x20;and&#x20;the&#x20;certificate&#039;s&#x20;trust&#x20;chain.&#x20;A&#x20;full&#x20;trust&#x20;chain&#x20;is&#x20;typically&#x20;delivered&#x20;in&#x20;.pem&#x20;format.&#x20;Step&#x20;3:&#x20;Install&#x20;certificate&#x20;and&#x20;signing&#x20;certificate&#x20;chain&#x20;on&#x20;your&#x20;web&#x20;server.&#x20;Place&#x20;the&#x20;.pem&#x20;file&#x20;from&#x20;your&#x20;certificate&#x20;authority&#x20;into&#x20;the&#x20;directory&#x20;of&#x20;your&#x20;choice.&#x20;Locate&#x20;your&#x20;created&#x20;key&#x20;file&#x20;from&#x20;the&#x20;command&#x20;you&#x20;used&#x20;to&#x20;generate&#x20;your&#x20;certificate&#x20;signing&#x20;request.&#x20;Open&#x20;your&#x20;website&#x20;configuration&#x20;file&#x20;and&#x20;edit&#x20;your&#x20;encrypted&#x20;listener&#x20;to&#x20;leverage&#x20;the&#x20;ssl_certificate&#x20;and&#x20;ssl_certificate_key&#x20;directives&#x20;for&#x20;a&#x20;web&#x20;server&#x20;as&#x20;shown&#x20;below.&#x20;You&#x20;should&#x20;also&#x20;inspect&#x20;include&#x20;files&#x20;inside&#x20;your&#x20;nginx.conf.&#x20;This&#x20;should&#x20;be&#x20;part&#x20;of&#x20;the&#x20;server&#x20;block.&#x20;After&#x20;editing&#x20;this&#x20;file,&#x20;you&#x20;must&#x20;recycle&#x20;nginx&#x20;services&#x20;for&#x20;these&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;This&#x20;can&#x20;be&#x20;done&#x20;with&#x20;the&#x20;following&#x20;command:&#x20;&#039;sudo&#x20;service&#x20;nginx&#x20;restart&#039;','[{\"cis\": [\"4.1.2\"]}, {\"cis_csc\": [\"14.2\"]}]'),(23026,'Ensure&#x20;private&#x20;key&#x20;permissions&#x20;are&#x20;restricted','The&#x20;server&#039;s&#x20;private&#x20;key&#x20;should&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;access&#x20;by&#x20;limiting&#x20;access&#x20;based&#x20;on&#x20;the&#x20;principle&#x20;of&#x20;least&#x20;privilege.','A&#x20;server&#039;s&#x20;private&#x20;key&#x20;file&#x20;should&#x20;be&#x20;restricted&#x20;to&#x20;400&#x20;permissions.&#x20;This&#x20;ensures&#x20;only&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;private&#x20;key&#x20;file&#x20;can&#x20;access&#x20;it.&#x20;This&#x20;is&#x20;the&#x20;minimum&#x20;necessary&#x20;permissions&#x20;for&#x20;the&#x20;server&#x20;to&#x20;operate.&#x20;If&#x20;the&#x20;private&#x20;key&#x20;file&#x20;is&#x20;not&#x20;protected,&#x20;an&#x20;unauthorized&#x20;user&#x20;with&#x20;access&#x20;to&#x20;the&#x20;server&#x20;may&#x20;be&#x20;able&#x20;to&#x20;find&#x20;the&#x20;private&#x20;key&#x20;file&#x20;and&#x20;use&#x20;it&#x20;to&#x20;decrypt&#x20;traffic&#x20;sent&#x20;to&#x20;your&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;on&#x20;your&#x20;key&#x20;file&#x20;to&#x20;ensure&#x20;its&#x20;permissions&#x20;are&#x20;set&#x20;to&#x20;400.&#x20;The&#x20;file&#x20;name&#x20;/etc/nginx/nginx.key&#x20;should&#x20;be&#x20;replaced&#x20;with&#x20;the&#x20;location&#x20;of&#x20;your&#x20;key&#x20;file.&#x20;&#039;sudo&#x20;chmod&#x20;400&#x20;/etc/nginx/nginx.key&#039;','[{\"cis\": [\"4.1.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23027,'Ensure&#x20;only&#x20;modern&#x20;TLS&#x20;protocols&#x20;are&#x20;used','Only&#x20;modern&#x20;TLS&#x20;protocols&#x20;should&#x20;be&#x20;enabled&#x20;in&#x20;NGINX&#x20;for&#x20;all&#x20;client&#x20;connections&#x20;and&#x20;upstream&#x20;connections.&#x20;Removing&#x20;legacy&#x20;TLS&#x20;and&#x20;SSL&#x20;protocols&#x20;&#40;SSL&#x20;3.0,&#x20;TLS&#x20;1.0&#x20;and&#x20;1.1&#41;,&#x20;and&#x20;enabling&#x20;emerging&#x20;and&#x20;stable&#x20;TLS&#x20;protocols&#x20;&#40;TLS&#x20;1.2&#41;,&#x20;ensures&#x20;users&#x20;are&#x20;able&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;strong&#x20;security&#x20;capabilities&#x20;and&#x20;protects&#x20;them&#x20;from&#x20;insecure&#x20;legacy&#x20;protocols.','Why&#x20;disable&#x20;SSL&#x20;3.0:&#x20;The&#x20;POODLE&#x20;Vulnerability&#x20;allowed&#x20;attackers&#x20;to&#x20;exploit&#x20;SSL&#x20;3.0&#x20;to&#x20;obtain&#x20;cleartext&#x20;information&#x20;by&#x20;exploiting&#x20;weaknesses&#x20;in&#x20;CBC&#x20;in&#x20;2014.&#x20;SSL&#x20;3.0&#x20;is&#x20;also&#x20;no&#x20;longer&#x20;FIPS&#x20;140-2&#x20;compliant.&#x20;Why&#x20;disable&#x20;TLS&#x20;1.0:&#x20;TLS&#x20;1.0&#x20;was&#x20;deprecated&#x20;from&#x20;use&#x20;when&#x20;PCI&#x20;DSS&#x20;Compliance&#x20;mandated&#x20;that&#x20;it&#x20;not&#x20;be&#x20;used&#x20;for&#x20;any&#x20;applications&#x20;processing&#x20;credit&#x20;card&#x20;numbers&#x20;in&#x20;June&#x20;2018.&#x20;TLS&#x20;1.0&#x20;does&#x20;not&#x20;make&#x20;use&#x20;of&#x20;modern&#x20;protections,&#x20;and&#x20;almost&#x20;all&#x20;user&#x20;agents&#x20;that&#x20;do&#x20;not&#x20;support&#x20;TLS&#x20;1.2&#x20;or&#x20;higher&#x20;are&#x20;no&#x20;longer&#x20;supported&#x20;by&#x20;their&#x20;vendor.&#x20;Why&#x20;disable&#x20;TLS&#x20;1.1:&#x20;Because&#x20;of&#x20;the&#x20;increased&#x20;security&#x20;associated&#x20;with&#x20;higher&#x20;versions&#x20;of&#x20;TLS,&#x20;TLS&#x20;1.0&#x20;should&#x20;be&#x20;disabled.&#x20;Modern&#x20;browsers&#x20;will&#x20;begin&#x20;to&#x20;flag&#x20;TLS&#x20;1.1&#x20;as&#x20;deprecated&#x20;in&#x20;early&#x20;2019.&#x20;Why&#x20;enable&#x20;TLS&#x20;1.2:&#x20;TLS&#x20;1.2&#x20;takes&#x20;advantage&#x20;of&#x20;several&#x20;security&#x20;features&#x20;including&#x20;modern&#x20;cipher&#x20;suites,&#x20;perfect&#x20;forward&#x20;security,&#x20;and&#x20;authenticated&#x20;encryption.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;change&#x20;your&#x20;ssl_protocols&#x20;if&#x20;they&#x20;are&#x20;already&#x20;configured.&#x20;This&#x20;remediation&#x20;advice&#x20;assumes&#x20;your&#x20;nginx&#x20;configuration&#x20;file&#x20;does&#x20;not&#x20;include&#x20;server&#x20;configuration&#x20;outside&#x20;of&#x20;/etc/nginx/nginx.conf.&#x20;You&#x20;may&#x20;have&#x20;to&#x20;also&#x20;inspect&#x20;the&#x20;include&#x20;files&#x20;in&#x20;your&#x20;nginx.conf&#x20;to&#x20;ensure&#x20;this&#x20;is&#x20;properly&#x20;implemented.&#x20;Web&#x20;Server:&#x20;&#039;sed&#x20;-i&#x20;&quot;s/ssl_protocols[^;]*;/ssl_protocols&#x20;TLSv1.2;/&quot;&#x20;/etc/nginx/nginx.conf&#039;.&#x20;Proxy.&#x20;&#039;sed&#x20;-i&#x20;&quot;s/proxy_ssl_protocols[^;]*;/proxy_ssl_protocols&#x20;TLSv1.2;/&quot;&#x20;/etc/nginx/nginx.conf&#039;.&#x20;If&#x20;your&#x20;ssl_protocols&#x20;are&#x20;not&#x20;already&#x20;configured,&#x20;this&#x20;can&#x20;be&#x20;accomplished&#x20;manually&#x20;by&#x20;opening&#x20;your&#x20;web&#x20;server&#x20;or&#x20;proxy&#x20;server&#x20;configuration&#x20;file&#x20;and&#x20;manually&#x20;adding&#x20;the&#x20;directives.&#x20;Web&#x20;Server.&#x20;&#039;server&#x20;{ssl_protocols&#x20;TLSv1.2;}&#039;.&#x20;Proxy.&#x20;&#039;location&#x20;/&#x20;{proxy_pass&#x20;cisecurity.org;proxy_ssl_protocols&#x20;TLSv1.2;}&#039;','[{\"cis\": [\"4.1.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23028,'Disable&#x20;weak&#x20;ciphers','The&#x20;ssl_ciphers&#x20;directive&#x20;should&#x20;be&#x20;used&#x20;to&#x20;configure&#x20;the&#x20;available&#x20;ciphers&#x20;on&#x20;your&#x20;web&#x20;server,&#x20;and&#x20;the&#x20;proxy_ssl_ciphers&#x20;directive&#x20;should&#x20;be&#x20;used&#x20;to&#x20;configure&#x20;the&#x20;available&#x20;ciphers&#x20;for&#x20;your&#x20;proxy.&#x20;Weak&#x20;ciphers&#x20;should&#x20;be&#x20;disabled&#x20;based&#x20;on&#x20;your&#x20;company&#039;s&#x20;policy&#x20;or&#x20;an&#x20;industry&#x20;best&#x20;practice&#x20;compliance&#x20;profile.&#x20;The&#x20;ssl_prefer_server_ciphers&#x20;should&#x20;be&#x20;used&#x20;to&#x20;ensure&#x20;the&#x20;user&#x20;agent&#x20;respects&#x20;the&#x20;server&#039;s&#x20;preferred&#x20;cipher&#x20;order&#x20;and&#x20;does&#x20;not&#x20;set&#x20;its&#x20;own.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;a&#x20;proxy&#x20;or&#x20;load&#x20;balancer,&#x20;you&#x20;should&#x20;use&#x20;the&#x20;proxy_ssl_ciphers&#x20;directive&#x20;to&#x20;ensure&#x20;your&#x20;upstream&#x20;connections&#x20;are&#x20;negotiated&#x20;using&#x20;secure&#x20;ciphers.','The&#x20;use&#x20;of&#x20;strong&#x20;ciphers&#x20;is&#x20;critical&#x20;to&#x20;maintaining&#x20;strong&#x20;encryption&#x20;on&#x20;your&#x20;web&#x20;server,&#x20;load&#x20;balancer,&#x20;or&#x20;proxy.&#x20;Weak&#x20;ciphers&#x20;may&#x20;compromise&#x20;the&#x20;security&#x20;of&#x20;your&#x20;site&#x20;or&#x20;your&#x20;users&#x20;by&#x20;allowing&#x20;legacy&#x20;user&#x20;agents&#x20;to&#x20;connect&#x20;to&#x20;your&#x20;site&#x20;in&#x20;a&#x20;vulnerable&#x20;way.&#x20;You&#x20;may&#x20;also&#x20;meet&#x20;compliance&#x20;concerns&#x20;by&#x20;ensuring&#x20;that&#x20;your&#x20;upstream&#x20;connections&#x20;meet&#x20;the&#x20;same&#x20;level&#x20;of&#x20;security&#x20;if&#x20;using&#x20;a&#x20;proxy&#x20;or&#x20;load&#x20;balancer.&#x20;The&#x20;server&#x20;should&#x20;enforce&#x20;the&#x20;cipher&#x20;preference&#x20;on&#x20;the&#x20;server&#x20;side&#x20;to&#x20;protect&#x20;users&#x20;from&#x20;malicious&#x20;actors&#x20;on&#x20;the&#x20;client&#x20;side.','','The&#x20;following&#x20;procedures&#x20;may&#x20;be&#x20;used&#x20;to&#x20;implement&#x20;industry&#x20;standard&#x20;cipher&#x20;profiles&#x20;if&#x20;you&#x20;have&#x20;an&#x20;existing&#x20;profile&#x20;defined.&#x20;These&#x20;profiles&#x20;may&#x20;be&#x20;modified&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;defined&#x20;in&#x20;your&#x20;company&#039;s&#x20;policy.&#x20;This&#x20;procedure&#x20;assumes&#x20;that&#x20;all&#x20;server&#x20;blocks&#x20;will&#x20;be&#x20;in&#x20;/etc/nginx/nginx.conf&#x20;and&#x20;not&#x20;inside&#x20;any&#x20;included&#x20;files&#x20;in&#x20;the&#x20;configuration.&#x20;Set&#x20;the&#x20;ssl_cipher&#x20;directive&#x20;as&#x20;part&#x20;of&#x20;your&#x20;server&#x20;block,&#x20;and&#x20;set&#x20;the&#x20;proxy_ssl_ciphers&#x20;directive&#x20;as&#x20;part&#x20;of&#x20;the&#x20;location&#x20;block&#x20;for&#x20;your&#x20;upstream&#x20;server.','[{\"cis\": [\"4.1.5\"]}, {\"cis_csc\": [\"5.1\", \"14.4\"]}]'),(23029,'Ensure&#x20;custom&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;used','Custom&#x20;Diffie-Hellman&#x20;&#40;DH&#41;&#x20;key&#x20;exchange&#x20;parameters&#x20;should&#x20;be&#x20;used.&#x20;DH&#x20;Ephemeral&#x20;&#40;DHE&#41;&#x20;parameters&#x20;with&#x20;at&#x20;least&#x20;2048&#x20;bits&#x20;should&#x20;be&#x20;generated.','Backward-compatible&#x20;Perfect&#x20;Forward&#x20;Secrecy&#x20;&#40;PFS&#41;&#x20;ciphers&#x20;&#40;e.g.&#x20;DHE-RSA-AES128-SHA256&#41;&#x20;should&#x20;use&#x20;strong&#x20;and&#x20;unique&#x20;parameters.&#x20;By&#x20;default,&#x20;NGINX&#x20;will&#x20;generate&#x20;1024-bit&#x20;RSA&#x20;keys&#x20;for&#x20;PFS&#x20;ciphers;&#x20;stronger&#x20;alternatives&#x20;should&#x20;be&#x20;used&#x20;instead&#x20;to&#x20;provide&#x20;betterprotection&#x20;for&#x20;data&#x20;protected&#x20;by&#x20;encryption.','','Generate&#x20;strong&#x20;DHE&#x20;&#40;Ephemeral&#x20;Diffie-Hellman&#41;&#x20;parameters&#x20;using&#x20;the&#x20;following&#x20;commands:&#x20;&#039;mkdir&#x20;/etc/nginx/ssl&#039;.&#x20;&#039;openssl&#x20;dhparam&#x20;-out&#x20;/etc/nginx/ssl/dhparam.pem&#x20;2048&#039;.&#x20;&#039;chmod&#x20;400&#x20;/etc/nginx/ssl/dhparam.pem&#039;.&#x20;Alter&#x20;the&#x20;server&#x20;configuration&#x20;to&#x20;use&#x20;the&#x20;new&#x20;parameters:&#x20;&#039;http&#x20;{server&#x20;{ssl_dhparam&#x20;/etc/nginx/ssl/dhparam.pem;}}','[{\"cis\": [\"4.1.6\"]}, {\"cis_csc\": [\"14.2\"]}]'),(23030,'Ensure&#x20;Online&#x20;Certificate&#x20;Status&#x20;Protocol&#x20;&#40;OCSP&#41;&#x20;stapling&#x20;is&#x20;enabled','OCSP&#x20;allows&#x20;a&#x20;user&#039;s&#x20;browser&#x20;or&#x20;another&#x20;user&#x20;agent&#x20;to&#x20;verify&#x20;the&#x20;certificate&#x20;it&#x20;is&#x20;seeing&#x20;is&#x20;not&#x20;revoked.&#x20;OCSP&#x20;stapling&#x20;ensures&#x20;your&#x20;server&#x20;presents&#x20;this&#x20;information&#x20;to&#x20;the&#x20;user&#039;s&#x20;browser&#x20;in&#x20;a&#x20;way&#x20;that&#x20;best&#x20;meets&#x20;the&#x20;performance&#x20;and&#x20;security&#x20;needs&#x20;of&#x20;your&#x20;website.&#x20;It&#x20;polls&#x20;the&#x20;Certificate&#x20;Authority&#039;s&#x20;&#40;CA&#41;&#x20;OCSP&#x20;server&#x20;at&#x20;regular&#x20;intervals&#x20;to&#x20;ensure&#x20;it&#x20;is&#x20;continuously&#x20;kept&#x20;up&#x20;to&#x20;date.&#x20;OCSP&#x20;stapling&#x20;helps&#x20;improve&#x20;performance&#x20;and&#x20;security,&#x20;so&#x20;it&#x20;should&#x20;be&#x20;enabled.','OCSP&#x20;stapling&#x20;protects&#x20;your&#x20;users&#x20;from&#x20;accessing&#x20;a&#x20;website&#x20;where&#x20;a&#x20;private&#x20;key&#x20;is&#x20;believed&#x20;to&#x20;be&#x20;compromised.&#x20;If&#x20;a&#x20;private&#x20;key&#x20;is&#x20;compromised,&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;able&#x20;to&#x20;obtain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;encrypted&#x20;data&#x20;transmitted&#x20;by&#x20;a&#x20;user.&#x20;Note:&#x20;OCSP&#x20;stapling,&#x20;while&#x20;a&#x20;step&#x20;forward&#x20;from&#x20;the&#x20;older&#x20;certificate&#x20;revocation&#x20;list&#x20;model,&#x20;does&#x20;share&#x20;similar&#x20;risks.&#x20;Between&#x20;the&#x20;time&#x20;a&#x20;certificate&#x20;is&#x20;revoked&#x20;and&#x20;the&#x20;point&#x20;where&#x20;a&#x20;new&#x20;signed&#x20;OCSP&#x20;profile&#x20;is&#x20;requested,&#x20;if&#x20;a&#x20;server&#039;s&#x20;certificate&#x20;has&#x20;been&#x20;revoked&#x20;a&#x20;user&#x20;agent&#x20;may&#x20;not&#x20;be&#x20;informed.','','Follow&#x20;this&#x20;procedure&#x20;to&#x20;enable&#x20;OCSP&#x20;validation.&#x20;Step&#x20;1:&#x20;Ensure&#x20;your&#x20;NGINX&#x20;server&#x20;has&#x20;access&#x20;to&#x20;your&#x20;CA&#039;s&#x20;OCSP&#x20;server.&#x20;Your&#x20;CA&#039;s&#x20;OCSP&#x20;server&#x20;may&#x20;be&#x20;found&#x20;on&#x20;your&#x20;CA&#039;s&#x20;website&#x20;and&#x20;will&#x20;vary&#x20;depending&#x20;on&#x20;your&#x20;CA&#x20;vendor.&#x20;Issue&#x20;the&#x20;following&#x20;command&#x20;in&#x20;order&#x20;to&#x20;check&#x20;your&#x20;connectivity&#x20;to&#x20;their&#x20;site.&#x20;&#039;curl&#x20;-I&#x20;&quot;insert&#x20;certificate&#x20;authority&#x20;ocsp&#x20;server&#x20;here&quot;&#039;.&#x20;If&#x20;you&#x20;get&#x20;a&#x20;200&#x20;code&#x20;response,&#x20;your&#x20;server&#x20;has&#x20;access.&#x20;Step&#x20;2.&#x20;Enable&#x20;OCSP&#x20;on&#x20;nginx.&#x20;Implement&#x20;the&#x20;ssl_stapling&#x20;and&#x20;ssl_stapling_verify&#x20;directives.&#x20;The&#x20;directive&#x20;ssl_stapling&#x20;enables&#x20;OCSP&#x20;stapling,&#x20;and&#x20;the&#x20;directive&#x20;ssl_stapling_verify&#x20;enables&#x20;verification&#x20;of&#x20;the&#x20;OCSP&#x20;responses&#x20;on&#x20;nginx.&#x20;&#039;server&#x20;{ssl_stapling&#x20;on;ssl_stapling_verify&#x20;on;}&#039;','[{\"cis\": [\"4.1.7\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23031,'Ensure&#x20;HTTP&#x20;Strict&#x20;Transport&#x20;Security&#x20;&#40;HSTS&#41;&#x20;is&#x20;enabled','HTTP&#x20;Strict&#x20;Transport&#x20;Security&#x20;&#40;HSTS&#41;&#x20;headers&#x20;instruct&#x20;a&#x20;user&#x20;agent&#x20;on&#x20;how&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;web&#x20;server.&#x20;HSTS&#x20;headers&#x20;ensure&#x20;the&#x20;strict&#x20;transport&#x20;security&#x20;policies&#x20;built&#x20;into&#x20;browsers&#x20;and&#x20;other&#x20;user&#x20;agents&#x20;are&#x20;informed&#x20;only&#x20;to&#x20;communicate&#x20;over&#x20;HTTPS.&#x20;HSTS&#x20;with&#x20;long&#x20;validity&#x20;periods&#x20;should&#x20;be&#x20;used&#x20;to&#x20;most&#x20;effectively&#x20;secure&#x20;your&#x20;user&#x20;population.&#x20;Strict-Transport-Security&#x20;should&#x20;have&#x20;a&#x20;long&#x20;max-age,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;at&#x20;least&#x20;six&#x20;months&#x20;in&#x20;length.&#x20;This&#x20;ensures&#x20;the&#x20;browser&#x20;remembers&#x20;your&#x20;website&#x20;should&#x20;only&#x20;be&#x20;accessible&#x20;via&#x20;HTTPS&#x20;for&#x20;this&#x20;amount&#x20;of&#x20;time.','HSTS&#x20;headers&#x20;help&#x20;protect&#x20;a&#x20;server&#039;s&#x20;users&#x20;from&#x20;accessing&#x20;the&#x20;server&#x20;over&#x20;unencrypted&#x20;protocols.&#x20;This&#x20;header&#x20;helps&#x20;to&#x20;prevent&#x20;HTTP&#x20;downgrade&#x20;attacks.','','Ensure&#x20;the&#x20;below&#x20;snippet&#x20;of&#x20;code&#x20;can&#x20;be&#x20;found&#x20;in&#x20;your&#x20;server&#x20;configuration&#x20;for&#x20;your&#x20;proxy&#x20;or&#x20;web&#x20;server.&#x20;This&#x20;will&#x20;ensure&#x20;the&#x20;HSTS&#x20;header&#x20;is&#x20;set&#x20;with&#x20;a&#x20;validity&#x20;period&#x20;of&#x20;six&#x20;months,&#x20;or&#x20;15768000&#x20;seconds.&#x20;&#039;server&#x20;{add_header&#x20;Strict-Transport-Security&#x20;&quot;max-age=15768000;&quot;;}&#039;','[{\"cis\": [\"4.1.8\"]}, {\"cis_csc\": [\"5.1\", \"14.4\"]}]'),(23032,'Ensure&#x20;HTTP&#x20;Public&#x20;Key&#x20;Pinning&#x20;is&#x20;enabled','HTTP&#x20;Public&#x20;Key&#x20;Pinning,&#x20;also&#x20;known&#x20;as&#x20;certificate&#x20;pinning,&#x20;allows&#x20;a&#x20;site&#x20;to&#x20;specify&#x20;exactly&#x20;which&#x20;certificates&#x20;the&#x20;browser&#x20;or&#x20;another&#x20;user&#x20;agent&#x20;should&#x20;accept.&#x20;HTTP&#x20;Public&#x20;Key&#x20;Pinning&#x20;allows&#x20;for&#x20;the&#x20;certificate&#x20;rotation&#x20;to&#x20;be&#x20;scheduled&#x20;using&#x20;backup&#x20;fingerprints&#x20;to&#x20;ensure&#x20;that&#x20;user&#x20;agent&#x20;has&#x20;both&#x20;certificates&#x20;stored.&#x20;HTTP&#x20;Public&#x20;Key&#x20;Pinning&#x20;should&#x20;be&#x20;enabled.','HTTP&#x20;Public&#x20;Key&#x20;Pinning&#x20;assists&#x20;in&#x20;preventing&#x20;a&#x20;user&#x20;agent&#x20;from&#x20;falling&#x20;victim&#x20;to&#x20;a&#x20;forged&#x20;certificate,&#x20;such&#x20;as&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks.','','Find&#x20;the&#x20;fingerprint&#x20;of&#x20;your&#x20;certificate&#x20;by&#x20;referencing&#x20;the&#x20;fingerprint&#x20;section&#x20;of&#x20;your&#x20;certificate&#x20;details.&#x20;Take&#x20;down&#x20;the&#x20;SHA256&#x20;fingerprint&#x20;in&#x20;this&#x20;section&#x20;as&#x20;well&#x20;as&#x20;that&#x20;of&#x20;a&#x20;backup&#x20;certificate&#x20;or&#x20;the&#x20;next&#x20;scheduled&#x20;certificate&#x20;for&#x20;the&#x20;website.&#x20;Insert&#x20;your&#x20;SHA256&#x20;fingerprint&#x20;along&#x20;with&#x20;the&#x20;below&#x20;header&#x20;to&#x20;your&#x20;server&#x20;configuration:&#x20;&#039;add_header&#x20;Public-Key-Pins&#x20;&#039;pinsha256=&quot;base64+primary==InsertPrimaryCertificateSHA256FingerPrintHere&quot;;&#x20;pinsha256=&quot;base64+backup==InsertBackupCertificateSHA256FingerPrintHere&quot;;&#x20;maxage=5184000;&#039;','[{\"cis\": [\"4.1.9\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23033,'Ensure&#x20;upstream&#x20;server&#x20;traffic&#x20;is&#x20;authenticated&#x20;with&#x20;a&#x20;client&#x20;certificate','Client&#x20;certificate&#x20;validation&#x20;allows&#x20;the&#x20;upstream&#x20;server&#x20;to&#x20;authenticate&#x20;the&#x20;identity&#x20;of&#x20;the&#x20;client&#x20;connecting&#x20;to&#x20;it.&#x20;This&#x20;assists&#x20;in&#x20;the&#x20;establishment&#x20;of&#x20;mutual&#x20;authentication&#x20;between&#x20;the&#x20;client&#x20;and&#x20;the&#x20;server.','Using&#x20;client&#x20;certificate&#x20;validation&#x20;allows&#x20;you&#x20;to&#x20;establish&#x20;a&#x20;trusted&#x20;proxy&#x20;server.','','In&#x20;order&#x20;to&#x20;implement&#x20;this&#x20;recommendation,&#x20;you&#x20;must&#x20;create&#x20;a&#x20;client&#x20;certificate&#x20;to&#x20;be&#x20;authenticated&#x20;against&#x20;and&#x20;have&#x20;it&#x20;signed.&#x20;Once&#x20;you&#x20;have&#x20;a&#x20;signed&#x20;certificate,&#x20;place&#x20;the&#x20;certificate&#x20;in&#x20;a&#x20;location&#x20;of&#x20;your&#x20;choice.&#x20;In&#x20;the&#x20;below&#x20;example,&#x20;we&#x20;use&#x20;/etc/nginx/ssl/cert.pem.&#x20;Implement&#x20;the&#x20;configuration&#x20;as&#x20;part&#x20;of&#x20;the&#x20;location&#x20;block:&#x20;&#039;proxy_ssl_certificate&#x20;/etc/nginx/ssl/nginx.pem;&#x20;proxy_ssl_certificate_key&#x20;/etc/nginx/ssl/nginx.key;&#039;','[{\"cis\": [\"4.1.10\"]}, {\"cis_csc\": [\"1.6\"]}]'),(23034,'Ensure&#x20;the&#x20;upstream&#x20;traffic&#x20;server&#x20;certificate&#x20;is&#x20;trusted','The&#x20;NGINX&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;validate&#x20;the&#x20;identity&#x20;of&#x20;the&#x20;upstream&#x20;server&#x20;it&#x20;is&#x20;sending&#x20;information&#x20;to.','Configuring&#x20;NGINX&#x20;to&#x20;validate&#x20;the&#x20;identity&#x20;of&#x20;the&#x20;upstream&#x20;server&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attack&#x20;occurring&#x20;against&#x20;your&#x20;server.','','Obtain&#x20;the&#x20;full&#x20;certificate&#x20;chain&#x20;of&#x20;the&#x20;upstream&#x20;server&#x20;in&#x20;.pem&#x20;format.&#x20;Then&#x20;reference&#x20;that&#x20;file&#x20;in&#x20;the&#x20;location&#x20;block&#x20;as&#x20;part&#x20;of&#x20;the&#x20;proxy_ssl_trusted_certificate&#x20;directive.&#x20;Implement&#x20;the&#x20;proxy_ssl_trusted_certificate&#x20;and&#x20;proxy_ssl_verify&#x20;directives&#x20;as&#x20;shown&#x20;below&#x20;as&#x20;part&#x20;of&#x20;the&#x20;location&#x20;block&#x20;you&#x20;are&#x20;using&#x20;to&#x20;send&#x20;traffic&#x20;to&#x20;your&#x20;upstream&#x20;server.&#x20;&#039;proxy_ssl_trusted_certificate&#x20;/etc/nginx/trusted_ca_cert.crt;&#x20;proxy_ssl_verify&#x20;on;&#039;','[{\"cis\": [\"4.1.11\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23035,'Ensure&#x20;session&#x20;resumption&#x20;is&#x20;disabled&#x20;to&#x20;enable&#x20;perfect&#x20;forward&#x20;security','Session&#x20;resumption&#x20;for&#x20;HTTPS&#x20;sessions&#x20;should&#x20;be&#x20;disabled&#x20;so&#x20;perfect&#x20;forward&#x20;secrecy&#x20;can&#x20;be&#x20;achieved.','Perfect&#x20;forward&#x20;secrecy&#x20;is&#x20;an&#x20;encryption&#x20;mechanism&#x20;that&#x20;enables&#x20;past&#x20;session&#x20;keys&#x20;to&#x20;not&#x20;be&#x20;compromised&#x20;even&#x20;if&#x20;the&#x20;server&#039;s&#x20;private&#x20;key&#x20;is&#x20;compromised.&#x20;If&#x20;an&#x20;attacker&#x20;recorded&#x20;all&#x20;traffic&#x20;to&#x20;a&#x20;server&#x20;and&#x20;stored&#x20;it&#x20;and&#x20;then&#x20;obtained&#x20;the&#x20;private&#x20;key&#x20;without&#x20;perfect&#x20;forward&#x20;secrecy,&#x20;all&#x20;communications&#x20;would&#x20;be&#x20;compromised.&#x20;With&#x20;perfect&#x20;forward&#x20;secrecy,&#x20;session&#x20;keys&#x20;are&#x20;generated&#x20;using&#x20;Diffie-Hellman&#x20;for&#x20;every&#x20;session&#x20;a&#x20;user&#x20;initiates,&#x20;which&#x20;isolates&#x20;session&#x20;compromise&#x20;to&#x20;only&#x20;that&#x20;communication&#x20;session.&#x20;Allowing&#x20;session&#x20;resumption&#x20;breaks&#x20;perfect&#x20;forward&#x20;secrecy;&#x20;this&#x20;expands&#x20;the&#x20;surface&#x20;area&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;compromise&#x20;past&#x20;sessions&#x20;and&#x20;communications&#x20;with&#x20;a&#x20;server&#x20;if&#x20;they&#x20;are&#x20;able&#x20;to&#x20;compromise&#x20;the&#x20;session.','','Turn&#x20;off&#x20;the&#x20;ssl_session_tickets&#x20;directive&#x20;as&#x20;part&#x20;of&#x20;any&#x20;server&#x20;block&#x20;in&#x20;your&#x20;nginx&#x20;configuration.&#x20;&#039;ssl_session_tickets&#x20;off;&#039;','[{\"cis\": [\"4.1.13\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23036,'Ensure&#x20;HTTP/2.0&#x20;is&#x20;used','HTTP/2.0&#x20;is&#x20;an&#x20;optimized&#x20;and&#x20;more&#x20;secure&#x20;version&#x20;of&#x20;the&#x20;HTTP&#x20;protocol.&#x20;It&#x20;should&#x20;be&#x20;enabled&#x20;so&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;it.&#x20;Note:&#x20;Legacy&#x20;user&#x20;agents&#x20;may&#x20;not&#x20;be&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#x20;using&#x20;HTTP/2.0.','HTTP/2.0&#x20;introduces&#x20;both&#x20;performance&#x20;benefits&#x20;through&#x20;full&#x20;multiplexing&#x20;and&#x20;several&#x20;security&#x20;benefits.&#x20;HTTP/2.0&#x20;has&#x20;improved&#x20;cipher&#x20;suite&#x20;requirements&#x20;and&#x20;blacklists.&#x20;It&#x20;also&#x20;disables&#x20;session&#x20;renegotiation&#x20;and&#x20;TLS&#x20;compression.&#x20;This&#x20;helps&#x20;protect&#x20;against&#x20;vulnerabilities&#x20;like&#x20;CRIME&#x20;and&#x20;ensures&#x20;we&#x20;have&#x20;stronger&#x20;encryption.','','Open&#x20;the&#x20;nginx&#x20;server&#x20;configuration&#x20;file&#x20;and&#x20;configure&#x20;all&#x20;listening&#x20;ports&#x20;with&#x20;http2,&#x20;similar&#x20;to&#x20;that&#x20;of&#x20;this&#x20;example:','[{\"cis\": [\"4.1.14\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23037,'Ensure&#x20;allow&#x20;and&#x20;deny&#x20;filters&#x20;limit&#x20;access&#x20;to&#x20;specific&#x20;IP&#x20;addresses','IP-based&#x20;restrictions&#x20;act&#x20;as&#x20;a&#x20;defense&#x20;in&#x20;depth&#x20;mechanism.&#x20;They&#x20;allow&#x20;you&#x20;to&#x20;whitelist&#x20;legitimate&#x20;paths&#x20;to&#x20;your&#x20;applications&#x20;and&#x20;explicitly&#x20;deny&#x20;IP&#x20;addresses&#x20;you&#x20;believe&#x20;to&#x20;be&#x20;malicious.','IP&#x20;restrictions&#x20;help&#x20;you&#x20;to&#x20;only&#x20;allow&#x20;traffic&#x20;based&#x20;on&#x20;the&#x20;concept&#x20;of&#x20;least&#x20;privilege.&#x20;You&#x20;may&#x20;specify&#x20;vlans,&#x20;countries,&#x20;or&#x20;specific&#x20;servers&#x20;that&#x20;may&#x20;be&#x20;allowed&#x20;or&#x20;denied&#x20;on&#x20;your&#x20;site.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;implicitly&#x20;deny&#x20;all&#x20;traffic&#x20;and&#x20;only&#x20;allow&#x20;those&#x20;with&#x20;a&#x20;legitimate&#x20;use&#x20;case&#x20;to&#x20;access&#x20;your&#x20;website&#x20;if&#x20;choosing&#x20;to&#x20;take&#x20;this&#x20;approach.&#x20;This&#x20;allows&#x20;you&#x20;to&#x20;limit&#x20;the&#x20;surface&#x20;area&#x20;an&#x20;attack&#x20;may&#x20;come&#x20;from.','','Compile&#x20;a&#x20;list&#x20;of&#x20;network&#x20;ranges&#x20;or&#x20;IP&#x20;addresses&#x20;you&#x20;would&#x20;want&#x20;to&#x20;access&#x20;your&#x20;web&#x20;server&#x20;or&#x20;proxy.&#x20;Then&#x20;add&#x20;these&#x20;ranges&#x20;with&#x20;the&#x20;allow&#x20;directive.&#x20;The&#x20;deny&#x20;directive&#x20;should&#x20;be&#x20;included&#x20;with&#x20;all&#x20;IP&#x20;addresses&#x20;implicitly&#x20;denied.&#x20;&#039;location&#x20;/&#x20;{allow&#x20;10.1.1.1;deny&#x20;all;}&#039;','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc\": [\"5.1\", \"9.5\"]}]'),(23038,'Ensure&#x20;timeout&#x20;values&#x20;for&#x20;reading&#x20;the&#x20;client&#x20;header&#x20;and&#x20;body&#x20;are&#x20;set&#x20;correctly','The&#x20;client_header_timeout&#x20;and&#x20;client_body_timeout&#x20;directives&#x20;define&#x20;the&#x20;time&#x20;the&#x20;server&#x20;will&#x20;wait&#x20;for&#x20;the&#x20;header&#x20;or&#x20;body&#x20;to&#x20;be&#x20;sent&#x20;from&#x20;the&#x20;client.&#x20;If&#x20;the&#x20;client&#x20;does&#x20;not&#x20;send&#x20;the&#x20;entire&#x20;header&#x20;in&#x20;this&#x20;predefined&#x20;timeframe,&#x20;the&#x20;server&#x20;will&#x20;send&#x20;back&#x20;a&#x20;408&#x20;request&#x20;timeout&#x20;error.','Setting&#x20;the&#x20;client&#x20;header&#x20;and&#x20;body&#x20;timeouts&#x20;help&#x20;your&#x20;server&#x20;mitigate&#x20;possible&#x20;denial&#x20;of&#x20;service&#x20;attacks.&#x20;By&#x20;timing&#x20;out&#x20;a&#x20;request,&#x20;the&#x20;server&#x20;is&#x20;able&#x20;to&#x20;free&#x20;up&#x20;resources&#x20;that&#x20;may&#x20;be&#x20;waiting&#x20;for&#x20;the&#x20;body&#x20;or&#x20;header.','','Find&#x20;the&#x20;HTTP&#x20;or&#x20;server&#x20;block&#x20;of&#x20;your&#x20;nginx&#x20;configuration&#x20;and&#x20;add&#x20;the&#x20;client_header_timeout&#x20;and&#x20;client_body_timeout&#x20;directives&#x20;set&#x20;to&#x20;the&#x20;configuration.&#x20;The&#x20;below&#x20;example&#x20;sets&#x20;the&#x20;timeouts&#x20;to&#x20;10&#x20;seconds.&#x20;&#039;client_body_timeout&#x20;10;&#x20;client_header_timeout&#x20;10;&#039;','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23039,'Ensure&#x20;the&#x20;maximum&#x20;request&#x20;body&#x20;size&#x20;is&#x20;set&#x20;correctly','The&#x20;client_max_body_size&#x20;directive&#x20;sets&#x20;the&#x20;size&#x20;of&#x20;the&#x20;request&#x20;body&#x20;that&#x20;is&#x20;allowed&#x20;to&#x20;read&#x20;a&#x20;client&#x20;request.&#x20;This&#x20;defines&#x20;the&#x20;number&#x20;of&#x20;bytes&#x20;allowed&#x20;in&#x20;a&#x20;request&#x20;and&#x20;is&#x20;equivalent&#x20;to&#x20;the&#x20;Content-Length&#x20;request&#x20;header&#x20;field.','Limiting&#x20;the&#x20;size&#x20;of&#x20;the&#x20;request&#x20;body&#x20;helps&#x20;prevent&#x20;unexpectedly&#x20;long&#x20;or&#x20;large&#x20;client&#x20;requests&#x20;from&#x20;being&#x20;passed&#x20;to&#x20;an&#x20;application&#x20;to&#x20;perform&#x20;buffer&#x20;overflow&#x20;attacks.&#x20;This&#x20;value&#x20;should&#x20;be&#x20;set&#x20;low&#x20;enough&#x20;to&#x20;protect&#x20;the&#x20;application&#x20;but&#x20;high&#x20;enough&#x20;not&#x20;to&#x20;interfere&#x20;with&#x20;functionality&#x20;and&#x20;block&#x20;legitimate&#x20;request&#x20;bodies.','','Find&#x20;the&#x20;HTTP&#x20;or&#x20;server&#x20;block&#x20;of&#x20;your&#x20;nginx&#x20;configuration&#x20;and&#x20;add&#x20;the&#x20;client_max_body_size&#x20;set&#x20;to&#x20;100K&#x20;in&#x20;this&#x20;block.&#x20;The&#x20;appropriate&#x20;value&#x20;may&#x20;be&#x20;different&#x20;based&#x20;on&#x20;your&#x20;application&#039;s&#x20;needs.&#x20;&#039;client_max_body_size&#x20;100K&#039;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23040,'Ensure&#x20;the&#x20;maximum&#x20;buffer&#x20;size&#x20;for&#x20;URIs&#x20;is&#x20;defined','The&#x20;large_client_header_buffers&#x20;directive&#x20;defines&#x20;the&#x20;number&#x20;and&#x20;size&#x20;of&#x20;buffers&#x20;used&#x20;within&#x20;the&#x20;URI.&#x20;A&#x20;request&#x20;cannot&#x20;exceed&#x20;the&#x20;size&#x20;of&#x20;this&#x20;buffer&#x20;when&#x20;this&#x20;directive&#x20;is&#x20;configured.&#x20;The&#x20;large_client_header_buffers&#x20;directive&#x20;should&#x20;be&#x20;set&#x20;to&#x20;restrict&#x20;buffer&#x20;usage.&#x20;The&#x20;number&#x20;of&#x20;buffers&#x20;should&#x20;generally&#x20;set&#x20;to&#x20;two&#x20;and&#x20;the&#x20;length&#x20;be&#x20;set&#x20;to&#x20;1K;&#x20;however,&#x20;this&#x20;may&#x20;not&#x20;be&#x20;a&#x20;good&#x20;fit&#x20;for&#x20;your&#x20;application&#x20;and&#x20;may&#x20;need&#x20;to&#x20;be&#x20;set&#x20;differently.','The&#x20;large_client_header_buffers&#x20;directive&#x20;may&#x20;assist&#x20;in&#x20;preventing&#x20;buffer&#x20;overflow&#x20;attacks&#x20;that&#x20;leverage&#x20;long&#x20;URI&#x20;query&#x20;parameters.','','Open&#x20;your&#x20;nginx.conf&#x20;file&#x20;and&#x20;locate&#x20;your&#x20;server&#x20;or&#x20;HTTP&#x20;blocks.&#x20;This&#x20;may&#x20;be&#x20;added&#x20;to&#x20;the&#x20;HTTP&#x20;block&#x20;for&#x20;all&#x20;configurations&#x20;or&#x20;the&#x20;server&#x20;block&#x20;for&#x20;more&#x20;specific&#x20;configurations&#x20;to&#x20;meet&#x20;your&#x20;needs.&#x20;Add&#x20;the&#x20;below&#x20;line&#x20;to&#x20;implement&#x20;this&#x20;recommendation:&#x20;&#039;large_client_header_buffers&#x20;2&#x20;1k&#039;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23041,'Ensure&#x20;the&#x20;number&#x20;of&#x20;connections&#x20;per&#x20;IP&#x20;address&#x20;is&#x20;limited','The&#x20;maximum&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;allowed&#x20;from&#x20;a&#x20;single&#x20;IP&#x20;address&#x20;to&#x20;your&#x20;server&#x20;should&#x20;be&#x20;limited.&#x20;It&#x20;should&#x20;be&#x20;set&#x20;to&#x20;a&#x20;value&#x20;that&#x20;meets&#x20;your&#x20;organizational&#x20;policies.','Limiting&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;is&#x20;an&#x20;effective&#x20;way&#x20;to&#x20;prevent&#x20;slow&#x20;denial&#x20;of&#x20;service&#x20;attacks&#x20;that&#x20;try&#x20;to&#x20;use&#x20;as&#x20;many&#x20;server&#x20;resources&#x20;as&#x20;possible.&#x20;This&#x20;can&#x20;also&#x20;help&#x20;prevent&#x20;brute&#x20;force&#x20;attacks&#x20;on&#x20;a&#x20;login&#x20;page.','','Implement&#x20;the&#x20;below&#x20;directives&#x20;under&#x20;the&#x20;HTTP&#x20;and&#x20;server&#x20;blocks&#x20;of&#x20;your&#x20;nginx&#x20;configuration&#x20;or&#x20;any&#x20;include&#x20;files.&#x20;The&#x20;below&#x20;configuration&#x20;creates&#x20;a&#x20;memory&#x20;zone&#x20;of&#x20;10&#x20;megabytes&#x20;called&#x20;limitperip.&#x20;It&#x20;will&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connections&#x20;per&#x20;IP&#x20;address&#x20;to&#x20;10&#x20;simultaneous&#x20;connections.&#x20;The&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;allow&#x20;may&#x20;be&#x20;different&#x20;depending&#x20;on&#x20;your&#x20;organization&#039;s&#x20;policies&#x20;and&#x20;use&#x20;cases.&#x20;&#039;http&#x20;{limit_conn_zone&#x20;$binary_remote_addr&#x20;zone=limitperip:10m;server&#x20;{limit_conn&#x20;limitperip&#x20;10;}}&#039;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23042,'Ensure&#x20;rate&#x20;limits&#x20;by&#x20;IP&#x20;address&#x20;are&#x20;set','Rate&#x20;limiting&#x20;should&#x20;be&#x20;enabled&#x20;to&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;requests&#x20;an&#x20;IP&#x20;address&#x20;may&#x20;make&#x20;to&#x20;a&#x20;server&#x20;in&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time.&#x20;The&#x20;configuration&#x20;values&#x20;should&#x20;be&#x20;set&#x20;based&#x20;on&#x20;your&#x20;application&#039;s&#x20;needs&#x20;and&#x20;your&#x20;organizational&#x20;policy.','Rate&#x20;limiting&#x20;allows&#x20;you&#x20;to&#x20;mitigate&#x20;potential&#x20;denial&#x20;of&#x20;service&#x20;attacks&#x20;as&#x20;a&#x20;defense&#x20;in&#x20;depth&#x20;mechanism.','','Implement&#x20;the&#x20;below&#x20;directives&#x20;under&#x20;the&#x20;HTTP&#x20;and&#x20;server&#x20;blocks&#x20;of&#x20;your&#x20;nginx&#x20;configuration&#x20;or&#x20;any&#x20;include&#x20;files.&#x20;The&#x20;below&#x20;configuration&#x20;creates&#x20;a&#x20;memory&#x20;zone&#x20;of&#x20;10&#x20;megabytes&#x20;called&#x20;&quot;ratelimit&quot;&#x20;and&#x20;sets&#x20;the&#x20;number&#x20;of&#x20;requests&#x20;per&#x20;second&#x20;that&#x20;can&#x20;be&#x20;sent&#x20;by&#x20;any&#x20;given&#x20;IP&#x20;address&#x20;to&#x20;5.&#x20;Further,&#x20;this&#x20;configuration&#x20;sets&#x20;a&#x20;burst&#x20;of&#x20;10&#x20;to&#x20;ensure&#x20;that&#x20;requests&#x20;may&#x20;come&#x20;more&#x20;frequently&#x20;and&#x20;sets&#x20;no&#x20;delay&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;bursting&#x20;may&#x20;be&#x20;all&#x20;at&#x20;once&#x20;and&#x20;not&#x20;queued.&#x20;&#039;http&#x20;{limit_req_zone&#x20;$binary_remote_addr&#x20;zone=ratelimit:10m&#x20;rate=5r/s;server&#x20;{location&#x20;/&#x20;{limit_req&#x20;zone=ratelimit&#x20;burst=10&#x20;nodelay;}}}&#039;','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23043,'Ensure&#x20;X-Frame-Options&#x20;header&#x20;is&#x20;configured&#x20;and&#x20;enabled','The&#x20;X-Frame-Options&#x20;header&#x20;should&#x20;be&#x20;set&#x20;to&#x20;allow&#x20;specific&#x20;websites&#x20;or&#x20;no&#x20;sites&#x20;at&#x20;all&#x20;to&#x20;embed&#x20;your&#x20;website&#x20;as&#x20;an&#x20;object&#x20;within&#x20;their&#x20;own,&#x20;depending&#x20;on&#x20;your&#x20;organizational&#x20;policy&#x20;and&#x20;application&#x20;needs.','The&#x20;X-Frame-Options&#x20;header&#x20;allows&#x20;you&#x20;to&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;clickjacking&#x20;attacks.','','Add&#x20;the&#x20;below&#x20;to&#x20;your&#x20;server&#x20;blocks&#x20;in&#x20;your&#x20;nginx&#x20;configuration.&#x20;The&#x20;policy&#x20;should&#x20;be&#x20;configured&#x20;to&#x20;meet&#x20;your&#x20;organization&#039;s&#x20;needs.&#x20;&#039;add_header&#x20;X-Frame-Options&#x20;&quot;SAMEORIGIN&quot;;&#039;','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23044,'Ensure&#x20;X-Content-Type-Options&#x20;header&#x20;is&#x20;configured&#x20;and&#x20;enabled','The&#x20;X-Content-Type-Options&#x20;header&#x20;should&#x20;be&#x20;used&#x20;to&#x20;force&#x20;supported&#x20;user&#x20;agents&#x20;to&#x20;check&#x20;an&#x20;HTTP&#x20;response&#039;s&#x20;content&#x20;type&#x20;header&#x20;with&#x20;what&#x20;is&#x20;expected&#x20;from&#x20;the&#x20;destination&#x20;of&#x20;the&#x20;request.','Implementing&#x20;the&#x20;X-Content-Type-Options&#x20;header&#x20;with&#x20;the&#x20;&quot;nosniff&quot;&#x20;directive&#x20;helps&#x20;to&#x20;prevent&#x20;drive-by&#x20;download&#x20;attacks&#x20;where&#x20;a&#x20;user&#x20;agent&#x20;is&#x20;sniffing&#x20;content&#x20;types&#x20;in&#x20;responses.','','Open&#x20;the&#x20;nginx&#x20;configuration&#x20;file&#x20;that&#x20;contains&#x20;your&#x20;server&#x20;blocks.&#x20;Add&#x20;the&#x20;below&#x20;line&#x20;into&#x20;your&#x20;server&#x20;block&#x20;to&#x20;add&#x20;X-Content-Type-Options&#x20;header&#x20;and&#x20;direct&#x20;your&#x20;user&#x20;agent&#x20;to&#x20;not&#x20;sniff&#x20;content&#x20;types.&#x20;&#039;add_header&#x20;X-Content-Type-Options&#x20;&quot;nosniff&quot;;&#039;','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23045,'Ensure&#x20;the&#x20;X-XSS-Protection&#x20;Header&#x20;is&#x20;enabled&#x20;and&#x20;configured&#x20;properly','The&#x20;X-Xss-Protection&#x20;Header&#x20;allows&#x20;you&#x20;to&#x20;leverage&#x20;browser-based&#x20;protections&#x20;against&#x20;cross-site&#x20;scripting.&#x20;This&#x20;should&#x20;be&#x20;implemented&#x20;on&#x20;your&#x20;web&#x20;servers&#x20;to&#x20;protect&#x20;your&#x20;users&#x20;and&#x20;increase&#x20;user&#x20;trust&#x20;in&#x20;your&#x20;site.&#x20;Your&#x20;policy&#x20;should&#x20;be&#x20;set&#x20;in&#x20;blocking&#x20;mode&#x20;when&#x20;possible&#x20;to&#x20;ensure&#x20;the&#x20;browser&#x20;blocks&#x20;a&#x20;page&#x20;if&#x20;cross-site&#x20;scripting&#x20;is&#x20;detected.','X-Xss-Protection&#x20;allows&#x20;you&#x20;to&#x20;protect&#x20;users&#x20;whose&#x20;browsers&#x20;do&#x20;not&#x20;support&#x20;Content&#x20;Security&#x20;Policy&#x20;&#40;generally&#x20;older&#x20;browsers&#41;,&#x20;or&#x20;protect&#x20;users&#x20;if&#x20;you&#x20;do&#x20;not&#x20;have&#x20;a&#x20;Content&#x20;Security&#x20;Policy.','','Open&#x20;your&#x20;nginx&#x20;configuration&#x20;file&#x20;that&#x20;contains&#x20;your&#x20;server&#x20;blocks.&#x20;Add&#x20;the&#x20;below&#x20;line&#x20;into&#x20;your&#x20;server&#x20;block&#x20;to&#x20;add&#x20;Content-Security-Policy&#x20;and&#x20;direct&#x20;your&#x20;user&#x20;agent&#x20;to&#x20;block&#x20;reflected&#x20;cross-site&#x20;scripting.&#x20;&#039;add_header&#x20;X-Xss-Protection&#x20;&quot;1;&#x20;mode=block&quot;;&#039;','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23046,'Ensure&#x20;that&#x20;Content&#x20;Security&#x20;Policy&#x20;&#40;CSP&#41;&#x20;is&#x20;enabled&#x20;and&#x20;configured&#x20;properly','Content&#x20;Security&#x20;Policy&#x20;allows&#x20;administrators&#x20;to&#x20;specify&#x20;the&#x20;locations&#x20;from&#x20;which&#x20;allowable&#x20;scripts&#x20;may&#x20;be&#x20;executed,&#x20;or&#x20;if&#x20;scripts&#x20;may&#x20;be&#x20;executed&#x20;at&#x20;all.&#x20;Content&#x20;Security&#x20;Policy&#x20;should&#x20;be&#x20;used&#x20;to&#x20;improve&#x20;user&#x20;trust&#x20;of&#x20;your&#x20;website.','Content&#x20;Security&#x20;Policies&#x20;assist&#x20;organizations&#x20;in&#x20;mitigating&#x20;and&#x20;reporting&#x20;cross-site&#x20;scripting&#x20;&#40;XSS&#41;&#x20;attacks.','','Open&#x20;your&#x20;nginx&#x20;configuration&#x20;file&#x20;that&#x20;contains&#x20;your&#x20;server&#x20;blocks.&#x20;Add&#x20;the&#x20;below&#x20;line&#x20;into&#x20;your&#x20;server&#x20;block&#x20;to&#x20;add&#x20;Content-Security-Policy&#x20;and&#x20;direct&#x20;your&#x20;user&#x20;agent&#x20;to&#x20;accept&#x20;documents&#x20;from&#x20;only&#x20;specific&#x20;origins.&#x20;&#039;add_header&#x20;Content-Security-Policy&#x20;&quot;default-src&#x20;&#039;self&#039;&quot;;&#039;','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23047,'Ensure&#x20;the&#x20;Referrer&#x20;Policy&#x20;is&#x20;enabled&#x20;and&#x20;configured&#x20;properly','When&#x20;an&#x20;origin&#x20;site&#x20;directs&#x20;a&#x20;user&#x20;to&#x20;another&#x20;site,&#x20;a&#x20;referrer&#x20;is&#x20;sent&#x20;that&#x20;identifies&#x20;the&#x20;URL&#x20;the&#x20;user&#x20;came&#x20;from.&#x20;Depending&#x20;on&#x20;your&#x20;site&#039;s&#x20;specific&#x20;use,&#x20;this&#x20;may&#x20;present&#x20;a&#x20;privacy&#x20;concern&#x20;to&#x20;your&#x20;users.&#x20;The&#x20;Referrer&#x20;Policy&#x20;enables&#x20;organizations&#x20;to&#x20;define&#x20;what&#x20;sites&#x20;should&#x20;see&#x20;that&#x20;a&#x20;referral&#x20;came&#x20;from&#x20;your&#x20;site,&#x20;which&#x20;helps&#x20;protect&#x20;user&#x20;privacy.','A&#x20;Referrer&#x20;header&#x20;may&#x20;expose&#x20;sensitive&#x20;data&#x20;in&#x20;another&#x20;web&#x20;server&#039;s&#x20;log&#x20;if&#x20;you&#x20;use&#x20;sensitive&#x20;data&#x20;in&#x20;your&#x20;URL&#x20;parameters,&#x20;such&#x20;as&#x20;personal&#x20;information,&#x20;username,&#x20;and&#x20;password&#x20;or&#x20;persistent&#x20;sessions.&#x20;Ultimately,&#x20;depending&#x20;on&#x20;your&#x20;application&#x20;design,&#x20;not&#x20;using&#x20;a&#x20;properly&#x20;configured&#x20;Referrer&#x20;Policy&#x20;may&#x20;allow&#x20;session&#x20;hijacking,&#x20;credential&#x20;gathering,&#x20;or&#x20;sensitive&#x20;data&#x20;exposure&#x20;in&#x20;a&#x20;third&#x20;party&#039;s&#x20;logs.','','Add&#x20;the&#x20;below&#x20;line&#x20;to&#x20;the&#x20;server&#x20;blocks&#x20;within&#x20;your&#x20;nginx&#x20;configuration.&#x20;The&#x20;policy&#x20;should&#x20;be&#x20;customized&#x20;for&#x20;your&#x20;specific&#x20;organization&#039;s&#x20;needs.&#x20;The&#x20;below&#x20;policy&#x20;will&#x20;ensure&#x20;your&#x20;website&#x20;is&#x20;never&#x20;allowed&#x20;in&#x20;a&#x20;referrer.&#x20;&#039;add_header&#x20;Referrer-Policy&#x20;&quot;no-referrer&quot;;&#039;','[{\"cis\": [\"5.3.5\"]}, {\"cis_csc\": [\"5.1\"]}]'),(23500,'Configure&#x20;TCP&#x20;Wrappers.','TCP&#x20;Wrappers&#x20;is&#x20;a&#x20;host-based&#x20;access&#x20;control&#x20;system&#x20;that&#x20;allows&#x20;administrators&#x20;to&#x20;control&#x20;who&#x20;has&#x20;access&#x20;to&#x20;various&#x20;network&#x20;services&#x20;based&#x20;on&#x20;the&#x20;IP&#x20;address&#x20;of&#x20;the&#x20;remote&#x20;end&#x20;of&#x20;the&#x20;connection.&#x20;TCP&#x20;Wrappers&#x20;also&#x20;provide&#x20;logging&#x20;information&#x20;via&#x20;syslog&#x20;about&#x20;both&#x20;successful&#x20;and&#x20;unsuccessful&#x20;connections.','TCP&#x20;Wrappers&#x20;provides&#x20;granular&#x20;control&#x20;over&#x20;what&#x20;services&#x20;can&#x20;be&#x20;accessed&#x20;over&#x20;the&#x20;network.&#x20;Its&#x20;logs&#x20;show&#x20;attempted&#x20;access&#x20;to&#x20;services&#x20;from&#x20;non-authorized&#x20;systems,which&#x20;can&#x20;help&#x20;identify&#x20;unauthorized&#x20;access&#x20;attempts.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;inetadm&#x20;-M&#x20;tcp_wrappers=TRUE&#x20;&amp;&amp;&#x20;echo&#x20;&quot;ALL:&#x20;&lt;net&gt;/&lt;mask&gt;,&#x20;&lt;net/&lt;mask&gt;,&#x20;&hellip;&quot;&#x20;&gt;&#x20;/etc/hosts.allow&#x20;&amp;&amp;&#x20;echo&#x20;&quot;ALL:&#x20;ALL&quot;&#x20;&gt;/etc/hosts.deny','[{\"cis\": [\"2.1\"]}]'),(23501,'Disable&#x20;Local-only&#x20;Graphical&#x20;Login&#x20;Environment.','The&#x20;graphical&#x20;login&#x20;service&#x20;provides&#x20;the&#x20;capability&#x20;of&#x20;logging&#x20;into&#x20;the&#x20;system&#x20;using&#x20;an&#x20;X-&#x20;windows&#x20;type&#x20;interface&#x20;from&#x20;the&#x20;console.&#x20;If&#x20;graphical&#x20;login&#x20;access&#x20;for&#x20;the&#x20;console&#x20;is&#x20;required,&#x20;leave&#x20;the&#x20;service&#x20;in&#x20;local-only&#x20;mode.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disablesvc:/application/graphical-login/gdm:default','[{\"cis\": [\"2.2\"]}]'),(23502,'Configure&#x20;sendmail&#x20;Service&#x20;for&#x20;Local-Only&#x20;Mode.','In&#x20;Solaris&#x20;11,&#x20;the&#x20;sendmail&#x20;service&#x20;is&#x20;set&#x20;to&#x20;local&#x20;only&#x20;mode&#x20;by&#x20;default.&#x20;This&#x20;means&#x20;that&#x20;users&#x20;on&#x20;remote&#x20;systems&#x20;cannot&#x20;connect&#x20;to&#x20;the&#x20;sendmail&#x20;service,&#x20;eliminating&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;remote&#x20;exploit&#x20;attack&#x20;against&#x20;some&#x20;future&#x20;sendmail&#x20;vulnerability.&#x20;Leaving&#x20;sendmail&#x20;in&#x20;local-only&#x20;mode&#x20;permits&#x20;mail&#x20;to&#x20;be&#x20;sent&#x20;out&#x20;from&#x20;the&#x20;local&#x20;system.&#x20;If&#x20;the&#x20;localsystem&#x20;will&#x20;not&#x20;be&#x20;processing&#x20;or&#x20;sending&#x20;any&#x20;mail,&#x20;this&#x20;service&#x20;can&#x20;be&#x20;disabled.&#x20;However,&#x20;if&#x20;sendmail&#x20;is&#x20;disabled&#x20;completely,emailmessages&#x20;sent&#x20;to&#x20;the&#x20;root&#x20;account&#x20;&#40;such&#x20;as&#x20;cron&#x20;job&#x20;output&#x20;or&#x20;audit&#x20;service&#x20;warnings&#41;&#x20;will&#x20;fail&#x20;to&#x20;be&#x20;delivered.&#x20;Analternative&#x20;approach&#x20;is&#x20;to&#x20;disable&#x20;the&#x20;sendmail&#x20;service&#x20;and&#x20;create&#x20;a&#x20;cron&#x20;job&#x20;to&#x20;process&#x20;all&#x20;mail&#x20;that&#x20;is&#x20;queued&#x20;on&#x20;the&#x20;localsystem,&#x20;sending&#x20;it&#x20;to&#x20;a&#x20;relay&#x20;host&#x20;defined&#x20;in&#x20;the&#x20;sendmail.cf&#x20;file.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;sendmail&#x20;be&#x20;left&#x20;in&#x20;local-only&#x20;modeunless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;requirement&#x20;to&#x20;completely&#x20;disable&#x20;it.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;itis&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listeningon&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.','','Run&#x20;the&#x20;following&#x20;to&#x20;set&#x20;sendmail&#x20;to&#x20;listen&#x20;only&#x20;local&#x20;interfaces:&#x20;#&#x20;svccfg&#x20;-v&#x20;-s&#x20;svc:/network/smtp:sendmail&#x20;setprop&#x20;config/local_only=false&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;refresh&#x20;sendmail&#x20;&#x20;&#x20;&#x20;#&#x20;svcadm&#x20;restart&#x20;sendmail','[{\"cis\": [\"2.3\"]}]'),(23503,'Disable&#x20;RPC&#x20;Encryption&#x20;Key.','The&#x20;keyserv&#x20;service&#x20;is&#x20;only&#x20;required&#x20;for&#x20;sites&#x20;that&#x20;are&#x20;using&#x20;the&#x20;Secure&#x20;RPC&#x20;mechanism.&#x20;The&#x20;most&#x20;common&#x20;use&#x20;for&#x20;Secure&#x20;RPC&#x20;on&#x20;Solaris&#x20;machines&#x20;is&#x20;&quot;secure&#x20;NFS&quot;,&#x20;which&#x20;uses&#x20;the&#x20;Secure&#x20;RPC&#x20;mechanism&#x20;to&#x20;provide&#x20;higher&#x20;levels&#x20;of&#x20;securitythan&#x20;the&#x20;standard&#x20;NFS&#x20;protocols.&#x20;&#40;&quot;Secure&#x20;NFS&quot;&#x20;is&#x20;unrelated&#x20;to&#x20;Kerberos&#x20;authentication&#x20;as&#x20;a&#x20;mechanism&#x20;for&#x20;providing&#x20;higherlevels&#x20;of&#x20;NFS&#x20;security.&#x20;&quot;Kerberized&quot;&#x20;NFS&#x20;does&#x20;not&#x20;require&#x20;the&#x20;keyserv&#x20;service&#x20;to&#x20;be&#x20;running.&#41;','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/keyserv','[{\"cis\": [\"2.4\"]}]'),(23504,'Disable&#x20;Generic&#x20;Security&#x20;Services&#x20;&#40;GSS&#41;.','The&#x20;GSS&#x20;API&#x20;is&#x20;a&#x20;security&#x20;abstraction&#x20;layer&#x20;that&#x20;is&#x20;designed&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;developers&#x20;to&#x20;integrate&#x20;with&#x20;different&#x20;authentication&#x20;schemes.&#x20;It&#x20;is&#x20;most&#x20;commonly&#x20;used&#x20;in&#x20;applications&#x20;for&#x20;sites&#x20;that&#x20;use&#x20;Kerberos&#x20;for&#x20;network&#x20;authentication,&#x20;though&#x20;it&#x20;can&#x20;also&#x20;allow&#x20;applications&#x20;to&#x20;interoperate&#x20;with&#x20;other&#x20;authentication&#x20;schemes.','GSS&#x20;does&#x20;not&#x20;expose&#x20;anything&#x20;external&#x20;to&#x20;the&#x20;system&#x20;as&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;use&#x20;TLI&#x20;&#40;protocol&#x20;=&#x20;ticotsord&#41;&#x20;by&#x20;default.&#x20;This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/gss','[{\"cis\": [\"2.5\"]}]'),(23505,'Disable&#x20;Apache&#x20;Service.','The&#x20;Apache&#x20;service&#x20;provides&#x20;an&#x20;instance&#x20;of&#x20;the&#x20;Apache&#x20;web&#x20;server.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/http:apache24','[{\"cis\": [\"2.6\"]}]'),(23506,'Disable&#x20;Kerberos&#x20;TGT&#x20;Expiration&#x20;Warning.','The&#x20;Kerberos&#x20;TGT&#x20;warning&#x20;service&#x20;is&#x20;used&#x20;to&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;Kerberos&#x20;tickets&#x20;are&#x20;about&#x20;expire&#x20;or&#x20;to&#x20;renew&#x20;those&#x20;tickets&#x20;before&#x20;they&#x20;expire.&#x20;This&#x20;service&#x20;is&#x20;not&#x20;used&#x20;if&#x20;Kerberos&#x20;has&#x20;not&#x20;been&#x20;configured.&#x20;This&#x20;service&#x20;is&#x20;configured&#x20;to&#x20;be&#x20;local&#x20;only&#x20;by&#x20;default.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/security/ktkt_warn','[{\"cis\": [\"2.7\"]}]'),(23507,'Disable&#x20;NIS&#x20;Client&#x20;Services.','If&#x20;the&#x20;local&#x20;site&#x20;is&#x20;not&#x20;using&#x20;the&#x20;NIS&#x20;naming&#x20;service&#x20;to&#x20;distribute&#x20;system&#x20;and&#x20;user&#x20;configuration&#x20;information,&#x20;this&#x20;service&#x20;may&#x20;be&#x20;disabled.&#x20;This&#x20;service&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;unless&#x20;the&#x20;NIS&#x20;service&#x20;has&#x20;been&#x20;installed&#x20;and&#x20;configured&#x20;on&#x20;the&#x20;system.','As&#x20;RPC-based&#x20;services&#x20;such&#x20;as&#x20;NIS&#x20;may&#x20;use&#x20;non-secure&#x20;authentication&#x20;and&#x20;share&#x20;sensitive&#x20;network&#x20;object&#x20;information&#x20;with&#x20;systems&#x20;and&#x20;applications&#x20;using&#x20;RPC-based&#x20;service,&#x20;NIS&#x20;client&#x20;daemons&#x20;should&#x20;be&#x20;disabled.&#x20;Users&#x20;are&#x20;encouraged&#x20;to&#x20;use&#x20;LDAP&#x20;as&#x20;a&#x20;name&#x20;service&#x20;in&#x20;place&#x20;of&#x20;NIS.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/client.&#x20;If&#x20;LDAP&#x20;is&#x20;not&#x20;in&#x20;use&#x20;also&#x20;disable&#x20;nis/domain:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/domain','[{\"cis\": [\"2.8\"]}]'),(23508,'Disable&#x20;NIS&#x20;Client&#x20;Services&#x20;&#40;Domain&#x20;-&#x20;Scored&#41;.','If&#x20;the&#x20;local&#x20;site&#x20;is&#x20;not&#x20;using&#x20;the&#x20;NIS&#x20;naming&#x20;service&#x20;to&#x20;distribute&#x20;system&#x20;and&#x20;user&#x20;configuration&#x20;information,&#x20;this&#x20;service&#x20;may&#x20;be&#x20;disabled.&#x20;This&#x20;service&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;unless&#x20;the&#x20;NIS&#x20;service&#x20;has&#x20;been&#x20;installed&#x20;and&#x20;configured&#x20;on&#x20;the&#x20;system.','As&#x20;RPC-based&#x20;services&#x20;such&#x20;as&#x20;NIS&#x20;may&#x20;use&#x20;non-secure&#x20;authentication&#x20;and&#x20;share&#x20;sensitive&#x20;network&#x20;object&#x20;information&#x20;with&#x20;systems&#x20;and&#x20;applications&#x20;using&#x20;RPC-based&#x20;service,&#x20;NIS&#x20;client&#x20;daemons&#x20;should&#x20;be&#x20;disabled.&#x20;Users&#x20;are&#x20;encouraged&#x20;to&#x20;use&#x20;LDAP&#x20;as&#x20;a&#x20;name&#x20;service&#x20;in&#x20;place&#x20;of&#x20;NIS.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/client.&#x20;If&#x20;LDAP&#x20;is&#x20;not&#x20;in&#x20;use&#x20;also&#x20;disable&#x20;nis/domain:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/domain','[{\"cis\": [\"2.8-2.9\"]}]'),(23509,'Disable&#x20;NIS&#x20;Server&#x20;Services.','The&#x20;NIS&#x20;server&#x20;software&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default&#x20;and&#x20;is&#x20;only&#x20;required&#x20;on&#x20;systems&#x20;that&#x20;are&#x20;acting&#x20;as&#x20;an&#x20;NIS&#x20;server&#x20;for&#x20;the&#x20;local&#x20;site.&#x20;Typically&#x20;there&#x20;are&#x20;only&#x20;a&#x20;small&#x20;number&#x20;of&#x20;NIS&#x20;servers&#x20;on&#x20;any&#x20;given&#x20;network.&#x20;These&#x20;services&#x20;are&#x20;disabled&#x20;by&#x20;default&#x20;unless&#x20;the&#x20;system&#x20;has&#x20;been&#x20;previously&#x20;configured&#x20;to&#x20;act&#x20;as&#x20;a&#x20;NIS&#x20;server.','As&#x20;RPC-based&#x20;services&#x20;such&#x20;as&#x20;NIS&#x20;may&#x20;use&#x20;non-secure&#x20;authentication&#x20;and&#x20;share&#x20;sensitive&#x20;network&#x20;object&#x20;information&#x20;with&#x20;systems&#x20;and&#x20;applications&#x20;using&#x20;RPC-based&#x20;services,&#x20;this&#x20;service&#x20;should&#x20;be&#x20;disabled.&#x20;Users&#x20;are&#x20;encouraged&#x20;to&#x20;use&#x20;LDAP&#x20;as&#x20;a&#x20;name&#x20;service&#x20;in&#x20;place&#x20;of&#x20;NIS.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/server.&#x20;If&#x20;LDAP&#x20;is&#x20;not&#x20;in&#x20;use&#x20;also&#x20;disable&#x20;nis/domain:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/nis/domain','[{\"cis\": [\"2.9\"]}]'),(23510,'Disable&#x20;Removable&#x20;Volume&#x20;Manager&#x20;&#40;rmvolmgr&#x20;-&#x20;Scored&#41;.','The&#x20;HAL-aware&#x20;removable&#x20;volume&#x20;manager&#x20;in&#x20;the&#x20;Solaris&#x20;11&#x20;OS&#x20;automatically&#x20;mounts&#x20;external&#x20;devices&#x20;for&#x20;users&#x20;whenever&#x20;the&#x20;device&#x20;is&#x20;attached&#x20;to&#x20;the&#x20;system.&#x20;These&#x20;devices&#x20;include&#x20;CD-R,&#x20;CD-RW,&#x20;floppies,&#x20;DVD,&#x20;USB&#x20;and&#x20;1394&#x20;mass&#x20;storage&#x20;devices.&#x20;See&#x20;the&#x20;rmvolmgr&#40;1M&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;details.','Allowing&#x20;users&#x20;to&#x20;mount&#x20;and&#x20;access&#x20;data&#x20;from&#x20;removable&#x20;media&#x20;devices&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;malicious&#x20;programs&#x20;and&#x20;data&#x20;to&#x20;be&#x20;imported&#x20;onto&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;introduces&#x20;the&#x20;risk&#x20;that&#x20;sensitive&#x20;data&#x20;may&#x20;be&#x20;transferred&#x20;off&#x20;the&#x20;system&#x20;without&#x20;a&#x20;log&#x20;record.&#x20;By&#x20;adding&#x20;rmvolmgr&#x20;to&#x20;the&#x20;.xinitrc&#x20;file,&#x20;user-isolated&#x20;instances&#x20;of&#x20;rmvolmgr&#x20;can&#x20;be&#x20;run&#x20;via&#x20;a&#x20;session&#x20;startup&#x20;script.&#x20;In&#x20;such&#x20;cases,&#x20;the&#x20;rmvolmgr&#x20;instance&#x20;will&#x20;not&#x20;allow&#x20;management&#x20;of&#x20;volumes&#x20;that&#x20;belong&#x20;to&#x20;other&#x20;than&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;startup&#x20;script.&#x20;When&#x20;a&#x20;user&#x20;logs&#x20;onto&#x20;the&#x20;workstation&#x20;console&#x20;&#40;/dev/console&#41;,&#x20;any&#x20;instance&#x20;of&#x20;user-initiated&#x20;rmvolmgr&#x20;will&#x20;only&#x20;own&#x20;locally&#x20;connected&#x20;devices,&#x20;such&#x20;as&#x20;CD-ROMs&#x20;or&#x20;flash&#x20;memory&#x20;hardware,&#x20;locally&#x20;connected&#x20;to&#x20;USB&#x20;or&#x20;FireWire&#x20;ports.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/system/filesystem/rmvolmgr&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/smserver','[{\"cis\": [\"2.10\"]}]'),(23511,'Disable&#x20;Removable&#x20;Volume&#x20;Manager.','The&#x20;HAL-aware&#x20;removable&#x20;volume&#x20;manager&#x20;in&#x20;the&#x20;Solaris&#x20;11&#x20;OS&#x20;automatically&#x20;mounts&#x20;external&#x20;devices&#x20;for&#x20;users&#x20;whenever&#x20;the&#x20;device&#x20;is&#x20;attached&#x20;to&#x20;the&#x20;system.&#x20;These&#x20;devices&#x20;include&#x20;CD-R,&#x20;CD-RW,&#x20;floppies,&#x20;DVD,&#x20;USB&#x20;and&#x20;1394&#x20;mass&#x20;storage&#x20;devices.&#x20;See&#x20;the&#x20;rmvolmgr&#40;1M&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;details.','Allowing&#x20;users&#x20;to&#x20;mount&#x20;and&#x20;access&#x20;data&#x20;from&#x20;removable&#x20;media&#x20;devices&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;malicious&#x20;programs&#x20;and&#x20;data&#x20;to&#x20;be&#x20;imported&#x20;onto&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;introduces&#x20;the&#x20;risk&#x20;that&#x20;sensitive&#x20;data&#x20;may&#x20;be&#x20;transferred&#x20;off&#x20;the&#x20;system&#x20;without&#x20;a&#x20;log&#x20;record.&#x20;By&#x20;adding&#x20;rmvolmgr&#x20;to&#x20;the&#x20;.xinitrc&#x20;file,&#x20;user-isolated&#x20;instances&#x20;of&#x20;rmvolmgr&#x20;can&#x20;be&#x20;run&#x20;via&#x20;a&#x20;session&#x20;startup&#x20;script.&#x20;In&#x20;such&#x20;cases,&#x20;the&#x20;rmvolmgr&#x20;instance&#x20;will&#x20;not&#x20;allow&#x20;management&#x20;of&#x20;volumes&#x20;that&#x20;belong&#x20;to&#x20;other&#x20;than&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;startup&#x20;script.&#x20;When&#x20;a&#x20;user&#x20;logs&#x20;onto&#x20;the&#x20;workstation&#x20;console&#x20;&#40;/dev/console&#41;,&#x20;any&#x20;instance&#x20;of&#x20;user-initiated&#x20;rmvolmgr&#x20;will&#x20;only&#x20;own&#x20;locally&#x20;connected&#x20;devices,&#x20;such&#x20;as&#x20;CD-ROMs&#x20;or&#x20;flash&#x20;memory&#x20;hardware,&#x20;locally&#x20;connected&#x20;to&#x20;USB&#x20;or&#x20;FireWire&#x20;ports.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/system/filesystem/rmvolmgr&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/rpc/smserver','[{\"cis\": [\"2.10\"]}]'),(23512,'Disable&#x20;automount&#x20;Service.','The&#x20;automount&#x20;daemon&#x20;is&#x20;normally&#x20;used&#x20;to&#x20;automatically&#x20;mount&#x20;NFS&#x20;file&#x20;systems&#x20;from&#x20;remote&#x20;file&#x20;servers&#x20;when&#x20;needed.&#x20;However,&#x20;the&#x20;automount&#x20;daemon&#x20;can&#x20;also&#x20;be&#x20;configured&#x20;to&#x20;mount&#x20;local&#x20;&#40;loopback&#41;&#x20;file&#x20;systems&#x20;as&#x20;well,&#x20;which&#x20;may&#x20;include&#x20;local&#x20;user&#x20;home&#x20;directories,&#x20;depending&#x20;on&#x20;the&#x20;system&#x20;configuration.','This&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;it&#x20;is&#x20;not&#x20;required.','','To&#x20;disable&#x20;this&#x20;service,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/system/filesystem/autofs','[{\"cis\": [\"2.11\"]}]'),(23513,'Disable&#x20;Telnet&#x20;Service.','The&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol&#x20;and&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;shell&#x20;access.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;protocol&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Disable&#x20;telnet&#x20;server&#x20;if&#x20;enabled:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/network/telnet','[{\"cis\": [\"2.12\"]}]'),(23514,'Disable&#x20;Response&#x20;to&#x20;Broadcast&#x20;ICMPv4&#x20;Echo&#x20;Request.','This&#x20;setting&#x20;controls&#x20;whether&#x20;Solaris&#x20;responds&#x20;to&#x20;broadcast&#x20;ICMPv4&#x20;echo&#x20;requests.','Reduce&#x20;attack&#x20;surface&#x20;by&#x20;restricting&#x20;this&#x20;vector&#x20;used&#x20;for&#x20;host&#x20;discovery&#x20;and&#x20;to&#x20;prevent&#x20;denial&#x20;of&#x20;service&#x20;attacks.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_respond_to_echo_broadcast=0&#x20;ip','[{\"cis\": [\"3.1\"]}]'),(23515,'Disable&#x20;Response&#x20;to&#x20;ICMP&#x20;Broadcast&#x20;Netmask&#x20;Requests.','This&#x20;setting&#x20;controls&#x20;whether&#x20;Solaris&#x20;will&#x20;respond&#x20;to&#x20;ICMP&#x20;broadcast&#x20;netmask&#x20;requests.','Reduce&#x20;attack&#x20;surface&#x20;by&#x20;restricting&#x20;this&#x20;vector&#x20;used&#x20;for&#x20;host&#x20;and&#x20;network&#x20;discovery&#x20;and&#x20;to&#x20;prevent&#x20;denial&#x20;of&#x20;service&#x20;attacks.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_respond_to_address_mask_broadcast=0&#x20;ip','[{\"cis\": [\"3.2\"]}]'),(23516,'Enable&#x20;Strong&#x20;TCP&#x20;Sequence&#x20;Number&#x20;Generation.','The&#x20;variable&#x20;TCP_STRONG_ISS&#x20;defines&#x20;the&#x20;mechanism&#x20;used&#x20;for&#x20;TCP&#x20;initial&#x20;sequence&#x20;number&#x20;generation.&#x20;If&#x20;an&#x20;attacker&#x20;can&#x20;predict&#x20;the&#x20;next&#x20;sequence&#x20;number,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;inject&#x20;fraudulent&#x20;packets&#x20;into&#x20;the&#x20;data&#x20;stream&#x20;to&#x20;hijack&#x20;the&#x20;session.','The&#x20;RFC&#x20;1948&#x20;method&#x20;is&#x20;widely&#x20;accepted&#x20;as&#x20;the&#x20;strongest&#x20;mechanism&#x20;for&#x20;TCP&#x20;packet&#x20;generation.&#x20;This&#x20;makes&#x20;remote&#x20;session&#x20;hijacking&#x20;attacks&#x20;more&#x20;difficult,&#x20;as&#x20;well&#x20;as&#x20;any&#x20;other&#x20;network-based&#x20;attack&#x20;that&#x20;relies&#x20;on&#x20;predicting&#x20;TCP&#x20;sequence&#x20;number&#x20;information.&#x20;It&#x20;is&#x20;theoretically&#x20;possible&#x20;that&#x20;there&#x20;may&#x20;be&#x20;a&#x20;small&#x20;performance&#x20;hit&#x20;in&#x20;connection&#x20;setup&#x20;time&#x20;when&#x20;this&#x20;setting&#x20;is&#x20;used,&#x20;but&#x20;there&#x20;are&#x20;no&#x20;publicly&#x20;available&#x20;benchmarks&#x20;that&#x20;establish&#x20;this.','','To&#x20;set&#x20;the&#x20;TCP_STRONG_ISS&#x20;parameter&#x20;on&#x20;a&#x20;running&#x20;system,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_strong_iss=2&#x20;tcp','[{\"cis\": [\"3.3\"]}]'),(23517,'Disable&#x20;Response&#x20;to&#x20;ICMP&#x20;Broadcast&#x20;Timestamp&#x20;Requests.','This&#x20;setting&#x20;controls&#x20;whether&#x20;Solaris&#x20;will&#x20;respond&#x20;to&#x20;ICMP&#x20;broadcast&#x20;timestamp&#x20;requests.','Reduce&#x20;attack&#x20;surface&#x20;by&#x20;restricting&#x20;this&#x20;vector&#x20;used&#x20;for&#x20;host&#x20;discovery&#x20;and&#x20;to&#x20;prevent&#x20;denial&#x20;of&#x20;service&#x20;attacks.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_respond_to_timestamp_broadcast=0&#x20;ip','[{\"cis\": [\"3.4\"]}]'),(23518,'Disable&#x20;Source&#x20;Packet&#x20;Forwarding.','This&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;IPv4&#x20;or&#x20;IPv6&#x20;configuration&#x20;will&#x20;forward&#x20;packets&#x20;with&#x20;IPv4&#x20;routing&#x20;options&#x20;or&#x20;IPv6&#x20;routing&#x20;headers.','Keep&#x20;this&#x20;parameter&#x20;disabled&#x20;to&#x20;prevent&#x20;denial&#x20;of&#x20;service&#x20;attacks&#x20;through&#x20;spoofed&#x20;packets.','','To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv4&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_forward_src_routed=0&#x20;ipv4.&#x20;To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv6&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_forward_src_routed=0&#x20;ipv6','[{\"cis\": [\"3.5\"]}]'),(23519,'Disable&#x20;Directed&#x20;Broadcast&#x20;Packet&#x20;Forwarding.','This&#x20;setting&#x20;controls&#x20;whether&#x20;Solaris&#x20;forwards&#x20;broadcast&#x20;packets&#x20;for&#x20;a&#x20;specific&#x20;network&#x20;if&#x20;it&#x20;is&#x20;directly&#x20;connected&#x20;to&#x20;the&#x20;machine.','Keep&#x20;this&#x20;parameter&#x20;disabled&#x20;to&#x20;prevent&#x20;denial&#x20;of&#x20;service&#x20;attacks.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_forward_directed_broadcasts=0&#x20;ip','[{\"cis\": [\"3.6\"]}]'),(23520,'Enable&#x20;Stack&#x20;Protection.','Buffer&#x20;overflow&#x20;exploits&#x20;have&#x20;been&#x20;the&#x20;basis&#x20;for&#x20;many&#x20;highly&#x20;publicized&#x20;compromises&#x20;and&#x20;defacements&#x20;of&#x20;large&#x20;numbers&#x20;of&#x20;Internet&#x20;connected&#x20;systems.&#x20;Many&#x20;of&#x20;the&#x20;automated&#x20;tools&#x20;in&#x20;use&#x20;by&#x20;system&#x20;attackers&#x20;exploit&#x20;well-known&#x20;buffer&#x20;overflow&#x20;problems&#x20;in&#x20;vendor-supplied&#x20;and&#x20;third&#x20;party&#x20;software.','Enabling&#x20;stack&#x20;protection&#x20;prevents&#x20;certain&#x20;classes&#x20;of&#x20;buffer&#x20;overflow&#x20;attacks&#x20;and&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;enhancement.&#x20;However,&#x20;this&#x20;does&#x20;not&#x20;protect&#x20;against&#x20;buffer&#x20;overflow&#x20;attacks&#x20;that&#x20;do&#x20;not&#x20;execute&#x20;code&#x20;on&#x20;the&#x20;stack&#x20;&#40;such&#x20;as&#x20;return-to-libc&#x20;exploits&#41;.&#x20;While&#x20;most&#x20;of&#x20;the&#x20;Solaris&#x20;OS&#x20;is&#x20;already&#x20;configured&#x20;to&#x20;employ&#x20;a&#x20;non-executable&#x20;stack,&#x20;this&#x20;setting&#x20;is&#x20;still&#x20;recommended&#x20;to&#x20;provide&#x20;a&#x20;more&#x20;comprehensive&#x20;solution&#x20;for&#x20;both&#x20;Solaris&#x20;and&#x20;other&#x20;software&#x20;that&#x20;may&#x20;be&#x20;installed.','','To&#x20;enable&#x20;stack&#x20;protection&#x20;and&#x20;block&#x20;stack-smashing&#x20;attacks,&#x20;run&#x20;the&#x20;following:&#x20;#&#x20;sxadm&#x20;delcust&#x20;nxheap&#x20;#&#x20;sxadm&#x20;delcust&#x20;nxstack','[{\"cis\": [\"3.7\"]}]'),(23521,'Restrict&#x20;Core&#x20;Dumps&#x20;to&#x20;Protected&#x20;Directory.','The&#x20;action&#x20;described&#x20;in&#x20;this&#x20;section&#x20;creates&#x20;a&#x20;protected&#x20;directory&#x20;to&#x20;store&#x20;core&#x20;dumps&#x20;and&#x20;also&#x20;causes&#x20;the&#x20;system&#x20;to&#x20;create&#x20;a&#x20;log&#x20;entry&#x20;whenever&#x20;a&#x20;regular&#x20;process&#x20;dumps&#x20;core.','Core&#x20;dumps,&#x20;particularly&#x20;those&#x20;from&#x20;set-UID&#x20;and&#x20;set-GID&#x20;processes,&#x20;may&#x20;contain&#x20;sensitive&#x20;data.','','To&#x20;implement&#x20;the&#x20;recommendation,&#x20;run&#x20;the&#x20;commands:&#x20;#&#x20;chmod&#x20;700&#x20;/var/share/cores&#x20;#&#x20;coreadm&#x20;-g&#x20;/var/share/cores/core_%n_%f_%u_%g_%t_%p&#x20;&#x20;-e&#x20;log&#x20;-e&#x20;global&#x20;-e&#x20;global-setid&#x20;&#x20;-d&#x20;process&#x20;-d&#x20;proc-setid&#x20;If&#x20;the&#x20;local&#x20;site&#x20;chooses,&#x20;dumping&#x20;of&#x20;core&#x20;files&#x20;can&#x20;be&#x20;completely&#x20;disabled&#x20;with&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;coreadm&#x20;-d&#x20;global&#x20;-d&#x20;global-setid&#x20;-d&#x20;process&#x20;-d&#x20;proc-setid','[{\"cis\": [\"3.8\"]}]'),(23522,'Disable&#x20;Response&#x20;to&#x20;ICMP&#x20;Timestamp&#x20;Requests.','This&#x20;setting&#x20;controls&#x20;whether&#x20;Solaris&#x20;will&#x20;respond&#x20;to&#x20;ICMP&#x20;timestamp&#x20;requests.','Reduce&#x20;attack&#x20;surface&#x20;by&#x20;restricting&#x20;this&#x20;vector&#x20;used&#x20;for&#x20;host&#x20;discovery.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_respond_to_timestamp=0&#x20;ip','[{\"cis\": [\"3.9\"]}]'),(23523,'Disable&#x20;Response&#x20;to&#x20;Multicast&#x20;Echo&#x20;Request.','These&#x20;settings&#x20;control&#x20;whether&#x20;Solaris&#x20;responds&#x20;to&#x20;multicast&#x20;IPv4&#x20;and&#x20;IPv6&#x20;echo&#x20;requests.','Reduce&#x20;attack&#x20;surface&#x20;by&#x20;restricting&#x20;this&#x20;vector&#x20;used&#x20;for&#x20;host&#x20;discovery&#x20;and&#x20;to&#x20;prevent&#x20;denial&#x20;of&#x20;service&#x20;attacks.','','To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv4&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_respond_to_echo_multicast=0&#x20;ipv4.&#x20;To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv6&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_respond_to_echo_multicast=0&#x20;ipv6','[{\"cis\": [\"3.10\"]}]'),(23524,'Ignore&#x20;ICMP&#x20;Redirect&#x20;Messages.','These&#x20;settings&#x20;control&#x20;whether&#x20;Solaris&#x20;will&#x20;ignore&#x20;ICMP&#x20;redirect&#x20;messages.','IP&#x20;redirects&#x20;should&#x20;not&#x20;be&#x20;necessary&#x20;in&#x20;a&#x20;well-designed&#x20;and&#x20;maintained&#x20;network.&#x20;Set&#x20;to&#x20;a&#x20;value&#x20;of&#x20;1&#x20;if&#x20;there&#x20;is&#x20;a&#x20;high&#x20;risk&#x20;for&#x20;a&#x20;DoS&#x20;attack.&#x20;Otherwise,&#x20;the&#x20;default&#x20;value&#x20;of&#x20;0&#x20;is&#x20;sufficient.','','To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv4&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_ignore_redirect=1&#x20;ipv4.&#x20;To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv6&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_ignore_redirect=1&#x20;ipv6','[{\"cis\": [\"3.11\"]}]'),(23525,'Set&#x20;Strict&#x20;Multihoming.','These&#x20;settings&#x20;control&#x20;whether&#x20;a&#x20;packet&#x20;arriving&#x20;on&#x20;a&#x20;non-forwarding&#x20;interface&#x20;can&#x20;be&#x20;accepted&#x20;for&#x20;an&#x20;IP&#x20;address&#x20;that&#x20;is&#x20;not&#x20;explicitly&#x20;configured&#x20;on&#x20;that&#x20;interface.','Enable&#x20;this&#x20;setting&#x20;for&#x20;systems&#x20;that&#x20;have&#x20;interfaces&#x20;that&#x20;cross&#x20;strict&#x20;networking&#x20;domains&#x20;&#40;for&#x20;example,&#x20;a&#x20;firewall&#x20;or&#x20;a&#x20;VPN&#x20;node&#41;.','','To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv4&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_strict_dst_multihoming=1&#x20;ipv4.&#x20;To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv6&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_strict_dst_multihoming=1&#x20;ipv6','[{\"cis\": [\"3.12\"]}]'),(23526,'Disable&#x20;ICMP&#x20;Redirect&#x20;Messages.','These&#x20;setting&#x20;controls&#x20;whether&#x20;Solaris&#x20;sends&#x20;ICMPv4&#x20;and&#x20;ICMPv6&#x20;redirect&#x20;messages.','A&#x20;malicious&#x20;user&#x20;can&#x20;exploit&#x20;the&#x20;ability&#x20;of&#x20;the&#x20;system&#x20;to&#x20;send&#x20;ICMP&#x20;redirects&#x20;by&#x20;continually&#x20;sending&#x20;packets&#x20;to&#x20;the&#x20;system,&#x20;forcing&#x20;the&#x20;system&#x20;to&#x20;respond&#x20;with&#x20;ICMP&#x20;redirect&#x20;messages,&#x20;resulting&#x20;in&#x20;an&#x20;adverse&#x20;impact&#x20;on&#x20;the&#x20;CPU&#x20;performance&#x20;of&#x20;the&#x20;system.','','To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv4&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;send_redirects=off&#x20;ipv4.&#x20;To&#x20;enforce&#x20;this&#x20;setting&#x20;for&#x20;IPv6&#x20;packets,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;send_redirects=off&#x20;ipv6','[{\"cis\": [\"3.13\"]}]'),(23527,'Disable&#x20;TCP&#x20;Reverse&#x20;IP&#x20;Source&#x20;Routing.','This&#x20;setting&#x20;controls&#x20;whether&#x20;TCP&#x20;reverses&#x20;the&#x20;IP&#x20;source&#x20;routing&#x20;option&#x20;for&#x20;incoming&#x20;connections.','If&#x20;IP&#x20;source&#x20;routing&#x20;is&#x20;needed&#x20;for&#x20;diagnostic&#x20;purposes,&#x20;enable&#x20;it.&#x20;Otherwise&#x20;disable&#x20;it.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_rev_src_routes=0&#x20;tcp','[{\"cis\": [\"3.14\"]}]'),(23528,'Set&#x20;Maximum&#x20;Number&#x20;of&#x20;Half-open&#x20;TCP&#x20;Connections.','This&#x20;setting&#x20;controls&#x20;how&#x20;many&#x20;half-open&#x20;connections&#x20;can&#x20;exist&#x20;for&#x20;a&#x20;TCP&#x20;port.','It&#x20;is&#x20;necessary&#x20;to&#x20;control&#x20;the&#x20;number&#x20;of&#x20;completed&#x20;connections&#x20;to&#x20;the&#x20;system&#x20;to&#x20;provide&#x20;some&#x20;protection&#x20;against&#x20;Denial&#x20;of&#x20;Service&#x20;attacks.&#x20;Note&#x20;that&#x20;the&#x20;value&#x20;of&#x20;4096&#x20;is&#x20;a&#x20;minimum&#x20;to&#x20;establish&#x20;a&#x20;good&#x20;security&#x20;posture&#x20;for&#x20;this&#x20;setting.&#x20;In&#x20;environments&#x20;where&#x20;connections&#x20;numbers&#x20;are&#x20;high,&#x20;such&#x20;as&#x20;a&#x20;busy&#x20;webserver,&#x20;this&#x20;value&#x20;may&#x20;need&#x20;to&#x20;be&#x20;increased.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_conn_req_max_q0=4096&#x20;tcp','[{\"cis\": [\"3.15\"]}]'),(23529,'Set&#x20;Maximum&#x20;Number&#x20;of&#x20;Incoming&#x20;Connections.','This&#x20;setting&#x20;controls&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;incoming&#x20;connections&#x20;that&#x20;can&#x20;be&#x20;accepted&#x20;on&#x20;a&#x20;TCP&#x20;port.','Note&#x20;that&#x20;the&#x20;value&#x20;of&#x20;1024&#x20;is&#x20;a&#x20;minimum&#x20;to&#x20;establish&#x20;a&#x20;good&#x20;security&#x20;posture&#x20;for&#x20;this&#x20;setting.&#x20;In&#x20;environments&#x20;where&#x20;connections&#x20;numbers&#x20;are&#x20;high,&#x20;such&#x20;as&#x20;a&#x20;busy&#x20;webserver,&#x20;this&#x20;value&#x20;may&#x20;need&#x20;to&#x20;be&#x20;increased.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;ipadm&#x20;set-prop&#x20;-p&#x20;_conn_req_max_q=1024&#x20;tcp','[{\"cis\": [\"3.16\"]}]'),(23530,'Disable&#x20;Network&#x20;Routing.','The&#x20;network&#x20;routing&#x20;daemon,&#x20;in.routed,&#x20;manages&#x20;network&#x20;routing&#x20;tables.&#x20;If&#x20;enabled,&#x20;it&#x20;periodically&#x20;supplies&#x20;copies&#x20;of&#x20;the&#x20;system&#039;s&#x20;routing&#x20;tables&#x20;to&#x20;any&#x20;directly&#x20;connected&#x20;hosts&#x20;and&#x20;networks&#x20;and&#x20;picks&#x20;up&#x20;routes&#x20;supplied&#x20;to&#x20;it&#x20;from&#x20;other&#x20;networks&#x20;and&#x20;hosts.','Routing&#x20;Internet&#x20;Protocol&#x20;&#40;RIP&#41;&#x20;is&#x20;a&#x20;legacy&#x20;protocol&#x20;with&#x20;a&#x20;number&#x20;of&#x20;security&#x20;weaknesses&#x20;including&#x20;a&#x20;lack&#x20;of&#x20;authentication,&#x20;zoning,&#x20;pruning,&#x20;etc.','','To&#x20;enforce&#x20;this&#x20;setting&#x20;and&#x20;disable&#x20;IPv4&#x20;routing,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;routeadm&#x20;-d&#x20;ipv4-forwarding&#x20;-d&#x20;ipv4-routing.&#x20;To&#x20;enforce&#x20;this&#x20;setting&#x20;and&#x20;disable&#x20;IPv6&#x20;routing,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;routeadm&#x20;-d&#x20;ipv6-forwarding&#x20;-d&#x20;ipv6-routing','[{\"cis\": [\"3.17\"]}]'),(23531,'Create&#x20;CIS&#x20;Audit&#x20;Class.','To&#x20;group&#x20;a&#x20;set&#x20;of&#x20;related&#x20;audit&#x20;events,&#x20;the&#x20;Solaris&#x20;Audit&#x20;service&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;sites&#x20;to&#x20;define&#x20;their&#x20;own&#x20;audit&#x20;classes&#x20;that&#x20;contain&#x20;just&#x20;those&#x20;events&#x20;that&#x20;the&#x20;site&#x20;wants&#x20;to&#x20;audit.','To&#x20;simplify&#x20;administration,&#x20;a&#x20;CIS&#x20;specific&#x20;audit&#x20;class&#x20;should&#x20;be&#x20;created.','','To&#x20;create&#x20;the&#x20;CIS&#x20;audit&#x20;class,&#x20;edit&#x20;the&#x20;/etc/security/audit_class&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;entry&#x20;before&#x20;the&#x20;last&#x20;line&#x20;of&#x20;the&#x20;file:&#x20;0x0100000000000000:cis:CIS&#x20;Solaris&#x20;Benchmark','[{\"cis\": [\"4.1\"]}]'),(23532,'Enable&#x20;Auditing&#x20;of&#x20;Incoming&#x20;Network&#x20;Connections.','The&#x20;Solaris&#x20;Audit&#x20;service&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;incoming&#x20;network&#x20;connections&#x20;to&#x20;any&#x20;listening&#x20;service&#x20;running&#x20;on&#x20;the&#x20;system.','This&#x20;recommendation&#x20;will&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;that&#x20;contains&#x20;information&#x20;related&#x20;to&#x20;incoming&#x20;network&#x20;connections.&#x20;While&#x20;this&#x20;functionality&#x20;can&#x20;be&#x20;enabled&#x20;using&#x20;service-specific&#x20;mechanisms,&#x20;using&#x20;the&#x20;Solaris&#x20;Audit&#x20;service&#x20;provides&#x20;a&#x20;more&#x20;centralized&#x20;and&#x20;complete&#x20;window&#x20;into&#x20;incoming&#x20;network&#x20;activity.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;commands&#x20;to&#x20;modify&#x20;the&#x20;/etc/security/audit_event&#x20;file&#x20;and&#x20;add&#x20;the&#x20;cis&#x20;audit&#x20;class&#x20;to&#x20;the&#x20;following&#x20;audit&#x20;events:&#x20;#&#x20;cp&#x20;/etc/security/audit_event&#x20;/etc/security/audit_event.orig&#x20;#&#x20;awk&#x20;&#039;BEGIN{FS=:;&#x20;OFS=:}&#x20;{if&#x20;&#40;$2&#x20;~&#x20;/AUE_ACCEPT|AUE_CONNECT|AUE_SOCKACCEPT|AUE_SOCKCONNECT|AUE_inetd_connect/&#41;&#x20;$4=$4,cis;}&#x20;{print}&#x20;&#039;&#x20;etc/security/audit_event&#x20;&gt;&#x20;/etc/security/audit_event.out&#x20;#&#x20;cp&#x20;/etc/security/audit_event.out&#x20;/etc/security/audit_event','[{\"cis\": [\"4.2\"]}]'),(23533,'Enable&#x20;Auditing&#x20;of&#x20;File&#x20;Metadata&#x20;Modification&#x20;Events.','The&#x20;Solaris&#x20;Audit&#x20;service&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;file&#x20;metadata&#x20;modification&#x20;events&#x20;for&#x20;every&#x20;process&#x20;running&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;will&#x20;allow&#x20;the&#x20;auditing&#x20;service&#x20;to&#x20;determine&#x20;when&#x20;file&#x20;ownership,&#x20;permissions&#x20;and&#x20;related&#x20;information&#x20;is&#x20;changed.','This&#x20;recommendation&#x20;will&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;that&#x20;contains&#x20;information&#x20;related&#x20;to&#x20;changes&#x20;of&#x20;file&#x20;metadata.&#x20;The&#x20;Solaris&#x20;Audit&#x20;service&#x20;is&#x20;used&#x20;to&#x20;provide&#x20;a&#x20;more&#x20;centralized&#x20;and&#x20;complete&#x20;window&#x20;into&#x20;activities&#x20;such&#x20;as&#x20;these.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;commands&#x20;to&#x20;modify&#x20;the&#x20;/etc/security/audit_event&#x20;file&#x20;and&#x20;add&#x20;the&#x20;cis&#x20;audit&#x20;class&#x20;to&#x20;the&#x20;following&#x20;audit&#x20;events:&#x20;#&#x20;awk&#x20;&#039;BEGIN{FS=:;&#x20;OFS=:}&#x20;{if&#x20;&#40;$2&#x20;~&#x20;/AUE_CHMOD|AUE_CHOWN|AUE_FCHOWN|AUE_FCHMOD|AUE_LCHOWN|AUE_ACLSET|AUE_FACLSET/&#41;&#x20;$4=$4,cis;}&#x20;{print}&#x20;&#039;&#x20;/etc/security/audit_event&#x20;&gt;&#x20;/etc/security/audit_event.CIS&#x20;#&#x20;cp&#x20;/etc/security/audit_event.CIS&#x20;/etc/security/audit_event','[{\"cis\": [\"4.3\"]}]'),(23534,'Enable&#x20;Auditing&#x20;of&#x20;Process&#x20;and&#x20;Privilege&#x20;Events.','The&#x20;Solaris&#x20;Audit&#x20;service&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;the&#x20;use&#x20;of&#x20;privileges&#x20;by&#x20;processes&#x20;running&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;will&#x20;capture&#x20;events&#x20;such&#x20;as&#x20;the&#x20;setting&#x20;of&#x20;UID&#x20;and&#x20;GID&#x20;values,&#x20;setting&#x20;of&#x20;privileges,&#x20;as&#x20;well&#x20;as&#x20;the&#x20;use&#x20;of&#x20;functionality&#x20;such&#x20;as&#x20;chroot&#40;2&#41;.','This&#x20;recommendation&#x20;will&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;that&#x20;contains&#x20;information&#x20;related&#x20;to&#x20;the&#x20;use&#x20;of&#x20;privileges&#x20;by&#x20;processes&#x20;running&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;Solaris&#x20;Audit&#x20;service&#x20;is&#x20;used&#x20;to&#x20;provide&#x20;a&#x20;more&#x20;centralized&#x20;and&#x20;complete&#x20;window&#x20;into&#x20;activities&#x20;such&#x20;as&#x20;these.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;commands&#x20;to&#x20;modify&#x20;the&#x20;/etc/security/audit_event&#x20;file&#x20;and&#x20;add&#x20;the&#x20;cis&#x20;audit&#x20;class&#x20;to&#x20;the&#x20;following&#x20;audit&#x20;events:&#x20;#&#x20;awk&#x20;&#039;BEGIN{FS=:;&#x20;OFS=:}&#x20;{if&#x20;&#40;$2&#x20;~&#x20;/AUE_CHROOT|AUE_SETREUID|AUE_SETREGID|AUE_FCHROOT|AUE_PFEXEC|AUE_SETUID|AUE_NICE|AUE_SETGID|AUE_PRIOCNTLSYS|AUE_SETEGID|AUE_SETEUID|AUE_SETPPRIV|AUE_SETSID|AUE_SETPGID/&#41;$4=$4,cis;}&#x20;{print}&#x20;&#039;&#x20;/etc/security/audit_event&#x20;&gt;&#x20;/etc/security/audit_event.CIS&#x20;#&#x20;cp&#x20;/etc/security/audit_event.CIS&#x20;/etc/security/audit_event','[{\"cis\": [\"4.4\"]}]'),(23535,'Configure&#x20;Solaris&#x20;Auditing.','Solaris&#x20;auditing&#x20;service&#x20;keeps&#x20;a&#x20;record&#x20;of&#x20;how&#x20;a&#x20;system&#x20;is&#x20;being&#x20;used.&#x20;Solaris&#x20;auditing&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;record&#x20;different&#x20;classes&#x20;of&#x20;events&#x20;based&#x20;upon&#x20;site&#x20;policy.&#x20;This&#x20;recommendation&#x20;will&#x20;set&#x20;and&#x20;verify&#x20;a&#x20;consensus-developed&#x20;auditing&#x20;policy.&#x20;That&#x20;said,&#x20;all&#x20;organizations&#x20;are&#x20;encouraged&#x20;to&#x20;tailor&#x20;this&#x20;policy&#x20;based&#x20;upon&#x20;their&#x20;specific&#x20;needs.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;the&#x20;Solaris&#x20;auditing&#x20;service&#x20;including&#x20;how&#x20;to&#x20;filter&#x20;and&#x20;view&#x20;events,&#x20;see&#x20;the&#x20;Oracle&#x20;Solaris&#x20;product&#x20;documentation.&#x20;The&#x20;cis&#x20;class&#x20;is&#x20;a&#x20;custom&#x20;class&#x20;that&#x20;CIS&#x20;recommends&#x20;creating&#x20;that&#x20;includes&#x20;specifically&#x20;those&#x20;events&#x20;that&#x20;are&#x20;of&#x20;interest&#x20;&#40;defined&#x20;in&#x20;the&#x20;sections&#x20;above&#41;.&#x20;In&#x20;addition&#x20;to&#x20;those&#x20;events,&#x20;this&#x20;recommendation&#x20;also&#x20;includes&#x20;auditing&#x20;of&#x20;login&#x20;and&#x20;logout&#x20;&#40;lo&#41;&#x20;events,&#x20;administrative&#x20;&#40;ad&#41;&#x20;events,&#x20;file&#x20;transfer&#x20;&#40;ft&#41;&#x20;events,&#x20;and&#x20;command&#x20;execution&#x20;&#40;ex&#41;&#x20;events.&#x20;This&#x20;recommendation&#x20;also&#x20;configures&#x20;the&#x20;Solaris&#x20;auditing&#x20;service&#x20;to&#x20;capture&#x20;and&#x20;report&#x20;command&#x20;line&#x20;arguments&#x20;&#40;for&#x20;command&#x20;execution&#x20;events&#41;&#x20;and&#x20;the&#x20;zone&#x20;name&#x20;in&#x20;which&#x20;a&#x20;command&#x20;was&#x20;executed&#x20;&#40;for&#x20;global&#x20;and&#x20;non-global&#x20;zones&#41;.&#x20;Further,&#x20;this&#x20;recommendation&#x20;sets&#x20;a&#x20;disk&#x20;utilization&#x20;threshold&#x20;of&#x20;1%.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x20;crossed&#x20;&#40;for&#x20;the&#x20;volume&#x20;that&#x20;includes&#x20;/var/shares/audit&#41;,&#x20;then&#x20;a&#x20;warning&#x20;e-mail&#x20;will&#x20;be&#x20;sent&#x20;to&#x20;advise&#x20;the&#x20;system&#x20;administrators&#x20;that&#x20;audit&#x20;events&#x20;may&#x20;be&#x20;lost&#x20;if&#x20;the&#x20;disk&#x20;becomes&#x20;full.&#x20;Finally,&#x20;this&#x20;recommendation&#x20;will&#x20;also&#x20;ensure&#x20;that&#x20;new&#x20;audit&#x20;trails&#x20;are&#x20;created&#x20;at&#x20;the&#x20;start&#x20;of&#x20;each&#x20;new&#x20;day&#x20;&#40;to&#x20;help&#x20;keep&#x20;the&#x20;size&#x20;of&#x20;the&#x20;files&#x20;small&#x20;to&#x20;facilitate&#x20;analysis&#41;.','The&#x20;consensus&#x20;settings&#x20;described&#x20;in&#x20;this&#x20;section&#x20;are&#x20;an&#x20;effort&#x20;to&#x20;log&#x20;interesting&#x20;system&#x20;events&#x20;without&#x20;consuming&#x20;excessive&#x20;amounts&#x20;of&#x20;resources&#x20;logging&#x20;significant&#x20;but&#x20;usually&#x20;uninteresting&#x20;system&#x20;calls.','','To&#x20;enforce&#x20;this&#x20;setting,&#x20;use&#x20;the&#x20;commands:&#x20;#&#x20;auditconfig&#x20;-conf&#x20;#&#x20;auditconfig&#x20;-setflags&#x20;lo,ad,ft,ex,cis&#x20;#auditconfig&#x20;-setnaflags&#x20;lo&#x20;#&#x20;auditconfig&#x20;-setpolicy&#x20;cnt,argv,zonename&#x20;#&#x20;auditconfig&#x20;-setplugin&#x20;audit_binfile&#x20;active&#x20;p_minfree=1&#x20;#&#x20;audit&#x20;-s&#x20;#&#x20;usermod&#x20;-K&#x20;audit_flags=lo,ad,ft,ex,cis:no&#x20;root&#x20;#&#x20;EDITOR=ed&#x20;crontab&#x20;-e&#x20;root&#x20;0&#x20;0&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/audit&#x20;-n&#x20;#&#x20;chown&#x20;root:root&#x20;/var/shares/audit&#x20;#&#x20;chmod&#x20;750&#x20;/var/shares/audit','[{\"cis\": [\"4.5\"]}]'),(23536,'Set&#x20;Sticky&#x20;Bit&#x20;on&#x20;World&#x20;Writable&#x20;Directories.','When&#x20;the&#x20;so-called&#x20;sticky&#x20;bit&#x20;&#40;set&#x20;with&#x20;chmod&#x20;+t&#41;&#x20;is&#x20;set&#x20;on&#x20;a&#x20;directory,&#x20;then&#x20;only&#x20;the&#x20;owner&#x20;of&#x20;a&#x20;file&#x20;may&#x20;remove&#x20;that&#x20;file&#x20;from&#x20;the&#x20;directory&#x20;&#40;as&#x20;opposed&#x20;to&#x20;the&#x20;usual&#x20;behavior&#x20;where&#x20;anybody&#x20;with&#x20;write&#x20;access&#x20;to&#x20;that&#x20;directory&#x20;may&#x20;remove&#x20;the&#x20;file&#41;.','Files&#x20;in&#x20;directories&#x20;that&#x20;have&#x20;had&#x20;the&#x20;&#039;sticky&#x20;bit&#039;&#x20;set,&#x20;can&#x20;only&#x20;be&#x20;deleted&#x20;by&#x20;users&#x20;that&#x20;have&#x20;both&#x20;write&#x20;permissions&#x20;for&#x20;the&#x20;directory&#x20;in&#x20;which&#x20;the&#x20;file&#x20;resides,&#x20;as&#x20;well&#x20;as&#x20;ownership&#x20;of&#x20;the&#x20;file&#x20;or&#x20;directory,&#x20;or&#x20;has&#x20;sufficient&#x20;privilege.&#x20;As&#x20;this&#x20;prevents&#x20;users&#x20;from&#x20;overwriting&#x20;each&#x20;other&#039;s&#x20;files,&#x20;whether&#x20;it&#x20;be&#x20;accidental&#x20;or&#x20;malicious,&#x20;it&#x20;is&#x20;generally&#x20;appropriate&#x20;for&#x20;most&#x20;world-writable&#x20;directories&#x20;&#40;e.g.,&#x20;/tmp&#41;.&#x20;However,&#x20;consult&#x20;appropriate&#x20;vendor&#x20;documentation&#x20;before&#x20;blindly&#x20;applying&#x20;the&#x20;sticky&#x20;bit&#x20;to&#x20;any&#x20;world&#x20;writable&#x20;directories&#x20;found,&#x20;in&#x20;order&#x20;to&#x20;avoid&#x20;breaking&#x20;any&#x20;application&#x20;dependencies&#x20;on&#x20;a&#x20;given&#x20;directory.','','To&#x20;set&#x20;the&#x20;sticky&#x20;bit&#x20;on&#x20;a&#x20;directory,&#x20;run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;chmod&#x20;+t&#x20;[directory&#x20;name]','[{\"cis\": [\"5.1\"]}]'),(23537,'Disable&#x20;login:&#x20;Services&#x20;on&#x20;Serial&#x20;Ports.','The&#x20;svccfg&#x20;command&#x20;provides&#x20;service&#x20;administration&#x20;for&#x20;the&#x20;lower&#x20;level&#x20;of&#x20;the&#x20;Service&#x20;Access&#x20;Facility&#x20;hierarchy&#x20;and&#x20;can&#x20;be&#x20;used&#x20;to&#x20;disable&#x20;the&#x20;ability&#x20;to&#x20;login&#x20;on&#x20;a&#x20;particular&#x20;port.','Login&#x20;services&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;any&#x20;serial&#x20;ports&#x20;that&#x20;are&#x20;not&#x20;strictly&#x20;required&#x20;to&#x20;support&#x20;the&#x20;mission&#x20;of&#x20;the&#x20;system.&#x20;This&#x20;action&#x20;can&#x20;be&#x20;safely&#x20;performed&#x20;even&#x20;when&#x20;console&#x20;access&#x20;is&#x20;provided&#x20;using&#x20;a&#x20;serial&#x20;port.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;svcadm&#x20;disable&#x20;svc:/system/console-login:terma&#x20;#svcadm&#x20;disable&#x20;svc:/system/console-login:termb','[{\"cis\": [\"6.1\"]}]'),(23539,'Restrict&#x20;at/cron&#x20;to&#x20;Authorized&#x20;Users.','The&#x20;cron.allow&#x20;and&#x20;at.allow&#x20;files&#x20;contain&#x20;a&#x20;list&#x20;of&#x20;users&#x20;who&#x20;are&#x20;allowed&#x20;to&#x20;run&#x20;the&#x20;crontab&#x20;and&#x20;at&#x20;commands&#x20;to&#x20;submit&#x20;jobs&#x20;to&#x20;be&#x20;run&#x20;at&#x20;scheduled&#x20;intervals.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;needs&#x20;the&#x20;ability&#x20;to&#x20;schedule&#x20;jobs.&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.&#x20;Much&#x20;more&#x20;effective&#x20;access&#x20;controls&#x20;for&#x20;the&#x20;cron&#x20;system&#x20;can&#x20;be&#x20;obtained&#x20;by&#x20;using&#x20;Role-Based&#x20;Access&#x20;Controls&#x20;&#40;RBAC&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;mv&#x20;/etc/cron.d/cron.deny&#x20;/etc/cron.d/cron.deny.cis&#x20;#&#x20;mv&#x20;/etc/cron.d/at.deny&#x20;/etc/cron.d/at.deny.cis&#x20;#&#x20;echo&#x20;root&#x20;&gt;&#x20;/etc/cron.d/cron.allow&#x20;#&#x20;cp&#x20;/dev/null&#x20;/etc/cron.d/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d/cron.allow&#x20;/etc/cron.d/at.allow&#x20;#&#x20;chmod&#x20;400&#x20;/etc/cron.d/cron.allow&#x20;/etc/cron.d/at.allow','[{\"cis\": [\"6.3\"]}]'),(23540,'Set&#x20;Default&#x20;Screen&#x20;Lock&#x20;for&#x20;GNOME&#x20;Users.','The&#x20;timeout&#x20;parameter&#x20;dictates&#x20;the&#x20;invocation&#x20;of&#x20;a&#x20;password-protected&#x20;screen&#x20;saver&#x20;after&#x20;a&#x20;specified&#x20;time&#x20;of&#x20;keyboard&#x20;and&#x20;mouse&#x20;inactivity,&#x20;specific&#x20;to&#x20;the&#x20;xscreensaver&#x20;application&#x20;used&#x20;in&#x20;the&#x20;GNOME&#x20;windowing&#x20;environment.','As&#x20;a&#x20;screensaver&#x20;timeout&#x20;provides&#x20;protection&#x20;for&#x20;a&#x20;desktop&#x20;that&#x20;has&#x20;not&#x20;been&#x20;locked&#x20;by&#x20;the&#x20;user&#x20;upon&#x20;his/her&#x20;departure,&#x20;to&#x20;help&#x20;prevent&#x20;session&#x20;hijacking,&#x20;this&#x20;value&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/usr/share/X11/app-defaults&#x20;#&#x20;cp&#x20;XScreenSaver&#x20;XScreenSaver.orig&#x20;#&#x20;vi&#x20;XScreenSaver:&#x20;timeout:&#x20;0:10:00,&#x20;lockTimeout:&#x20;0:00:00,&#x20;lock:&#x20;True&#x20;#&#x20;mv&#x20;xScreenSaver.CIS&#x20;xScreenSaver','[{\"cis\": [\"6.4\"]}]'),(23541,'Remove&#x20;Autologin&#x20;Capabilities&#x20;from&#x20;the&#x20;GNOME&#x20;desktop.','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;used&#x20;for&#x20;login&#x20;session&#x20;management.&#x20;See&#x20;the&#x20;manual&#x20;page&#x20;gdm&#40;1&#41;&#x20;for&#x20;more&#x20;information.&#x20;By&#x20;default,&#x20;GNOME&#x20;automatic&#x20;login&#x20;is&#x20;defined&#x20;in&#x20;/etc/pam.d/gdm-autologin&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;access&#x20;the&#x20;system&#x20;without&#x20;a&#x20;password.','As&#x20;automatic&#x20;logins&#x20;are&#x20;a&#x20;known&#x20;security&#x20;risk&#x20;for&#x20;other&#x20;than&#x20;kiosk&#x20;types&#x20;of&#x20;systems,&#x20;GNOME&#x20;automatic&#x20;login&#x20;should&#x20;be&#x20;disabled&#x20;in&#x20;/etc/pam.d/gdm-autologin.','','Comment&#x20;out&#x20;or&#x20;remove&#x20;all&#x20;lines&#x20;from&#x20;/etc/pam.d/gdm-autologin','[{\"cis\": [\"6.5\"]}]'),(23542,'Set&#x20;Delay&#x20;between&#x20;Failed&#x20;Login&#x20;Attempts&#x20;to&#x20;4.','The&#x20;SLEEPTIME&#x20;variable&#x20;in&#x20;the&#x20;/etc/default/login&#x20;file&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;seconds&#x20;to&#x20;wait&#x20;before&#x20;printing&#x20;the&#x20;login&#x20;incorrect&#x20;message&#x20;when&#x20;a&#x20;bad&#x20;password&#x20;is&#x20;provided.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;SLEEPTIME&#x20;is&#x20;4&#x20;seconds.','As&#x20;an&#x20;immediate&#x20;return&#x20;of&#x20;an&#x20;error&#x20;message,&#x20;coupled&#x20;with&#x20;the&#x20;capability&#x20;to&#x20;try&#x20;again&#x20;may&#x20;facilitate&#x20;automatic&#x20;and&#x20;rapid-fire&#x20;brute-force&#x20;password&#x20;attacks&#x20;by&#x20;a&#x20;malicious&#x20;user,&#x20;this&#x20;delay&#x20;time&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;cd&#x20;/etc/default&#x20;#&#x20;cp&#x20;login&#x20;login.orig&#x20;#&#x20;nano&#x20;login&#x20;SLEEPTIME=4','[{\"cis\": [\"6.6\"]}]'),(23543,'Disable&#x20;Rhost-based&#x20;Authentication&#x20;for&#x20;SSH.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;existing&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files,&#x20;which&#x20;may&#x20;apply&#x20;to&#x20;application&#x20;rather&#x20;than&#x20;user&#x20;logins,&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;SSH.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;nano&#x20;/etc/ssh/sshd_config&#x20;-&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"6.7\"]}]'),(23545,'Disable&#x20;root&#x20;login&#x20;for&#x20;SSH.','The&#x20;PermitRootLogin&#x20;value&#x20;&#40;in&#x20;/etc/ssh/sshd_config&#41;&#x20;allows&#x20;for&#x20;direct&#x20;root&#x20;login&#x20;by&#x20;a&#x20;remote&#x20;user/application&#x20;to&#x20;resources&#x20;on&#x20;the&#x20;local&#x20;host.','By&#x20;default,&#x20;it&#x20;is&#x20;not&#x20;possible&#x20;for&#x20;the&#x20;root&#x20;account&#x20;to&#x20;log&#x20;directly&#x20;into&#x20;the&#x20;system&#x20;console&#x20;because&#x20;the&#x20;account&#x20;is&#x20;configured&#x20;as&#x20;a&#x20;role.&#x20;This&#x20;setting&#x20;therefore&#x20;does&#x20;not&#x20;significantly&#x20;alter&#x20;the&#x20;security&#x20;posture&#x20;of&#x20;the&#x20;system&#x20;unless&#x20;the&#x20;root&#x20;account&#x20;is&#x20;changed&#x20;from&#x20;this&#x20;default&#x20;and&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;normal&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;nano&#x20;/etc/ssh/sshd_config&#x20;-&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"6.9\"]}]'),(23546,'Disable&#x20;Host-based&#x20;Authentication&#x20;for&#x20;Login-based&#x20;Services.','The&#x20;.rhosts&#x20;files&#x20;are&#x20;used&#x20;for&#x20;automatic&#x20;login&#x20;to&#x20;remote&#x20;hosts&#x20;and&#x20;contain&#x20;username&#x20;and&#x20;hostname&#x20;combinations.&#x20;The&#x20;.rhosts&#x20;files&#x20;are&#x20;unencrypted&#x20;&#40;usually&#x20;group-&#x20;or&#x20;world-readable&#41;&#x20;and&#x20;present&#x20;a&#x20;serious&#x20;risk&#x20;in&#x20;that&#x20;a&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;the&#x20;information&#x20;within&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;a&#x20;remote&#x20;host&#x20;with&#x20;the&#x20;privileges&#x20;of&#x20;the&#x20;original&#x20;application&#x20;or&#x20;user.','The&#x20;use&#x20;of&#x20;.rhosts&#x20;authentication&#x20;is&#x20;an&#x20;old&#x20;and&#x20;insecure&#x20;protocol&#x20;and&#x20;can&#x20;be&#x20;replaced&#x20;with&#x20;public-key&#x20;authentication&#x20;using&#x20;Secure&#x20;Shell.&#x20;As&#x20;automatic&#x20;authentication&#x20;settings&#x20;in&#x20;the&#x20;.rhosts&#x20;files&#x20;can&#x20;provide&#x20;a&#x20;malicious&#x20;user&#x20;with&#x20;sensitive&#x20;system&#x20;credentials,&#x20;the&#x20;use&#x20;of&#x20;.rhosts&#x20;files&#x20;should&#x20;be&#x20;disabled.&#x20;It&#x20;should&#x20;be&#x20;noted&#x20;that&#x20;by&#x20;default&#x20;the&#x20;Solaris&#x20;services&#x20;that&#x20;use&#x20;this&#x20;file,&#x20;including&#x20;rsh&#x20;and&#x20;rlogin,&#x20;are&#x20;disabled&#x20;by&#x20;default.','','Edit&#x20;/etc/pam.conf&#x20;and&#x20;any&#x20;/etc/pam.d&#47;&#42;&#x20;results&#x20;from&#x20;audit&#x20;procedure&#x20;and&#x20;comment&#x20;out&#x20;or&#x20;remove&#x20;any&#x20;pam_rhosts_auth&#x20;lines:&#x20;#rlogin&#x20;auth&#x20;sufficient&#x20;pam_rhosts_auth.so.1&#x20;#rsh&#x20;auth&#x20;sufficient&#x20;pam_rhosts_auth.so.1','[{\"cis\": [\"6.10\"]}]'),(23547,'Blocking&#x20;Authentication&#x20;Using&#x20;Empty/Null&#x20;Passwords&#x20;for&#x20;SSH.','The&#x20;PermitEmptyPasswords&#x20;value&#x20;allows&#x20;for&#x20;direct&#x20;login&#x20;through&#x20;SSH&#x20;without&#x20;a&#x20;password&#x20;by&#x20;a&#x20;remote&#x20;user/application&#x20;to&#x20;resources&#x20;on&#x20;the&#x20;local&#x20;host&#x20;in&#x20;the&#x20;same&#x20;way&#x20;a&#x20;standard&#x20;remote&#x20;login&#x20;would.','Permitting&#x20;login&#x20;without&#x20;a&#x20;password&#x20;is&#x20;inherently&#x20;risky.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Edit&#x20;/etc/ssh/sshd_config&#x20;-&#x20;PermitEmptyPasswords&#x20;no&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.11\"]}]'),(23548,'Limit&#x20;Consecutive&#x20;Login&#x20;Attempts&#x20;for&#x20;SSH.','The&#x20;&#039;MaxAuthTries&#039;&#x20;parameter&#x20;in&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;By&#x20;restricting&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;authentication&#x20;attempts&#x20;before&#x20;the&#x20;server&#x20;terminates&#x20;the&#x20;connection,&#x20;malicious&#x20;users&#x20;are&#x20;blocked&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;host&#x20;by&#x20;using&#x20;repetitive&#x20;brute-force&#x20;login&#x20;exploits.','By&#x20;setting&#x20;the&#x20;authentication&#x20;login&#x20;limit&#x20;to&#x20;a&#x20;low&#x20;value&#x20;this&#x20;will&#x20;disconnect&#x20;the&#x20;attacker&#x20;and&#x20;force&#x20;a&#x20;reconnect,&#x20;which&#x20;severely&#x20;limits&#x20;the&#x20;speed&#x20;of&#x20;such&#x20;brute&#x20;force&#x20;attacks.','','Edit&#x20;/etc/ssh/sshd_config&#x20;-&#x20;MaxAuthTries&#x20;6&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.12\"]}]'),(23549,'Disable&#x20;X11&#x20;Forwarding&#x20;for&#x20;SSH.','The&#x20;X11&#x20;Forwarding&#x20;parameter&#x20;defined&#x20;within&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;specifies&#x20;whether&#x20;or&#x20;not&#x20;X11&#x20;Forwarding&#x20;via&#x20;SSH&#x20;is&#x20;enabled&#x20;on&#x20;the&#x20;server:&#x20;The&#x20;Secure&#x20;Shell&#x20;service&#x20;provides&#x20;an&#x20;encrypted&#x20;&#039;tunnel&#039;&#x20;for&#x20;the&#x20;data&#x20;traffic&#x20;passing&#x20;through&#x20;it.&#x20;While&#x20;commonly&#x20;used&#x20;to&#x20;substitute&#x20;for&#x20;clear-text,&#x20;CLI-based&#x20;remote&#x20;connections&#x20;such&#x20;as&#x20;telnet,&#x20;Secure&#x20;Shell&#x20;can&#x20;be&#x20;used&#x20;to&#x20;forward&#x20;an&#x20;&#039;X&#x20;Window&#039;&#x20;session&#x20;through&#x20;the&#x20;encrypted&#x20;tunnel,&#x20;allowing&#x20;the&#x20;remote&#x20;user&#x20;to&#x20;have&#x20;a&#x20;GUI&#x20;interface.','As&#x20;enabling&#x20;X11Forwarding&#x20;on&#x20;the&#x20;host&#x20;can&#x20;permit&#x20;a&#x20;malicious&#x20;user&#x20;to&#x20;secretly&#x20;open&#x20;another&#x20;X11&#x20;connection&#x20;to&#x20;another&#x20;remote&#x20;client&#x20;during&#x20;the&#x20;session&#x20;and&#x20;perform&#x20;unobtrusive&#x20;activities&#x20;such&#x20;as&#x20;keystroke&#x20;monitoring,&#x20;if&#x20;the&#x20;X11&#x20;services&#x20;are&#x20;not&#x20;required&#x20;for&#x20;the&#x20;system&#039;s&#x20;intended&#x20;function,&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;or&#x20;restricted&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;user&#039;s&#x20;needs.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Edit&#x20;/etc/ssh/sshd_config&#x20;-&#x20;X11Forwarding&#x20;no&#x20;#&#x20;svcadm&#x20;restart&#x20;svc:/network/ssh','[{\"cis\": [\"6.13\"]}]'),(23550,'Disable&#x20;.&quot;nobody&quot;&#x20;Access&#x20;for&#x20;RPC&#x20;Encryption&#x20;Key&#x20;Storage&#x20;Service','This&#x20;action&#x20;listed&#x20;prevents&#x20;keyserv&#x20;from&#x20;using&#x20;default&#x20;keys&#x20;for&#x20;the&#x20;nobody&#x20;user,&#x20;effectively&#x20;stopping&#x20;the&#x20;nobody&#x20;user&#x20;from&#x20;accessing&#x20;information&#x20;via&#x20;Secure&#x20;RPC.','If&#x20;login&#x20;by&#x20;the&#x20;user&#x20;nobody&#x20;is&#x20;allowed&#x20;for&#x20;secure&#x20;RPC,&#x20;there&#x20;is&#x20;an&#x20;increased&#x20;risk&#x20;of&#x20;system&#x20;compromise.&#x20;If&#x20;keyserv&#x20;holds&#x20;a&#x20;private&#x20;key&#x20;for&#x20;the&#x20;nobody&#x20;user,&#x20;it&#x20;will&#x20;be&#x20;used&#x20;by&#x20;key_encryptsession&#x20;to&#x20;compute&#x20;a&#x20;magic&#x20;phrase&#x20;which&#x20;can&#x20;be&#x20;easily&#x20;recovered&#x20;by&#x20;a&#x20;malicious&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Edit&#x20;/etc/default/keyserv&#x20;-&#x20;ENABLE&#x20;NOBODY&#x20;KEYS=NO&#x20;or&#x20;comment&#x20;the&#x20;line','[{\"cis\": [\"6.14\"]}]'),(23551,'Secure&#x20;the&#x20;GRUB&#x20;Menu&#x20;&#40;Intel&#41;.','GRUB&#x20;is&#x20;a&#x20;boot&#x20;loader&#x20;for&#x20;x64&#x20;based&#x20;systems&#x20;that&#x20;permits&#x20;loading&#x20;an&#x20;OS&#x20;image&#x20;from&#x20;any&#x20;location.&#x20;Oracle&#x20;x64&#x20;systems&#x20;support&#x20;the&#x20;use&#x20;of&#x20;a&#x20;GRUB&#x20;Menu&#x20;password&#x20;for&#x20;the&#x20;console.','The&#x20;flexibility&#x20;that&#x20;GRUB&#x20;provides&#x20;creates&#x20;a&#x20;security&#x20;risk&#x20;if&#x20;its&#x20;configuration&#x20;is&#x20;modified&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x20;The&#x20;failsafe&#x20;menu&#x20;entry&#x20;needs&#x20;to&#x20;be&#x20;secured&#x20;in&#x20;the&#x20;same&#x20;environments&#x20;that&#x20;require&#x20;securing&#x20;the&#x20;systems&#x20;firmware&#x20;to&#x20;avoid&#x20;unauthorized&#x20;removable&#x20;media&#x20;boots.&#x20;Setting&#x20;the&#x20;GRUB&#x20;Menu&#x20;password&#x20;helps&#x20;prevent&#x20;attackers&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;system&#x20;console&#x20;from&#x20;booting&#x20;off&#x20;some&#x20;external&#x20;device&#x20;&#40;such&#x20;as&#x20;a&#x20;CD-ROM&#x20;or&#x20;floppy&#41;&#x20;and&#x20;subverting&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;actions&#x20;described&#x20;in&#x20;this&#x20;section&#x20;will&#x20;ensure&#x20;you&#x20;cannot&#x20;get&#x20;to&#x20;failsafe&#x20;or&#x20;any&#x20;of&#x20;the&#x20;GRUB&#x20;command&#x20;line&#x20;options&#x20;without&#x20;first&#x20;entering&#x20;the&#x20;password.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;generate&#x20;your&#x20;password&#x20;hash:&#x20;#&#x20;/usr/lib/grub2/bios/bin/grub-mkpasswd-pbkdf2&#x20;Enter&#x20;password:&#x20;Reenter&#x20;password:&#x20;PBKDF2&#x20;hash&#x20;of&#x20;your&#x20;password&#x20;is&#x20;&lt;em&gt;&lt;password_hash&gt;&lt;/em&gt;&#x20;Create&#x20;the&#x20;file&#x20;/usr/lib/grub2/bios/etc/grub.d/01&nbsp;password:&#x20;#!/bin/sh&#x20;/usr/bin/cat&#x20;&gt;&#x20;/rpool/boot/grub/password.cfg&lt;&lt;EOF&#x20;#&#x20;#&#x20;GRUB&#x20;password&#x20;#&#x20;set&#x20;superusers=&quot;root&quot;&#x20;password_pbkdf2&#x20;root&#x20;&lt;em&gt;&lt;password_hash&gt;&lt;/em&gt;&#x20;EOF&#x20;/usr/bin/chmod&#x20;600&#x20;/rpool/boot/grub/password.cfg&#x20;/usr/bin/echo&#x20;&#039;source&#x20;&#x20;/@/boot/grub/password.cfg&#039;&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;finalize&#x20;the&#x20;password&#x20;configuration&#x20;and&#x20;set&#x20;menu&#x20;timeout:&#x20;#&#x20;/usr/bin/chmod&#x20;700&#x20;/usr/lib/grub2/bios/etc/grub.d/01_password&#x20;#&#x20;/usr/sbin/bootadm&#x20;set-menu&#x20;timeout=30&#x20;Changes&#x20;will&#x20;take&#x20;effect&#x20;on&#x20;the&#x20;next&#x20;reboot.','[{\"cis\": [\"6.15\"]}]'),(23552,'Restrict&#x20;root&#x20;Login&#x20;to&#x20;System&#x20;Console.','Privileged&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;root&#x20;must&#x20;be&#x20;accountable&#x20;to&#x20;a&#x20;particular&#x20;user.','Use&#x20;an&#x20;authorized&#x20;mechanism&#x20;such&#x20;as&#x20;RBAC&#x20;and&#x20;the&#x20;su&#x20;command&#x20;to&#x20;provide&#x20;administrative&#x20;access&#x20;to&#x20;unprivileged&#x20;accounts.&#x20;These&#x20;mechanisms&#x20;provide&#x20;an&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;problems.','','Edit&#x20;/etc/default/login&#x20;-&#x20;CONSOLE=/dev/console','[{\"cis\": [\"6.16\"]}]'),(23553,'Set&#x20;Retry&#x20;Limit&#x20;for&#x20;Account&#x20;Lockout.','The&#x20;RETRIES&#x20;parameter&#x20;is&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;a&#x20;user&#x20;is&#x20;allowed&#x20;before&#x20;being&#x20;disconnected&#x20;from&#x20;the&#x20;system&#x20;and&#x20;forced&#x20;to&#x20;reconnect.&#x20;When&#x20;LOCK_AFTER_RETRIES&#x20;is&#x20;set&#x20;in&#x20;/etc/security/policy.conf,&#x20;then&#x20;the&#x20;user&#039;s&#x20;account&#x20;is&#x20;locked&#x20;after&#x20;this&#x20;many&#x20;failed&#x20;retries&#x20;&#40;the&#x20;account&#x20;can&#x20;only&#x20;be&#x20;unlocked&#x20;by&#x20;the&#x20;administrator&#x20;using&#x20;the&#x20;command:&#x20;passwd&#x20;-u&#x20;&lt;username&gt;.&#x20;The&#x20;account&#x20;lockout&#x20;threshold&#x20;&#40;RETRIES&#x20;parameter&#41;&#x20;restricts&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;allowed&#x20;before&#x20;requiring&#x20;the&#x20;offending&#x20;account&#x20;be&#x20;locked.&#x20;The&#x20;lockout&#x20;requirement&#x20;will&#x20;help&#x20;block&#x20;malicious&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;host&#x20;via&#x20;automated,&#x20;repetitive&#x20;brute-force&#x20;login&#x20;exploits--trying&#x20;different&#x20;passwords&#x20;until&#x20;one&#x20;fits&#x20;a&#x20;user&#x20;name.','Setting&#x20;the&#x20;failed&#x20;login&#x20;limit&#x20;to&#x20;an&#x20;appropriate&#x20;value&#x20;locks&#x20;the&#x20;user&#x20;account,&#x20;which&#x20;will&#x20;severely&#x20;limit&#x20;the&#x20;speed&#x20;of&#x20;such&#x20;attacks,&#x20;making&#x20;it&#x20;much&#x20;more&#x20;likely&#x20;that&#x20;the&#x20;attacker&#039;s&#x20;pattern&#x20;will&#x20;be&#x20;noticed&#x20;and&#x20;the&#x20;offending&#x20;source&#x20;address&#x20;and/or&#x20;port&#x20;blocked,&#x20;so&#x20;this&#x20;should&#x20;be&#x20;set&#x20;according&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;edit&#x20;/etc/default/login&#x20;-&#x20;RETRIES=3,&#x20;edit&#x20;/etc/security/policy.conf&#x20;-&#x20;LOCK_AFTER_RETRIES=YES.&#x20;Be&#x20;careful&#x20;when&#x20;enabling&#x20;these&#x20;settings&#x20;as&#x20;they&#x20;can&#x20;create&#x20;a&#x20;denial-of-service&#x20;situation&#x20;for&#x20;legitimate&#x20;users&#x20;and&#x20;applications.&#x20;Account&#x20;lockout&#x20;can&#x20;be&#x20;disabled&#x20;for&#x20;specific&#x20;users&#x20;via&#x20;the&#x20;usermod&#x20;command.&#x20;For&#x20;example,&#x20;the&#x20;following&#x20;command&#x20;disables&#x20;account&#x20;lock&#x20;specifically&#x20;for&#x20;the&#x20;oracle&#x20;account:&#x20;#&#x20;usermod&#x20;-K&#x20;lock_after_retries=no&#x20;oracle&#x20;Note:&#x20;The&#x20;root&#x20;role&#x20;is&#x20;configured&#x20;in&#x20;this&#x20;manner&#x20;by&#x20;default&#x20;to&#x20;prevent&#x20;accidental&#x20;lock&#x20;out.','[{\"cis\": [\"6.17\"]}]'),(23554,'Set&#x20;Password&#x20;Expiration&#x20;Parameters&#x20;on&#x20;Active&#x20;Accounts.','The&#x20;characteristics&#x20;of&#x20;an&#x20;operating&#x20;system&#x20;that&#x20;make&#x20;&#039;user&#x20;identification&#039;&#x20;via&#x20;password&#x20;a&#x20;secure&#x20;and&#x20;workable&#x20;solution&#x20;is&#x20;the&#x20;combination&#x20;of&#x20;settings&#x20;chosen.&#x20;By&#x20;requiring&#x20;that&#x20;a&#x20;series&#x20;of&#x20;password-choices&#x20;be&#x20;security-centric,&#x20;it&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;malicious&#x20;user&#x20;breaking&#x20;the&#x20;password&#x20;through&#x20;dictionary/brute&#x20;force&#x20;attacks&#x20;or&#x20;fortuitous&#x20;guessing&#x20;based&#x20;upon&#x20;&#039;social&#x20;engineering.&#039;&#x20;A&#x20;basic&#x20;password&#x20;security&#x20;strategy&#x20;is&#x20;requiring&#x20;a&#x20;new&#x20;password&#x20;to&#x20;be&#x20;chosen&#x20;every&#x20;45-90&#x20;days,&#x20;so&#x20;that&#x20;repeated&#x20;attempts&#x20;to&#x20;gain&#x20;entry&#x20;by&#x20;brute-force&#x20;tactics&#x20;will&#x20;fail&#x20;when&#x20;a&#x20;new&#x20;password&#x20;is&#x20;chosen,&#x20;which&#x20;requires&#x20;starting&#x20;over&#x20;again&#x20;to&#x20;break&#x20;the&#x20;new&#x20;password','The&#x20;commands&#x20;for&#x20;this&#x20;item&#x20;set&#x20;all&#x20;active&#x20;accounts&#x20;&#40;except&#x20;the&#x20;root&#x20;account&#41;&#x20;to&#x20;force&#x20;password&#x20;changes&#x20;every&#x20;91&#x20;days&#x20;&#40;13&#x20;weeks&#41;,&#x20;and&#x20;then&#x20;prevent&#x20;password&#x20;changes&#x20;for&#x20;seven&#x20;days&#x20;&#40;one&#x20;week&#41;,&#x20;thereafter.&#x20;Users&#x20;will&#x20;begin&#x20;receiving&#x20;warnings&#x20;7&#x20;days&#x20;&#40;1&#x20;week&#41;&#x20;before&#x20;their&#x20;password&#x20;expires.&#x20;Sites&#x20;also&#x20;have&#x20;the&#x20;option&#x20;of&#x20;expiring&#x20;idle&#x20;accounts&#x20;after&#x20;a&#x20;certain&#x20;number&#x20;of&#x20;days&#x20;&#40;see&#x20;the&#x20;on-line&#x20;manual&#x20;page&#x20;for&#x20;the&#x20;usermod&#x20;command,&#x20;particularly&#x20;the&#x20;-f&#x20;option&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Edit&#x20;/etc/default/passwd&#x20;-&#x20;MAXWEEKS=13&#x20;MINWEEKS=1&#x20;WARNWEEKS=1','[{\"cis\": [\"7.1\"]}]'),(23555,'Set&#x20;Strong&#x20;Password&#x20;Creation&#x20;Policies.','The&#x20;variables&#x20;in&#x20;the&#x20;/etc/default/passwd&#x20;file&#x20;indicate&#x20;various&#x20;strategies&#x20;for&#x20;creating&#x20;differences&#x20;required&#x20;between&#x20;an&#x20;old&#x20;and&#x20;a&#x20;new&#x20;password.&#x20;As&#x20;requiring&#x20;users&#x20;to&#x20;select&#x20;a&#x20;specific&#x20;numbers&#x20;of&#x20;differences&#x20;between&#x20;the&#x20;characters&#x20;in&#x20;the&#x20;existing&#x20;password&#x20;and&#x20;the&#x20;new&#x20;one&#x20;can&#x20;strengthen&#x20;the&#x20;password&#x20;by&#x20;increasing&#x20;the&#x20;symbol-set&#x20;space,&#x20;to&#x20;further&#x20;increase&#x20;the&#x20;difficulty&#x20;of&#x20;breaking&#x20;any&#x20;password&#x20;by&#x20;brute-force&#x20;attacks,&#x20;these&#x20;values&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate&#x20;to&#x20;the&#x20;needs&#x20;of&#x20;the&#x20;user.','Administrators&#x20;may&#x20;wish&#x20;to&#x20;add&#x20;site-specific&#x20;dictionaries&#x20;to&#x20;the&#x20;DICTIONLIST&#x20;parameter.','','Edit&#x20;/etc/default/passwd&#x20;with&#x20;these&#x20;values:&#x20;PASSLENGTH=14&#x20;NAMECHECK=YES&#x20;HISTORY=10&#x20;MINDIFF=3&#x20;MINUPPER=1&#x20;MINLOWER=1&#x20;MINSPECIAL=1&#x20;MINDIGIT=1&#x20;MAXREPEATS=1&#x20;WHITESPACE=YES&#x20;DICTIONDBDIR=/var/passwd&#x20;DICTIONLIST=/usr/share/lib/dict/words','[{\"cis\": [\"7.2\"]}]'),(23556,'Set&#x20;Default&#x20;umask&#x20;for&#x20;users.','The&#x20;default&#x20;umask&#40;1&#41;&#x20;determines&#x20;the&#x20;permissions&#x20;of&#x20;files&#x20;created&#x20;by&#x20;users.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#40;1&#41;&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umaskby&#x20;inserting&#x20;the&#x20;umaskcommand&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;.profile,&#x20;.cshrc,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','Setting&#x20;a&#x20;very&#x20;secure&#x20;default&#x20;value&#x20;for&#x20;umask&#x20;ensures&#x20;that&#x20;users&#x20;make&#x20;a&#x20;conscious&#x20;choice&#x20;about&#x20;their&#x20;file&#x20;permissions.&#x20;A&#x20;default&#x20;umask&#x20;setting&#x20;of&#x20;077&#x20;causes&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;users&#x20;to&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;allow&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.','','Edit&#x20;/etc/default/login&#x20;-&#x20;UMASK=027','[{\"cis\": [\"7.3\"]}]'),(23557,'Default&#x20;File&#x20;Creation&#x20;Mask&#x20;for&#x20;FTP&#x20;Users.','If&#x20;FTP&#x20;is&#x20;permitted,&#x20;set&#x20;a&#x20;strong,&#x20;default&#x20;file&#x20;creation&#x20;mask&#x20;to&#x20;apply&#x20;to&#x20;files&#x20;created&#x20;by&#x20;the&#x20;FTP&#x20;server.','Many&#x20;users&#x20;assume&#x20;that&#x20;the&#x20;FTP&#x20;server&#x20;will&#x20;use&#x20;their&#x20;system&#x20;file&#x20;creation&#x20;mask;&#x20;generally&#x20;it&#x20;does&#x20;not.&#x20;This&#x20;setting&#x20;ensures&#x20;that&#x20;files&#x20;transmitted&#x20;over&#x20;FTP&#x20;use&#x20;a&#x20;strong&#x20;file&#x20;creation&#x20;mask.','','Edit&#x20;/etc/proftpd.conf&#x20;-&#x20;Umask&#x20;027','[{\"cis\": [\"7.4\"]}]'),(23558,'Set&#x20;mesg&#x20;n&#x20;as&#x20;Default&#x20;for&#x20;All&#x20;Users.','The&#x20;mesg&#x20;n&#x20;command&#x20;blocks&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;write&#x20;or&#x20;talk&#x20;commands&#x20;to&#x20;contact&#x20;users&#x20;at&#x20;their&#x20;terminals,&#x20;but&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;slightly&#x20;strengthening&#x20;permissions&#x20;on&#x20;the&#x20;users&#x20;tty&#x20;device.','Since&#x20;write&#x20;and&#x20;talk&#x20;are&#x20;no&#x20;longer&#x20;widely&#x20;used&#x20;at&#x20;most&#x20;sites,&#x20;the&#x20;incremental&#x20;security&#x20;increase&#x20;is&#x20;worth&#x20;the&#x20;loss&#x20;of&#x20;functionality.','','Refer&#x20;to&#x20;documentation&#x20;to&#x20;execute&#x20;a&#x20;script&#x20;to&#x20;set&#x20;mesg&#x20;n','[{\"cis\": [\"7.5\"]}]'),(23560,'Create&#x20;Warnings&#x20;for&#x20;Standard&#x20;Login&#x20;Services.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;prior&#x20;to&#x20;the&#x20;login&#x20;prompt&#x20;on&#x20;the&#x20;systems&#x20;console&#x20;and&#x20;serial&#x20;devices&#x20;and&#x20;also&#x20;prior&#x20;to&#x20;logins&#x20;via&#x20;telnet&#x20;and&#x20;Secure&#x20;Shell.&#x20;The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;generally&#x20;displayed&#x20;after&#x20;all&#x20;successful&#x20;logins,&#x20;regardless&#x20;from&#x20;where&#x20;the&#x20;user&#x20;is&#x20;logging&#x20;in.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;As&#x20;implementing&#x20;a&#x20;logon&#x20;banner&#x20;to&#x20;deter&#x20;inappropriate&#x20;use&#x20;and&#x20;can&#x20;provide&#x20;a&#x20;foundation&#x20;for&#x20;legal&#x20;action&#x20;against&#x20;abuse,&#x20;this&#x20;warning&#x20;content&#x20;should&#x20;be&#x20;set&#x20;as&#x20;appropriate.&#x20;Consult&#x20;with&#x20;your&#x20;organizations&#x20;legal&#x20;counsel&#x20;for&#x20;the&#x20;appropriate&#x20;wording&#x20;as&#x20;the&#x20;examples&#x20;below&#x20;are&#x20;for&#x20;demonstration&#x20;purposes&#x20;only.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;echo&#x20;Authorized&#x20;users&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#x20;&gt;&#x20;/etc/motd&#x20;#&#x20;echo&#x20;Authorized&#x20;users&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&#x20;&gt;&#x20;/etc/issue&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;644&#x20;/etc/issue','[{\"cis\": [\"8.1\"]}]'),(23561,'Enable&#x20;a&#x20;Warning&#x20;Banner&#x20;for&#x20;the&#x20;FTP&#x20;service.','The&#x20;action&#x20;for&#x20;this&#x20;item&#x20;sets&#x20;a&#x20;warning&#x20;message&#x20;for&#x20;FTP&#x20;users&#x20;before&#x20;they&#x20;log&#x20;in.','If&#x20;FTP&#x20;is&#x20;permitted&#x20;for&#x20;use&#x20;in&#x20;your&#x20;environment,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;Warning&#x20;Banners&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;access&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;using&#x20;the&#x20;system.&#x20;The&#x20;text&#x20;below&#x20;is&#x20;a&#x20;generic&#x20;sample&#x20;only,&#x20;so&#x20;consult&#x20;with&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;counsel&#x20;for&#x20;the&#x20;appropriate&#x20;wording.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;echo&#x20;DisplayConnect&#x20;/etc/issue&#x20;&gt;&gt;&#x20;/etc/proftpd.conf&#x20;#&#x20;svcadm&#x20;restart&#x20;ftp','[{\"cis\": [\"8.2\"]}]'),(23562,'Enable&#x20;a&#x20;Warning&#x20;Banner&#x20;for&#x20;the&#x20;SSH&#x20;Service.','The&#x20;contents&#x20;of&#x20;the&#x20;Banner&#x20;string&#x20;in&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;allowed,&#x20;requiring&#x20;that&#x20;the&#x20;user&#x20;read&#x20;the&#x20;legal&#x20;caution.','Performing&#x20;these&#x20;steps&#x20;will&#x20;ensure&#x20;the&#x20;appropriate&#x20;legal&#x20;caution&#x20;is&#x20;displayed&#x20;to&#x20;any&#x20;user&#x20;accessing&#x20;the&#x20;system&#x20;via&#x20;SSH.','','Edit&#x20;/etc/ssh/sshd_config&#x20;-&#x20;Banner&#x20;/etc/issue','[{\"cis\": [\"8.3\"]}]'),(23563,'Enable&#x20;a&#x20;Warning&#x20;Banner&#x20;for&#x20;the&#x20;GNOME&#x20;Service.','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;used&#x20;for&#x20;login&#x20;session&#x20;management.&#x20;See&#x20;the&#x20;manual&#x20;page&#x20;gdm&#40;1&#41;&#x20;for&#x20;more&#x20;information&#x20;on&#x20;configuration&#x20;of&#x20;the&#x20;settings,&#x20;which&#x20;can&#x20;be&#x20;user&#x20;or&#x20;group&#x20;specific.','The&#x20;remediation&#x20;action&#x20;for&#x20;this&#x20;item&#x20;sets&#x20;a&#x20;pre-login&#x20;warning&#x20;message&#x20;for&#x20;GDM&#x20;users.&#x20;Additional&#x20;methods&#x20;can&#x20;be&#x20;employed&#x20;to&#x20;display&#x20;a&#x20;similar&#x20;message&#x20;to&#x20;a&#x20;user&#x20;post-authentication.&#x20;For&#x20;more&#x20;information,&#x20;see&#x20;the&#x20;Oracle&#x20;Solaris&#x20;11&#x20;Security&#x20;Guidelines&#x20;document.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;Edit&#x20;the&#x20;/etc/gdm/Init/Default&#x20;file&#x20;to&#x20;add&#x20;the&#x20;following&#x20;content&#x20;before&#x20;the&#x20;last&#x20;line&#x20;of&#x20;the&#x20;file.&#x20;/usr/bin/zenity&#x20;--text-info&#x20;--width=800&#x20;--height=300&#x20;--title=Security&#x20;Message&#x20;--filename=/etc/issue','[{\"cis\": [\"8.4\"]}]'),(23564,'Check&#x20;that&#x20;the&#x20;Banner&#x20;Setting&#x20;for&#x20;telnet&#x20;is&#x20;Null.','The&#x20;BANNER&#x20;variable&#x20;in&#x20;the&#x20;file&#x20;/etc/default/telnetd&#x20;can&#x20;be&#x20;used&#x20;to&#x20;display&#x20;text&#x20;before&#x20;the&#x20;telnet&#x20;login&#x20;prompt.&#x20;Traditionally,&#x20;it&#x20;has&#x20;been&#x20;used&#x20;to&#x20;display&#x20;the&#x20;OS&#x20;level&#x20;of&#x20;the&#x20;target&#x20;system.','The&#x20;warning&#x20;banner&#x20;provides&#x20;information&#x20;that&#x20;can&#x20;be&#x20;used&#x20;in&#x20;reconnaissance&#x20;for&#x20;an&#x20;attack.&#x20;By&#x20;default,&#x20;this&#x20;file&#x20;is&#x20;distributed&#x20;with&#x20;the&#x20;BANNER&#x20;variable&#x20;set&#x20;to&#x20;null.&#x20;It&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;create&#x20;a&#x20;separate&#x20;warning&#x20;banner&#x20;for&#x20;telnet&#x20;if&#x20;a&#x20;warning&#x20;is&#x20;set&#x20;in&#x20;the&#x20;/etc/issue&#x20;file.&#x20;As&#x20;telnet&#x20;is&#x20;an&#x20;insecure&#x20;protocol,&#x20;it&#x20;should&#x20;be&#x20;disabled&#x20;and&#x20;all&#x20;remote&#x20;administrative/user&#x20;connections&#x20;take&#x20;place&#x20;by&#x20;Secure&#x20;Shell.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;edit&#x20;/etc/default/telnetd&#x20;-&#x20;BANNER=','[{\"cis\": [\"8.5\"]}]'),(23565,'Check&#x20;for&#x20;Remote&#x20;Consoles.','The&#x20;consadm&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;select&#x20;or&#x20;display&#x20;alternate&#x20;console&#x20;devices.','Since&#x20;the&#x20;system&#x20;console&#x20;has&#x20;special&#x20;properties&#x20;to&#x20;handle&#x20;emergency&#x20;situations,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;console&#x20;is&#x20;in&#x20;a&#x20;physically&#x20;secure&#x20;location&#x20;and&#x20;that&#x20;unauthorized&#x20;consoles&#x20;have&#x20;not&#x20;been&#x20;defined.&#x20;The&#x20;consadm&#x20;-p&#x20;command&#x20;displays&#x20;any&#x20;alternate&#x20;consoles&#x20;that&#x20;have&#x20;been&#x20;defined&#x20;as&#x20;auxiliary&#x20;across&#x20;reboots.&#x20;If&#x20;no&#x20;remote&#x20;consoles&#x20;have&#x20;been&#x20;defined,&#x20;there&#x20;will&#x20;be&#x20;no&#x20;output&#x20;from&#x20;this&#x20;command.','','Perform&#x20;the&#x20;following&#x20;to&#x20;implement&#x20;the&#x20;recommended&#x20;state:&#x20;#&#x20;/usr/sbin/consadm&#x20;[-d&#x20;device...]','[{\"cis\": [\"9.1\"]}]'),(23568,'Verify&#x20;System&#x20;Account&#x20;Default&#x20;Passwords.','There&#x20;are&#x20;a&#x20;number&#x20;of&#x20;accounts&#x20;provided&#x20;with&#x20;the&#x20;Solaris&#x20;OS&#x20;that&#x20;are&#x20;used&#x20;to&#x20;manage&#x20;applications&#x20;and&#x20;are&#x20;not&#x20;intended&#x20;to&#x20;provide&#x20;an&#x20;interactive&#x20;shell.&#x20;These&#x20;accounts&#x20;are&#x20;delivered&#x20;either&#x20;in&#x20;a&#x20;locked&#x20;or&#x20;non-login&#x20;state.&#x20;Oracle&#x20;does&#x20;not&#x20;support&#x20;nor&#x20;recommend&#x20;changing&#x20;the&#x20;passwords&#x20;associated&#x20;with&#x20;these&#x20;accounts.','System&#x20;accounts,&#x20;such&#x20;as&#x20;bin,&#x20;lpd,&#x20;and&#x20;sys&#x20;have&#x20;special&#x20;purposes&#x20;and&#x20;privileges.&#x20;By&#x20;default,&#x20;these&#x20;accounts&#x20;are&#x20;configured&#x20;as&#x20;either&#x20;locked&#x20;or&#x20;non-login.&#x20;This&#x20;status&#x20;should&#x20;be&#x20;verified&#x20;to&#x20;ensure&#x20;that&#x20;these&#x20;accounts&#x20;have&#x20;not&#x20;accidentally&#x20;or&#x20;intentionally&#x20;been&#x20;enabled.','','To&#x20;lock&#x20;a&#x20;single&#x20;account,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;passwd&#x20;-d&#x20;[username]&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;em&gt;[username]&#x20;To&#x20;configure&#x20;a&#x20;single&#x20;account&#x20;to&#x20;be&#x20;non-login,&#x20;use&#x20;the&#x20;command:&#x20;#&#x20;passwd&#x20;-d&#x20;[username]&#x20;#&#x20;passwd&#x20;-N&#x20;&lt;em&gt;[username]','[{\"cis\": [\"9.4\"]}]'),(23569,'Verify&#x20;System&#x20;File&#x20;Permissions.','The&#x20;pkg&#x20;verify&#x20;and&#x20;command&#x20;checks&#x20;the&#x20;accuracy&#x20;of&#x20;installed&#x20;directory&#x20;structures&#x20;and&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;system&#x20;files&#x20;and&#x20;directories&#x20;are&#x20;maintained&#x20;with&#x20;the&#x20;permissions&#x20;they&#x20;were&#x20;intended&#x20;to&#x20;have&#x20;from&#x20;the&#x20;OS&#x20;vendor&#x20;&#40;Oracle&#41;.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;correct&#x20;any&#x20;identified&#x20;package&#x20;errors:&#x20;#&#x20;pkg&#x20;fix.&#x20;Exercise&#x20;caution&#x20;in&#x20;running&#x20;this&#x20;command&#x20;as&#x20;it&#x20;may&#x20;reverse&#x20;modifications&#x20;implemented&#x20;previously&#x20;including&#x20;some&#x20;of&#x20;those&#x20;recommended&#x20;by&#x20;this&#x20;document.&#x20;Rather&#x20;than&#x20;use&#x20;this&#x20;command&#x20;broadly,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;it&#x20;be&#x20;used&#x20;more&#x20;tactically&#x20;to&#x20;correct&#x20;specific&#x20;package&#x20;problems&#x20;when&#x20;possible.','[{\"cis\": [\"9.5\"]}]'),(23570,'Ensure&#x20;Password&#x20;Fields&#x20;are&#x20;Not&#x20;Empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password&#x20;at&#x20;all&#x20;&#40;assuming&#x20;that&#x20;the&#x20;value&#x20;PASSREQ=NO&#x20;is&#x20;set&#x20;in&#x20;/etc/default/login&#41;.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords,&#x20;be&#x20;configured&#x20;as&#x20;Non-login,&#x20;or&#x20;be&#x20;locked.','','Use&#x20;the&#x20;passwd&#x20;-l&#x20;command&#x20;to&#x20;lock&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;permitted&#x20;to&#x20;execute&#x20;commands&#x20;.&#x20;Use&#x20;the&#x20;passwd&#x20;-N&#x20;command&#x20;to&#x20;set&#x20;accounts&#x20;to&#x20;be&#x20;non-login.','[{\"cis\": [\"9.6\"]}]'),(23571,'Verify&#x20;No&#x20;UID&#x20;0&#x20;Accounts&#x20;Exist&#x20;Other&#x20;than&#x20;root.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;rights&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;role&#x20;and&#x20;be&#x20;made&#x20;accessible&#x20;from&#x20;the&#x20;system&#x20;console&#x20;only.&#x20;Administrative&#x20;access&#x20;granted&#x20;to&#x20;an&#x20;unprivileged&#x20;account&#x20;should&#x20;use&#x20;an&#x20;approved&#x20;mechanism&#x20;such&#x20;as&#x20;RBAC.','','Disable&#x20;or&#x20;delete&#x20;any&#x20;other&#x20;0&#x20;UID&#x20;entries&#x20;that&#x20;are&#x20;displayed;&#x20;there&#x20;should&#x20;be&#x20;only&#x20;one&#x20;root&#x20;account.&#x20;Finer&#x20;granularity&#x20;access&#x20;control&#x20;for&#x20;administrative&#x20;access&#x20;can&#x20;be&#x20;obtained&#x20;by&#x20;using&#x20;the&#x20;Solaris&#x20;Role-Based&#x20;Access&#x20;Control&#x20;&#40;RBAC&#41;&#x20;mechanism.&#x20;RBAC&#x20;configurations&#x20;should&#x20;be&#x20;monitored&#x20;via&#x20;user_attr&#40;4&#41;&#x20;to&#x20;make&#x20;sure&#x20;that&#x20;privileges&#x20;are&#x20;managed&#x20;appropriately.','[{\"cis\": [\"9.7\"]}]'),(23572,'Ensure&#x20;root&#x20;PATH&#x20;Integrity.','The&#x20;root&#x20;user&#x20;can&#x20;execute&#x20;any&#x20;command&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;be&#x20;tricked&#x20;into&#x20;executing&#x20;programs&#x20;if&#x20;the&#x20;PATH&#x20;is&#x20;not&#x20;set&#x20;correctly.','Including&#x20;the&#x20;current&#x20;working&#x20;directory&#x20;&#40;.&#41;&#x20;or&#x20;any&#x20;other&#x20;writable&#x20;directory&#x20;in&#x20;root&#039;s&#x20;executable&#x20;path&#x20;makes&#x20;it&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;can&#x20;gain&#x20;superuser&#x20;access&#x20;by&#x20;forcing&#x20;an&#x20;administrator&#x20;operating&#x20;as&#x20;root&#x20;to&#x20;execute&#x20;a&#x20;malcode,&#x20;such&#x20;as&#x20;a&#x20;Trojan&#x20;horse&#x20;program.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.','[{\"cis\": [\"9.8\"]}]'),(23578,'Check&#x20;That&#x20;Users&#x20;Are&#x20;Assigned&#x20;Home&#x20;Directories.','passwd&#x20;defines&#x20;a&#x20;home&#x20;directory&#x20;that&#x20;each&#x20;user&#x20;is&#x20;placed&#x20;in&#x20;upon&#x20;login.&#x20;If&#x20;there&#x20;is&#x20;no&#x20;defined&#x20;home&#x20;directory,&#x20;a&#x20;user&#x20;will&#x20;be&#x20;placed&#x20;in&#x20;/&#x20;and&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;write&#x20;any&#x20;files&#x20;or&#x20;have&#x20;local&#x20;environment&#x20;variables&#x20;set.','All&#x20;users&#x20;must&#x20;be&#x20;assigned&#x20;a&#x20;home&#x20;directory&#x20;in&#x20;passwd.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;if&#x20;there&#x20;exists&#x20;any&#x20;users&#x20;who&#x20;are&#x20;in&#x20;passwd&#x20;but&#x20;do&#x20;not&#x20;have&#x20;a&#x20;home&#x20;directory,&#x20;and&#x20;work&#x20;with&#x20;those&#x20;users&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.','[{\"cis\": [\"9.14\"]}]'),(23580,'Check&#x20;for&#x20;Duplicate&#x20;UIDs.','Although&#x20;the&#x20;useradd&#x20;program&#x20;will&#x20;not&#x20;let&#x20;you&#x20;create&#x20;a&#x20;duplicate&#x20;User&#x20;ID&#x20;&#40;UID&#41;,&#x20;it&#x20;is&#x20;possible&#x20;for&#x20;an&#x20;administrator&#x20;to&#x20;manually&#x20;modify&#x20;passwd&#x20;and&#x20;change&#x20;the&#x20;UID&#x20;field.','Users&#x20;must&#x20;be&#x20;assigned&#x20;unique&#x20;UIDs&#x20;for&#x20;accountability&#x20;and&#x20;to&#x20;ensure&#x20;appropriate&#x20;access&#x20;protections.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;if&#x20;there&#x20;exists&#x20;any&#x20;users&#x20;who&#x20;share&#x20;a&#x20;common&#x20;UID,&#x20;and&#x20;work&#x20;with&#x20;those&#x20;users&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.','[{\"cis\": [\"9.16\"]}]'),(23585,'Find&#x20;World&#x20;Writable&#x20;Files.','Unix-based&#x20;systems&#x20;support&#x20;variable&#x20;settings&#x20;to&#x20;control&#x20;access&#x20;to&#x20;files.&#x20;World-writable&#x20;files&#x20;are&#x20;the&#x20;least&#x20;secure.&#x20;See&#x20;the&#x20;chmod&#x20;man&#x20;page&#x20;for&#x20;more&#x20;information.','Data&#x20;in&#x20;world-writable&#x20;files&#x20;can&#x20;be&#x20;read,&#x20;modified,&#x20;and&#x20;potentially&#x20;compromised&#x20;by&#x20;any&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;World-writable&#x20;files&#x20;may&#x20;also&#x20;indicate&#x20;an&#x20;incorrectly&#x20;written&#x20;script&#x20;or&#x20;program&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;the&#x20;cause&#x20;of&#x20;a&#x20;larger&#x20;compromise&#x20;to&#x20;the&#x20;system&#x20;integrity.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;the&#x20;existence&#x20;of&#x20;any&#x20;write&#x20;access&#x20;given&#x20;for&#x20;the&#x20;other&#x20;category&#x20;&#40;chmod&#x20;o-w&#x20;filename&#41;,&#x20;and&#x20;work&#x20;with&#x20;the&#x20;owner&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.','[{\"cis\": [\"9.21\"]}]'),(23586,'Find&#x20;SUID/SGID&#x20;System&#x20;Executables.','The&#x20;owner&#x20;of&#x20;a&#x20;file&#x20;can&#x20;set&#x20;the&#x20;file&#x20;permissions&#x20;to&#x20;run&#x20;with&#x20;the&#x20;owner&#x20;or&#x20;group&#x20;permissions,&#x20;even&#x20;if&#x20;the&#x20;user&#x20;running&#x20;the&#x20;program&#x20;is&#x20;not&#x20;the&#x20;owner&#x20;or&#x20;a&#x20;member&#x20;of&#x20;the&#x20;group.&#x20;The&#x20;most&#x20;common&#x20;reason&#x20;for&#x20;a&#x20;SUID/SGID&#x20;program&#x20;is&#x20;to&#x20;enable&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;&#40;such&#x20;as&#x20;changing&#x20;their&#x20;password&#41;,&#x20;which&#x20;requires&#x20;root&#x20;privileges.','There&#x20;are&#x20;valid&#x20;reasons&#x20;for&#x20;SUID/SGID&#x20;programs,&#x20;but&#x20;it&#x20;is&#x20;important&#x20;to&#x20;identify&#x20;and&#x20;review&#x20;such&#x20;programs&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;legitimate.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;the&#x20;existence&#x20;of&#x20;any&#x20;set-UID&#x20;programs&#x20;that&#x20;do&#x20;not&#x20;belong&#x20;on&#x20;the&#x20;system,&#x20;and&#x20;work&#x20;with&#x20;the&#x20;owner&#x20;&#40;or&#x20;system&#x20;administrator&#41;&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;Digital&#x20;signatures&#x20;on&#x20;the&#x20;Solaris&#x20;Set-UID&#x20;binaries&#x20;can&#x20;be&#x20;verified&#x20;with&#x20;the&#x20;elfsign&#x20;utility,&#x20;such&#x20;as&#x20;this&#x20;example:&#x20;#&#x20;elfsign&#x20;verify&#x20;-e&#x20;/usr/bin/su&#x20;elfsign:&#x20;verification&#x20;of&#x20;/usr/bin/su&#x20;passed.','[{\"cis\": [\"9.22\"]}]'),(23587,'Find&#x20;Un-owned&#x20;Files&#x20;and&#x20;Directories.','Sometimes&#x20;when&#x20;administrators&#x20;delete&#x20;users&#x20;from&#x20;the&#x20;password&#x20;file&#x20;they&#x20;neglect&#x20;to&#x20;remove&#x20;all&#x20;files&#x20;owned&#x20;by&#x20;those&#x20;users&#x20;from&#x20;the&#x20;system.','A&#x20;new&#x20;user&#x20;who&#x20;is&#x20;assigned&#x20;the&#x20;deleted&#x20;user&#039;s&#x20;user&#x20;ID&#x20;or&#x20;group&#x20;ID&#x20;may&#x20;then&#x20;end&#x20;up&#x20;owning&#x20;these&#x20;files,&#x20;and&#x20;thus&#x20;have&#x20;more&#x20;access&#x20;on&#x20;the&#x20;system&#x20;than&#x20;was&#x20;intended.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;the&#x20;existence&#x20;of&#x20;any&#x20;files&#x20;that&#x20;are&#x20;not&#x20;attributed&#x20;to&#x20;current&#x20;users&#x20;or&#x20;groups&#x20;on&#x20;the&#x20;system,&#x20;and&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;Note&#x20;that&#x20;the&#x20;Solaris&#x20;OS&#x20;is&#x20;shipped&#x20;with&#x20;all&#x20;files&#x20;appropriately&#x20;owned.','[{\"cis\": [\"9.23\"]}]'),(23588,'Find&#x20;Files&#x20;and&#x20;Directories&#x20;with&#x20;Extended&#x20;Attributes.','Extended&#x20;attributes&#x20;are&#x20;implemented&#x20;as&#x20;files&#x20;in&#x20;a&#x20;shadow&#x20;file&#x20;system&#x20;that&#x20;is&#x20;not&#x20;generally&#x20;visible&#x20;via&#x20;normal&#x20;administration&#x20;commands&#x20;without&#x20;special&#x20;arguments.','Attackers&#x20;or&#x20;malicious&#x20;users&#x20;could&#x20;hide&#x20;information,&#x20;exploits,&#x20;etc.&#x20;in&#x20;extended&#x20;attribute&#x20;areas.&#x20;Since&#x20;extended&#x20;attributes&#x20;are&#x20;rarely&#x20;used,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;find&#x20;files&#x20;with&#x20;extended&#x20;attributes&#x20;set.','','Correct&#x20;or&#x20;justify&#x20;any&#x20;items&#x20;discovered&#x20;in&#x20;the&#x20;Audit&#x20;step.&#x20;Determine&#x20;the&#x20;existence&#x20;of&#x20;any&#x20;files&#x20;having&#x20;extended&#x20;file&#x20;attributes,&#x20;and&#x20;determine&#x20;the&#x20;best&#x20;course&#x20;of&#x20;action&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy.&#x20;Note&#x20;that&#x20;the&#x20;Solaris&#x20;OS&#x20;does&#x20;not&#x20;ship&#x20;with&#x20;files&#x20;that&#x20;have&#x20;extended&#x20;attributes.','[{\"cis\": [\"9.24\"]}]'),(24000,'Ensure&#x20;systemd&#x20;Service&#x20;Files&#x20;Are&#x20;Enabled','Confirm,&#x20;and&#x20;correct&#x20;if&#x20;necessary,&#x20;the&#x20;PostgreSQL&#x20;systemd&#x20;service&#x20;is&#x20;enabled.','Enabling&#x20;the&#x20;systemd&#x20;service&#x20;on&#x20;the&#x20;OS&#x20;ensures&#x20;the&#x20;database&#x20;service&#x20;is&#x20;active&#x20;when&#x20;a&#x20;change&#x20;of&#x20;state&#x20;occurs&#x20;as&#x20;in&#x20;the&#x20;case&#x20;of&#x20;a&#x20;system&#x20;startup&#x20;or&#x20;reboot.&#x0a;','','Irrespective&#x20;of&#x20;package&#x20;source,&#x20;PostgreSQL&#x20;services&#x20;can&#x20;be&#x20;identified&#x20;because&#x20;it&#x20;typically&#x20;includes&#x20;the&#x20;text&#x20;string&#x20;&quot;postgresql&quot;.&#x20;PGDG&#x20;installs&#x20;do&#x20;not&#x20;automatically&#x20;register&#x20;the&#x20;service&#x20;as&#x20;a&#x20;&quot;want&quot;&#x20;of&#x20;the&#x20;default&#x20;systemd&#x20;target.&#x20;Multiple&#x20;instances&#x20;of&#x20;PostgreSQL&#x20;services&#x20;often&#x20;distinguish&#x20;themselves&#x20;using&#x20;a&#x20;version&#x20;number.&#x0a;','[{\"cis\": [\"1.2\"]}, {\"cis_csc\": [\"18\", \"5.1\"]}]'),(24001,'Ensure&#x20;the&#x20;log&#x20;destinations&#x20;are&#x20;set&#x20;correctly','PostgreSQL&#x20;supports&#x20;several&#x20;methods&#x20;for&#x20;logging&#x20;server&#x20;messages,&#x20;including&#x20;stderr,&#x20;csvlog&#x20;and&#x20;syslog.&#x20;On&#x20;Windows,&#x20;eventlog&#x20;is&#x20;also&#x20;supported.&#x20;One&#x20;or&#x20;more&#x20;of&#x20;these&#x20;destinations&#x20;should&#x20;be&#x20;set&#x20;for&#x20;server&#x20;log&#x20;output.&#x0a;','If&#x20;log_destination&#x20;is&#x20;not&#x20;set,&#x20;then&#x20;any&#x20;log&#x20;messages&#x20;generated&#x20;by&#x20;the&#x20;core&#x20;PostgreSQL&#x20;processes&#x20;will&#x20;be&#x20;lost.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statements&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;setting&#x20;the&#x20;log&#x20;destination&#x20;to&#x20;csvlog&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_destination&#x20;=&#x20;&#039;csvlog&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24002,'Ensure&#x20;the&#x20;logging&#x20;collector&#x20;is&#x20;enabled','The&#x20;logging&#x20;collector&#x20;is&#x20;a&#x20;background&#x20;process&#x20;that&#x20;captures&#x20;log&#x20;messages&#x20;sent&#x20;to&#x20;stderr&#x20;and&#x20;redirects&#x20;them&#x20;into&#x20;log&#x20;files.&#x20;The&#x20;logging_collector&#x20;setting&#x20;must&#x20;be&#x20;enabled&#x20;in&#x20;order&#x20;for&#x20;this&#x20;process&#x20;to&#x20;run.&#x20;It&#x20;can&#x20;only&#x20;be&#x20;set&#x20;at&#x20;server&#x20;start.&#x0a;','&quot;The&#x20;logging&#x20;collector&#x20;approach&#x20;is&#x20;often&#x20;more&#x20;useful&#x20;than&#x20;logging&#x20;to&#x20;syslog,&#x20;since&#x20;some&#x20;types&#x20;of&#x20;messages&#x20;might&#x20;not&#x20;appear&#x20;in&#x20;syslog&#x20;output.&#x20;One&#x20;common&#x20;example&#x20;is&#x20;dynamiclinker&#x20;failure&#x20;message;&#x20;another&#x20;may&#x20;be&#x20;error&#x20;messages&#x20;produced&#x20;by&#x20;scripts&#x20;such&#x20;as&#x20;archive_command.&#x20;Note:&#x20;This&#x20;setting&#x20;must&#x20;be&#x20;enabled&#x20;when&#x20;log_destination&#x20;is&#x20;either&#x20;stderr&#x20;or&#x20;csvlog&#x20;and&#x20;for&#x20;certain&#x20;other&#x20;logging&#x20;parameters&#x20;to&#x20;take&#x20;effect.&quot;&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;logging_collector&#x20;=&#x20;&#039;on&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;26&#x20;|&#x20;Page&#x0a;Unfortunately,&#x20;this&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;changed&#x20;at&#x20;server&#x20;&#40;re&#41;start.&#x20;As&#x20;root,&#x20;restart&#x20;the&#x0a;PostgreSQL&#x20;service&#x20;for&#x20;this&#x20;change&#x20;to&#x20;take&#x20;effect:&#x0a;#&#x20;whoami&#x0a;root&#x0a;#&#x20;systemctl&#x20;restart&#x20;postgresql-13&#x0a;#&#x20;systemctl&#x20;status&#x20;postgresql-13|grep&#x20;&#039;ago$&#039;&#x0a;Active:&#x20;active&#x20;&#40;running&#41;&#x20;since&#x20;&lt;date&gt;;&#x20;1s&#x20;ago&quot;&#x0a;','[{\"cis\": [\"3.1.3\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24003,'Ensure&#x20;the&#x20;log&#x20;file&#x20;destination&#x20;directory&#x20;is&#x20;set&#x20;correctly','The&#x20;log_directory&#x20;setting&#x20;specifies&#x20;the&#x20;destination&#x20;directory&#x20;for&#x20;log&#x20;files&#x20;when&#x20;log_destination&#x20;is&#x20;stderr&#x20;or&#x20;csvlog.&#x20;It&#x20;can&#x20;be&#x20;specified&#x20;as&#x20;relative&#x20;to&#x20;the&#x20;cluster&#x20;data&#x20;directory&#x20;&#40;$PGDATA&#41;&#x20;or&#x20;as&#x20;an&#x20;absolute&#x20;path.&#x20;log_directory&#x20;should&#x20;be&#x20;set&#x20;according&#x20;to&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy.&#x0a;','If&#x20;log_directory&#x20;is&#x20;not&#x20;set,&#x20;it&#x20;is&#x20;interpreted&#x20;as&#x20;the&#x20;absolute&#x20;path&#x20;&#039;/&#039;&#x20;and&#x20;PostgreSQL&#x20;will&#x20;attempt&#x20;to&#x20;write&#x20;its&#x20;logs&#x20;there&#x20;&#40;and&#x20;typically&#x20;fail&#x20;due&#x20;to&#x20;a&#x20;lack&#x20;of&#x20;permissions&#x20;to&#x20;that&#x20;directory&#41;.&#x20;This&#x20;parameter&#x20;should&#x20;be&#x20;set&#x20;to&#x20;direct&#x20;the&#x20;logs&#x20;into&#x20;the&#x20;appropriate&#x20;directory&#x20;location&#x20;as&#x20;defined&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_directory=&#039;/var/log/postgres&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;28&#x20;|&#x20;Page&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;postgres=#&#x20;SHOW&#x20;log_directory;&#x0a;log_directory&#x0a;---------------&#x0a;/var/log/postgres&#x0a;&#40;1&#x20;row&#41;&#x0a;Note:&#x20;The&#x20;use&#x20;of&#x20;/var/log/postgres,&#x20;above,&#x20;is&#x20;an&#x20;example.&#x20;This&#x20;should&#x20;be&#x20;set&#x20;to&#x20;an&#x20;appropriate&#x20;path&#x20;as&#x20;defined&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;requirements.&#x20;Having&#x20;said&#x20;that,&#x20;it&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;have&#x20;the&#x20;logs&#x20;outside&#x20;of&#x20;your&#x20;PGDATA&#x20;directory&#x20;so&#x20;that&#x20;they&#x20;are&#x20;not&#x20;included&#x20;by&#x20;things&#x20;like&#x20;pg_basebackup&#x20;or&#x20;pgBackRest.&quot;&#x0a;','[{\"cis\": [\"3.1.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24004,'Ensure&#x20;the&#x20;filename&#x20;pattern&#x20;for&#x20;log&#x20;files&#x20;is&#x20;set&#x20;correctly','The&#x20;log_filename&#x20;setting&#x20;specifies&#x20;the&#x20;filename&#x20;pattern&#x20;for&#x20;log&#x20;files.&#x20;The&#x20;value&#x20;for&#x20;log_filename&#x20;should&#x20;match&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy.&#x20;The&#x20;value&#x20;is&#x20;treated&#x20;as&#x20;a&#x20;strftime&#x20;pattern,&#x20;so&#x20;%-escapes&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;timevarying&#x20;filenames.&#x20;The&#x20;supported&#x20;%-escapes&#x20;are&#x20;similar&#x20;to&#x20;those&#x20;listed&#x20;in&#x20;the&#x20;Open&#x20;Group&#039;s&#x20;strftime&#x20;specification.&#x20;If&#x20;you&#x20;specify&#x20;a&#x20;filename&#x20;without&#x20;escapes,&#x20;you&#x20;should&#x20;plan&#x20;to&#x20;use&#x20;a&#x20;log&#x20;rotation&#x20;utility&#x20;to&#x20;avoid&#x20;eventually&#x20;filling&#x20;the&#x20;partition&#x20;that&#x20;contains&#x20;log_directory.&#x20;If&#x20;there&#x20;are&#x20;any&#x20;time-zone-dependent&#x20;%-escapes,&#x20;the&#x20;computation&#x20;is&#x20;done&#x20;in&#x20;the&#x20;zone&#x20;specified&#x20;by&#x20;log_timezone.&#x20;Also,&#x20;the&#x20;system&#039;s&#x20;strftime&#x20;is&#x20;not&#x20;used&#x20;directly,&#x20;so&#x20;platformspecific&#x20;&#40;nonstandard&#41;&#x20;extensions&#x20;do&#x20;not&#x20;work.&#x20;If&#x20;CSV-format&#x20;output&#x20;is&#x20;enabled&#x20;in&#x20;log_destination,&#x20;.csv&#x20;will&#x20;be&#x20;appended&#x20;to&#x20;the&#x20;log&#x20;filename.&#x20;&#40;If&#x20;log_filename&#x20;ends&#x20;in&#x20;.log,&#x20;the&#x20;suffix&#x20;is&#x20;replaced&#x20;instead.&#41;&#x0a;','If&#x20;log_filename&#x20;is&#x20;not&#x20;set,&#x20;then&#x20;the&#x20;value&#x20;of&#x20;log_directory&#x20;is&#x20;appended&#x20;to&#x20;an&#x20;empty&#x20;string&#x20;try&#x20;to&#x20;write&#x20;to&#x20;a&#x20;directory&#x20;instead&#x20;of&#x20;a&#x20;file.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_filename=&#039;postgresql-%Y%m%d.log&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;postgres=#&#x20;SHOW&#x20;log_filename;&#x0a;log_filename&#x0a;-------------------&#x0a;postgresql-%Y%m%d.log&#x0a;&#40;1&#x20;row&#41;&#x0a;Note:&#x20;In&#x20;this&#x20;example,&#x20;a&#x20;new&#x20;logfile&#x20;will&#x20;be&#x20;created&#x20;for&#x20;each&#x20;day&#x20;&#40;e.g.&#x20;postgresql20180901.log&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24005,'Ensure&#x20;the&#x20;log&#x20;file&#x20;permissions&#x20;are&#x20;set&#x20;correctly','The&#x20;log_file_mode&#x20;setting&#x20;determines&#x20;the&#x20;file&#x20;permissions&#x20;for&#x20;log&#x20;files&#x20;when&#x20;logging_collector&#x20;is&#x20;enabled.&#x20;The&#x20;parameter&#x20;value&#x20;is&#x20;expected&#x20;to&#x20;be&#x20;a&#x20;numeric&#x20;mode&#x20;specification&#x20;in&#x20;the&#x20;form&#x20;accepted&#x20;by&#x20;the&#x20;chmod&#x20;and&#x20;umask&#x20;system&#x20;calls.&#x20;&#40;To&#x20;use&#x20;the&#x20;customary&#x20;octal&#x20;format,&#x20;the&#x20;number&#x20;must&#x20;start&#x20;with&#x20;a&#x20;0&#x20;&#40;zero&#41;.&#41;&#x20;The&#x20;permissions&#x20;should&#x20;be&#x20;set&#x20;to&#x20;allow&#x20;only&#x20;the&#x20;necessary&#x20;access&#x20;to&#x20;authorized&#x20;personnel.&#x20;In&#x20;most&#x20;cases&#x20;the&#x20;best&#x20;setting&#x20;is&#x20;0600,&#x20;so&#x20;that&#x20;only&#x20;the&#x20;server&#x20;owner&#x20;can&#x20;read&#x20;or&#x20;write&#x20;the&#x20;log&#x20;files.&#x20;The&#x20;other&#x20;commonly&#x20;useful&#x20;setting&#x20;is&#x20;0640,&#x20;allowing&#x20;members&#x20;of&#x20;the&#x20;owner&#039;s&#x20;group&#x20;to&#x20;read&#x20;the&#x20;files,&#x20;although&#x20;to&#x20;make&#x20;use&#x20;of&#x20;that,&#x20;you&#x20;will&#x20;need&#x20;to&#x20;alter&#x20;the&#x20;log_directory&#x20;setting&#x20;to&#x20;store&#x20;the&#x20;log&#x20;files&#x20;outside&#x20;the&#x20;cluster&#x20;data&#x20;directory.&#x0a;','Log&#x20;files&#x20;often&#x20;contain&#x20;sensitive&#x20;data.&#x20;Allowing&#x20;unnecessary&#x20;access&#x20;to&#x20;log&#x20;files&#x20;may&#x20;inadvertently&#x20;expose&#x20;sensitive&#x20;data&#x20;to&#x20;unauthorized&#x20;personnel.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;with&#x20;the&#x20;example&#x20;assuming&#x20;a&#x20;desired&#x20;value&#x20;of&#x20;0600&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_file_mode&#x20;=&#x20;&#039;0600&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;33&#x20;|&#x20;Page&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;postgres=#&#x20;SHOW&#x20;log_file_mode;&#x0a;log_file_mode&#x0a;---------------&#x0a;0600&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.6\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(24006,'Ensure&#x20;&#039;log_truncate_on_rotation&#039;&#x20;is&#x20;enabled','&quot;Enabling&#x20;the&#x20;log_truncate_on_rotation&#x20;setting&#x20;when&#x20;logging_collector&#x20;is&#x20;enabled&#x20;causes&#x20;PostgreSQL&#x20;to&#x20;truncate&#x20;&#40;overwrite&#41;&#x20;existing&#x20;log&#x20;files&#x20;with&#x20;the&#x20;same&#x20;name&#x20;during&#x20;log&#x20;rotation&#x20;instead&#x20;of&#x20;appending&#x20;to&#x20;them.&#x20;For&#x20;example,&#x20;using&#x20;this&#x20;setting&#x20;in&#x20;combination&#x20;with&#x20;a&#x20;log_filename&#x20;setting&#x20;value&#x20;like&#x20;postgresql-%H.log&#x20;would&#x20;result&#x20;in&#x20;generating&#x20;24&#x20;hourly&#x20;log&#x20;files&#x20;and&#x20;then&#x20;cyclically&#x20;overwriting&#x20;them:&#x0a;postgresql-00.log&#x0a;postgresql-01.log&#x0a;[...]&#x0a;postgresql-23.log&#x0a;Note:&#x20;Truncation&#x20;will&#x20;occur&#x20;only&#x20;when&#x20;a&#x20;new&#x20;file&#x20;is&#x20;being&#x20;opened&#x20;due&#x20;to&#x20;time-based&#x20;rotation,&#x20;not&#x20;during&#x20;server&#x20;startup&#x20;or&#x20;size-based&#x20;rotation&#x20;&#40;see&#x20;later&#x20;in&#x20;this&#x20;benchmark&#x20;for&#x20;size-based&#x20;rotation&#x20;details&#41;.&quot;&#x0a;','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;pre-existing&#x20;log&#x20;files&#x20;will&#x20;be&#x20;appended&#x20;to&#x20;if&#x20;log_filename&#x20;is&#x20;configured&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;static&#x20;names&#x20;are&#x20;generated.&#x20;Enabling&#x20;or&#x20;disabling&#x20;the&#x20;truncation&#x20;should&#x20;only&#x20;be&#x20;decided&#x20;when&#x20;also&#x20;considering&#x20;the&#x20;value&#x20;of&#x20;log_filename&#x20;and&#x20;log_rotation_age/log_rotation_size.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_truncate_on_rotation&#x20;=&#x20;&#039;on&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;postgres=#&#x20;SHOW&#x20;log_truncate_on_rotation;&#x0a;log_truncate_on_rotation&#x0a;--------------------------&#x0a;on&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.7\"]}, {\"cis_csc\": [\"6.3\", \"6.4\"]}]'),(24007,'Ensure&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;lifetime&#x20;is&#x20;set&#x20;correctly','When&#x20;logging_collector&#x20;is&#x20;enabled,&#x20;the&#x20;log_rotation_age&#x20;parameter&#x20;determines&#x20;the&#x20;maximum&#x20;lifetime&#x20;of&#x20;an&#x20;individual&#x20;log&#x20;file&#x20;&#40;depending&#x20;on&#x20;the&#x20;value&#x20;of&#x20;log_filename&#41;.&#x20;After&#x20;this&#x20;many&#x20;minutes&#x20;have&#x20;elapsed,&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;created&#x20;via&#x20;automatic&#x20;log&#x20;file&#x20;rotation.&#x20;Current&#x20;best&#x20;practices&#x20;advise&#x20;log&#x20;rotation&#x20;at&#x20;least&#x20;daily,&#x20;but&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy&#x20;should&#x20;dictate&#x20;your&#x20;rotation&#x20;schedule.&#x0a;','Log&#x20;rotation&#x20;is&#x20;a&#x20;standard&#x20;best&#x20;practice&#x20;for&#x20;log&#x20;management.','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;setting&#x20;it&#x0a;to&#x20;one&#x20;hour&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_rotation_age=&#039;1h&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.8\"]}, {\"cis_csc\": [\"6.3\", \"6.4\"]}]'),(24008,'Ensure&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;is&#x20;set&#x20;correctly','The&#x20;log_rotation_size&#x20;setting&#x20;determines&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;an&#x20;individual&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;maximum&#x20;size&#x20;is&#x20;reached,&#x20;automatic&#x20;log&#x20;file&#x20;rotation&#x20;will&#x20;occur.&#x0a;','If&#x20;this&#x20;is&#x20;set&#x20;to&#x20;zero,&#x20;size-triggered&#x20;creation&#x20;of&#x20;new&#x20;log&#x20;files&#x20;is&#x20;disabled.&#x20;This&#x20;will&#x20;prevent&#x20;automatic&#x20;log&#x20;file&#x20;rotation&#x20;when&#x20;files&#x20;become&#x20;too&#x20;large,&#x20;which&#x20;could&#x20;put&#x20;log&#x20;data&#x20;at&#x20;increased&#x20;risk&#x20;of&#x20;loss&#x20;&#40;unless&#x20;age-based&#x20;rotation&#x20;is&#x20;configured&#41;.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;setting&#x20;it&#x20;to&#x20;1GB&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_rotation_size&#x20;=&#x20;&#039;1GB&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.9\"]}, {\"cis_csc\": [\"6.3\", \"6.4\"]}]'),(24009,'Ensure&#x20;the&#x20;correct&#x20;syslog&#x20;facility&#x20;is&#x20;selected','The&#x20;syslog_facility&#x20;setting&#x20;specifies&#x20;the&#x20;syslog&#x20;&quot;facility&quot;&#x20;to&#x20;be&#x20;used&#x20;when&#x20;logging&#x20;to&#x20;syslog&#x20;is&#x20;enabled.&#x20;You&#x20;can&#x20;choose&#x20;from&#x20;any&#x20;of&#x20;the&#x20;&#039;local&#039;&#x20;facilities.&#x20;Your&#x20;organization&#039;s&#x20;logging&#x20;policy&#x20;should&#x20;dictate&#x20;which&#x20;facility&#x20;to&#x20;use&#x20;based&#x20;on&#x20;the&#x20;syslog&#x20;daemon&#x20;in&#x20;use.&#x0a;','If&#x20;not&#x20;set&#x20;to&#x20;the&#x20;appropriate&#x20;facility,&#x20;the&#x20;PostgreSQL&#x20;log&#x20;messages&#x20;may&#x20;be&#x20;intermingled&#x20;with&#x20;other&#x20;applications&#039;&#x20;log&#x20;messages,&#x20;incorrectly&#x20;routed,&#x20;or&#x20;potentially&#x20;dropped&#x20;&#40;depending&#x20;on&#x20;your&#x20;syslog&#x20;configuration&#41;.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;setting&#x20;it&#x20;to&#x20;the&#x20;LOCAL1&#x20;facility&#41;:&#x0a;postgres=&#x20;&#x20;alter&#x20;system&#x20;set&#x20;syslog_facility&#x20;=&#x20;&#039;LOCAL1&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=&#x20;&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.10\"]}, {\"cis_csc\": [\"6\", \"6.2\"]}]'),(24010,'Ensure&#x20;the&#x20;program&#x20;name&#x20;for&#x20;PostgreSQL&#x20;syslog&#x20;messages&#x20;is&#x20;correct','The&#x20;syslog_ident&#x20;setting&#x20;specifies&#x20;the&#x20;program&#x20;name&#x20;used&#x20;to&#x20;identify&#x20;PostgreSQL&#x20;messages&#x20;in&#x20;syslog&#x20;logs.&#x20;An&#x20;example&#x20;of&#x20;a&#x20;possible&#x20;program&#x20;name&#x20;is&#x20;postgres.&#x0a;','If&#x20;this&#x20;is&#x20;not&#x20;set&#x20;correctly,&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;distinguish&#x20;PostgreSQL&#x20;messages&#x20;from&#x20;other&#x20;messages&#x20;in&#x20;syslog&#x20;logs.&#x0a;','','&quot;Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;assuming&#x20;a&#x20;program&#x20;name&#x20;of&#x20;proddb&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;syslog_ident&#x20;=&#x20;&#039;proddb&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;postgres=#&#x20;show&#x20;syslog_ident;&#x0a;syslog_ident&#x0a;--------------&#x0a;proddb&#x0a;&#40;1&#x20;row&#41;&quot;&#x0a;','[{\"cis\": [\"3.1.11\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24011,'Ensure&#x20;the&#x20;correct&#x20;messages&#x20;are&#x20;written&#x20;to&#x20;the&#x20;server&#x20;log','The&#x20;log_min_messages&#x20;setting&#x20;specifies&#x20;the&#x20;message&#x20;levels&#x20;that&#x20;are&#x20;written&#x20;to&#x20;the&#x20;server&#x20;log.&#x20;Each&#x20;level&#x20;includes&#x20;all&#x20;the&#x20;levels&#x20;that&#x20;follow&#x20;it.&#x20;The&#x20;lower&#x20;the&#x20;level&#x20;&#40;vertically,&#x20;below&#41;,&#x20;the&#x20;fewer&#x20;messages&#x20;are&#x20;sent.&#x0a;','If&#x20;this&#x20;is&#x20;not&#x20;set&#x20;to&#x20;the&#x20;correct&#x20;value,&#x20;too&#x20;many&#x20;messages&#x20;or&#x20;too&#x20;few&#x20;messages&#x20;may&#x20;be&#x20;written&#x20;to&#x20;the&#x20;server&#x20;log.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;as&#x20;superuser&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;to&#x20;set&#x20;it&#x20;to&#x20;warning&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_min_messages&#x20;=&#x20;&#039;warning&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.12\"]}, {\"cis_csc\": [\"6\", \"6.4\"]}]'),(24012,'Ensure&#x20;the&#x20;correct&#x20;SQL&#x20;statements&#x20;generating&#x20;errors&#x20;are&#x20;recorded','The&#x20;log_min_error_statement&#x20;setting&#x20;causes&#x20;all&#x20;SQL&#x20;statements&#x20;generating&#x20;errors&#x20;at&#x20;or&#x20;above&#x20;the&#x20;specified&#x20;severity&#x20;level&#x20;to&#x20;be&#x20;recorded&#x20;in&#x20;the&#x20;server&#x20;log.&#x20;Each&#x20;level&#x20;includes&#x20;all&#x20;the&#x20;levels&#x20;that&#x20;follow&#x20;it.&#x20;The&#x20;lower&#x20;the&#x20;level&#x20;&#40;vertically,&#x20;below&#41;,&#x20;the&#x20;fewer&#x20;messages&#x20;are&#x20;recorded.&#x0a;ERROR&#x20;is&#x20;considered&#x20;the&#x20;best&#x20;practice&#x20;setting.&#x20;Changes&#x20;should&#x20;only&#x20;be&#x20;made&#x20;in&#x20;accordance&#x20;with&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy.&#x0a;Note:&#x20;To&#x20;effectively&#x20;turn&#x20;off&#x20;logging&#x20;of&#x20;failing&#x20;statements,&#x20;set&#x20;this&#x20;parameter&#x20;to&#x20;PANIC.&#x0a;','If&#x20;this&#x20;is&#x20;not&#x20;set&#x20;to&#x20;the&#x20;correct&#x20;value,&#x20;too&#x20;many&#x20;erring&#x20;SQL&#x20;statements&#x20;or&#x20;too&#x20;few&#x20;erring&#x20;SQL&#x20;statements&#x20;may&#x20;be&#x20;written&#x20;to&#x20;the&#x20;server&#x20;log.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;as&#x20;superuser&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;the&#x20;example,&#x20;to&#x20;error&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_min_error_statement&#x20;=&#x20;&#039;error&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.13\"]}, {\"cis_csc\": [\"6\", \"6.4\"]}]'),(24013,'Ensure&#x20;&#039;debug_print_parse&#039;&#x20;is&#x20;disabled','The&#x20;debug_print_parse&#x20;setting&#x20;enables&#x20;printing&#x20;the&#x20;resulting&#x20;parse&#x20;tree&#x20;for&#x20;each&#x20;executed&#x20;query.&#x20;These&#x20;messages&#x20;are&#x20;emitted&#x20;at&#x20;the&#x20;LOG&#x20;message&#x20;level.&#x20;Unless&#x20;directed&#x20;otherwise&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy,&#x20;it&#x20;is&#x20;recommended&#x20;this&#x20;setting&#x20;be&#x20;disabled&#x20;by&#x20;setting&#x20;it&#x20;to&#x20;off.&#x0a;','Enabling&#x20;any&#x20;of&#x20;the&#x20;DEBUG&#x20;printing&#x20;variables&#x20;may&#x20;cause&#x20;the&#x20;logging&#x20;of&#x20;sensitive&#x20;information&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;omitted&#x20;based&#x20;on&#x20;the&#x20;configuration&#x20;of&#x20;the&#x20;other&#x20;logging&#x20;settings.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=&#x20;&#x20;alter&#x20;system&#x20;set&#x20;debug_print_parse=&#039;off&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=&#x20;&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.14\"]}, {\"cis_csc\": [\"6\", \"5.1\"]}]'),(24014,'Ensure&#x20;&#039;debug_print_rewritten&#039;&#x20;is&#x20;disabled','The&#x20;debug_print_rewritten&#x20;setting&#x20;enables&#x20;printing&#x20;the&#x20;query&#x20;rewriter&#x20;output&#x20;for&#x20;each&#x20;executed&#x20;query.&#x20;These&#x20;messages&#x20;are&#x20;emitted&#x20;at&#x20;the&#x20;LOG&#x20;message&#x20;level.&#x20;Unless&#x20;directed&#x20;otherwise&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy,&#x20;it&#x20;is&#x20;recommended&#x20;this&#x20;setting&#x20;be&#x20;disabled&#x20;by&#x20;setting&#x20;it&#x20;to&#x20;off.&#x0a;','Enabling&#x20;any&#x20;of&#x20;the&#x20;DEBUG&#x20;printing&#x20;variables&#x20;may&#x20;cause&#x20;the&#x20;logging&#x20;of&#x20;sensitive&#x20;information&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;omitted&#x20;based&#x20;on&#x20;the&#x20;configuration&#x20;of&#x20;the&#x20;other&#x20;logging&#x20;settings.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;disable&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;debug_print_rewritten&#x20;=&#x20;&#039;off&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.15\"]}, {\"cis_csc\": [\"6\", \"5.1\"]}]'),(24015,'Ensure&#x20;&#039;debug_print_plan&#039;&#x20;is&#x20;disabled','The&#x20;debug_print_plan&#x20;setting&#x20;enables&#x20;printing&#x20;the&#x20;execution&#x20;plan&#x20;for&#x20;each&#x20;executed&#x20;query.&#x20;These&#x20;messages&#x20;are&#x20;emitted&#x20;at&#x20;the&#x20;LOG&#x20;message&#x20;level.&#x20;Unless&#x20;directed&#x20;otherwise&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy,&#x20;it&#x20;is&#x20;recommended&#x20;this&#x20;setting&#x20;be&#x20;disabled&#x20;by&#x20;setting&#x20;it&#x20;to&#x20;off.&#x0a;','Enabling&#x20;any&#x20;of&#x20;the&#x20;DEBUG&#x20;printing&#x20;variables&#x20;may&#x20;cause&#x20;the&#x20;logging&#x20;of&#x20;sensitive&#x20;information&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;omitted&#x20;based&#x20;on&#x20;the&#x20;configuration&#x20;of&#x20;the&#x20;other&#x20;logging&#x20;settings.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;disable&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;debug_print_plan&#x20;=&#x20;&#039;off&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.16\"]}, {\"cis_csc\": [\"6\", \"5.1\"]}]'),(24016,'Ensure&#x20;&#039;debug_pretty_print&#039;&#x20;is&#x20;enabled','Enabling&#x20;debug_pretty_print&#x20;indents&#x20;the&#x20;messages&#x20;produced&#x20;by&#x20;debug_print_parse,&#x20;debug_print_rewritten,&#x20;or&#x20;debug_print_plan&#x20;making&#x20;them&#x20;significantly&#x20;easier&#x20;to&#x20;read.&#x0a;','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;&quot;compact&quot;&#x20;format&#x20;is&#x20;used&#x20;instead,&#x20;significantly&#x20;reducing&#x20;readability&#x20;of&#x20;the&#x20;DEBUG&#x20;statement&#x20;log&#x20;messages.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;enable&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;debug_pretty_print&#x20;=&#x20;&#039;on&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.17\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24017,'Ensure&#x20;&#039;log_connections&#039;&#x20;is&#x20;enabled','Enabling&#x20;the&#x20;log_connections&#x20;setting&#x20;causes&#x20;each&#x20;attempted&#x20;connection&#x20;to&#x20;the&#x20;server&#x20;to&#x20;be&#x20;logged,&#x20;as&#x20;well&#x20;as&#x20;successful&#x20;completion&#x20;of&#x20;client&#x20;authentication.&#x20;This&#x20;parameter&#x20;cannot&#x20;be&#x20;changed&#x20;after&#x20;session&#x20;start.&#x0a;','PostgreSQL&#x20;does&#x20;not&#x20;maintain&#x20;an&#x20;internal&#x20;record&#x20;of&#x20;attempted&#x20;connections&#x20;to&#x20;the&#x20;database&#x20;for&#x20;later&#x20;auditing.&#x20;It&#x20;is&#x20;only&#x20;by&#x20;enabling&#x20;the&#x20;logging&#x20;of&#x20;these&#x20;attempts&#x20;that&#x20;one&#x20;can&#x20;determine&#x20;if&#x20;unexpected&#x20;attempts&#x20;are&#x20;being&#x20;made.&#x0a;Note&#x20;that&#x20;enabling&#x20;this&#x20;without&#x20;also&#x20;enabling&#x20;log_disconnections&#x20;provides&#x20;little&#x20;value.&#x20;Generally,&#x20;you&#x20;would&#x20;enable/disable&#x20;the&#x20;pair&#x20;together.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;enable&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_connections&#x20;=&#x20;&#039;on&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.18\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24018,'Ensure&#x20;&#039;log_disconnections&#039;&#x20;is&#x20;enabled&#x20;&#40;Automated&#41;','Enabling&#x20;the&#x20;log_disconnections&#x20;setting&#x20;logs&#x20;the&#x20;end&#x20;of&#x20;each&#x20;session,&#x20;including&#x20;session&#x20;duration.&#x20;This&#x20;parameter&#x20;cannot&#x20;be&#x20;changed&#x20;after&#x20;session&#x20;start.&#x0a;','PostgreSQL&#x20;does&#x20;not&#x20;maintain&#x20;the&#x20;beginning&#x20;or&#x20;ending&#x20;of&#x20;a&#x20;connection&#x20;internally&#x20;for&#x20;later&#x20;review.&#x20;It&#x20;is&#x20;only&#x20;by&#x20;enabling&#x20;the&#x20;logging&#x20;of&#x20;these&#x20;that&#x20;one&#x20;can&#x20;examine&#x20;connections&#x20;for&#x20;failed&#x20;attempts,&#x20;&#039;over&#x20;long&#039;&#x20;duration,&#x20;or&#x20;other&#x20;anomalies.&#x0a;Note&#x20;that&#x20;enabling&#x20;this&#x20;without&#x20;also&#x20;enabling&#x20;log_connections&#x20;provides&#x20;little&#x20;value.&#x20;Generally,&#x20;you&#x20;would&#x20;enable/disable&#x20;the&#x20;pair&#x20;together&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;enable&#x20;this&#x20;setting:&#x0a;postgres=&#x20;&#x20;alter&#x20;system&#x20;set&#x20;log_disconnections&#x20;=&#x20;&#039;on&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=&#x20;&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.19\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24019,'Ensure&#x20;&#039;log_error_verbosity&#039;&#x20;is&#x20;set&#x20;correctly','The&#x20;log_error_verbosity&#x20;setting&#x20;specifies&#x20;the&#x20;verbosity&#x20;&#40;amount&#x20;of&#x20;detail&#41;&#x20;of&#x20;logged&#x20;messages.&#x0a;','If&#x20;this&#x20;is&#x20;not&#x20;set&#x20;to&#x20;the&#x20;correct&#x20;value,&#x20;too&#x20;many&#x20;details&#x20;or&#x20;too&#x20;few&#x20;details&#x20;may&#x20;be&#x20;logged.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;as&#x20;superuser&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;to&#x20;verbose&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_error_verbosity&#x20;=&#x20;&#039;verbose&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.20\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24020,'Ensure&#x20;&#039;log_hostname&#039;&#x20;is&#x20;set&#x20;correctly','Enabling&#x20;the&#x20;log_hostname&#x20;setting&#x20;causes&#x20;the&#x20;hostname&#x20;of&#x20;the&#x20;connecting&#x20;host&#x20;to&#x20;be&#x20;logged&#x20;in&#x20;addition&#x20;to&#x20;the&#x20;host&#039;s&#x20;IP&#x20;address&#x20;for&#x20;connection&#x20;log&#x20;messages.&#x20;Disabling&#x20;the&#x20;setting&#x20;causes&#x20;only&#x20;the&#x20;connecting&#x20;host&#039;s&#x20;IP&#x20;address&#x20;to&#x20;be&#x20;logged,&#x20;and&#x20;not&#x20;the&#x20;hostname.&#x20;Unless&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy&#x20;requires&#x20;hostname&#x20;logging,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;disable&#x20;this&#x20;setting&#x20;so&#x20;as&#x20;not&#x20;to&#x20;incur&#x20;the&#x20;overhead&#x20;of&#x20;DNS&#x20;resolution&#x20;for&#x20;each&#x20;statement&#x20;that&#x20;is&#x20;logged.&#x0a;','Depending&#x20;on&#x20;your&#x20;hostname&#x20;resolution&#x20;setup,&#x20;enabling&#x20;this&#x20;setting&#x20;might&#x20;impose&#x20;a&#x20;nonnegligible&#x20;performance&#x20;penalty.&#x20;Additionally,&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;logged&#x20;can&#x20;be&#x20;resolved&#x20;to&#x20;their&#x20;DNS&#x20;names&#x20;when&#x20;reviewing&#x20;the&#x20;logs&#x20;&#40;unless&#x20;dynamic&#x20;host&#x20;names&#x20;are&#x20;being&#x20;used&#x20;as&#x20;part&#x20;of&#x20;your&#x20;DHCP&#x20;setup&#41;.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting&#x20;&#40;in&#x20;this&#x20;example,&#x20;to&#x20;off&#41;:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_hostname=&#039;off&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.21\"]}, {\"cis_csc\": [\"6\", \"5.1\"]}]'),(24021,'Ensure&#x20;&#039;log_line_prefix&#039;&#x20;is&#x20;set&#x20;correctly','The&#x20;log_line_prefix&#x20;setting&#x20;specifies&#x20;a&#x20;printf-style&#x20;string&#x20;that&#x20;is&#x20;prefixed&#x20;to&#x20;each&#x20;log&#x20;line.&#x20;If&#x20;blank,&#x20;no&#x20;prefix&#x20;is&#x20;used.&#x20;You&#x20;should&#x20;configure&#x20;this&#x20;as&#x20;recommended&#x20;by&#x20;the&#x20;pgBadger&#x20;development&#x20;team&#x20;unless&#x20;directed&#x20;otherwise&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy.&#x0a;%&#x20;characters&#x20;begin&#x20;&quot;escape&#x20;sequences&quot;&#x20;that&#x20;are&#x20;replaced&#x20;with&#x20;status&#x20;information&#x20;as&#x20;outlined&#x20;below.&#x20;Unrecognized&#x20;escapes&#x20;are&#x20;ignored.&#x20;Other&#x20;characters&#x20;are&#x20;copied&#x20;straight&#x20;to&#x20;the&#x20;log&#x20;line.&#x20;Some&#x20;escapes&#x20;are&#x20;only&#x20;recognized&#x20;by&#x20;session&#x20;processes&#x20;and&#x20;will&#x20;be&#x20;treated&#x20;as&#x20;empty&#x20;by&#x20;background&#x20;processes&#x20;such&#x20;as&#x20;the&#x20;main&#x20;server&#x20;process.&#x20;Status&#x20;information&#x20;may&#x20;be&#x20;aligned&#x20;either&#x20;left&#x20;or&#x20;right&#x20;by&#x20;specifying&#x20;a&#x20;numeric&#x20;literal&#x20;after&#x20;the&#x20;%&#x20;and&#x20;before&#x20;the&#x20;option.&#x20;A&#x20;negative&#x20;value&#x20;will&#x20;cause&#x20;the&#x20;status&#x20;information&#x20;to&#x20;be&#x20;padded&#x20;on&#x20;the&#x20;right&#x20;with&#x20;spaces&#x20;to&#x20;give&#x20;it&#x20;a&#x20;minimum&#x20;width,&#x20;whereas&#x20;a&#x20;positive&#x20;value&#x20;will&#x20;pad&#x20;on&#x20;the&#x20;left.&#x20;Padding&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;aid&#x20;human&#x20;readability&#x20;in&#x20;log&#x20;files.&#x0a;','Properly&#x20;setting&#x20;log_line_prefix&#x20;allows&#x20;for&#x20;adding&#x20;additional&#x20;information&#x20;to&#x20;each&#x20;log&#x20;entry&#x20;&#40;such&#x20;as&#x20;the&#x20;user,&#x20;or&#x20;the&#x20;database&#41;.&#x20;Said&#x20;information&#x20;may&#x20;then&#x20;be&#x20;of&#x20;use&#x20;in&#x20;auditing&#x20;or&#x20;security&#x20;reviews.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_line_prefix&#x20;=&#x20;&#039;%m&#x20;[%p]:&#x20;[%l-1]&#x0a;db=%d,user=%u,app=%a,client=%h&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.22\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]');
INSERT INTO `tsca` VALUES (24022,'Ensure&#x20;&#039;log_statement&#039;&#x20;is&#x20;set&#x20;correctly','The&#x20;log_statement&#x20;setting&#x20;specifies&#x20;the&#x20;types&#x20;of&#x20;SQL&#x20;statements&#x20;that&#x20;are&#x20;logged.&#x20;It&#x20;is&#x20;recommended&#x20;this&#x20;be&#x20;set&#x20;to&#x20;ddl&#x20;unless&#x20;otherwise&#x20;directed&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy.&#x0a;','Setting&#x20;log_statement&#x20;to&#x20;align&#x20;with&#x20;your&#x20;organization&#039;s&#x20;security&#x20;and&#x20;logging&#x20;policies&#x20;facilitates&#x20;later&#x20;auditing&#x20;and&#x20;review&#x20;of&#x20;database&#x20;activities.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;as&#x20;superuser&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_statement=&#039;ddl&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.23\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24023,'Ensure&#x20;&#039;log_timezone&#039;&#x20;is&#x20;set&#x20;correctly','The&#x20;log_timezone&#x20;setting&#x20;specifies&#x20;the&#x20;time&#x20;zone&#x20;to&#x20;use&#x20;in&#x20;timestamps&#x20;within&#x20;log&#x20;messages.&#x20;This&#x20;value&#x20;is&#x20;cluster-wide,&#x20;so&#x20;that&#x20;all&#x20;sessions&#x20;will&#x20;report&#x20;timestamps&#x20;consistently.&#x20;Unless&#x20;directed&#x20;otherwise&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy,&#x20;set&#x20;this&#x20;to&#x20;either&#x20;GMT&#x20;or&#x20;UTC.&#x0a;','Log&#x20;entry&#x20;timestamps&#x20;should&#x20;be&#x20;configured&#x20;for&#x20;an&#x20;appropriate&#x20;time&#x20;zone&#x20;as&#x20;defined&#x20;by&#x20;your&#x20;organization&#039;s&#x20;logging&#x20;policy&#x20;to&#x20;ensure&#x20;a&#x20;lack&#x20;of&#x20;confusion&#x20;around&#x20;when&#x20;a&#x20;logged&#x20;event&#x20;occurred.&#x0a;Note&#x20;that&#x20;this&#x20;setting&#x20;affects&#x20;only&#x20;the&#x20;timestamps&#x20;present&#x20;in&#x20;the&#x20;logs.&#x20;It&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;time&#x20;zone&#x20;in&#x20;use&#x20;by&#x20;the&#x20;database&#x20;itself&#x20;&#40;for&#x20;example,&#x20;select&#x20;now&#40;&#41;&#41;,&#x20;nor&#x20;does&#x20;it&#x20;affect&#x20;the&#x20;host&#039;s&#x20;time&#x20;zone.&#x0a;','','Execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#40;s&#41;&#x20;to&#x20;remediate&#x20;this&#x20;setting:&#x0a;postgres=#&#x20;alter&#x20;system&#x20;set&#x20;log_timezone&#x20;=&#x20;&#039;GMT&#039;;&#x0a;ALTER&#x20;SYSTEM&#x0a;postgres=#&#x20;select&#x20;pg_reload_conf&#40;&#41;;&#x0a;pg_reload_conf&#x0a;----------------&#x0a;72&#x20;|&#x20;Page&#x0a;t&#x0a;&#40;1&#x20;row&#41;&#x0a;','[{\"cis\": [\"3.1.24\"]}, {\"cis_csc\": [\"6\", \"6.3\"]}]'),(24024,'Ensure&#x20;the&#x20;PostgreSQL&#x20;Audit&#x20;Extension&#x20;&#40;pgAudit&#41;&#x20;is&#x20;enabled','The&#x20;PostgreSQL&#x20;Audit&#x20;Extension&#x20;&#40;pgAudit&#41;&#x20;provides&#x20;detailed&#x20;session&#x20;and/or&#x20;object&#x20;audit&#x20;logging&#x20;via&#x20;the&#x20;standard&#x20;PostgreSQL&#x20;logging&#x20;facility.&#x20;The&#x20;goal&#x20;of&#x20;pgAudit&#x20;is&#x20;to&#x20;provide&#x20;PostgreSQL&#x20;users&#x20;with&#x20;the&#x20;capability&#x20;to&#x20;produce&#x20;audit&#x20;logs&#x20;often&#x20;required&#x20;to&#x20;comply&#x20;with&#x20;government,&#x20;financial,&#x20;or&#x20;ISO&#x20;certifications.&#x0a;','Basic&#x20;statement&#x20;logging&#x20;can&#x20;be&#x20;provided&#x20;by&#x20;the&#x20;standard&#x20;logging&#x20;facility&#x20;with&#x20;log_statement&#x20;=&#x20;all.&#x20;This&#x20;is&#x20;acceptable&#x20;for&#x20;monitoring&#x20;and&#x20;other&#x20;uses&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;the&#x20;level&#x20;of&#x20;detail&#x20;generally&#x20;required&#x20;for&#x20;an&#x20;audit.&#x20;It&#x20;is&#x20;not&#x20;enough&#x20;to&#x20;have&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;operations&#x20;performed&#x20;against&#x20;the&#x20;database,&#x20;it&#x20;must&#x20;also&#x20;be&#x20;possible&#x20;to&#x20;find&#x20;particular&#x20;statements&#x20;that&#x20;are&#x20;of&#x20;interest&#x20;to&#x20;an&#x20;auditor.&#x20;The&#x20;standard&#x20;logging&#x20;facility&#x20;shows&#x20;what&#x20;the&#x20;user&#x20;requested,&#x20;while&#x20;pgAudit&#x20;focuses&#x20;on&#x20;the&#x20;details&#x20;of&#x20;what&#x20;happened&#x20;while&#x20;the&#x20;database&#x20;was&#x20;satisfying&#x20;the&#x20;request.&#x0a;When&#x20;logging&#x20;SELECT&#x20;and&#x20;DML&#x20;statements,&#x20;pgAudit&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;log&#x20;a&#x20;separate&#x20;entry&#x20;for&#x20;each&#x20;relation&#x20;referenced&#x20;in&#x20;a&#x20;statement.&#x20;No&#x20;parsing&#x20;is&#x20;required&#x20;to&#x20;find&#x20;all&#x20;statements&#x20;that&#x20;touch&#x20;a&#x20;particular&#x20;table.&#x20;In&#x20;fact,&#x20;the&#x20;goal&#x20;is&#x20;that&#x20;the&#x20;statement&#x20;text&#x20;is&#x20;provided&#x20;primarily&#x20;for&#x20;deep&#x20;forensics&#x20;and&#x20;should&#x20;not&#x20;be&#x20;required&#x20;for&#x20;an&#x20;audit.&#x0a;','','To&#x20;install&#x20;and&#x20;enable&#x20;pgAudit,&#x20;simply&#x20;install&#x20;the&#x20;appropriate&#x20;rpm&#x20;from&#x20;the&#x20;PGDG&#x20;repo:&#x0a;#&#x20;whoami&#x0a;root&#x0a;pgauditlogtofile_96.x86_64&#x20;:&#x20;PostgreSQL&#x20;Audit&#x20;Log&#x20;To&#x20;File&#x20;Extension&#x0a;[root@centos8&#x20;~]#&#x20;dnf&#x20;-y&#x20;install&#x20;pgaudit15_13&#x0a;Last&#x20;metadata&#x20;expiration&#x20;check:&#x20;0:24:09&#x20;ago&#x20;on&#x20;Mon&#x20;14&#x20;Dec&#x20;2020&#x20;06:59:52&#x20;PM&#x0a;UTC.&#x0a;Dependencies&#x20;resolved.&#x0a;=============================================================================&#x0a;Package&#x20;Architecture&#x20;Version&#x20;Repository&#x20;Size&#x0a;=============================================================================&#x0a;Installing:&#x0a;pgaudit15_13&#x20;x86_64&#x20;1.5.0-1.rhel8&#x20;pgdg13&#x20;52&#x20;k&#x0a;Transaction&#x20;Summary&#x0a;=============================================================================&#x0a;Install&#x20;1&#x20;Package&#x0a;Total&#x20;download&#x20;size:&#x20;52&#x20;k&#x0a;Installed&#x20;size:&#x20;93&#x20;k&#x0a;Downloading&#x20;Packages:&#x0a;pgaudit15_13-1.5.0-1.rhel8.x86_64.rpm&#x20;54&#x20;kB/s&#x20;|&#x20;52&#x20;kB&#x20;00:00&#x0a;-----------------------------------------------------------------------------&#x0a;Total&#x20;54&#x20;kB/s&#x20;|&#x20;52&#x20;kB&#x20;00:00&#x0a;75&#x20;|&#x20;Page&#x0a;Running&#x20;transaction&#x20;check&#x0a;Transaction&#x20;check&#x20;succeeded.&#x0a;Running&#x20;transaction&#x20;test&#x0a;Transaction&#x20;test&#x20;succeeded.&#x0a;Running&#x20;transaction&#x0a;Preparing&#x20;:&#x20;1/1&#x0a;Installing&#x20;:&#x20;pgaudit15_13-1.5.0-1.rhel8.x86_64&#x20;1/1&#x0a;Running&#x20;scriptlet:&#x20;pgaudit15_13-1.5.0-1.rhel8.x86_64&#x20;1/1&#x0a;Verifying&#x20;:&#x20;pgaudit15_13-1.5.0-1.rhel8.x86_64&#x20;1/1&#x0a;Installed:&#x0a;pgaudit15_13-1.5.0-1.rhel8.x86_64&#x0a;Complete!&#x0a;pgAudit&#x20;is&#x20;now&#x20;installed&#x20;and&#x20;ready&#x20;to&#x20;be&#x20;configured.&#x20;Next,&#x20;we&#x20;need&#x20;to&#x20;alter&#x20;the&#x20;postgresql.conf&#x20;configuration&#x20;file&#x20;to:&#x0a;&bull;&#x20;enable&#x20;pgAudit&#x20;as&#x20;an&#x20;extension&#x20;in&#x20;the&#x20;shared_preload_libraries&#x20;parameter&#x0a;&bull;&#x20;indicate&#x20;which&#x20;classes&#x20;of&#x20;statements&#x20;we&#x20;want&#x20;to&#x20;log&#x20;via&#x20;the&#x20;pgaudit.log&#x20;parameter&#x0a;and,&#x20;finally,&#x20;restart&#x20;the&#x20;PostgreSQL&#x20;service:&#x0a;$&#x20;vi&#x20;${PGDATA}/postgresql.conf&#x0a;Find&#x20;the&#x20;shared_preload_libraries&#x20;entry,&#x20;and&#x20;add&#x20;&#039;pgaudit&#039;&#x20;to&#x20;it&#x20;&#40;preserving&#x20;any&#x20;existing&#x20;entries&#41;:&#x0a;shared_preload_libraries&#x20;=&#x20;&#039;pgaudit&#039;&#x0a;OR&#x0a;shared_preload_libraries&#x20;=&#x20;&#039;pgaudit,somethingelse&#039;&#x0a;Now,&#x20;add&#x20;a&#x20;new&#x20;pgaudit-specific&#x20;entry:&#x0a;#&#x20;for&#x20;this&#x20;example&#x20;we&#x20;are&#x20;logging&#x20;the&#x20;ddl&#x20;and&#x20;write&#x20;operations&#x0a;pgaudit.log=&#039;ddl,write&#039;&#x0a;Restart&#x20;the&#x20;PostgreSQL&#x20;server&#x20;for&#x20;changes&#x20;to&#x20;take&#x20;affect:&#x0a;#&#x20;whoami&#x0a;root&#x0a;#&#x20;systemctl&#x20;restart&#x20;postgresql-13&#x0a;#&#x20;systemctl&#x20;status&#x20;postgresql-13|grep&#x20;&#039;ago$&#039;&#x0a;Active:&#x20;active&#x20;&#40;running&#41;&#x20;since&#x20;[date]&#x20;10s&#x20;ago&#x0a;','[{\"cis\": [\"3.2\"]}, {\"cis\": [\"6\", \"6.2\"]}]'),(24025,'Use&#x20;pg_permission&#x20;extension&#x20;to&#x20;audit&#x20;object&#x20;permissions','Using&#x20;a&#x20;PostgreSQL&#x20;extension&#x20;called&#x20;pg_permissions&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;declare&#x20;which&#x20;DB&#x20;users&#x20;should&#x20;have&#x20;which&#x20;permissions&#x20;on&#x20;a&#x20;given&#x20;object&#x20;and&#x20;generate&#x20;a&#x20;report&#x20;showing&#x20;compliance/deviation.&#x0a;','Auditing&#x20;permissions&#x20;in&#x20;a&#x20;PostgreSQL&#x20;database&#x20;can&#x20;be&#x20;intimidating&#x20;given&#x20;the&#x20;default&#x20;manner&#x20;in&#x20;which&#x20;permissions&#x20;are&#x20;presented.&#x20;The&#x20;pg_permissions&#x20;extension&#x20;greatly&#x20;simplifies&#x20;this&#x20;presentation&#x20;and&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;declare&#x20;what&#x20;permissions&#x20;should&#x20;exist&#x20;and&#x20;then&#x20;report&#x20;on&#x20;differences&#x20;from&#x20;that&#x20;ideal.&#x0a;','','','[{\"cis\": [\"4.5\"]}, {\"cis_csc\": [\"5.1\"]}]'),(24026,'Ensure&#x20;the&#x20;set_user&#x20;extension&#x20;is&#x20;installed','PostgreSQL&#x20;access&#x20;to&#x20;the&#x20;superuser&#x20;database&#x20;role&#x20;must&#x20;be&#x20;controlled&#x20;and&#x20;audited&#x20;to&#x20;prevent&#x20;unauthorized&#x20;access.&#x0a;','Even&#x20;when&#x20;reducing&#x20;and&#x20;limiting&#x20;the&#x20;access&#x20;to&#x20;the&#x20;superuser&#x20;role&#x20;as&#x20;described&#x20;earlier&#x20;in&#x20;this&#x20;benchmark,&#x20;it&#x20;is&#x20;still&#x20;difficult&#x20;to&#x20;determine&#x20;who&#x20;accessed&#x20;the&#x20;superuser&#x20;role&#x20;and&#x20;what&#x20;actions&#x20;were&#x20;taken&#x20;using&#x20;that&#x20;role.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;ideal&#x20;to&#x20;prevent&#x20;anyone&#x20;from&#x20;logging&#x20;in&#x20;as&#x20;the&#x20;superuser&#x20;and&#x20;forcing&#x20;them&#x20;to&#x20;escalate&#x20;their&#x20;role.&#x20;This&#x20;model&#x20;is&#x20;used&#x20;at&#x20;the&#x20;OS&#x20;level&#x20;by&#x20;the&#x20;use&#x20;of&#x20;sudo&#x20;and&#x20;should&#x20;be&#x20;emulated&#x20;in&#x20;the&#x20;database.&#x20;The&#x20;set_user&#x20;extension&#x20;allows&#x20;for&#x20;this&#x20;setup.&#x0a;','','','[{\"cis\": [\"4.7\"]}, {\"cis_csc\": [\"5.1\", \"5.8\", \"4.3\"]}]'),(24027,'Ensure&#x20;FIPS&#x20;140-2&#x20;OpenSSL&#x20;Cryptography&#x20;Is&#x20;Used','Install,&#x20;configure,&#x20;and&#x20;use&#x20;OpenSSL&#x20;on&#x20;a&#x20;platform&#x20;that&#x20;has&#x20;a&#x20;NIST&#x20;certified&#x20;FIPS&#x20;140-2&#x20;installation&#x20;of&#x20;OpenSSL.&#x20;This&#x20;provides&#x20;PostgreSQL&#x20;instances&#x20;the&#x20;ability&#x20;to&#x20;generate&#x20;and&#x20;validate&#x20;cryptographic&#x20;hashes&#x20;to&#x20;protect&#x20;unclassified&#x20;information&#x20;requiring&#x20;confidentiality&#x20;and&#x20;cryptographic&#x20;protection,&#x20;in&#x20;accordance&#x20;with&#x20;the&#x20;data&#x20;owner&#039;s&#x20;requirements.&#x0a;','Federal&#x20;Information&#x20;Processing&#x20;Standard&#x20;&#40;FIPS&#41;&#x20;Publication&#x20;140-2&#x20;is&#x20;a&#x20;computer&#x20;security&#x20;standard&#x20;developed&#x20;by&#x20;a&#x20;U.S.&#x20;Government&#x20;and&#x20;industry&#x20;working&#x20;group&#x20;for&#x20;validating&#x20;the&#x20;quality&#x20;of&#x20;cryptographic&#x20;modules.&#x20;Use&#x20;of&#x20;weak,&#x20;or&#x20;untested,&#x20;encryption&#x20;algorithms&#x20;undermine&#x20;the&#x20;purposes&#x20;of&#x20;utilizing&#x20;encryption&#x20;to&#x20;protect&#x20;data.&#x20;PostgreSQL&#x20;uses&#x20;OpenSSL&#x20;for&#x20;the&#x20;underlying&#x20;encryption&#x20;layer.&#x20;The&#x20;database&#x20;and&#x20;application&#x20;must&#x20;implement&#x20;cryptographic&#x20;modules&#x20;adhering&#x20;to&#x20;the&#x20;higher&#x20;standards&#x20;approved&#x20;by&#x20;the&#x20;federal&#x20;government&#x20;since&#x20;this&#x20;provides&#x20;assurance&#x20;they&#x20;have&#x20;been&#x20;tested&#x20;and&#x20;validated.&#x20;It&#x20;is&#x20;the&#x20;responsibility&#x20;of&#x20;the&#x20;data&#x20;owner&#x20;to&#x20;assess&#x20;the&#x20;cryptography&#x20;requirements&#x20;in&#x20;light&#x20;of&#x20;applicable&#x20;federal&#x20;laws,&#x20;Executive&#x20;Orders,&#x20;directives,&#x20;policies,&#x20;regulations,&#x20;and&#x20;standards.&#x20;For&#x20;detailed&#x20;information,&#x20;refer&#x20;to&#x20;NIST&#x20;FIPS&#x20;Publication&#x20;140-2,&#x20;Security&#x20;Requirements&#x20;for&#x20;Cryptographic&#x20;Modules.&#x20;Note&#x20;that&#x20;the&#x20;product&#039;s&#x20;cryptographic&#x20;modules&#x20;must&#x20;be&#x20;validated&#x20;and&#x20;certified&#x20;by&#x20;NIST&#x20;as&#x20;FIPS-compliant.&#x20;The&#x20;security&#x20;functions&#x20;validated&#x20;as&#x20;part&#x20;of&#x20;FIPS&#x20;140-2&#x20;for&#x20;cryptographic&#x20;modules&#x20;are&#x20;described&#x20;in&#x20;FIPS&#x20;140-2&#x20;Annex&#x20;A.&#x20;Currently&#x20;only&#x20;Red&#x20;Hat&#x20;Enterprise&#x20;Linux&#x20;is&#x20;certified&#x20;as&#x20;a&#x20;FIPS&#x20;140-2&#x20;distribution&#x20;of&#x20;OpenSSL.&#x20;For&#x20;other&#x20;operating&#x20;systems,&#x20;users&#x20;must&#x20;obtain&#x20;or&#x20;build&#x20;their&#x20;own&#x20;FIPS&#x20;140-2&#x20;OpenSSL&#x20;libraries.&#x0a;','','','[{\"cis\": [\"6.7\"]}, {\"cis_csc\": [\"14.2\", \"14.4\"]}]'),(24028,'Ensure&#x20;SSL&#x20;is&#x20;enabled&#x20;and&#x20;configured&#x20;correctly','SSL&#x20;on&#x20;a&#x20;PostgreSQL&#x20;server&#x20;should&#x20;be&#x20;enabled&#x20;&#40;set&#x20;to&#x20;on&#41;&#x20;and&#x20;configured&#x20;to&#x20;encrypt&#x20;TCP&#x20;traffic&#x20;to&#x20;and&#x20;from&#x20;the&#x20;server.&#x0a;','If&#x20;SSL&#x20;is&#x20;not&#x20;enabled&#x20;and&#x20;configured&#x20;correctly,&#x20;this&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;data&#x20;being&#x20;compromised&#x20;in&#x20;transit.&#x0a;','','','[{\"cis\": [\"6.8\"]}, {\"cis_csc\": [\"14.2\", \"14.4\"]}]'),(24029,'Ensure&#x20;the&#x20;backup&#x20;and&#x20;restore&#x20;tool,&#x20;&#039;pgBackRest&#039;,&#x20;is&#x20;installed&#x20;and&#x20;configured','pgBackRest&#x20;aims&#x20;to&#x20;be&#x20;a&#x20;simple,&#x20;reliable&#x20;backup&#x20;and&#x20;restore&#x20;system&#x20;that&#x20;can&#x20;seamlessly&#x20;scale&#x20;up&#x20;to&#x20;the&#x20;largest&#x20;databases&#x20;and&#x20;workloads.&#x20;Instead&#x20;of&#x20;relying&#x20;on&#x20;traditional&#x20;backup&#x20;tools&#x20;like&#x20;tar&#x20;and&#x20;rsync,&#x20;pgBackRest&#x20;implements&#x20;all&#x20;backup&#x20;features&#x20;internally&#x20;and&#x20;uses&#x20;a&#x20;custom&#x20;protocol&#x20;for&#x20;communicating&#x20;with&#x20;remote&#x20;systems.&#x20;Removing&#x20;reliance&#x20;on&#x20;tar&#x20;and&#x20;rsync&#x20;allows&#x20;for&#x20;better&#x20;solutions&#x20;to&#x20;database-specific&#x20;backup&#x20;challenges.&#x20;The&#x20;custom&#x20;remote&#x20;protocol&#x20;allows&#x20;for&#x20;more&#x20;flexibility&#x20;and&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;connections&#x20;that&#x20;are&#x20;required&#x20;to&#x20;perform&#x20;a&#x20;backup&#x20;which&#x20;increases&#x20;security.&#x0a;','The&#x20;native&#x20;PostgreSQL&#x20;backup&#x20;facility&#x20;pg_dump&#x20;provides&#x20;adequate&#x20;logical&#x20;backup&#x20;operations&#x20;but&#x20;does&#x20;not&#x20;provide&#x20;for&#x20;Point&#x20;In&#x20;Time&#x20;Recovery&#x20;&#40;PITR&#41;.&#x20;The&#x20;PostgreSQL&#x20;facility&#x20;pg_basebackup&#x20;performs&#x20;physical&#x20;backup&#x20;of&#x20;the&#x20;database&#x20;files&#x20;and&#x20;does&#x20;provide&#x20;for&#x20;PITR,&#x20;but&#x20;it&#x20;is&#x20;constrained&#x20;by&#x20;single&#x20;threading.&#x20;Both&#x20;of&#x20;these&#x20;methodologies&#x20;are&#x20;standard&#x20;in&#x20;the&#x20;PostgreSQL&#x20;ecosystem&#x20;and&#x20;appropriate&#x20;for&#x20;particular&#x20;backup/recovery&#x20;needs.&#x20;pgBackRest&#x20;offers&#x20;another&#x20;option&#x20;with&#x20;much&#x20;more&#x20;robust&#x20;features&#x20;and&#x20;flexibility.&#x20;pgBackRest&#x20;is&#x20;open-source&#x20;software&#x20;developed&#x20;to&#x20;perform&#x20;efficient&#x20;backups&#x20;on&#x20;PostgreSQL&#x20;databases&#x20;that&#x20;measure&#x20;in&#x20;tens&#x20;of&#x20;terabytes&#x20;and&#x20;greater.&#x20;It&#x20;supports&#x20;per&#x20;file&#x20;checksums,&#x20;compression,&#x20;partial/failed&#x20;backup&#x20;resume,&#x20;high-performance&#x20;parallel&#x20;transfer,&#x20;asynchronous&#x20;archiving,&#x20;tablespaces,&#x20;expiration,&#x20;full/differential/incremental,&#x20;local/remote&#x20;operation&#x20;via&#x20;SSH,&#x20;hard-linking,&#x20;restore,&#x20;backup&#x20;encryption,&#x20;and&#x20;more.&#x20;pgBackRest&#x20;is&#x20;written&#x20;in&#x20;C&#x20;and&#x20;Perl&#x20;and&#x20;does&#x20;not&#x20;depend&#x20;on&#x20;rsync&#x20;or&#x20;tar&#x20;but&#x20;instead&#x20;performs&#x20;its&#x20;own&#x20;deltas&#x20;which&#x20;gives&#x20;it&#x20;maximum&#x20;flexibility.&#x20;Finally,&#x20;pgBackRest&#x20;provides&#x20;an&#x20;easy-to-use&#x20;internal&#x20;repository&#x20;listing&#x20;backup&#x20;details&#x20;accessible&#x20;via&#x20;the&#x20;pgbackrest&#x20;info&#x20;command.&#x0a;','','pgBackRest&#x20;is&#x20;not&#x20;installed&#x20;nor&#x20;configured&#x20;for&#x20;PostgreSQL&#x20;by&#x20;default,&#x20;but&#x20;instead&#x20;is&#x20;maintained&#x20;as&#x20;a&#x20;GitHub&#x20;project.&#x20;Fortunately,&#x20;it&#x20;is&#x20;a&#x20;part&#x20;of&#x20;the&#x20;PGDG&#x20;repository&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;installed:&#x0a;$&#x20;whoami&#x0a;root&#x0a;$&#x20;dnf&#x20;-y&#x20;install&#x20;pgbackrest&#x0a;[snip]&#x0a;Installed:&#x0a;pgbackrest-2.31-1.rhel8.x86_64&#x0a;Complete!&#x0a;Once&#x20;installed,&#x20;pgBackRest&#x20;must&#x20;be&#x20;configured&#x20;for&#x20;things&#x20;like&#x20;stanza&#x20;name,&#x20;backup&#x20;location,&#x20;retention&#x20;policy,&#x20;logging,&#x20;etc.&#x20;Please&#x20;consult&#x20;the&#x20;configuration&#x20;guide.&#x20;If&#x20;employing&#x20;pgBackRest&#x20;for&#x20;your&#x20;backup/recovery&#x20;solution,&#x20;ensure&#x20;the&#x20;repository,&#x20;base&#x20;backups,&#x20;and&#x20;WAL&#x20;archives&#x20;are&#x20;stored&#x20;on&#x20;a&#x20;reliable&#x20;file&#x20;system&#x20;separate&#x20;from&#x20;the&#x20;database&#x20;server.&#x20;Further,&#x20;the&#x20;external&#x20;storage&#x20;system&#x20;where&#x20;backups&#x20;resided&#x20;should&#x20;have&#x20;limited&#x20;access&#x20;to&#x20;only&#x20;those&#x20;system&#x20;administrators&#x20;as&#x20;necessary.&#x20;Finally,&#x20;as&#x20;with&#x20;any&#x20;backup/recovery&#x20;solution,&#x20;stringent&#x20;testing&#x20;must&#x20;be&#x20;conducted.&#x20;A&#x20;backup&#x20;is&#x20;only&#x20;good&#x20;if&#x20;it&#x20;can&#x20;be&#x20;restored&#x20;successfully.&#x0a;','[{\"cis\": [\"8.3\"]}, {\"cis_csc\": [\"10\", \"10.1\", \"10.2\"]}]'),(24500,'Ensure&#x20;&#039;extproc&#039;&#x20;Is&#x20;Not&#x20;Present&#x20;in&#x20;&#039;listener.ora&#039;.','extproc&#x20;should&#x20;be&#x20;removed&#x20;from&#x20;the&#x20;listener.ora&#x20;to&#x20;mitigate&#x20;the&#x20;risk&#x20;that&#x20;OS&#x20;libraries&#x20;can&#x20;be&#x20;invoked&#x20;by&#x20;the&#x20;Oracle&#x20;instance.','extproc&#x20;allows&#x20;the&#x20;database&#x20;to&#x20;run&#x20;procedures&#x20;from&#x20;OS&#x20;libraries.&#x20;These&#x20;library&#x20;calls&#x20;can,&#x20;in&#x20;turn,&#x20;run&#x20;any&#x20;OS&#x20;command.','','Remove&#x20;extproc&#x20;from&#x20;the&#x20;listener.ora&#x20;file.','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc\": [\"18.9\", \"9.2\"]}]'),(24501,'Ensure&#x20;&#039;ADMIN_RESTRICTIONS_&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;ON&#039;.','The&#x20;admin_restrictions_&lt;listener_name&gt;&#x20;setting&#x20;&#x20;in&#x20;&#x20;the&#x20;listener.ora&#x20;file&#x20;can&#x20;require&#x20;that&#x20;&#x20;any&#x20;attempted&#x20;real-time&#x20;alteration&#x20;&#x20;of&#x20;&#x20;the&#x20;parameters&#x20;&#x20;in&#x20;&#x20;the&#x20;listener&#x20;&#x20;via&#x20;the&#x20;set&#x20;command&#x20;file&#x20;&#x20;be&#x20;&#x20;refused&#x20;unless&#x20;&#x20;the&#x20;listener.ora&#x20;file&#x20;is&#x20;&#x20;manually&#x20;&#x20;altered,&#x20;&#x20;then&#x20;&#x20;restarted&#x20;by&#x20;&#x20;a&#x20;privileged&#x20;&#x20;user.','Blocking&#x20;&#x20;unprivileged&#x20;&#x20;users&#x20;from&#x20;&#x20;making&#x20;&#x20;alterations&#x20;of&#x20;&#x20;the&#x20;listener.ora&#x20;file,&#x20;&#x20;where&#x20;remote&#x20;&#x20;data/service&#x20;&#x20;settings&#x20;&#x20;are&#x20;specified,&#x20;&#x20;will&#x20;&#x20;help&#x20;&#x20;protect&#x20;data&#x20;&#x20;confidentiality.','','Use&#x20;a&#x20;text&#x20;&#x20;editor&#x20;&#x20;such&#x20;&#x20;as&#x20;&#x20;vi&#x20;to&#x20;set&#x20;the&#x20;admin_restrictions_&lt;listener_name&gt;&#x20;to&#x20;the&#x20;value&#x20;ON','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc\": [\"5.1\", \"4.3\"]}]'),(24502,'Ensure&#x20;&#039;AUDIT_SYS_OPERATIONS&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;TRUE&#039;.','The&#x20;AUDIT_SYS_OPERATIONS&#x20;setting&#x20;&#x20;provides&#x20;&#x20;for&#x20;the&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;conducted&#x20;under&#x20;the&#x20;SYSOPER&#x20;and&#x20;SYSDBA&#x20;accounts.&#x20;&#x20;The&#x20;setting&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;to&#x20;&#x20;TRUE&#x20;to&#x20;enable&#x20;&#x20;this&#x20;auditing.','If&#x20;&#x20;the&#x20;parameter&#x20;AUDIT_SYS_OPERATIONS&#x20;is&#x20;FALSE,&#x20;&#x20;all&#x20;statements&#x20;&#x20;except&#x20;&#x20;for&#x20;Startup/Shutdown&#x20;&#x20;and&#x20;Logon&#x20;by&#x20;&#x20;SYSDBA/SYSOPER&#x20;users&#x20;&#x20;are&#x20;not&#x20;audited.','','To&#x20;&#x20;remediate&#x20;this&#x20;&#x20;setting,&#x20;&#x20;execute&#x20;the&#x20;following&#x20;SQL&#x20;statement&#x20;and&#x20;restart&#x20;the&#x20;instance.&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;AUDIT_SYS_OPERATIONS&#x20;=&#x20;TRUE&#x20;SCOPE=SPFILE;','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc\": [\"5.4\", \"6.2\", \"4.8\", \"6.2\", \"6.3\"]}]'),(24503,'Ensure&#x20;&#039;AUDIT_TRAIL&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;DB&#039;,&#x20;&#039;XML&#039;,&#x20;&#039;OS&#039;,&#x20;&#039;DB,EXTENDED&#039;,&#x20;or&#x20;&#039;XML,EXTENDED&#039;.','The&#x20;audit_trail&#x20;setting&#x20;determines&#x20;&#x20;whether&#x20;or&#x20;&#x20;not&#x20;Oracle&#039;s&#x20;&#x20;basic&#x20;audit&#x20;features&#x20;&#x20;are&#x20;enabled.&#x20;&#x20;It&#x20;&#x20;can&#x20;be&#x20;&#x20;set&#x20;to&#x20;&#x20;Operating&#x20;System&#40;OS&#41;;&#x20;DB;&#x20;DB,EXTENDED;&#x20;&#x20;XML;&#x20;&#x20;or&#x20;&#x20;XML,EXTENDED.&#x20;The&#x20;value&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.','Enabling&#x20;&#x20;the&#x20;basic&#x20;auditing&#x20;&#x20;features&#x20;&#x20;for&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;permits&#x20;the&#x20;collection&#x20;&#x20;of&#x20;&#x20;data&#x20;&#x20;to&#x20;troubleshoot&#x20;problems,&#x20;as&#x20;&#x20;well&#x20;&#x20;as&#x20;&#x20;provides&#x20;&#x20;valuable&#x20;&#x20;forensic&#x20;&#x20;logs&#x20;&#x20;in&#x20;&#x20;the&#x20;case&#x20;&#x20;of&#x20;&#x20;a&#x20;system&#x20;breach&#x20;this&#x20;&#x20;value&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.','','To&#x20;&#x20;remediate&#x20;this&#x20;&#x20;setting,&#x20;&#x20;execute&#x20;one&#x20;of&#x20;&#x20;the&#x20;following&#x20;SQL&#x20;statements&#x20;&#x20;and&#x20;restart&#x20;the&#x20;instance.&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;AUDIT_TRAIL&#x20;=&#x20;DB,&#x20;EXTENDED&#x20;SCOPE&#x20;=&#x20;SPFILE;&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;AUDIT_TRAIL&#x20;=&#x20;OS&#x20;SCOPE&#x20;=&#x20;SPFILE;&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;AUDIT_TRAIL&#x20;=&#x20;XML,&#x20;EXTENDED&#x20;SCOPE&#x20;=&#x20;SPFILE;&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;AUDIT_TRAIL&#x20;=&#x20;DB&#x20;SCOPE&#x20;=&#x20;SPFILE;&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;AUDIT_TRAIL&#x20;=&#x20;XML&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc\": [\"6\", \"6.2\", \"6.3\"]}]'),(24504,'Ensure&#x20;&#039;GLOBAL_NAMES&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;TRUE&#039;.','The&#x20;global_names&#x20;setting&#x20;&#x20;requires&#x20;&#x20;that&#x20;&#x20;the&#x20;name&#x20;&#x20;of&#x20;&#x20;a&#x20;database&#x20;&#x20;link&#x20;&#x20;matches&#x20;that&#x20;&#x20;of&#x20;&#x20;the&#x20;remote&#x20;&#x20;database&#x20;&#x20;it&#x20;&#x20;will&#x20;&#x20;connect&#x20;to.&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#x20;TRUE.','Not&#x20;requiring&#x20;database&#x20;&#x20;connections&#x20;to&#x20;&#x20;match&#x20;the&#x20;domain&#x20;&#x20;that&#x20;&#x20;is&#x20;&#x20;being&#x20;called&#x20;&#x20;remotely&#x20;could&#x20;&#x20;allow&#x20;unauthorized&#x20;&#x20;domain&#x20;&#x20;sources&#x20;to&#x20;&#x20;potentially&#x20;connect&#x20;via&#x20;brute-force&#x20;tactics.','','To&#x20;&#x20;remediate&#x20;this&#x20;&#x20;setting,&#x20;&#x20;execute&#x20;the&#x20;following&#x20;SQL&#x20;statement.&#x20;ALTER&#x20;SYSTEM&#x20;SET&#x20;GLOBAL_NAMES&#x20;=&#x20;TRUE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc\": [\"9\", \"14.6\"]}]'),(24505,'Ensure&#x20;&#039;OS_ROLES&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;FALSE&#039;.','The&#x20;os_roles&#x20;setting&#x20;&#x20;permits&#x20;externally&#x20;&#x20;created&#x20;groups&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;applied&#x20;to&#x20;&#x20;database&#x20;management','Allowing&#x20;&#x20;the&#x20;OS&#x20;&#x20;to&#x20;&#x20;use&#x20;external&#x20;&#x20;groups&#x20;&#x20;for&#x20;database&#x20;&#x20;management&#x20;&#x20;could&#x20;cause&#x20;privilege&#x20;overlaps&#x20;&#x20;and&#x20;generally&#x20;weaken&#x20;&#x20;security.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;OS_ROLES&#x20;=&#x20;FALSE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc\": [\"16\", \"14.6\"]}]'),(24506,'Ensure&#x20;&#039;REMOTE_LISTENER&#039;&#x20;Is&#x20;Empty.','The&#x20;remote_listener&#x20;setting&#x20;determines&#x20;&#x20;whether&#x20;or&#x20;&#x20;not&#x20;a&#x20;valid&#x20;listener&#x20;&#x20;can&#x20;be&#x20;&#x20;established&#x20;on&#x20;&#x20;a&#x20;system&#x20;&#x20;separate&#x20;&#x20;from&#x20;&#x20;the&#x20;database&#x20;&#x20;instance.&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;be&#x20;&#x20;empty&#x20;unless&#x20;&#x20;the&#x20;organization&#x20;&#x20;specifically&#x20;&#x20;needs&#x20;a&#x20;valid&#x20;listener&#x20;&#x20;on&#x20;&#x20;a&#x20;separate&#x20;&#x20;system&#x20;&#x20;or&#x20;&#x20;on&#x20;&#x20;nodes&#x20;running&#x20;Oracle&#x20;RAC&#x20;&#x20;instances','Permitting&#x20;&#x20;a&#x20;remote&#x20;&#x20;listener&#x20;&#x20;for&#x20;connections&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;instance&#x20;&#x20;can&#x20;allow&#x20;for&#x20;the&#x20;potential&#x20;spoofing&#x20;&#x20;of&#x20;&#x20;connections&#x20;and&#x20;that&#x20;&#x20;could&#x20;compromise&#x20;&#x20;data&#x20;&#x20;confidentiality&#x20;and&#x20;integrity.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;REMOTE_LISTENER&#x20;=&#x20;&#039;&#039;&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc\": [\"9\", \"9.2\"]}]'),(24507,'Ensure&#x20;&#039;REMOTE_LOGIN_PASSWORDFILE&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;NONE&#039;.','The&#x20;remote_login_passwordfile&#x20;setting&#x20;specifies&#x20;whether&#x20;or&#x20;&#x20;not&#x20;Oracle&#x20;&#x20;checks&#x20;&#x20;for&#x20;a&#x20;password&#x20;&#x20;file&#x20;&#x20;during&#x20;&#x20;login&#x20;and&#x20;how&#x20;many&#x20;&#x20;databases&#x20;can&#x20;use&#x20;the&#x20;password&#x20;&#x20;file.&#x20;The&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#x20;NONE&#x20;or&#x20;in&#x20;&#x20;the&#x20;event&#x20;you&#x20;are&#x20;running&#x20;DR/Data&#x20;Guard,&#x20;&#x20;EXCLUSIVE&#x20;is&#x20;an&#x20;allowable&#x20;value.','The&#x20;use&#x20;of&#x20;&#x20;this&#x20;&#x20;sort&#x20;&#x20;of&#x20;&#x20;password&#x20;&#x20;login&#x20;file&#x20;&#x20;could&#x20;permit&#x20;&#x20;unsecured,&#x20;&#x20;privileged&#x20;&#x20;connections&#x20;to&#x20;&#x20;the&#x20;database.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;REMOTE_LOGIN_PASSWORDFILE&#x20;=&#x20;&#039;NONE&#039;&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc\": [\"16\", \"16.2\"]}]'),(24508,'Ensure&#x20;&#039;REMOTE_OS_AUTHENT&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;FALSE&#039;.','The&#x20;remote_os_authent&#x20;setting&#x20;determines&#x20;&#x20;whether&#x20;or&#x20;&#x20;not&#x20;OS&#x20;&#x20;&#039;roles&#039;&#x20;with&#x20;&#x20;the&#x20;attendant&#x20;privileges&#x20;&#x20;are&#x20;allowed&#x20;for&#x20;remote&#x20;&#x20;client&#x20;&#x20;connections.&#x20;&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;FALSE.','Permitting&#x20;&#x20;OS&#x20;roles&#x20;&#x20;for&#x20;database&#x20;&#x20;connections&#x20;can&#x20;allow&#x20;the&#x20;spoofing&#x20;&#x20;of&#x20;&#x20;connections&#x20;and&#x20;permit&#x20;&#x20;granting&#x20;&#x20;the&#x20;privileges&#x20;&#x20;of&#x20;&#x20;an&#x20;&#x20;OS&#x20;&#x20;role&#x20;&#x20;to&#x20;&#x20;unauthorized&#x20;&#x20;users&#x20;to&#x20;&#x20;make&#x20;&#x20;connections,&#x20;this&#x20;value&#x20;should&#x20;&#x20;be&#x20;&#x20;restricted&#x20;&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;REMOTE_OS_AUTHENT&#x20;=&#x20;FALSE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc\": [\"16\", \"16.2\"]}]'),(24509,'Ensure&#x20;&#039;REMOTE_OS_ROLES&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;FALSE&#039;.','The&#x20;remote_os_roles&#x20;setting&#x20;permits&#x20;remote&#x20;&#x20;users&#039;&#x20;&#x20;OS&#x20;&#x20;roles&#x20;to&#x20;&#x20;be&#x20;&#x20;applied&#x20;to&#x20;&#x20;database&#x20;management.&#x20;&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#x20;FALSE.','Allowing&#x20;&#x20;remote&#x20;&#x20;clients&#x20;OS&#x20;&#x20;roles&#x20;to&#x20;&#x20;have&#x20;&#x20;permissions&#x20;for&#x20;database&#x20;&#x20;management&#x20;&#x20;could&#x20;cause&#x20;privilege&#x20;overlaps&#x20;&#x20;and&#x20;generally&#x20;weaken&#x20;&#x20;security','','ALTER&#x20;SYSTEM&#x20;SET&#x20;REMOTE_OS_ROLES&#x20;=&#x20;FALSE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc\": [\"16\", \"16.2\"]}]'),(24510,'Ensure&#x20;&#039;SEC_CASE_SENSITIVE_LOGON&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;TRUE&#039;&#x20;.','The&#x20;SEC_CASE_SENSITIVE_LOGON&#x20;information&#x20;&#x20;determines&#x20;&#x20;whether&#x20;or&#x20;&#x20;not&#x20;case-sensitivity&#x20;&#x20;is&#x20;required&#x20;for&#x20;passwords&#x20;during&#x20;&#x20;login.&#x20;Note:&#x20;This&#x20;parameter&#x20;has&#x20;been&#x20;&#x20;deprecated&#x20;&#x20;in&#x20;&#x20;12.1&#x20;&#x20;and&#x20;higher&#x20;&#x20;versions.','Oracle&#x20;&#x20;database&#x20;&#x20;password&#x20;&#x20;case-sensitivity&#x20;&#x20;increases&#x20;the&#x20;pool&#x20;&#x20;of&#x20;&#x20;characters&#x20;&#x20;that&#x20;can&#x20;&#x20;be&#x20;chosen&#x20;for&#x20;the&#x20;passwords,&#x20;&#x20;making&#x20;&#x20;brute-force&#x20;password&#x20;&#x20;attacks&#x20;quite&#x20;difficult.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;SEC_CASE_SENSITIVE_LOGON&#x20;=&#x20;TRUE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc\": [\"16\", \"4.4\"]}]'),(24511,'Ensure&#x20;&#039;SEC_MAX_FAILED_LOGIN_ATTEMPTS&#039;&#x20;Is&#x20;&#039;3&#039;&#x20;or&#x20;Less37.','The&#x20;SEC_MAX_FAILED_LOGIN_ATTEMPTS&#x20;parameter&#x20;determines&#x20;&#x20;how&#x20;many&#x20;&#x20;failed&#x20;&#x20;login&#x20;attempts&#x20;&#x20;are&#x20;allowed&#x20;before&#x20;&#x20;Oracle&#x20;&#x20;closes&#x20;&#x20;the&#x20;login&#x20;connection.','Allowing&#x20;&#x20;an&#x20;&#x20;unlimited&#x20;number&#x20;&#x20;of&#x20;&#x20;login&#x20;attempts&#x20;&#x20;for&#x20;a&#x20;user&#x20;&#x20;connection&#x20;&#x20;can&#x20;facilitate&#x20;&#x20;both&#x20;brute-force&#x20;&#x20;login&#x20;attacks&#x20;and&#x20;the&#x20;occurrence&#x20;&#x20;of&#x20;&#x20;denial-of-service.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;SEC_MAX_FAILED_LOGIN_ATTEMPTS&#x20;=&#x20;3&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc\": [\"16.7\"]}]'),(24512,'Ensure&#x20;&#039;SEC_PROTOCOL_ERROR_FURTHER_ACTION&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;&#40;DROP,3&#41;&#039;.','The&#x20;SEC_PROTOCOL_ERROR_FURTHER_ACTION&#x20;setting&#x20;determines&#x20;&#x20;the&#x20;Oracle&#x20;&#x20;server&#039;s&#x20;&#x20;response&#x20;to&#x20;bad/malformed&#x20;packets&#x20;received&#x20;&#x20;from&#x20;&#x20;the&#x20;client.&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#40;DROP,3&#41;,&#x20;&#x20;which&#x20;will&#x20;&#x20;cause&#x20;a&#x20;connection&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;dropped&#x20;after&#x20;three&#x20;bad/malformed&#x20;packets.','Bad&#x20;packets&#x20;received&#x20;&#x20;from&#x20;&#x20;the&#x20;client&#x20;&#x20;can&#x20;potentially&#x20;indicate&#x20;&#x20;packet-based&#x20;&#x20;attacks&#x20;on&#x20;&#x20;the&#x20;system,&#x20;such&#x20;&#x20;as&#x20;&#x20;TCP&#x20;SYN&#x20;Flood&#x20;or&#x20;&#x20;Smurf&#x20;attacks,&#x20;&#x20;which&#x20;could&#x20;result&#x20;&#x20;in&#x20;&#x20;a&#x20;denial-ofservice&#x20;&#x20;condition,&#x20;&#x20;this&#x20;&#x20;value&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;SEC_PROTOCOL_ERROR_FURTHER_ACTION&#x20;=&#x20;&#039;&#40;DROP,3&#41;&#039;&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc\": [\"18\"]}]'),(24513,'Ensure&#x20;&#039;SEC_PROTOCOL_ERROR_TRACE_ACTION&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;LOG&#039;.','The&#x20;SEC_PROTOCOL_ERROR_TRACE_ACTION&#x20;setting&#x20;determines&#x20;&#x20;the&#x20;Oracle&#039;s&#x20;&#x20;server&#039;s&#x20;&#x20;logging&#x20;response&#x20;&#x20;level&#x20;to&#x20;&#x20;bad/malformed&#x20;packets&#x20;received&#x20;&#x20;from&#x20;&#x20;the&#x20;client&#x20;&#x20;by&#x20;&#x20;generating&#x20;&#x20;ALERT,&#x20;LOG,&#x20;or&#x20;&#x20;TRACE&#x20;levels&#x20;&#x20;of&#x20;&#x20;detail&#x20;&#x20;in&#x20;&#x20;the&#x20;log&#x20;files.&#x20;&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#x20;LOG&#x20;unless&#x20;the&#x20;&#x20;organization&#x20;&#x20;has&#x20;a&#x20;compelling&#x20;&#x20;reason&#x20;&#x20;to&#x20;&#x20;use&#x20;a&#x20;different&#x20;value&#x20;because&#x20;LOG&#x20;should&#x20;&#x20;cause&#x20;the&#x20;necessary&#x20;information&#x20;to&#x20;&#x20;be&#x20;&#x20;logged.&#x20;Setting&#x20;the&#x20;value&#x20;as&#x20;&#x20;TRACE&#x20;can&#x20;generate&#x20;&#x20;an&#x20;enormous&#x20;amount&#x20;&#x20;of&#x20;&#x20;log&#x20;output&#x20;&#x20;and&#x20;should&#x20;&#x20;be&#x20;&#x20;reserved&#x20;&#x20;for&#x20;debugging&#x20;only.','Bad&#x20;packets&#x20;received&#x20;&#x20;from&#x20;&#x20;the&#x20;client&#x20;&#x20;can&#x20;potentially&#x20;indicate&#x20;&#x20;packet-based&#x20;&#x20;attacks&#x20;on&#x20;&#x20;the&#x20;system,&#x20;which&#x20;could&#x20;result&#x20;&#x20;in&#x20;&#x20;a&#x20;denial-of-service&#x20;condition.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;SEC_PROTOCOL_ERROR_TRACE_ACTION=LOG&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24514,'Ensure&#x20;&#039;SEC_RETURN_SERVER_RELEASE_BANNER&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;FALSE&#039;.','The&#x20;information&#x20;about&#x20;patch/update&#x20;&#x20;release&#x20;number&#x20;&#x20;provides&#x20;&#x20;information&#x20;about&#x20;the&#x20;exact&#x20;patch/update&#x20;&#x20;release&#x20;that&#x20;&#x20;is&#x20;&#x20;currently&#x20;running&#x20;on&#x20;&#x20;the&#x20;database.&#x20;This&#x20;&#x20;is&#x20;&#x20;sensitive&#x20;information&#x20;that&#x20;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;revealed&#x20;&#x20;to&#x20;&#x20;anyone&#x20;&#x20;who&#x20;requests&#x20;&#x20;it.','Allowing&#x20;&#x20;the&#x20;database&#x20;&#x20;to&#x20;&#x20;return&#x20;&#x20;information&#x20;about&#x20;the&#x20;patch/update&#x20;&#x20;release&#x20;number&#x20;&#x20;could&#x20;facilitate&#x20;&#x20;unauthorized&#x20;&#x20;users&#039;&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;gain&#x20;&#x20;access&#x20;&#x20;based&#x20;upon&#x20;&#x20;known&#x20;patch&#x20;weaknesses.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;SEC_RETURN_SERVER_RELEASE_BANNER&#x20;=&#x20;FALSE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc\": [\"9\", \"14.6\"]}]'),(24515,'Ensure&#x20;&#039;SQL92_SECURITY&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;TRUE&#039;.','The&#x20;SQL92_SECURITY&#x20;parameter&#x20;&#x20;setting&#x20;TRUE&#x20;requires&#x20;that&#x20;&#x20;a&#x20;user&#x20;&#x20;must&#x20;&#x20;also&#x20;&#x20;be&#x20;&#x20;granted&#x20;the&#x20;SELECT&#x20;object&#x20;privilege&#x20;before&#x20;&#x20;being&#x20;able&#x20;&#x20;to&#x20;&#x20;perform&#x20;UPDATE&#x20;or&#x20;DELETE&#x20;operations&#x20;on&#x20;&#x20;tables&#x20;that&#x20;have&#x20;&#x20;WHERE&#x20;or&#x20;&#x20;SET&#x20;clauses.&#x20;&#x20;The&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#x20;TRUE.','A&#x20;user&#x20;&#x20;without&#x20;SELECT&#x20;privilege&#x20;&#x20;can&#x20;still&#x20;infer&#x20;the&#x20;value&#x20;stored&#x20;&#x20;in&#x20;&#x20;a&#x20;column&#x20;&#x20;by&#x20;&#x20;referring&#x20;to&#x20;that&#x20;column&#x20;&#x20;in&#x20;&#x20;a&#x20;DELETE&#x20;or&#x20;UPDATE&#x20;statement.&#x20;This&#x20;&#x20;setting&#x20;prevents&#x20;&#x20;inadvertent&#x20;information&#x20;disclosure&#x20;&#x20;by&#x20;&#x20;ensuring&#x20;&#x20;that&#x20;&#x20;only&#x20;&#x20;users&#x20;who&#x20;already&#x20;have&#x20;&#x20;SELECT&#x20;privilege&#x20;&#x20;can&#x20;execute&#x20;the&#x20;statements&#x20;&#x20;that&#x20;&#x20;would&#x20;allow&#x20;them&#x20;&#x20;to&#x20;&#x20;infer&#x20;the&#x20;stored&#x20;&#x20;values.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;SQL92_SECURITY&#x20;=&#x20;TRUE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc\": [\"18\", \"14.6\"]}]'),(24516,'Ensure&#x20;&#039;RESOURCE_LIMIT&#039;&#x20;Is&#x20;Set&#x20;to&#x20;&#039;TRUE&#039;.','RESOURCE_LIMIT&#x20;determines&#x20;whether&#x20;resource&#x20;&#x20;limits&#x20;&#x20;are&#x20;enforced&#x20;&#x20;in&#x20;&#x20;database&#x20;&#x20;profiles.&#x20;This&#x20;&#x20;setting&#x20;should&#x20;&#x20;have&#x20;&#x20;a&#x20;value&#x20;of&#x20;&#x20;TRUE.','If&#x20;&#x20;RESOURCE_LIMIT&#x20;is&#x20;set&#x20;to&#x20;&#x20;FALSE,&#x20;&#x20;none&#x20;&#x20;of&#x20;&#x20;the&#x20;system&#x20;&#x20;resource&#x20;&#x20;limits&#x20;&#x20;that&#x20;&#x20;are&#x20;set&#x20;in&#x20;&#x20;any&#x20;database&#x20;&#x20;profiles&#x20;&#x20;are&#x20;enforced.&#x20;If&#x20;&#x20;RESOURCE_LIMIT&#x20;is&#x20;set&#x20;to&#x20;&#x20;TRUE,&#x20;the&#x20;limits&#x20;&#x20;set&#x20;in&#x20;&#x20;database&#x20;profiles&#x20;are&#x20;enforced.','','ALTER&#x20;SYSTEM&#x20;SET&#x20;RESOURCE_LIMIT&#x20;=&#x20;TRUE&#x20;SCOPE&#x20;=&#x20;SPFILE;','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(24517,'Ensure&#x20;&#039;FAILED_LOGIN_ATTEMPTS&#039;&#x20;Is&#x20;Less&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;5&#039;.','The&#x20;FAILED_LOGIN_ATTEMPTS&#x20;setting&#x20;determines&#x20;&#x20;how&#x20;many&#x20;&#x20;failed&#x20;&#x20;login&#x20;attempts&#x20;&#x20;are&#x20;permitted&#x20;before&#x20;&#x20;the&#x20;system&#x20;&#x20;locks&#x20;the&#x20;user&#039;s&#x20;&#x20;account.&#x20;&#x20;While&#x20;different&#x20;profiles&#x20;&#x20;can&#x20;have&#x20;different&#x20;&#x20;and&#x20;more&#x20;&#x20;restrictive&#x20;settings,&#x20;such&#x20;&#x20;as&#x20;&#x20;USERS&#x20;and&#x20;APPS,&#x20;the&#x20;minimum&#40;s&#41;&#x20;recommended&#x20;&#x20;here&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;on&#x20;&#x20;the&#x20;DEFAULT&#x20;profile.','Repeated&#x20;&#x20;failed&#x20;&#x20;login&#x20;attempts&#x20;&#x20;can&#x20;indicate&#x20;&#x20;the&#x20;initiation&#x20;&#x20;of&#x20;&#x20;a&#x20;brute-force&#x20;login&#x20;attack,&#x20;this&#x20;value&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.&#x20;&#40;See&#x20;&#x20;the&#x20;Notes&#x20;for&#x20;a&#x20;warning&#x20;on&#x20;&#x20;a&#x20;known&#x20;bug&#x20;that&#x20;&#x20;can&#x20;make&#x20;&#x20;this&#x20;&#x20;security&#x20;&#x20;measure&#x20;backfire.&#41;','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;FAILED_LOGIN_ATTEMPTS&#x20;5;','[{\"cis\": [\"3.1\"]}, {\"cis_csc\": [\"16.7\"]}]'),(24518,'Ensure&#x20;&#039;PASSWORD_LOCK_TIME&#039;&#x20;Is&#x20;Greater&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;1&#039;.','The&#x20;PASSWORD_LOCK_TIME&#x20;setting&#x20;&#x20;determines&#x20;&#x20;how&#x20;many&#x20;&#x20;days&#x20;&#x20;must&#x20;&#x20;pass&#x20;&#x20;for&#x20;the&#x20;user&#039;s&#x20;account&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;unlocked&#x20;&#x20;after&#x20;the&#x20;set&#x20;number&#x20;&#x20;of&#x20;&#x20;failed&#x20;&#x20;login&#x20;attempts&#x20;&#x20;has&#x20;occurred.&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;&#x20;one&#x20;day&#x20;or&#x20;&#x20;greater.','Locking&#x20;the&#x20;user&#x20;&#x20;account&#x20;after&#x20;repeated&#x20;&#x20;failed&#x20;&#x20;login&#x20;attempts&#x20;&#x20;can&#x20;block&#x20;further&#x20;brute-force&#x20;login&#x20;attacks,&#x20;&#x20;but&#x20;can&#x20;create&#x20;&#x20;administrative&#x20;&#x20;headaches&#x20;as&#x20;&#x20;this&#x20;&#x20;account&#x20;unlocking&#x20;process&#x20;always&#x20;&#x20;requires&#x20;&#x20;DBA&#x20;intervention.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;PASSWORD_LOCK_TIME&#x20;1;','[{\"cis\": [\"3.2\"]}, {\"cis_csc\": [\"16.7\"]}]'),(24519,'Ensure&#x20;&#039;PASSWORD_LIFE_TIME&#039;&#x20;Is&#x20;Less&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;90&#039;.','The&#x20;PASSWORD_LIFE_TIME&#x20;setting&#x20;&#x20;determines&#x20;&#x20;how&#x20;long&#x20;&#x20;a&#x20;password&#x20;&#x20;may&#x20;be&#x20;&#x20;used&#x20;&#x20;before&#x20;&#x20;the&#x20;user&#x20;&#x20;is&#x20;&#x20;required&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;change&#x20;&#x20;it.&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;&#x20;90&#x20;&#x20;days&#x20;&#x20;or&#x20;&#x20;less.','Allowing&#x20;&#x20;passwords&#x20;to&#x20;&#x20;remain&#x20;&#x20;unchanged&#x20;for&#x20;long&#x20;&#x20;periods&#x20;makes&#x20;the&#x20;success&#x20;of&#x20;&#x20;bruteforce&#x20;&#x20;login&#x20;attacks&#x20;more&#x20;&#x20;likely.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;PASSWORD_LIFE_TIME&#x20;90;','[{\"cis\": [\"3.3\"]}, {\"cis_csc\": [\"16\"]}]'),(24520,'Ensure&#x20;&#039;PASSWORD_REUSE_MAX&#039;&#x20;Is&#x20;Greater&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;20&#039;.','The&#x20;PASSWORD_REUSE_MAX&#x20;setting&#x20;&#x20;determines&#x20;&#x20;how&#x20;many&#x20;&#x20;different&#x20;passwords&#x20;must&#x20;&#x20;be&#x20;&#x20;used&#x20;before&#x20;the&#x20;user&#x20;&#x20;is&#x20;&#x20;allowed&#x20;to&#x20;&#x20;reuse&#x20;a&#x20;prior&#x20;password.&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;&#x20;20&#x20;passwords&#x20;&#x20;or&#x20;&#x20;greater.','Allowing&#x20;&#x20;reuse&#x20;of&#x20;&#x20;a&#x20;password&#x20;&#x20;within&#x20;&#x20;a&#x20;short&#x20;period&#x20;&#x20;of&#x20;&#x20;time&#x20;&#x20;after&#x20;the&#x20;password&#039;s&#x20;&#x20;initial&#x20;use&#x20;can&#x20;make&#x20;&#x20;the&#x20;success&#x20;of&#x20;&#x20;both&#x20;&#x20;social-engineering&#x20;&#x20;and&#x20;brute-force&#x20;password-based&#x20;&#x20;attacks&#x20;more&#x20;&#x20;likely.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;PASSWORD_REUSE_MAX&#x20;20;','[{\"cis\": [\"3.4\"]}, {\"cis_csc\": [\"16\", \"4.4\"]}]'),(24521,'Ensure&#x20;&#039;PASSWORD_REUSE_TIME&#039;&#x20;Is&#x20;Greater&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;365&#039;.','The&#x20;PASSWORD_REUSE_TIME&#x20;setting&#x20;determines&#x20;&#x20;the&#x20;amount&#x20;&#x20;of&#x20;&#x20;time&#x20;&#x20;in&#x20;&#x20;days&#x20;&#x20;that&#x20;&#x20;must&#x20;&#x20;pass&#x20;before&#x20;the&#x20;same&#x20;&#x20;password&#x20;&#x20;may&#x20;be&#x20;&#x20;reused.&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;365&#x20;&#x20;days&#x20;&#x20;or&#x20;greater.','Reusing&#x20;the&#x20;same&#x20;&#x20;password&#x20;&#x20;after&#x20;only&#x20;&#x20;a&#x20;short&#x20;period&#x20;&#x20;of&#x20;&#x20;time&#x20;&#x20;has&#x20;passed&#x20;&#x20;makes&#x20;the&#x20;success&#x20;of&#x20;&#x20;brute-force&#x20;login&#x20;attacks&#x20;more&#x20;&#x20;likely.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;PASSWORD_REUSE_TIME&#x20;365;','[{\"cis\": [\"3.5\"]}, {\"cis_csc\": [\"16\", \"4.4\"]}]'),(24522,'Ensure&#x20;&#039;PASSWORD_GRACE_TIME&#039;&#x20;Is&#x20;Less&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;5&#039;.','The&#x20;PASSWORD_GRACE_TIME&#x20;setting&#x20;determines&#x20;&#x20;how&#x20;many&#x20;&#x20;days&#x20;&#x20;can&#x20;pass&#x20;&#x20;after&#x20;the&#x20;user&#039;s&#x20;password&#x20;expires&#x20;before&#x20;&#x20;the&#x20;user&#039;s&#x20;&#x20;login&#x20;capability&#x20;&#x20;is&#x20;&#x20;automatically&#x20;locked&#x20;&#x20;out.&#x20;&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;&#x20;five&#x20;&#x20;days&#x20;&#x20;or&#x20;&#x20;less.','Locking&#x20;the&#x20;user&#x20;&#x20;account&#x20;after&#x20;the&#x20;expiration&#x20;&#x20;of&#x20;&#x20;the&#x20;password&#x20;&#x20;change&#x20;&#x20;requirement&#039;s&#x20;grace&#x20;period&#x20;&#x20;can&#x20;help&#x20;&#x20;prevent&#x20;password-based&#x20;&#x20;attacks&#x20;against&#x20;any&#x20;forgotten&#x20;or&#x20;&#x20;disused&#x20;accounts,&#x20;while&#x20;still&#x20;allowing&#x20;&#x20;the&#x20;account&#x20;and&#x20;its&#x20;information&#x20;to&#x20;&#x20;be&#x20;&#x20;accessible&#x20;&#x20;by&#x20;&#x20;DBA&#x20;intervention.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;PASSWORD_GRACE_TIME&#x20;5;','[{\"cis\": [\"3.6\"]}, {\"cis_csc\": [\"16\", \"16.10\", \"16.9\"]}]'),(24523,'Ensure&#x20;&#039;PASSWORD_VERIFY_FUNCTION&#039;&#x20;Is&#x20;Set&#x20;for&#x20;All&#x20;Profiles.','The&#x20;PASSWORD_VERIFY_FUNCTION&#x20;determines&#x20;password&#x20;&#x20;settings&#x20;&#x20;requirements&#x20;&#x20;when&#x20;&#x20;a&#x20;user&#x20;password&#x20;is&#x20;&#x20;changed&#x20;at&#x20;&#x20;the&#x20;SQL&#x20;command&#x20;prompt.&#x20;It&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;set&#x20;for&#x20;all&#x20;profiles.&#x20;Note&#x20;&#x20;that&#x20;this&#x20;setting&#x20;does&#x20;&#x20;not&#x20;apply&#x20;for&#x20;users&#x20;managed&#x20;by&#x20;&#x20;the&#x20;Oracle&#x20;&#x20;password&#x20;&#x20;file.','Through&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;profiles,&#x20;password&#x20;&#x20;complexity&#x20;&#x20;rules&#x20;&#40;mixed&#x20;&#x20;cases&#x20;with&#x20;&#x20;digits&#x20;&#x20;and&#x20;special&#x20;characters&#41;,&#x20;&#x20;blocking&#x20;&#x20;of&#x20;&#x20;simple&#x20;&#x20;combinations,&#x20;and&#x20;enforcing&#x20;change/history&#x20;&#x20;settings&#x20;can&#x20;&#x20;potentially&#x20;thwart&#x20;&#x20;unauthorized&#x20;&#x20;logins&#x20;&#x20;by&#x20;&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user.','','Create&#x20;&#x20;a&#x20;custom&#x20;&#x20;password&#x20;&#x20;verification&#x20;&#x20;function&#x20;&#x20;which&#x20;fulfills&#x20;&#x20;the&#x20;password&#x20;&#x20;requirements&#x20;&#x20;of&#x20;the&#x20;&#x20;organization.','[{\"cis\": [\"3.7\"]}, {\"cis_csc\": [\"16\", \"4.4\"]}]'),(24524,'Ensure&#x20;&#039;SESSIONS_PER_USER&#039;&#x20;Is&#x20;Less&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;10&#039;.','The&#x20;SESSIONS_PER_USER&#x20;setting&#x20;determines&#x20;&#x20;the&#x20;maximum&#x20;number&#x20;&#x20;of&#x20;&#x20;user&#x20;&#x20;sessions&#x20;&#x20;that&#x20;&#x20;are&#x20;allowed&#x20;to&#x20;&#x20;be&#x20;&#x20;open&#x20;&#x20;concurrently.&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;&#x20;10&#x20;&#x20;or&#x20;&#x20;less.','Limiting&#x20;&#x20;the&#x20;number&#x20;&#x20;of&#x20;&#x20;the&#x20;SESSIONS_PER_USER&#x20;can&#x20;help&#x20;&#x20;prevent&#x20;memory&#x20;&#x20;resource&#x20;exhaustion&#x20;by&#x20;&#x20;poorly&#x20;&#x20;formed&#x20;&#x20;requests&#x20;&#x20;or&#x20;&#x20;intentional&#x20;denial-of-service&#x20;attacks.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;SESSIONS_PER_USER&#x20;10;','[{\"cis\": [\"3.8\"]}, {\"cis_csc\": [\"18\", \"16.7\"]}]'),(24525,'Ensure&#x20;&#039;INACTIVE_ACCOUNT_TIME&#039;&#x20;Is&#x20;Less&#x20;than&#x20;or&#x20;Equal&#x20;to&#x20;&#039;120&#039;.','The&#x20;&#039;INACTIVE_ACCOUNT_TIME&#039;&#x20;setting&#x20;determines&#x20;&#x20;the&#x20;maximum&#x20;number&#x20;&#x20;of&#x20;&#x20;days&#x20;&#x20;of&#x20;inactivity&#x20;&#40;no&#x20;logins&#x20;&#x20;at&#x20;&#x20;all&#41;&#x20;&#x20;after&#x20;which&#x20;the&#x20;account&#x20;will&#x20;&#x20;be&#x20;&#x20;locked.&#x20;The&#x20;suggested&#x20;value&#x20;for&#x20;this&#x20;&#x20;is&#x20;&#x20;120&#x20;or&#x20;&#x20;less.','Setting&#x20;&#039;INACTIVE_ACCOUNT_TIME&#039;&#x20;can&#x20;help&#x20;&#x20;with&#x20;&#x20;deactivation&#x20;&#x20;of&#x20;&#x20;inactive&#x20;&#x20;or&#x20;&#x20;unused&#x20;accounts.','','ALTER&#x20;PROFILE&#x20;&lt;profile_name&gt;&#x20;LIMIT&#x20;INACTIVE_ACCOUNT_TIME&#x20;120;','[{\"cis\": [\"3.9\"]}, {\"cis_csc\": [\"18\", \"16.9\"]}]'),(24526,'Ensure&#x20;All&#x20;Default&#x20;Passwords&#x20;Are&#x20;Changed.','Default&#x20;passwords&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;used&#x20;&#x20;by&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;users.','Default&#x20;passwords&#x20;should&#x20;&#x20;be&#x20;&#x20;considered&#x20;&#x20;well&#x20;&#x20;known&#x20;to&#x20;&#x20;attackers.&#x20;&#x20;Consequently,&#x20;if&#x20;&#x20;default&#x20;passwords&#x20;remain&#x20;&#x20;in&#x20;&#x20;place,&#x20;&#x20;any&#x20;attacker&#x20;&#x20;with&#x20;&#x20;access&#x20;&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;can&#x20;authenticate&#x20;&#x20;as&#x20;&#x20;the&#x20;user&#x20;&#x20;with&#x20;&#x20;that&#x20;&#x20;default&#x20;password.','','','[{\"cis\": [\"4.1\"]}, {\"cis_csc\": [\"5.3\", \"4.2\"]}]'),(24527,'Ensure&#x20;All&#x20;Sample&#x20;Data&#x20;And&#x20;Users&#x20;Have&#x20;Been&#x20;Removed.','Oracle&#x20;&#x20;sample&#x20;&#x20;schemas&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;sample&#x20;&#x20;users&#x20;&#40;BI,HR,IX,OE,PM,SCOTT,SH&#41;,&#x20;&#x20;with&#x20;well-known&#x20;default&#x20;passwords,&#x20;&#x20;particular&#x20;&#x20;views,&#x20;&#x20;and&#x20;procedures/functions,&#x20;in&#x20;&#x20;addition&#x20;&#x20;to&#x20;tables&#x20;and&#x20;fictitious&#x20;&#x20;data.&#x20;The&#x20;sample&#x20;&#x20;schemas&#x20;should&#x20;&#x20;be&#x20;&#x20;removed.','The&#x20;sample&#x20;&#x20;schemas&#x20;are&#x20;typically&#x20;not&#x20;required&#x20;&#x20;for&#x20;production&#x20;&#x20;operations&#x20;&#x20;of&#x20;&#x20;the&#x20;database.&#x20;The&#x20;default&#x20;users,&#x20;&#x20;views,&#x20;&#x20;and/or&#x20;&#x20;procedures/functions&#x20;&#x20;created&#x20;by&#x20;&#x20;sample&#x20;&#x20;schemas&#x20;could&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;launch&#x20;&#x20;exploits&#x20;&#x20;against&#x20;production&#x20;&#x20;environments.','','$ORACLE_HOME/demo/schema/drop_sch.sql&#x20;DROP&#x20;USER&#x20;SCOTT&#x20;CASCADE;','[{\"cis\": [\"4.2\"]}, {\"cis_csc\": [\"18.9\", \"4.7\"]}]'),(24528,'Ensure&#x20;&#039;DBA_USERS.AUTHENTICATION_TYPE&#039;&#x20;Is&#x20;Not&#x20;Set&#x20;to&#x20;&#039;EXTERNAL&#039;&#x20;for&#x20;Any&#x20;User.','The&#x20;authentication_type=&#039;&#039;EXTERNAL&#039;&#039;&#x20;setting&#x20;&#x20;determines&#x20;&#x20;whether&#x20;or&#x20;&#x20;not&#x20;a&#x20;user&#x20;&#x20;can&#x20;be&#x20;authenticated&#x20;&#x20;by&#x20;&#x20;a&#x20;remote&#x20;&#x20;OS&#x20;&#x20;to&#x20;&#x20;allow&#x20;access&#x20;&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;with&#x20;&#x20;full&#x20;&#x20;authorization.&#x20;&#x20;This&#x20;setting&#x20;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;used.','Allowing&#x20;&#x20;remote&#x20;&#x20;OS&#x20;&#x20;authentication&#x20;&#x20;of&#x20;&#x20;a&#x20;user&#x20;&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;can&#x20;potentially&#x20;allow&#x20;supposed&#x20;privileged&#x20;users&#x20;to&#x20;&#x20;connect&#x20;as&#x20;&#x20;authenticated,&#x20;&#x20;even&#x20;&#x20;when&#x20;&#x20;the&#x20;remote&#x20;&#x20;system&#x20;&#x20;is&#x20;compromised.','','ALTER&#x20;USER&#x20;&lt;username&gt;&#x20;IDENTIFIED&#x20;BY&#x20;&lt;password&gt;;','[{\"cis\": [\"4.3\"]}, {\"cis_csc\": [\"16\", \"16.2\"]}]'),(24529,'Ensure&#x20;No&#x20;Users&#x20;Are&#x20;Assigned&#x20;the&#x20;&#039;DEFAULT&#039;&#x20;Profile.','Upon&#x20;&#x20;creation&#x20;&#x20;database&#x20;&#x20;users&#x20;are&#x20;assigned&#x20;&#x20;to&#x20;&#x20;the&#x20;DEFAULT&#x20;profile&#x20;unless&#x20;&#x20;otherwise&#x20;specified.&#x20;&#x20;No&#x20;&#x20;users&#x20;should&#x20;&#x20;be&#x20;&#x20;assigned&#x20;&#x20;to&#x20;&#x20;that&#x20;&#x20;profile.','Users&#x20;should&#x20;&#x20;be&#x20;&#x20;created&#x20;with&#x20;&#x20;function-appropriate&#x20;&#x20;profiles.&#x20;The&#x20;DEFAULT&#x20;profile,&#x20;&#x20;being&#x20;defined&#x20;by&#x20;&#x20;Oracle,&#x20;is&#x20;&#x20;subject&#x20;to&#x20;&#x20;change&#x20;&#x20;at&#x20;&#x20;any&#x20;time&#x20;&#x20;&#40;e.g.&#x20;by&#x20;&#x20;patch&#x20;or&#x20;&#x20;version&#x20;update&#41;.&#x20;&#x20;The&#x20;DEFAULT&#x20;profile&#x20;has&#x20;unlimited&#x20;settings&#x20;&#x20;that&#x20;&#x20;are&#x20;often&#x20;required&#x20;&#x20;by&#x20;&#x20;the&#x20;SYS&#x20;user&#x20;&#x20;when&#x20;patching;&#x20;&#x20;such&#x20;&#x20;unlimited&#x20;settings&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;tightly&#x20;reserved&#x20;&#x20;and&#x20;not&#x20;applied&#x20;to&#x20;unnecessary&#x20;&#x20;users.','','ALTER&#x20;USER&#x20;&lt;username&gt;&#x20;PROFILE&#x20;&lt;appropriate_profile&gt;;','[{\"cis\": [\"4.4\"]}, {\"cis_csc\": [\"16\", \"4.3\"]}]'),(24530,'Ensure&#x20;&#039;SYS.USER$MIG&#039;&#x20;Has&#x20;Been&#x20;Dropped.','The&#x20;table&#x20;sys.user$mig&#x20;is&#x20;created&#x20;during&#x20;&#x20;migration&#x20;and&#x20;contains&#x20;&#x20;the&#x20;Oracle&#x20;&#x20;password&#x20;hashes&#x20;before&#x20;&#x20;the&#x20;migration&#x20;starts.&#x20;This&#x20;&#x20;table&#x20;should&#x20;&#x20;be&#x20;&#x20;dropped.','The&#x20;table&#x20;sys.user$mig&#x20;is&#x20;not&#x20;deleted&#x20;after&#x20;the&#x20;migration.&#x20;&#x20;An&#x20;&#x20;attacker&#x20;&#x20;could&#x20;access&#x20;&#x20;the&#x20;table&#x20;containing&#x20;&#x20;the&#x20;Oracle&#x20;&#x20;password&#x20;&#x20;hashes.','','DROP&#x20;TABLE&#x20;SYS.USER$MIG;','[{\"cis\": [\"4.5\"]}, {\"cis_csc\": [\"16.14\", \"16.4\"]}]'),(24531,'Ensure&#x20;No&#x20;Public&#x20;Database&#x20;Links&#x20;Exist.','Public&#x20;&#x20;Database&#x20;&#x20;links&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;allow&#x20;connections&#x20;between&#x20;databases.','Using&#x20;public&#x20;&#x20;database&#x20;&#x20;links&#x20;in&#x20;&#x20;the&#x20;database&#x20;&#x20;can&#x20;allow&#x20;anyone&#x20;&#x20;with&#x20;&#x20;a&#x20;connection&#x20;&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;to&#x20;&#x20;query,&#x20;&#x20;update,&#x20;insert,&#x20;delete&#x20;&#x20;data&#x20;&#x20;on&#x20;&#x20;a&#x20;remote&#x20;&#x20;database&#x20;&#x20;depending&#x20;on&#x20;&#x20;the&#x20;userid&#x20;&#x20;that&#x20;&#x20;is&#x20;&#x20;part&#x20;&#x20;of&#x20;&#x20;the&#x20;link.','','DROP&#x20;PUBLIC&#x20;DATABASE&#x20;LINK&#x20;&lt;DB_LINK&gt;;','[{\"cis\": [\"4.6\"]}, {\"cis_csc\": [\"14.6\"]}]'),(24532,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;revoked&#x20;from&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;Network&#x20;Packages.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Network&#x20;packages&#x20;&#x20;-&#x20;DBMS_LDAP,&#x20;&#x20;UTL_INADDR,&#x20;UTL_TCP,&#x20;&#x20;UTL_MAIL,&#x20;UTL_SMTP,&#x20;UTL_DBWS,&#x20;UTL_ORAMTS,&#x20;UTL_HTTP&#x20;and&#x20;&#x20;type&#x20;&#x20;HTTPURITYPE&#x20;&ndash;&#x20;provide&#x20;PL/SQL&#x20;&#x20;APIs&#x20;&#x20;to&#x20;&#x20;interact&#x20;&#x20;or&#x20;&#x20;access&#x20;&#x20;remote&#x20;&#x20;servers.&#x20;&#x20;The&#x20;PUBLIC&#x20;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;able&#x20;to&#x20;execute&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_LDAP&#x20;package&#x20;contains&#x20;&#x20;functions&#x20;and&#x20;procedures&#x20;&#x20;that&#x20;enable&#x20;programmers&#x20;to&#x20;&#x20;access&#x20;&#x20;data&#x20;&#x20;from&#x20;&#x20;LDAP&#x20;&#x20;servers.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_INADDR&#x20;package&#x20;&#x20;provides&#x20;&#x20;an&#x20;&#x20;API&#x20;to&#x20;&#x20;retrieve&#x20;&#x20;host&#x20;&#x20;names&#x20;and&#x20;IP&#x20;&#x20;addresses&#x20;of&#x20;&#x20;local&#x20;and&#x20;remote&#x20;&#x20;hosts.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_TCP&#x20;package&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;read/write&#x20;&#x20;file&#x20;&#x20;to&#x20;&#x20;TCP&#x20;sockets&#x20;on&#x20;&#x20;the&#x20;server&#x20;&#x20;where&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;is&#x20;&#x20;installed.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_MAIL&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;send&#x20;&#x20;email&#x20;from&#x20;&#x20;the&#x20;server&#x20;where&#x20;&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;is&#x20;&#x20;installed.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_SMTP&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;send&#x20;&#x20;email&#x20;from&#x20;&#x20;the&#x20;server&#x20;where&#x20;&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;is&#x20;&#x20;installed.&#x20;&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;UTL_SMTP.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_DBWS&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;read/write&#x20;&#x20;file&#x20;&#x20;to&#x20;&#x20;web-based&#x20;applications&#x20;&#x20;on&#x20;&#x20;the&#x20;server&#x20;&#x20;where&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;is&#x20;&#x20;installed.&#x20;&#x20;This&#x20;&#x20;package&#x20;is&#x20;&#x20;not&#x20;automatically&#x20;installed&#x20;for&#x20;security&#x20;&#x20;reasons.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_ORAMTS&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;perform&#x20;HTTP&#x20;&#x20;requests.&#x20;This&#x20;&#x20;could&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;send&#x20;&#x20;information&#x20;to&#x20;&#x20;the&#x20;outside.85&#x20;|&#x20;&#x20;P&#x20;a&#x20;g&#x20;e&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_HTTP&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;perform&#x20;HTTP&#x20;&#x20;requests.&#x20;This&#x20;could&#x20;&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;send&#x20;&#x20;information&#x20;to&#x20;&#x20;the&#x20;outside.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;HTTPURITYPE&#x20;object&#x20;&#x20;type&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;perform&#x20;HTTP&#x20;requests.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_LDAP,&#x20;&#x20;UTL_INADDR,&#x20;UTL_TCP,&#x20;UTL_MAIL,&#x20;&#x20;UTL_SMTP,&#x20;UTL_DBWS,&#x20;UTL_ORAMTS,&#x20;UTL_HTTP&#x20;and&#x20;&#x20;type&#x20;&#x20;HTTPURITYPE&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;by&#x20;unauthorized&#x20;users&#x20;to&#x20;&#x20;create&#x20;&#x20;specially&#x20;crafted&#x20;error&#x20;messages&#x20;&#x20;or&#x20;&#x20;send&#x20;&#x20;information&#x20;to&#x20;external&#x20;servers.&#x20;&#x20;The&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;use&#x20;of&#x20;&#x20;the&#x20;DBMS_LDAP&#x20;package&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;specially&#x20;crafted&#x20;error&#x20;messages&#x20;&#x20;or&#x20;&#x20;send&#x20;&#x20;information&#x20;via&#x20;DNS&#x20;to&#x20;&#x20;the&#x20;outside.&#x20;&bull;&#x20;The&#x20;&#x20;UTL_INADDR&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;specially&#x20;crafted&#x20;error&#x20;messages&#x20;&#x20;or&#x20;send&#x20;information&#x20;via&#x20;DNS&#x20;to&#x20;the&#x20;&#x20;outside.&#x20;&bull;&#x20;The&#x20;&#x20;UTL_TCP&#x20;package&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;corrupt&#x20;the&#x20;TCP&#x20;stream&#x20;used&#x20;to&#x20;&#x20;carry&#x20;the&#x20;protocols&#x20;that&#x20;&#x20;communicate&#x20;with&#x20;&#x20;the&#x20;instance&#039;s&#x20;&#x20;external&#x20;communications.&#x20;&bull;&#x20;The&#x20;&#x20;UTL_MAIL&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;corrupt&#x20;the&#x20;SMTP&#x20;function&#x20;to&#x20;&#x20;accept&#x20;&#x20;or&#x20;&#x20;generate&#x20;&#x20;junk&#x20;&#x20;mail&#x20;&#x20;that&#x20;&#x20;can&#x20;result&#x20;&#x20;in&#x20;&#x20;a&#x20;denial-of-service&#x20;condition&#x20;due&#x20;to&#x20;&#x20;network&#x20;saturation.&#x20;&bull;&#x20;The&#x20;UTL_SMTP&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;corrupt&#x20;the&#x20;SMTP&#x20;function&#x20;to&#x20;&#x20;accept&#x20;&#x20;or&#x20;&#x20;generate&#x20;&#x20;junk&#x20;&#x20;mail&#x20;&#x20;that&#x20;&#x20;can&#x20;result&#x20;&#x20;in&#x20;&#x20;a&#x20;denial-of-service&#x20;condition&#x20;due&#x20;to&#x20;&#x20;network&#x20;saturation.&#x20;&bull;&#x20;The&#x20;UTL_DBWS&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;corrupt&#x20;the&#x20;HTTP&#x20;stream&#x20;used&#x20;&#x20;to&#x20;&#x20;carry&#x20;the&#x20;protocols&#x20;that&#x20;&#x20;communicate&#x20;for&#x20;the&#x20;instance&#039;s&#x20;&#x20;web-based&#x20;external&#x20;&#x20;communications.&#x20;&bull;&#x20;The&#x20;UTL_ORAMTS&#x20;package&#x20;&#x20;could&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;send&#x20;&#x20;&#40;sensitive&#41;&#x20;information&#x20;to&#x20;&#x20;external&#x20;websites.&#x20;&#x20;The&#x20;use&#x20;of&#x20;&#x20;this&#x20;&#x20;package&#x20;should&#x20;&#x20;be&#x20;&#x20;restricted&#x20;&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.&#x20;&bull;&#x20;The&#x20;UTL_HTTP&#x20;package&#x20;&#x20;could&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;send&#x20;&#x20;&#40;sensitive&#41;&#x20;information&#x20;to&#x20;&#x20;external&#x20;websites.&#x20;&bull;&#x20;The&#x20;&#x20;use&#x20;of&#x20;this&#x20;package&#x20;should&#x20;&#x20;be&#x20;&#x20;restricted&#x20;&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.&#x20;&bull;&#x20;The&#x20;ability&#x20;to&#x20;&#x20;perform&#x20;HTTP&#x20;&#x20;requests&#x20;&#x20;could&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;leak&#x20;&#x20;information&#x20;from&#x20;&#x20;the&#x20;database&#x20;&#x20;to&#x20;&#x20;an&#x20;&#x20;external&#x20;&#x20;destination.','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_LDAP&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_INADDR&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_TCP&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_MAIL&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_SMTP&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_DBWS&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_ORAMTS&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_HTTP&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;HTTPURITYPE&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"5.1.1.1\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24533,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;revoked&#x20;from&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;File&#x20;System&#x20;Packages.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;File&#x20;&#x20;System&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_ADVISOR,&#x20;DBMS_LOB&#x20;and&#x20;&#x20;UTL_FILE&#x20;&ndash;&#x20;provide&#x20;&#x20;PL/SQL&#x20;&#x20;APIs&#x20;&#x20;to&#x20;&#x20;access&#x20;&#x20;files&#x20;on&#x20;&#x20;the&#x20;servers.&#x20;&#x20;The&#x20;user&#x20;PUBLIC&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_ADVISOR&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;write&#x20;files&#x20;located&#x20;on&#x20;&#x20;the&#x20;server&#x20;&#x20;where&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;is&#x20;&#x20;installed.&#x20;&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;execute&#x20;&#x20;DBMS_ADVISOR.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_LOB&#x20;package&#x20;&#x20;provides&#x20;&#x20;subprograms&#x20;that&#x20;&#x20;can&#x20;manipulate&#x20;and&#x20;&#x20;read/write&#x20;&#x20;on&#x20;&#x20;BLOB&#039;s,&#x20;CLOB&#039;s,&#x20;NCLOB&#039;s,&#x20;&#x20;BFILE&#039;s,&#x20;&#x20;and&#x20;temporary&#x20;LOB&#039;s.&#x20;&#x20;The&#x20;user&#x20;PUBLIC&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;DBMS_LOB.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;UTL_FILE&#x20;package&#x20;&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;read/write&#x20;&#x20;files&#x20;located&#x20;on&#x20;the&#x20;&#x20;server&#x20;&#x20;where&#x20;the&#x20;Oracle&#x20;&#x20;instance&#x20;&#x20;is&#x20;&#x20;installed.&#x20;&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;to&#x20;execute&#x20;UTL_FILE.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;File&#x20;&#x20;System&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_ADVISOR,&#x20;DBMS_LOB&#x20;and&#x20;&#x20;UTL_FILE&#x20;&ndash;&#x20;should&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;Use&#x20;of&#x20;&#x20;the&#x20;DBMS_ADVISOR&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;corrupt&#x20;operating&#x20;system&#x20;&#x20;files&#x20;on&#x20;&#x20;the&#x20;instance&#039;s&#x20;&#x20;host.&#x20;&bull;&#x20;Use&#x20;of&#x20;&#x20;the&#x20;DBMS_LOB&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;manipulate&#x20;&#x20;BLOB&#039;s,&#x20;CLOB&#039;s,&#x20;NCLOB&#039;s,&#x20;&#x20;BFILE&#039;s,&#x20;&#x20;and&#x20;temporary&#x20;LOBs&#x20;&#x20;on&#x20;&#x20;the&#x20;instance,&#x20;either&#x20;&#x20;destroying&#x20;&#x20;data&#x20;or&#x20;causing&#x20;a&#x20;denial-of-service&#x20;condition&#x20;due&#x20;to&#x20;&#x20;corruption&#x20;&#x20;of&#x20;&#x20;disk&#x20;&#x20;space.&#x20;&bull;&#x20;Use&#x20;&#x20;of&#x20;&#x20;the&#x20;UTL_FILE&#x20;package&#x20;&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;&#x20;to&#x20;&#x20;read&#x20;&#x20;OS&#x20;&#x20;files.&#x20;&#x20;These&#x20;files&#x20;could&#x20;contain&#x20;sensitive&#x20;information&#x20;&#40;e.g.&#x20;passwords&#x20;in&#x20;&#x20;.bash_history&#41;','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_ADVISOR&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_LOB&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;UTL_FILE&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"6\", \"7\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24534,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;revoked&#x20;from&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;Encryption&#x20;Packages.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Encryption&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_CRYPTO,&#x20;DBMS_OBFUSCATION_TOOLKIT&#x20;and&#x20;DBMS_RANDOM&#x20;&ndash;&#x20;provide&#x20;PL/SQL&#x20;&#x20;APIs&#x20;&#x20;to&#x20;&#x20;perform&#x20;functions&#x20;related&#x20;to&#x20;&#x20;cryptography.&#x20;The&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;DBMS_CRYPTO&#x20;settings&#x20;&#x20;provide&#x20;a&#x20;toolset&#x20;that&#x20;&#x20;determines&#x20;&#x20;the&#x20;strength&#x20;&#x20;of&#x20;&#x20;the&#x20;encryption&#x20;&#x20;algorithm&#x20;used&#x20;&#x20;to&#x20;&#x20;encrypt&#x20;application&#x20;data&#x20;&#x20;and&#x20;is&#x20;&#x20;part&#x20;&#x20;of&#x20;&#x20;the&#x20;SYS&#x20;schema.&#x20;The&#x20;DES&#x20;&#40;56-bit&#x20;key&#41;,&#x20;3DES&#x20;&#40;168-bit&#x20;key&#41;,&#x20;3DES-2KEY&#x20;&#40;112-bit&#x20;&#x20;key&#41;,&#x20;AES&#x20;&#40;128/192/256-bit&#x20;&#x20;keys&#41;,&#x20;&#x20;and&#x20;RC4&#x20;are&#x20;available.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_OBFUSCATION_TOOLKIT&#x20;provides&#x20;one&#x20;of&#x20;&#x20;the&#x20;tools&#x20;that&#x20;&#x20;determine&#x20;the&#x20;strength&#x20;&#x20;of&#x20;&#x20;the&#x20;encryption&#x20;&#x20;algorithm&#x20;used&#x20;&#x20;to&#x20;&#x20;encrypt&#x20;application&#x20;data&#x20;&#x20;and&#x20;is&#x20;&#x20;part&#x20;&#x20;of&#x20;the&#x20;&#x20;SYS&#x20;schema.&#x20;The&#x20;DES&#x20;&#40;56-bit&#x20;key&#41;&#x20;&#x20;and&#x20;3DES&#x20;&#40;168-bit&#x20;key&#41;&#x20;&#x20;are&#x20;the&#x20;only&#x20;&#x20;two&#x20;types&#x20;available.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_RANDOM&#x20;package&#x20;is&#x20;&#x20;used&#x20;&#x20;for&#x20;generating&#x20;&#x20;random&#x20;&#x20;numbers&#x20;but&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;used&#x20;&#x20;for&#x20;cryptographic&#x20;purposes.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Encryption&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_CRYPTO,&#x20;DBMS_OBFUSCATION_TOOLKIT&#x20;and&#x20;DBMS_RANDOM&#x20;&ndash;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;Execution&#x20;of&#x20;&#x20;the&#x20;DBMS_CRYPTO&#x20;procedures&#x20;&#x20;by&#x20;&#x20;the&#x20;PUBLIC&#x20;can&#x20;&#x20;potentially&#x20;endanger&#x20;portions&#x20;of&#x20;&#x20;or&#x20;&#x20;all&#x20;of&#x20;&#x20;the&#x20;data&#x20;&#x20;storage.&#x20;&bull;&#x20;Allowing&#x20;the&#x20;PUBLIC&#x20;privileges&#x20;to&#x20;&#x20;access&#x20;&#x20;this&#x20;&#x20;capability&#x20;&#x20;can&#x20;be&#x20;&#x20;potentially&#x20;harm&#x20;&#x20;data&#x20;storage.&#x20;&bull;&#x20;Use&#x20;of&#x20;&#x20;the&#x20;DBMS_RANDOM&#x20;package&#x20;can&#x20;allow&#x20;the&#x20;unauthorized&#x20;&#x20;application&#x20;of&#x20;&#x20;the&#x20;random&#x20;&#x20;number-generating&#x20;function.','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_CRYPTO&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_OBFUSCATION_TOOLKIT&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_RANDOM&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"5.1.1.3\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24535,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;revoked&#x20;from&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;Java&#x20;Packages.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Java&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_JAVA&#x20;and&#x20;DBMS_JAVA_TEST&#x20;&ndash;&#x20;provide&#x20;&#x20;APIs&#x20;&#x20;to&#x20;&#x20;run&#x20;Java&#x20;&#x20;classes&#x20;or&#x20;&#x20;grant&#x20;Java&#x20;&#x20;packages.&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_JAVA&#x20;package&#x20;can&#x20;run&#x20;Java&#x20;&#x20;classes&#x20;&#40;e.g.&#x20;OS&#x20;&#x20;commands&#41;&#x20;or&#x20;grant&#x20;&#x20;Java&#x20;&#x20;privileges.&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;DBMS_JAVA.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_JAVA_TEST&#x20;package&#x20;&#x20;can&#x20;run&#x20;Java&#x20;&#x20;classes&#x20;&#40;e.g.&#x20;OS&#x20;commands&#41;&#x20;&#x20;or&#x20;&#x20;grant&#x20;Java&#x20;&#x20;privileges.&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;DBMS_JAVA_TEST.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Java&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_JAVA&#x20;and&#x20;DBMS_JAVA_TEST&#x20;&ndash;&#x20;should&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;The&#x20;DBMS_JAVA&#x20;package&#x20;could&#x20;allow&#x20;an&#x20;&#x20;attacker&#x20;&#x20;to&#x20;&#x20;run&#x20;OS&#x20;&#x20;commands&#x20;&#x20;from&#x20;&#x20;the&#x20;database.&#x20;&bull;&#x20;The&#x20;DBMS_JAVA_TEST&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;attacker&#x20;&#x20;to&#x20;&#x20;run&#x20;operating&#x20;system&#x20;commands&#x20;from&#x20;&#x20;the&#x20;database.','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_JAVA&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_JAVA_TEST&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"5.1.1.4\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24536,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;revoked&#x20;from&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;Job&#x20;Scheduler&#x20;Packages.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Job&#x20;Scheduler&#x20;packages&#x20;&#x20;-&#x20;DBMS_SCHEDULER&#x20;and&#x20;&#x20;DBMS_JOB&#x20;&ndash;&#x20;provide&#x20;&#x20;APIs&#x20;&#x20;to&#x20;&#x20;schedule&#x20;&#x20;jobs.&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;execute&#x20;&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_SCHEDULER&#x20;package&#x20;&#x20;schedules&#x20;and&#x20;manages&#x20;the&#x20;database&#x20;and&#x20;&#x20;operating&#x20;system&#x20;&#x20;jobs.&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;DBMS_SCHEDULER.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_JOB&#x20;package&#x20;&#x20;schedules&#x20;and&#x20;manages&#x20;the&#x20;jobs&#x20;&#x20;sent&#x20;&#x20;to&#x20;&#x20;the&#x20;job&#x20;queue&#x20;and&#x20;has&#x20;been&#x20;&#x20;superseded&#x20;&#x20;by&#x20;&#x20;the&#x20;DBMS_SCHEDULER&#x20;package,&#x20;even&#x20;&#x20;though&#x20;DBMS_JOB&#x20;has&#x20;been&#x20;&#x20;retained&#x20;&#x20;for&#x20;backwards&#x20;compatibility.&#x20;&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;DBMS_JOB.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;Job&#x20;Scheduler&#x20;packages&#x20;&#x20;-&#x20;DBMS_SCHEDULER&#x20;and&#x20;&#x20;DBMS_JOB&#x20;&ndash;&#x20;should&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;the&#x20;user&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;Use&#x20;of&#x20;&#x20;the&#x20;DBMS_SCHEDULER&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;database&#x20;&#x20;or&#x20;&#x20;operating&#x20;system&#x20;&#x20;jobs.&#x20;&bull;&#x20;Use&#x20;of&#x20;&#x20;the&#x20;DBMS_JOB&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;disable&#x20;or&#x20;overload&#x20;the&#x20;job&#x20;queue.&#x20;&#x20;It&#x20;&#x20;has&#x20;been&#x20;&#x20;superseded&#x20;&#x20;by&#x20;&#x20;the&#x20;DBMS_SCHEDULER&#x20;package','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_JOB&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_SCHEDULER&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"6\", \"7\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24537,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;revoked&#x20;from&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;SQL&#x20;Injection&#x20;Helper&#x20;Packages.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;SQL&#x20;Injection&#x20;Helper&#x20;&#x20;Packages&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_SQL,&#x20;DBMS_XMLGEN,&#x20;&#x20;DBMS_XMLQUERY,&#x20;&#x20;DBMS_XLMSTORE,&#x20;&#x20;DBMS_XLMSAVE&#x20;and&#x20;&#x20;DBMS_REDACT&#x20;&ndash;&#x20;provide&#x20;APIs&#x20;&#x20;to&#x20;&#x20;schedule&#x20;&#x20;jobs.&#x20;The&#x20;user&#x20;&#x20;PUBLIC&#x20;should&#x20;not&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;execute&#x20;these&#x20;packages.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_SQL&#x20;package&#x20;&#x20;is&#x20;&#x20;used&#x20;&#x20;for&#x20;running&#x20;dynamic&#x20;SQL&#x20;statements.&#x20;&bull;&#x20;The&#x20;DBMS_XMLGEN&#x20;package&#x20;takes&#x20;an&#x20;&#x20;arbitrary&#x20;SQL&#x20;query&#x20;as&#x20;&#x20;input,&#x20;&#x20;converts&#x20;&#x20;it&#x20;&#x20;to&#x20;&#x20;XML&#x20;format,&#x20;and&#x20;returns&#x20;the&#x20;result&#x20;&#x20;as&#x20;&#x20;a&#x20;CLOB.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;package&#x20;DBMS_XMLQUERY&#x20;takes&#x20;an&#x20;&#x20;arbitrary&#x20;SQL&#x20;query,&#x20;&#x20;converts&#x20;&#x20;it&#x20;&#x20;to&#x20;&#x20;XML&#x20;format,&#x20;and&#x20;returns&#x20;the&#x20;result.&#x20;This&#x20;&#x20;package&#x20;is&#x20;&#x20;similar&#x20;to&#x20;&#x20;DBMS_XMLGEN.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_XLMSTORE&#x20;package&#x20;provides&#x20;&#x20;XML&#x20;functionality.&#x20;&#x20;It&#x20;&#x20;accepts&#x20;a&#x20;table&#x20;name&#x20;&#x20;and&#x20;XML&#x20;as&#x20;&#x20;input&#x20;to&#x20;&#x20;perform&#x20;DML&#x20;operations&#x20;&#x20;against&#x20;the&#x20;table.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_XLMSAVE&#x20;package&#x20;&#x20;provides&#x20;&#x20;XML&#x20;functionality.&#x20;&#x20;It&#x20;&#x20;accepts&#x20;a&#x20;table&#x20;name&#x20;&#x20;and&#x20;XML&#x20;as&#x20;&#x20;input&#x20;and&#x20;then&#x20;&#x20;inserts&#x20;into&#x20;&#x20;or&#x20;&#x20;updates&#x20;that&#x20;&#x20;table.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_REDACT&#x20;package&#x20;provides&#x20;&#x20;an&#x20;&#x20;interface&#x20;to&#x20;&#x20;Oracle&#x20;&#x20;Data&#x20;&#x20;Redaction,&#x20;&#x20;which&#x20;enables&#x20;you&#x20;to&#x20;&#x20;mask&#x20;&#x20;&#40;redact&#41;&#x20;&#x20;data&#x20;&#x20;that&#x20;&#x20;is&#x20;&#x20;returned&#x20;&#x20;from&#x20;&#x20;queries&#x20;issued&#x20;&#x20;by&#x20;&#x20;lowprivileged&#x20;users&#x20;or&#x20;&#x20;an&#x20;&#x20;application.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;Oracle&#x20;&#x20;Database&#x20;&#x20;PL/SQL&#x20;&#x20;SQL&#x20;Injection&#x20;Helper&#x20;&#x20;Packages&#x20;&#x20;packages&#x20;&#x20;-&#x20;DBMS_SQL,&#x20;DBMS_XMLGEN,&#x20;&#x20;DBMS_XMLQUERY,&#x20;&#x20;DBMS_XLMSTORE,&#x20;&#x20;DBMS_XLMSAVE&#x20;and&#x20;&#039;DBMS_REDACT&#039;&#x20;&#x20;&ndash;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;The&#x20;DBMS_SQL&#x20;package&#x20;&#x20;could&#x20;allow&#x20;privilege&#x20;escalation&#x20;&#x20;if&#x20;&#x20;input&#x20;validation&#x20;&#x20;is&#x20;&#x20;not&#x20;done&#x20;properly.&#x20;&bull;&#x20;The&#x20;&#x20;package&#x20;DBMS_XMLGEN&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;search&#x20;&#x20;the&#x20;entire&#x20;&#x20;database&#x20;&#x20;for&#x20;sensitive&#x20;information&#x20;like&#x20;&#x20;credit&#x20;&#x20;card&#x20;&#x20;numbers&#x20;&bull;&#x20;The&#x20;package&#x20;DBMS_XMLQUERY&#x20;can&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;search&#x20;&#x20;the&#x20;entire&#x20;&#x20;database&#x20;&#x20;for&#x20;sensitive&#x20;information&#x20;like&#x20;&#x20;credit&#x20;&#x20;card&#x20;&#x20;numbers.&#x20;&#x20;Malicious&#x20;users&#x20;may&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;exploit&#x20;this&#x20;package&#x20;&#x20;as&#x20;&#x20;an&#x20;&#x20;auxiliary&#x20;inject&#x20;&#x20;function&#x20;&#x20;in&#x20;&#x20;a&#x20;SQL&#x20;injection&#x20;attack.&#x20;&bull;&#x20;Malicious&#x20;users&#x20;may&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;exploit&#x20;the&#x20;DBMS_XLMSTORE&#x20;package&#x20;as&#x20;&#x20;an&#x20;&#x20;auxiliary&#x20;inject&#x20;&#x20;function&#x20;&#x20;in&#x20;&#x20;a&#x20;SQL&#x20;injection&#x20;attack.&#x20;&bull;&#x20;Malicious&#x20;users&#x20;may&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;exploit&#x20;the&#x20;DBMS_XLMSAVE&#x20;package&#x20;&#x20;as&#x20;&#x20;an&#x20;&#x20;auxiliary&#x20;inject&#x20;&#x20;function&#x20;&#x20;in&#x20;&#x20;a&#x20;SQL&#x20;injection&#x20;attack.&#x20;&bull;&#x20;Malicious&#x20;users&#x20;may&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;exploit&#x20;DBMS_REDACT&#x20;as&#x20;&#x20;an&#x20;&#x20;auxiliary&#x20;inject&#x20;&#x20;function&#x20;in&#x20;a&#x20;SQL&#x20;injection&#x20;attack.','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_SQL&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_XMLGEN&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_XMLQUERY&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_XMLSAVE&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_XMLSTORE&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_AW&#x20;FROM&#x20;PUBLIC;REVOKE&#x20;EXECUTE&#x20;ON&#x20;OWA_UTIL&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_REDACT&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"5.1.1.6\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24538,'Ensure&#x20;&#039;EXECUTE&#039;&#x20;is&#x20;not&#x20;granted&#x20;to&#x20;&#039;PUBLIC&#039;&#x20;on&#x20;Non-default&#x20;Packages.','The&#x20;packages&#x20;&#x20;described&#x20;in&#x20;&#x20;this&#x20;&#x20;control&#x20;are&#x20;not&#x20;granted&#x20;to&#x20;&#x20;PUBLIC&#x20;by&#x20;default&#x20;&#40;Non-default&#x20;packages&#41;.&#x20;These&#x20;packages&#x20;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_BACKUP_RESTORE&#x20;package&#x20;is&#x20;&#x20;used&#x20;&#x20;for&#x20;applying&#x20;&#x20;PL/SQL&#x20;commands&#x20;to&#x20;&#x20;the&#x20;native&#x20;&#x20;RMAN&#x20;sequences.&#x20;&bull;&#x20;The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_FILE_TRANSFER&#x20;package&#x20;&#x20;allows&#x20;&#x20;a&#x20;user&#x20;&#x20;to&#x20;&#x20;transfer&#x20;&#x20;files&#x20;from&#x20;&#x20;one&#x20;database&#x20;&#x20;server&#x20;&#x20;to&#x20;&#x20;another.&#x20;&bull;&#x20;The&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBMS_SYS_SQL,DBMS_REPCAT_SQL_UTL,&#x20;INITJVMAUX,&#x20;DBMS_AQADM_SYS,&#x20;DBMS_STREAMS_RPC,&#x20;DBMS_PRVTAQIM,&#x20;&#x20;LTADM&#x20;and&#x20;DBMS_IJOB&#x20;packages&#x20;are&#x20;&#x20;shipped&#x20;as&#x20;&#x20;undocumented.','As&#x20;&#x20;described&#x20;below,&#x20;&#x20;these&#x20;non-default&#x20;group&#x20;of&#x20;&#x20;PL/SQL&#x20;&#x20;packages,&#x20;which&#x20;are&#x20;not&#x20;granted&#x20;to&#x20;&#x20;PUBLIC&#x20;by&#x20;default,&#x20;&#x20;packages&#x20;&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;PUBLIC.&#x20;&bull;&#x20;The&#x20;DBMS_BACKUP_RESTORE&#x20;package&#x20;can&#x20;allow&#x20;access&#x20;&#x20;to&#x20;&#x20;OS&#x20;&#x20;files.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_FILE_TRANSFER&#x20;package&#x20;&#x20;could&#x20;allow&#x20;to&#x20;&#x20;transfer&#x20;&#x20;files&#x20;from&#x20;&#x20;one&#x20;database&#x20;server&#x20;to&#x20;&#x20;another&#x20;without&#x20;authorization&#x20;to&#x20;&#x20;do&#x20;&#x20;so.&#x20;&bull;&#x20;The&#x20;DBMS_SYS_SQL&#x20;package&#x20;&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;code&#x20;&#x20;as&#x20;&#x20;a&#x20;different&#x20;user&#x20;without&#x20;&#x20;entering&#x20;&#x20;valid&#x20;credentials.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_REPCAT_SQL_UTL&#x20;package&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;SQL&#x20;commands&#x20;&#x20;as&#x20;&#x20;user&#x20;&#x20;SYS.&#x20;&bull;&#x20;The&#x20;&#x20;INITJVMAUX&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;SQL&#x20;commands&#x20;&#x20;as&#x20;user&#x20;SYS.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_AQADM_SYS&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;SQL&#x20;commands&#x20;&#x20;as&#x20;&#x20;user&#x20;&#x20;SYS.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_STREAMS_RPC&#x20;package&#x20;&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;SQL&#x20;commands&#x20;&#x20;as&#x20;&#x20;user&#x20;&#x20;SYS.102&#x20;|&#x20;P&#x20;a&#x20;g&#x20;e&#x20;&bull;&#x20;The&#x20;DBMS_PRVTAQIM&#x20;package&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;escalate&#x20;&#x20;privileges&#x20;because&#x20;&#x20;any&#x20;SQL&#x20;statements&#x20;&#x20;could&#x20;be&#x20;&#x20;executed&#x20;&#x20;as&#x20;&#x20;user&#x20;SYS.&#x20;&bull;&#x20;The&#x20;LTADM&#x20;package&#x20;could&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;any&#x20;SQL&#x20;command&#x20;as&#x20;user&#x20;SYS.&#x20;&#x20;It&#x20;&#x20;allows&#x20;&#x20;privilege&#x20;escalation&#x20;&#x20;if&#x20;&#x20;granted&#x20;to&#x20;&#x20;unprivileged&#x20;&#x20;users.&#x20;&bull;&#x20;The&#x20;&#x20;DBMS_IJOB&#x20;package&#x20;could&#x20;allow&#x20;an&#x20;&#x20;attacker&#x20;&#x20;to&#x20;&#x20;change&#x20;&#x20;identities&#x20;&#x20;by&#x20;&#x20;using&#x20;a&#x20;different&#x20;username&#x20;&#x20;to&#x20;&#x20;execute&#x20;a&#x20;database&#x20;&#x20;job.&#x20;&#x20;It&#x20;&#x20;allows&#x20;&#x20;a&#x20;user&#x20;&#x20;to&#x20;&#x20;run&#x20;database&#x20;&#x20;jobs&#x20;&#x20;in&#x20;the&#x20;&#x20;context&#x20;of&#x20;&#x20;another&#x20;user.','','REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_BACKUP_RESTORE&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_FILE_TRANSFER&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_SYS_SQL&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_REPCAT_SQL_UTL&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;INITJVMAUX&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_AQADM_SYS&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_STREAMS_RPC&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_PRVTAQIM&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;LTADM&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_IJOB&#x20;FROM&#x20;PUBLIC;&#x20;REVOKE&#x20;EXECUTE&#x20;ON&#x20;DBMS_PDB_EXEC_SQL&#x20;FROM&#x20;PUBLIC;','[{\"cis\": [\"5.1.2.1\"]}, {\"cis_csc\": [\"18\", \"14.6\"]}]'),(24539,'Ensure&#x20;&#039;ALL&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;&#x20;on&#x20;&#039;AUD$&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;SYS.AUD$&#x20;table&#x20;&#x20;contains&#x20;&#x20;all&#x20;the&#x20;audit&#x20;records&#x20;for&#x20;the&#x20;database&#x20;&#x20;of&#x20;&#x20;the&#x20;non-Data&#x20;&#x20;Manipulation&#x20;&#x20;Language&#x20;&#x20;&#40;DML&#41;&#x20;events,&#x20;such&#x20;&#x20;as&#x20;&#x20;ALTER,&#x20;&#x20;DROP,&#x20;and&#x20;CREATE,&#x20;and&#x20;so&#x20;forth.&#x20;&#40;DML&#x20;&#x20;changes&#x20;need&#x20;&#x20;trigger-based&#x20;audit&#x20;events&#x20;&#x20;to&#x20;&#x20;record&#x20;&#x20;data&#x20;&#x20;alterations.&#41;&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;not&#x20;&#x20;have&#x20;&#x20;full&#x20;&#x20;access&#x20;&#x20;to&#x20;&#x20;that&#x20;&#x20;table.','Permitting&#x20;&#x20;non-privileged&#x20;&#x20;users&#x20;the&#x20;authorization&#x20;to&#x20;&#x20;manipulate&#x20;&#x20;the&#x20;SYS.AUD$&#x20;table&#x20;&#x20;can&#x20;allow&#x20;distortion&#x20;&#x20;of&#x20;&#x20;the&#x20;audit&#x20;records,&#x20;&#x20;hiding&#x20;&#x20;unauthorized&#x20;&#x20;activities.','','REVOKE&#x20;ALL&#x20;ON&#x20;AUD$&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.1.3.1\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24540,'Ensure&#x20;&#039;ALL&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;&#x20;on&#x20;&#039;DBA_%&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBA_&#x20;views&#x20;&#x20;show&#x20;&#x20;all&#x20;information&#x20;which&#x20;is&#x20;&#x20;relevant&#x20;&#x20;to&#x20;&#x20;administrative&#x20;accounts.&#x20;&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;full&#x20;&#x20;access&#x20;&#x20;to&#x20;&#x20;those&#x20;views.','Permitting&#x20;&#x20;users&#x20;the&#x20;authorization&#x20;to&#x20;&#x20;manipulate&#x20;&#x20;the&#x20;DBA_&#x20;views&#x20;&#x20;can&#x20;expose&#x20;&#x20;sensitive&#x20;data.','','REVOKE&#x20;ALL&#x20;ON&#x20;&lt;DBA_%&gt;&#x20;FROM&#x20;&lt;Non-DBA/SYS&#x20;grantee&gt;;','[{\"cis\": [\"5.1.3.2\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24541,'Ensure&#x20;&#039;ALL&#039;&#x20;Is&#x20;Revoked&#x20;on&#x20;&#039;Sensitive&#039;&#x20;Tables&#x20;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;tables&#x20;&#x20;listed&#x20;&#x20;below&#x20;may&#x20;contain&#x20;sensitive&#x20;information,&#x20;&#x20;and&#x20;should&#x20;&#x20;not&#x20;be&#x20;&#x20;accessible&#x20;&#x20;to&#x20;&#x20;unauthorized&#x20;&#x20;users.&#x20;&bull;&#x20;USER$,&#x20;USER_HISTORY$,&#x20;&#x20;XS$VERIFIERS&#x20;and&#x20;&#x20;DEFAULT_PWD$&#x20;may&#x20;&#x20;contain&#x20;password&#x20;hashes.&#x20;&bull;&#x20;CDB_LOCAL_ADMINAUTH$&#x20;and&#x20;PDB_SYNC$&#x20;may&#x20;contain&#x20;DDLs.&#x20;&bull;&#x20;LINK$&#x20;and&#x20;SCHEDULER$_CREDENTIAL&#x20;may&#x20;contain&#x20;encrypted&#x20;passwords.&#x20;&bull;&#x20;ENC$&#x20;may&#x20;contains&#x20;&#x20;encryption&#x20;&#x20;keys.&#x20;&bull;&#x20;HISTGRM$&#x20;and&#x20;&#x20;HIST_HEAD$&#x20;may&#x20;&#x20;contain&#x20;sensitive&#x20;data.','Access&#x20;&#x20;to&#x20;&#x20;sensitive&#x20;information&#x20;such&#x20;&#x20;as&#x20;&#x20;hashed&#x20;&#x20;passwords&#x20;may&#x20;allow&#x20;unauthorized&#x20;&#x20;users&#x20;to&#x20;decrypt&#x20;&#x20;the&#x20;passwords&#x20;hashes&#x20;&#x20;which&#x20;could&#x20;potentially&#x20;result&#x20;&#x20;in&#x20;&#x20;complete&#x20;&#x20;compromise&#x20;&#x20;of&#x20;the&#x20;&#x20;database.','','REVOKE&#x20;ALL&#x20;ON&#x20;SYS.CDB_LOCAL_ADMINAUTH$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.DEFAULT_PWD$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.ENC$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.HISTGRM$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.HIST_HEAD$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.LINK$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.PDB_SYNC$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.SCHEDULER$_CREDENTIAL&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.USER$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.USER_HISTORY$&#x20;FROM&#x20;&lt;grantee&gt;;&#x20;REVOKE&#x20;ALL&#x20;ON&#x20;SYS.XS$VERIFIERS&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.1.3.3\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24542,'Ensure&#x20;&#039;%ANY%&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;ANY&#x20;keyword&#x20;provides&#x20;&#x20;the&#x20;user&#x20;&#x20;the&#x20;capability&#x20;&#x20;to&#x20;&#x20;alter&#x20;any&#x20;item&#x20;&#x20;in&#x20;&#x20;the&#x20;catalog&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;keyword&#x20;assigned&#x20;&#x20;to&#x20;them','Authorization&#x20;to&#x20;&#x20;use&#x20;the&#x20;ANY&#x20;expansion&#x20;of&#x20;&#x20;a&#x20;privilege&#x20;can&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;to&#x20;potentially&#x20;change&#x20;&#x20;confidential&#x20;&#x20;data&#x20;&#x20;or&#x20;&#x20;damage&#x20;&#x20;the&#x20;data&#x20;&#x20;catalog.','','REVOKE&#x20;&#039;&lt;ANY&#x20;Privilege&gt;&#039;&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(24543,'Ensure&#x20;&#039;DBA_SYS_PRIVS.%&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;&#x20;with&#x20;&#039;ADMIN_OPTION&#039;&#x20;Set&#x20;to&#x20;&#039;YES&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;WITH_ADMIN&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;grant&#x20;another&#x20;user&#x20;the&#x20;&#x20;same&#x20;&#x20;privileges.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','Assignment&#x20;&#x20;of&#x20;&#x20;the&#x20;WITH_ADMIN&#x20;privilege&#x20;&#x20;can&#x20;allow&#x20;the&#x20;granting&#x20;&#x20;of&#x20;&#x20;a&#x20;restricted&#x20;&#x20;privilege&#x20;to&#x20;an&#x20;unauthorized&#x20;&#x20;user.','','REVOKE&#x20;&lt;privilege&gt;&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24544,'Ensure&#x20;&#039;EXECUTE&#x20;ANY&#x20;PROCEDURE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;&#039;OUTLN&#039;.','Remove&#x20;&#x20;unneeded&#x20;&#x20;EXECUTE&#x20;ANY&#x20;PROCEDURE&#x20;privileges&#x20;&#x20;from&#x20;&#x20;OUTLN.','Migrated&#x20;&#x20;OUTLN&#x20;users&#x20;have&#x20;&#x20;more&#x20;&#x20;privileges&#x20;&#x20;than&#x20;&#x20;required.','','REVOKE&#x20;EXECUTE&#x20;ANY&#x20;PROCEDURE&#x20;FROM&#x20;OUTLN;','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24545,'Ensure&#x20;&#039;EXECUTE&#x20;ANY&#x20;PROCEDURE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;&#039;DBSNMP&#039;.','Remove&#x20;&#x20;unneeded&#x20;&#x20;EXECUTE&#x20;ANY&#x20;PROCEDURE&#x20;privileges&#x20;&#x20;from&#x20;&#x20;DBSNMP.','Migrated&#x20;&#x20;DBSNMP&#x20;users&#x20;&#x20;have&#x20;&#x20;more&#x20;&#x20;privileges&#x20;&#x20;than&#x20;&#x20;required.','','REVOKE&#x20;EXECUTE&#x20;ANY&#x20;PROCEDURE&#x20;FROM&#x20;DBSNMP;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24546,'Ensure&#x20;&#039;SELECT&#x20;ANY&#x20;DICTIONARY&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;SELECT&#x20;ANY&#x20;DICTIONARY&#x20;privilege&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;access&#x20;SYS&#x20;schema&#x20;objects.&#x20;&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','SELECT&#x20;ANY&#x20;DICTIONARY&#x20;is&#x20;&#x20;a&#x20;powerful&#x20;&#x20;system&#x20;&#x20;privilege&#x20;which&#x20;would&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;&#x20;to&#x20;&#x20;gather&#x20;&#x20;information&#x20;about&#x20;the&#x20;database&#x20;&#x20;through&#x20;data&#x20;&#x20;dictionary&#x20;objects.&#x20;Information&#x20;collected&#x20;could&#x20;potentially&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;exploit&#x20;the&#x20;database.','','REVOKE&#x20;SELECT&#x20;ANY&#x20;DICTIONARY&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(24547,'Ensure&#x20;&#039;SELECT&#x20;ANY&#x20;TABLE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;SELECT&#x20;ANY&#x20;TABLE&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;open&#x20;&#x20;any&#x20;table,&#x20;&#x20;except&#x20;&#x20;SYS,&#x20;&#x20;to&#x20;&#x20;view&#x20;&#x20;it.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','Assignment&#x20;&#x20;of&#x20;&#x20;the&#x20;SELECT&#x20;ANY&#x20;TABLE&#x20;privilege&#x20;&#x20;can&#x20;allow&#x20;the&#x20;unauthorized&#x20;&#x20;viewing&#x20;of&#x20;sensitive&#x20;&#x20;data.','','REVOKE&#x20;SELECT&#x20;ANY&#x20;TABLE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(24548,'Ensure&#x20;&#039;AUDIT&#x20;SYSTEM&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;AUDIT&#x20;SYSTEM&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;changes&#x20;to&#x20;&#x20;auditing&#x20;&#x20;activities&#x20;&#x20;on&#x20;&#x20;the&#x20;system.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','The&#x20;AUDIT&#x20;SYSTEM&#x20;privilege&#x20;&#x20;can&#x20;allow&#x20;the&#x20;unauthorized&#x20;&#x20;alteration&#x20;&#x20;of&#x20;&#x20;system&#x20;&#x20;audit&#x20;activities,&#x20;such&#x20;&#x20;as&#x20;&#x20;disabling&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;audit&#x20;trails.','','REVOKE&#x20;AUDIT&#x20;SYSTEM&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24549,'Ensure&#x20;&#039;EXEMPT&#x20;ACCESS&#x20;POLICY&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;EXEMPT&#x20;ACCESS&#x20;POLICY&#x20;keyword&#x20;&#x20;provides&#x20;&#x20;the&#x20;user&#x20;&#x20;the&#x20;capability&#x20;&#x20;to&#x20;access&#x20;all&#x20;the&#x20;table&#x20;rows&#x20;&#x20;regardless&#x20;&#x20;of&#x20;&#x20;row-level&#x20;security&#x20;&#x20;lockouts.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;should&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;keyword&#x20;assigned&#x20;&#x20;to&#x20;&#x20;them.','The&#x20;EXEMPT&#x20;ACCESS&#x20;POLICY&#x20;privilege&#x20;&#x20;can&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;potentially&#x20;access&#x20;and&#x20;&#x20;change&#x20;&#x20;data.','','REVOKE&#x20;EXEMPT&#x20;ACCESS&#x20;POLICY&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc\": [\"14.4\", \"14.6\"]}]'),(24550,'Ensure&#x20;&#039;BECOME&#x20;USER&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;BECOME&#x20;USER&#x20;privilege&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;inherit&#x20;the&#x20;rights&#x20;of&#x20;another&#x20;user.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','The&#x20;BECOME&#x20;USER&#x20;privilege&#x20;can&#x20;allow&#x20;the&#x20;unauthorized&#x20;&#x20;use&#x20;of&#x20;&#x20;another&#x20;user&#039;s&#x20;&#x20;privileges,&#x20;this&#x20;capability&#x20;should&#x20;&#x20;be&#x20;&#x20;restricted&#x20;&#x20;according&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.','','REVOKE&#x20;BECOME&#x20;USER&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24551,'Ensure&#x20;&#039;CREATE&#x20;PROCEDURE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;CREATE&#x20;PROCEDURE&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;a&#x20;stored&#x20;&#x20;procedure&#x20;that&#x20;&#x20;will&#x20;&#x20;fire&#x20;&#x20;when&#x20;&#x20;given&#x20;the&#x20;correct&#x20;command&#x20;sequence.&#x20;Unauthorized&#x20;grantees&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','The&#x20;CREATE&#x20;PROCEDURE&#x20;privilege&#x20;&#x20;can&#x20;lead&#x20;&#x20;to&#x20;&#x20;severe&#x20;&#x20;problems&#x20;&#x20;in&#x20;&#x20;unauthorized&#x20;&#x20;hands,&#x20;&#x20;such&#x20;as&#x20;rogue&#x20;procedures&#x20;&#x20;facilitating&#x20;&#x20;data&#x20;&#x20;theft&#x20;or&#x20;&#x20;denial-of-service&#x20;by&#x20;&#x20;corrupting&#x20;&#x20;data&#x20;&#x20;tables.','','REVOKE&#x20;CREATE&#x20;PROCEDURE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24552,'Ensure&#x20;&#039;ALTER&#x20;SYSTEM&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;ALTER&#x20;SYSTEM&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;dynamically&#x20;alter&#x20;the&#x20;instance&#039;s&#x20;&#x20;running&#x20;operations.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;privilege.','The&#x20;ALTER&#x20;SYSTEM&#x20;privilege&#x20;&#x20;can&#x20;lead&#x20;&#x20;to&#x20;&#x20;severe&#x20;&#x20;problems,&#x20;such&#x20;&#x20;as&#x20;&#x20;the&#x20;instance&#039;s&#x20;&#x20;session&#x20;being&#x20;killed&#x20;&#x20;or&#x20;&#x20;the&#x20;stopping&#x20;&#x20;of&#x20;&#x20;redo&#x20;&#x20;log&#x20;recording,&#x20;&#x20;which&#x20;would&#x20;make&#x20;&#x20;transactions&#x20;unrecoverable.','','REVOKE&#x20;ALTER&#x20;SYSTEM&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24553,'Ensure&#x20;&#039;CREATE&#x20;ANY&#x20;LIBRARY&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;CREATE&#x20;ANY&#x20;LIBRARY&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;create&#x20;objects&#x20;&#x20;that&#x20;&#x20;are&#x20;associated&#x20;&#x20;to&#x20;&#x20;the&#x20;shared&#x20;&#x20;libraries.&#x20;&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;that&#x20;privilege.','The&#x20;CREATE&#x20;ANY&#x20;LIBRARY&#x20;privilege&#x20;&#x20;can&#x20;allow&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;numerous&#x20;&#x20;library-associated&#x20;objects&#x20;&#x20;and&#x20;potentially&#x20;corrupt&#x20;the&#x20;libraries&#039;&#x20;&#x20;integrity.','','REVOKE&#x20;CREATE&#x20;ANY&#x20;LIBRARY&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24554,'Ensure&#x20;&#039;CREATE&#x20;LIBRARY&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;CREATE&#x20;LIBRARY&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;designated&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;objects&#x20;that&#x20;&#x20;are&#x20;associated&#x20;&#x20;to&#x20;&#x20;the&#x20;shared&#x20;&#x20;libraries.&#x20;&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;privilege.','The&#x20;CREATE&#x20;LIBRARY&#x20;privilege&#x20;&#x20;can&#x20;allow&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;numerous&#x20;&#x20;library-associated&#x20;objects&#x20;&#x20;and&#x20;potentially&#x20;corrupt&#x20;the&#x20;libraries&#039;&#x20;&#x20;integrity','','REVOKE&#x20;CREATE&#x20;LIBRARY&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24555,'Ensure&#x20;&#039;GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE&#x20;keyword&#x20;&#x20;provides&#x20;&#x20;the&#x20;grantee&#x20;the&#x20;capability&#x20;&#x20;to&#x20;&#x20;grant&#x20;access&#x20;&#x20;to&#x20;&#x20;any&#x20;single&#x20;&#x20;or&#x20;&#x20;multiple&#x20;&#x20;combinations&#x20;&#x20;of&#x20;&#x20;objects&#x20;to&#x20;&#x20;any&#x20;grantee&#x20;in&#x20;&#x20;the&#x20;catalog&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;keyword&#x20;assigned&#x20;&#x20;to&#x20;&#x20;them.','The&#x20;GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE&#x20;capability&#x20;can&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;potentially&#x20;access&#x20;&#x20;or&#x20;&#x20;change&#x20;&#x20;confidential&#x20;&#x20;data,&#x20;or&#x20;&#x20;damage&#x20;&#x20;the&#x20;data&#x20;&#x20;catalog&#x20;due&#x20;to&#x20;&#x20;potential&#x20;complete&#x20;instance&#x20;access.','','REVOKE&#x20;GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24556,'Ensure&#x20;&#039;GRANT&#x20;ANY&#x20;ROLE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;GRANT&#x20;ANY&#x20;ROLE&#x20;keyword&#x20;&#x20;provides&#x20;&#x20;the&#x20;grantee&#x20;the&#x20;capability&#x20;&#x20;to&#x20;&#x20;grant&#x20;any&#x20;single&#x20;&#x20;role&#x20;&#x20;to&#x20;&#x20;any&#x20;grantee&#x20;in&#x20;&#x20;the&#x20;catalog&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;not&#x20;&#x20;have&#x20;&#x20;that&#x20;&#x20;keyword&#x20;assigned&#x20;&#x20;to&#x20;&#x20;them.','The&#x20;GRANT&#x20;ANY&#x20;ROLE&#x20;capability&#x20;can&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;potentially&#x20;access&#x20;&#x20;or&#x20;change&#x20;confidential&#x20;&#x20;data&#x20;&#x20;or&#x20;&#x20;damage&#x20;&#x20;the&#x20;data&#x20;&#x20;catalog&#x20;due&#x20;to&#x20;&#x20;potential&#x20;complete&#x20;&#x20;instance&#x20;access.','','REVOKE&#x20;GRANT&#x20;ANY&#x20;ROLE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24557,'Ensure&#x20;&#039;GRANT&#x20;ANY&#x20;PRIVILEGE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;GRANT&#x20;ANY&#x20;PRIVILEGE&#x20;keyword&#x20;provides&#x20;&#x20;the&#x20;grantee&#x20;the&#x20;capability&#x20;&#x20;to&#x20;grant&#x20;&#x20;any&#x20;single&#x20;&#x20;privilege&#x20;to&#x20;&#x20;any&#x20;item&#x20;&#x20;in&#x20;&#x20;the&#x20;catalog&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;should&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;privilege.','The&#x20;GRANT&#x20;ANY&#x20;PRIVILEGE&#x20;capability&#x20;&#x20;can&#x20;allow&#x20;an&#x20;&#x20;unauthorized&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;potentially&#x20;access&#x20;or&#x20;change&#x20;&#x20;confidential&#x20;&#x20;data&#x20;&#x20;or&#x20;&#x20;damage&#x20;&#x20;the&#x20;data&#x20;&#x20;catalog&#x20;due&#x20;to&#x20;&#x20;potential&#x20;complete&#x20;&#x20;instance&#x20;access.','','REVOKE&#x20;GRANT&#x20;ANY&#x20;PRIVILEGE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24558,'Ensure&#x20;&#039;SELECT_CATALOG_ROLE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;SELECT_CATALOG_ROLE&#x20;provides&#x20;&#x20;SELECT&#x20;privileges&#x20;on&#x20;&#x20;all&#x20;data&#x20;dictionary&#x20;views&#x20;held&#x20;&#x20;in&#x20;&#x20;the&#x20;SYS&#x20;schema.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;role.','Permitting&#x20;&#x20;unauthorized&#x20;&#x20;access&#x20;&#x20;to&#x20;&#x20;the&#x20;SELECT_CATALOG_ROLE&#x20;can&#x20;allow&#x20;the&#x20;disclosure&#x20;&#x20;of&#x20;&#x20;all&#x20;dictionary&#x20;&#x20;data.','','REVOKE&#x20;SELECT_CATALOG_ROLE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24559,'Ensure&#x20;&#039;EXECUTE_CATALOG_ROLE&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;EXECUTE_CATALOG_ROLE&#x20;provides&#x20;EXECUTE&#x20;privileges&#x20;&#x20;for&#x20;a&#x20;number&#x20;&#x20;of&#x20;packages&#x20;and&#x20;procedures&#x20;&#x20;in&#x20;&#x20;the&#x20;data&#x20;&#x20;dictionary&#x20;&#x20;in&#x20;&#x20;the&#x20;SYS&#x20;schema.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;should&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;role.','Permitting&#x20;&#x20;unauthorized&#x20;&#x20;access&#x20;&#x20;to&#x20;&#x20;the&#x20;EXECUTE_CATALOG_ROLE&#x20;can&#x20;&#x20;allow&#x20;the&#x20;disruption&#x20;&#x20;of&#x20;operations&#x20;by&#x20;&#x20;initialization&#x20;&#x20;of&#x20;&#x20;rogue&#x20;procedures,&#x20;this&#x20;&#x20;capability&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;restricted&#x20;according&#x20;&#x20;to&#x20;&#x20;the&#x20;needs&#x20;of&#x20;&#x20;the&#x20;organization.','','REVOKE&#x20;EXECUTE_CATALOG_ROLE&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24560,'Ensure&#x20;&#039;DBA&#039;&#x20;Is&#x20;Revoked&#x20;from&#x20;Unauthorized&#x20;&#039;GRANTEE&#039;.','The&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;DBA&#x20;role&#x20;&#x20;is&#x20;&#x20;the&#x20;default&#x20;database&#x20;&#x20;administrator&#x20;role&#x20;&#x20;provided&#x20;&#x20;for&#x20;the&#x20;allocation&#x20;&#x20;of&#x20;&#x20;administrative&#x20;&#x20;privileges.&#x20;Unauthorized&#x20;&#x20;grantees&#x20;&#x20;should&#x20;&#x20;not&#x20;have&#x20;&#x20;that&#x20;&#x20;role.','Assignment&#x20;&#x20;of&#x20;&#x20;the&#x20;DBA&#x20;role&#x20;&#x20;to&#x20;&#x20;an&#x20;&#x20;ordinary&#x20;&#x20;user&#x20;&#x20;can&#x20;provide&#x20;a&#x20;great&#x20;number&#x20;&#x20;of&#x20;&#x20;unnecessary&#x20;privileges&#x20;&#x20;to&#x20;&#x20;that&#x20;&#x20;user&#x20;&#x20;and&#x20;open&#x20;&#x20;the&#x20;door&#x20;&#x20;to&#x20;&#x20;data&#x20;&#x20;breaches,&#x20;integrity&#x20;violations,&#x20;and&#x20;denialof-service&#x20;&#x20;conditions.','','REVOKE&#x20;DBA&#x20;FROM&#x20;&lt;grantee&gt;;','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc\": [\"5.1\", \"14.6\"]}]'),(24561,'Ensure&#x20;the&#x20;&#039;USER&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;USER&#x20;object&#x20;allows&#x20;&#x20;for&#x20;creating&#x20;&#x20;accounts&#x20;&#x20;that&#x20;&#x20;can&#x20;interact&#x20;&#x20;with&#x20;&#x20;the&#x20;database&#x20;&#x20;according&#x20;to&#x20;&#x20;the&#x20;roles&#x20;and&#x20;privileges&#x20;&#x20;allotted&#x20;&#x20;to&#x20;&#x20;the&#x20;account.&#x20;&#x20;It&#x20;&#x20;may&#x20;also&#x20;&#x20;own&#x20;database&#x20;&#x20;objects.&#x20;Enabling&#x20;the&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;activities&#x20;&#x20;and&#x20;requests&#x20;&#x20;to&#x20;&#x20;create,&#x20;drop&#x20;&#x20;or&#x20;alter&#x20;&#x20;a&#x20;user,&#x20;including&#x20;a&#x20;user&#x20;&#x20;changing&#x20;&#x20;their&#x20;own&#x20;password.&#x20;&#40;The&#x20;&#x20;latter&#x20;&#x20;is&#x20;&#x20;not&#x20;audited&#x20;by&#x20;audit&#x20;ALTER&#x20;USER.&#41;','Any&#x20;unauthorized&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create,&#x20;drop&#x20;&#x20;or&#x20;&#x20;alter&#x20;a&#x20;user&#x20;&#x20;should&#x20;&#x20;cause&#x20;concern,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;not.&#x20;&#x20;Auditing&#x20;&#x20;can&#x20;also&#x20;&#x20;be&#x20;&#x20;useful&#x20;&#x20;in&#x20;&#x20;forensics&#x20;if&#x20;&#x20;an&#x20;&#x20;account&#x20;is&#x20;&#x20;compromised,&#x20;&#x20;and&#x20;auditing&#x20;&#x20;is&#x20;&#x20;mandated&#x20;&#x20;by&#x20;&#x20;many&#x20;&#x20;common&#x20;&#x20;security&#x20;&#x20;initiatives.&#x20;&#x20;An&#x20;&#x20;abnormally&#x20;&#x20;high&#x20;&#x20;number&#x20;&#x20;of&#x20;these&#x20;&#x20;activities&#x20;&#x20;in&#x20;&#x20;a&#x20;given&#x20;period&#x20;&#x20;might&#x20;be&#x20;&#x20;worth&#x20;investigation.&#x20;&#x20;Any&#x20;failed&#x20;&#x20;attempt&#x20;to&#x20;&#x20;drop&#x20;&#x20;a&#x20;user&#x20;&#x20;or&#x20;&#x20;create&#x20;&#x20;a&#x20;user&#x20;&#x20;may&#x20;be&#x20;&#x20;worth&#x20;further&#x20;review.','','AUDIT&#x20;USER;','[{\"cis\": [\"6.1.1\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24562,'Ensure&#x20;the&#x20;&#039;ROLE&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;ROLE&#x20;object&#x20;allows&#x20;&#x20;for&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;a&#x20;set&#x20;of&#x20;&#x20;privileges&#x20;&#x20;that&#x20;&#x20;can&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;users&#x20;or&#x20;other&#x20;&#x20;roles.&#x20;&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts,&#x20;successful&#x20;&#x20;or&#x20;&#x20;not,&#x20;&#x20;to&#x20;create,&#x20;&#x20;drop,&#x20;alter&#x20;or&#x20;&#x20;set&#x20;roles.','Roles&#x20;are&#x20;a&#x20;key&#x20;database&#x20;&#x20;security&#x20;&#x20;infrastructure&#x20;&#x20;component.&#x20;&#x20;Any&#x20;attempt&#x20;to&#x20;&#x20;create,&#x20;drop&#x20;&#x20;or&#x20;alter&#x20;&#x20;a&#x20;role&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;audited.&#x20;&#x20;This&#x20;&#x20;statement&#x20;auditing&#x20;&#x20;option&#x20;&#x20;also&#x20;&#x20;audits&#x20;&#x20;attempts,&#x20;successful&#x20;&#x20;or&#x20;&#x20;not,&#x20;&#x20;to&#x20;&#x20;set&#x20;a&#x20;role&#x20;&#x20;in&#x20;&#x20;a&#x20;session.&#x20;&#x20;Any&#x20;unauthorized&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create,&#x20;drop&#x20;&#x20;or&#x20;alter&#x20;&#x20;a&#x20;role&#x20;&#x20;may&#x20;be&#x20;&#x20;worthy&#x20;&#x20;of&#x20;&#x20;investigation.&#x20;&#x20;Attempts&#x20;&#x20;to&#x20;&#x20;set&#x20;a&#x20;role&#x20;&#x20;by&#x20;&#x20;users&#x20;without&#x20;the&#x20;role&#x20;privilege&#x20;&#x20;may&#x20;warrant&#x20;investigation.','','AUDIT&#x20;ROLE;','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24563,'Ensure&#x20;the&#x20;&#039;SYSTEM&#x20;GRANT&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;for&#x20;the&#x20;SYSTEM&#x20;GRANT&#x20;object&#x20;causes&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;any&#x20;attempt,&#x20;successful&#x20;or&#x20;&#x20;not,&#x20;&#x20;to&#x20;&#x20;grant&#x20;or&#x20;&#x20;revoke&#x20;&#x20;any&#x20;system&#x20;&#x20;privilege&#x20;or&#x20;&#x20;role,&#x20;regardless&#x20;&#x20;of&#x20;&#x20;privilege&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;user&#x20;&#x20;attempting&#x20;&#x20;the&#x20;operation.','Logging&#x20;of&#x20;&#x20;all&#x20;grant&#x20;and&#x20;revokes&#x20;&#40;roles&#x20;&#x20;and&#x20;system&#x20;&#x20;privileges&#41;&#x20;can&#x20;provide&#x20;forensic&#x20;evidence&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;suspect/unauthorized&#x20;&#x20;activities.&#x20;Any&#x20;unauthorized&#x20;&#x20;attempt&#x20;may&#x20;be&#x20;&#x20;cause&#x20;for&#x20;further&#x20;investigation.','','AUDIT&#x20;SYSTEM&#x20;GRANT;','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc\": [\"5.4\", \"4.8\"]}]'),(24564,'Ensure&#x20;the&#x20;&#039;PROFILE&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;PROFILE&#x20;object&#x20;&#x20;allows&#x20;&#x20;for&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;a&#x20;set&#x20;of&#x20;&#x20;database&#x20;&#x20;resource&#x20;&#x20;limits&#x20;&#x20;that&#x20;&#x20;can&#x20;be&#x20;assigned&#x20;to&#x20;&#x20;a&#x20;user,&#x20;so&#x20;&#x20;that&#x20;&#x20;that&#x20;&#x20;user&#x20;&#x20;cannot&#x20;&#x20;exceed&#x20;&#x20;those&#x20;resource&#x20;&#x20;limitations.&#x20;&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts,&#x20;successful&#x20;&#x20;or&#x20;&#x20;not,&#x20;&#x20;to&#x20;&#x20;create,&#x20;drop&#x20;&#x20;or&#x20;&#x20;alter&#x20;any&#x20;profile.','As&#x20;&#x20;profiles&#x20;&#x20;are&#x20;part&#x20;&#x20;of&#x20;&#x20;the&#x20;database&#x20;&#x20;security&#x20;&#x20;infrastructure,&#x20;auditing&#x20;&#x20;the&#x20;creation,&#x20;modification,&#x20;and&#x20;deletion&#x20;&#x20;of&#x20;&#x20;profiles&#x20;&#x20;is&#x20;&#x20;recommended.','','AUDIT&#x20;PROFILE;','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24565,'Ensure&#x20;the&#x20;&#039;DATABASE&#x20;LINK&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;for&#x20;the&#x20;DATABASE&#x20;&#x20;LINK&#x20;&#x20;object&#x20;&#x20;causes&#x20;&#x20;all&#x20;activities&#x20;&#x20;on&#x20;&#x20;database&#x20;links&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;&#x20;or&#x20;&#x20;dropping&#x20;&#x20;of&#x20;&#x20;a&#x20;DATABASE&#x20;LINK&#x20;can&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;unauthorized&#x20;&#x20;activities,&#x20;the&#x20;audit&#x20;capability&#x20;should&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;DATABASE&#x20;LINK;','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24566,'Ensure&#x20;the&#x20;&#039;PUBLIC&#x20;DATABASE&#x20;LINK&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;PUBLIC&#x20;DATABASE&#x20;LINK&#x20;object&#x20;allows&#x20;&#x20;for&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;a&#x20;public&#x20;&#x20;link&#x20;&#x20;for&#x20;an&#x20;application-based&#x20;&#x20;user&#x20;&#x20;to&#x20;&#x20;access&#x20;&#x20;the&#x20;database&#x20;&#x20;for&#x20;connections/session&#x20;creation.&#x20;Enabling&#x20;the&#x20;&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation,&#x20;alteration,&#x20;or&#x20;&#x20;dropping&#x20;&#x20;of&#x20;public&#x20;links&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation,&#x20;alteration,&#x20;or&#x20;&#x20;dropping&#x20;&#x20;of&#x20;&#x20;a&#x20;PUBLIC&#x20;DATABASE&#x20;LINK&#x20;can&#x20;&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;unauthorized&#x20;&#x20;activities,&#x20;the&#x20;audit&#x20;capability&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;PUBLIC&#x20;DATABASE&#x20;LINK;','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24567,'Ensure&#x20;the&#x20;&#039;PUBLIC&#x20;SYNONYM&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;PUBLIC&#x20;SYNONYM&#x20;object&#x20;allows&#x20;&#x20;for&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;an&#x20;&#x20;alternate&#x20;description&#x20;of&#x20;&#x20;an&#x20;&#x20;object.&#x20;Public&#x20;&#x20;synonyms&#x20;&#x20;are&#x20;accessible&#x20;&#x20;by&#x20;&#x20;all&#x20;users&#x20;that&#x20;&#x20;have&#x20;&#x20;the&#x20;appropriate&#x20;privileges&#x20;&#x20;to&#x20;&#x20;the&#x20;underlying&#x20;&#x20;object.&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;or&#x20;dropping&#x20;&#x20;of&#x20;&#x20;public&#x20;&#x20;synonyms&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;&#x20;or&#x20;&#x20;dropping&#x20;&#x20;of&#x20;&#x20;a&#x20;PUBLIC&#x20;SYNONYM&#x20;can&#x20;provide&#x20;&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;unauthorized&#x20;&#x20;activities,&#x20;the&#x20;audit&#x20;capability&#x20;should&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;PUBLIC&#x20;SYNONYM;','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24568,'Ensure&#x20;the&#x20;&#039;SYNONYM&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;SYNONYM&#x20;operation&#x20;allows&#x20;&#x20;for&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;an&#x20;&#x20;alternative&#x20;name&#x20;&#x20;for&#x20;a&#x20;database&#x20;&#x20;object&#x20;such&#x20;as&#x20;&#x20;a&#x20;Java&#x20;&#x20;class&#x20;schema&#x20;&#x20;object,&#x20;materialized&#x20;&#x20;view,&#x20;operator,&#x20;package,&#x20;&#x20;procedure,&#x20;sequence,&#x20;&#x20;stored&#x20;&#x20;function,&#x20;table,&#x20;&#x20;view,&#x20;user-defined&#x20;&#x20;object&#x20;&#x20;type,&#x20;or&#x20;&#x20;even&#x20;&#x20;another&#x20;synonym.&#x20;This&#x20;synonym&#x20;puts&#x20;&#x20;a&#x20;dependency&#x20;&#x20;on&#x20;&#x20;its&#x20;target&#x20;&#x20;and&#x20;is&#x20;&#x20;rendered&#x20;&#x20;invalid&#x20;if&#x20;&#x20;the&#x20;target&#x20;&#x20;object&#x20;&#x20;is&#x20;changed/dropped.&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;or&#x20;dropping&#x20;&#x20;of&#x20;&#x20;synonyms&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;&#x20;or&#x20;&#x20;dropping&#x20;&#x20;of&#x20;&#x20;a&#x20;SYNONYM&#x20;can&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;suspect/unauthorized&#x20;&#x20;activities,&#x20;the&#x20;audit&#x20;capability&#x20;should&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;SYNONYM;','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24569,'Ensure&#x20;the&#x20;&#039;DIRECTORY&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;DIRECTORY&#x20;object&#x20;&#x20;allows&#x20;&#x20;for&#x20;the&#x20;creation&#x20;&#x20;of&#x20;&#x20;a&#x20;directory&#x20;object&#x20;&#x20;that&#x20;&#x20;specifies&#x20;an&#x20;&#x20;alias&#x20;for&#x20;a&#x20;directory&#x20;on&#x20;&#x20;the&#x20;server&#x20;&#x20;file&#x20;&#x20;system,&#x20;where&#x20;the&#x20;external&#x20;&#x20;binary&#x20;&#x20;file&#x20;&#x20;LOBs&#x20;&#40;BFILEs&#41;/&#x20;&#x20;table&#x20;data&#x20;&#x20;are&#x20;located.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;or&#x20;dropping&#x20;&#x20;of&#x20;&#x20;a&#x20;directory&#x20;alias&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;creation&#x20;&#x20;or&#x20;&#x20;dropping&#x20;&#x20;of&#x20;&#x20;a&#x20;DIRECTORY&#x20;can&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;unauthorized&#x20;&#x20;activities,&#x20;the&#x20;audit&#x20;capability&#x20;should&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;DIRECTORY;','[{\"cis\": [\"6.1.9\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24570,'Ensure&#x20;the&#x20;&#039;SELECT&#x20;ANY&#x20;DICTIONARY&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;SELECT&#x20;ANY&#x20;DICTIONARY&#x20;capability&#x20;&#x20;allows&#x20;&#x20;the&#x20;user&#x20;&#x20;to&#x20;&#x20;view&#x20;&#x20;the&#x20;definitions&#x20;of&#x20;&#x20;all&#x20;schema&#x20;objects&#x20;&#x20;in&#x20;&#x20;the&#x20;database.&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;this&#x20;capability&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;the&#x20;capability&#x20;&#x20;to&#x20;&#x20;access&#x20;&#x20;the&#x20;description&#x20;of&#x20;&#x20;all&#x20;schema&#x20;&#x20;objects&#x20;in&#x20;&#x20;the&#x20;database&#x20;&#x20;can&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;a&#x20;pattern&#x20;of&#x20;unauthorized&#x20;activities,&#x20;the&#x20;audit&#x20;capability&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;SELECT&#x20;ANY&#x20;DICTIONARY;','[{\"cis\": [\"6.1.10\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24571,'Ensure&#x20;the&#x20;&#039;GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE&#x20;allows&#x20;the&#x20;user&#x20;&#x20;to&#x20;&#x20;grant&#x20;or&#x20;&#x20;revoke&#x20;&#x20;any&#x20;object&#x20;&#x20;privilege,&#x20;which&#x20;&#x20;includes&#x20;&#x20;privileges&#x20;&#x20;on&#x20;&#x20;tables,&#x20;directories,&#x20;&#x20;mining&#x20;&#x20;models,&#x20;etc.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;uses&#x20;&#x20;of&#x20;&#x20;that&#x20;&#x20;privilege.','Logging&#x20;of&#x20;&#x20;privilege&#x20;grants&#x20;&#x20;that&#x20;&#x20;can&#x20;lead&#x20;&#x20;to&#x20;&#x20;the&#x20;creation,&#x20;alteration,&#x20;or&#x20;&#x20;deletion&#x20;&#x20;of&#x20;&#x20;critical&#x20;data,&#x20;&#x20;the&#x20;modification&#x20;&#x20;of&#x20;&#x20;objects,&#x20;&#x20;object&#x20;&#x20;privilege&#x20;propagation&#x20;and&#x20;other&#x20;such&#x20;&#x20;activities&#x20;&#x20;can&#x20;be&#x20;&#x20;critical&#x20;&#x20;to&#x20;&#x20;forensic&#x20;&#x20;investigations.','','AUDIT&#x20;GRANT&#x20;ANY&#x20;OBJECT&#x20;PRIVILEGE;','[{\"cis\": [\"6.1.11\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24572,'Ensure&#x20;the&#x20;&#039;GRANT&#x20;ANY&#x20;PRIVILEGE&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','GRANT&#x20;ANY&#x20;PRIVILEGE&#x20;allows&#x20;&#x20;a&#x20;user&#x20;&#x20;to&#x20;&#x20;grant&#x20;any&#x20;system&#x20;&#x20;privilege,&#x20;&#x20;including&#x20;the&#x20;most&#x20;powerful&#x20;privileges&#x20;&#x20;typically&#x20;available&#x20;only&#x20;&#x20;to&#x20;&#x20;administrators&#x20;&#x20;-&#x20;to&#x20;&#x20;change&#x20;&#x20;the&#x20;security&#x20;infrastructure,&#x20;&#x20;to&#x20;&#x20;drop/add/modify&#x20;users&#x20;and&#x20;more.','Auditing&#x20;&#x20;the&#x20;use&#x20;of&#x20;&#x20;this&#x20;&#x20;privilege&#x20;is&#x20;&#x20;part&#x20;&#x20;of&#x20;&#x20;a&#x20;comprehensive&#x20;auditing&#x20;&#x20;policy&#x20;&#x20;that&#x20;&#x20;can&#x20;help&#x20;&#x20;in&#x20;detecting&#x20;&#x20;issues&#x20;&#x20;and&#x20;can&#x20;be&#x20;&#x20;useful&#x20;&#x20;in&#x20;&#x20;forensics.','','AUDIT&#x20;GRANT&#x20;ANY&#x20;PRIVILEGE;','[{\"cis\": [\"6.1.12\"]}, {\"cis_csc\": [\"5.4\", \"6.2\", \"4.8\", \"6.3\"]}]'),(24573,'Ensure&#x20;the&#x20;&#039;DROP&#x20;ANY&#x20;PROCEDURE&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;AUDIT&#x20;DROP&#x20;ANY&#x20;PROCEDURE&#x20;command&#x20;&#x20;is&#x20;&#x20;auditing&#x20;&#x20;the&#x20;dropping&#x20;&#x20;of&#x20;&#x20;procedures.&#x20;Enabling&#x20;&#x20;the&#x20;option&#x20;&#x20;causes&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;such&#x20;&#x20;activities.','Dropping&#x20;&#x20;procedures&#x20;&#x20;of&#x20;&#x20;another&#x20;user&#x20;&#x20;could&#x20;be&#x20;&#x20;part&#x20;&#x20;of&#x20;&#x20;a&#x20;privilege&#x20;escalation&#x20;&#x20;exploit&#x20;and&#x20;should&#x20;&#x20;be&#x20;&#x20;audited.','','AUDIT&#x20;DROP&#x20;ANY&#x20;PROCEDURE;','[{\"cis\": [\"6.1.13\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24574,'Ensure&#x20;the&#x20;&#039;ALL&#039;&#x20;Audit&#x20;Option&#x20;on&#x20;&#039;SYS.AUD$&#039;&#x20;Is&#x20;Enabled.','The&#x20;logging&#x20;of&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;the&#x20;audit&#x20;trail&#x20;in&#x20;&#x20;the&#x20;SYS.AUD$&#x20;table&#x20;&#x20;&#40;open&#x20;for&#x20;read/update/delete/view&#41;&#x20;&#x20;will&#x20;&#x20;provide&#x20;a&#x20;record&#x20;&#x20;of&#x20;&#x20;any&#x20;activities&#x20;&#x20;that&#x20;&#x20;may&#x20;indicate&#x20;unauthorized&#x20;attempts&#x20;&#x20;to&#x20;&#x20;access&#x20;&#x20;the&#x20;audit&#x20;trail.&#x20;&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;will&#x20;&#x20;cause&#x20;these&#x20;activities&#x20;&#x20;to&#x20;&#x20;be&#x20;&#x20;audited.','As&#x20;&#x20;the&#x20;logging&#x20;of&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;the&#x20;SYS.AUD$&#x20;table&#x20;&#x20;can&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;of&#x20;&#x20;the&#x20;initiation&#x20;&#x20;of&#x20;&#x20;a&#x20;pattern&#x20;of&#x20;&#x20;unauthorized&#x20;&#x20;activities,&#x20;this&#x20;&#x20;logging&#x20;capability&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;enabled.','','AUDIT&#x20;ALL&#x20;ON&#x20;SYS.AUD$&#x20;BY&#x20;ACCESS;','[{\"cis\": [\"6.1.14\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24575,'Ensure&#x20;the&#x20;&#039;PROCEDURE&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','In&#x20;&#x20;this&#x20;&#x20;statement&#x20;audit,&#x20;&#x20;PROCEDURE&#x20;means&#x20;any&#x20;procedure,&#x20;&#x20;function,&#x20;package&#x20;or&#x20;&#x20;library.&#x20;Enabling&#x20;this&#x20;&#x20;audit&#x20;option&#x20;&#x20;causes&#x20;&#x20;any&#x20;attempt,&#x20;&#x20;successful&#x20;&#x20;or&#x20;&#x20;not,&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;or&#x20;&#x20;drop&#x20;&#x20;any&#x20;of&#x20;these&#x20;&#x20;types&#x20;of&#x20;&#x20;objects&#x20;to&#x20;&#x20;be&#x20;&#x20;audited,&#x20;&#x20;regardless&#x20;&#x20;of&#x20;&#x20;privilege&#x20;or&#x20;&#x20;lack&#x20;&#x20;thereof.&#x20;&#x20;Java&#x20;&#x20;schema&#x20;objects&#x20;&#x20;&#40;sources,&#x20;classes,&#x20;&#x20;and&#x20;resources&#41;&#x20;&#x20;are&#x20;considered&#x20;&#x20;the&#x20;same&#x20;&#x20;as&#x20;&#x20;procedures&#x20;&#x20;for&#x20;the&#x20;purposes&#x20;&#x20;of&#x20;&#x20;auditing&#x20;&#x20;SQL&#x20;statements.','Any&#x20;unauthorized&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;or&#x20;&#x20;drop&#x20;&#x20;a&#x20;procedure&#x20;in&#x20;&#x20;another&#039;s&#x20;schema&#x20;&#x20;should&#x20;&#x20;cause&#x20;concern,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;not.&#x20;&#x20;Changes&#x20;to&#x20;&#x20;critical&#x20;&#x20;stored&#x20;&#x20;code&#x20;&#x20;can&#x20;dramatically&#x20;&#x20;change&#x20;the&#x20;&#x20;behavior&#x20;&#x20;of&#x20;&#x20;the&#x20;application&#x20;and&#x20;produce&#x20;serious&#x20;security&#x20;&#x20;consequences,&#x20;including&#x20;enabling&#x20;&#x20;privilege&#x20;escalation&#x20;&#x20;and&#x20;introducing&#x20;SQL&#x20;injection&#x20;vulnerabilities.&#x20;&#x20;Audit&#x20;records&#x20;of&#x20;such&#x20;changes&#x20;can&#x20;be&#x20;&#x20;helpful&#x20;in&#x20;&#x20;forensics.','','AUDIT&#x20;PROCEDURE;','[{\"cis\": [\"6.1.15\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24576,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;SYSTEM&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','ALTER&#x20;SYSTEM&#x20;allows&#x20;one&#x20;to&#x20;&#x20;change&#x20;&#x20;instance&#x20;&#x20;settings,&#x20;including&#x20;security&#x20;&#x20;settings&#x20;&#x20;and&#x20;auditing&#x20;&#x20;options.&#x20;&#x20;Additionally,&#x20;ALTER&#x20;SYSTEM&#x20;can&#x20;&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;run&#x20;operating&#x20;system&#x20;commands&#x20;using&#x20;undocumented&#x20;&#x20;Oracle&#x20;&#x20;functionality.&#x20;&#x20;Enabling&#x20;&#x20;the&#x20;audit&#x20;option&#x20;&#x20;will&#x20;&#x20;audit&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;perform&#x20;ALTER&#x20;SYSTEM,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;not&#x20;and&#x20;regardless&#x20;&#x20;of&#x20;&#x20;whether&#x20;or&#x20;&#x20;not&#x20;the&#x20;ALTER&#x20;SYSTEM&#x20;privilege&#x20;&#x20;is&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;user&#x20;&#x20;attempting&#x20;&#x20;the&#x20;action.','Any&#x20;unauthorized&#x20;&#x20;attempt&#x20;to&#x20;&#x20;alter&#x20;the&#x20;system&#x20;&#x20;should&#x20;&#x20;be&#x20;&#x20;cause&#x20;for&#x20;concern.&#x20;&#x20;Alterations&#x20;outside&#x20;of&#x20;&#x20;some&#x20;&#x20;specified&#x20;maintenance&#x20;window&#x20;&#x20;may&#x20;be&#x20;&#x20;of&#x20;&#x20;concern.&#x20;&#x20;In&#x20;&#x20;forensics,&#x20;&#x20;these&#x20;audit&#x20;records&#x20;could&#x20;be&#x20;&#x20;quite&#x20;useful.','','AUDIT&#x20;ALTER&#x20;SYSTEM;','[{\"cis\": [\"6.1.16\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24577,'Ensure&#x20;the&#x20;&#039;TRIGGER&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','A&#x20;TRIGGER&#x20;may&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;modify&#x20;&#x20;DML&#x20;actions&#x20;or&#x20;&#x20;invoke&#x20;&#x20;other&#x20;&#40;recursive&#41;&#x20;actions&#x20;when&#x20;some&#x20;types&#x20;of&#x20;&#x20;user-initiated&#x20;&#x20;actions&#x20;occur.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;audit&#x20;option&#x20;&#x20;will&#x20;&#x20;cause&#x20;auditing&#x20;&#x20;of&#x20;any&#x20;&#x20;attempt,&#x20;&#x20;successful&#x20;&#x20;or&#x20;&#x20;not,&#x20;&#x20;to&#x20;&#x20;create,&#x20;drop,&#x20;enable&#x20;&#x20;or&#x20;&#x20;disable&#x20;any&#x20;schema&#x20;&#x20;trigger&#x20;in&#x20;&#x20;any&#x20;schema&#x20;&#x20;regardless&#x20;&#x20;of&#x20;&#x20;privilege&#x20;or&#x20;&#x20;lack&#x20;&#x20;thereof.&#x20;&#x20;For&#x20;enabling&#x20;&#x20;and&#x20;disabling&#x20;a&#x20;trigger,&#x20;&#x20;it&#x20;covers&#x20;both&#x20;&#x20;ALTER&#x20;TRIGGER&#x20;and&#x20;ALTER&#x20;TABLE.','Triggers&#x20;&#x20;are&#x20;often&#x20;part&#x20;&#x20;of&#x20;&#x20;schema&#x20;&#x20;security,&#x20;data&#x20;&#x20;validation&#x20;&#x20;and&#x20;other&#x20;critical&#x20;&#x20;constraints&#x20;upon&#x20;&#x20;actions&#x20;and&#x20;data.&#x20;A&#x20;trigger&#x20;in&#x20;&#x20;another&#x20;schema&#x20;&#x20;may&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;escalate&#x20;&#x20;privileges,&#x20;redirect&#x20;&#x20;operations,&#x20;transform&#x20;data&#x20;&#x20;and&#x20;perform&#x20;other&#x20;sorts&#x20;of&#x20;&#x20;perhaps&#x20;undesired&#x20;actions.&#x20;Any&#x20;&#x20;unauthorized&#x20;&#x20;attempt&#x20;to&#x20;&#x20;create,&#x20;drop&#x20;&#x20;or&#x20;&#x20;alter&#x20;a&#x20;trigger&#x20;in&#x20;&#x20;another&#x20;schema&#x20;&#x20;may&#x20;be&#x20;&#x20;cause&#x20;for&#x20;investigation.','','AUDIT&#x20;TRIGGER;','[{\"cis\": [\"6.1.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24578,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;SESSION&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','Enabling&#x20;&#x20;this&#x20;&#x20;audit&#x20;option&#x20;&#x20;will&#x20;&#x20;cause&#x20;auditing&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;connect&#x20;to&#x20;&#x20;the&#x20;database,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;not,&#x20;&#x20;as&#x20;&#x20;well&#x20;&#x20;as&#x20;&#x20;audit&#x20;session&#x20;disconnects/logoffs.&#x20;&#x20;The&#x20;commands&#x20;&#x20;to&#x20;audit&#x20;&#x20;SESSION,&#x20;&#x20;CONNECT&#x20;or&#x20;&#x20;CREATE&#x20;SESSION&#x20;all&#x20;&#x20;accomplish&#x20;&#x20;the&#x20;same&#x20;&#x20;thing&#x20;-&#x20;they&#x20;&#x20;initiate&#x20;statement&#x20;&#x20;auditing&#x20;&#x20;of&#x20;&#x20;the&#x20;connect&#x20;statement&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;a&#x20;database&#x20;&#x20;session.','Auditing&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;connect&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;is&#x20;&#x20;basic&#x20;and&#x20;mandated&#x20;&#x20;by&#x20;&#x20;most&#x20;&#x20;security&#x20;initiatives.&#x20;Any&#x20;attempt&#x20;to&#x20;&#x20;logon&#x20;to&#x20;&#x20;a&#x20;locked&#x20;&#x20;account,&#x20;&#x20;failed&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;logon&#x20;to&#x20;&#x20;default&#x20;accounts&#x20;&#x20;or&#x20;&#x20;an&#x20;&#x20;unusually&#x20;high&#x20;&#x20;number&#x20;&#x20;of&#x20;&#x20;failed&#x20;&#x20;logon&#x20;attempts&#x20;&#x20;of&#x20;&#x20;any&#x20;sort,&#x20;for&#x20;any&#x20;user,&#x20;in&#x20;&#x20;a&#x20;particular&#x20;&#x20;time&#x20;&#x20;period&#x20;&#x20;may&#x20;indicate&#x20;&#x20;an&#x20;&#x20;intrusion&#x20;attempt.&#x20;&#x20;In&#x20;&#x20;forensics,&#x20;&#x20;the&#x20;logon&#x20;record&#x20;may&#x20;&#x20;be&#x20;&#x20;first&#x20;in&#x20;&#x20;a&#x20;chain&#x20;of&#x20;&#x20;evidence&#x20;&#x20;and&#x20;contain&#x20;information&#x20;found&#x20;in&#x20;&#x20;no&#x20;&#x20;other&#x20;type&#x20;&#x20;of&#x20;&#x20;audit&#x20;record&#x20;&#x20;for&#x20;the&#x20;session.&#x20;&#x20;Logon&#x20;and&#x20;logoff&#x20;&#x20;in&#x20;&#x20;the&#x20;audit&#x20;trail&#x20;define&#x20;&#x20;the&#x20;period&#x20;&#x20;and&#x20;duration&#x20;&#x20;of&#x20;the&#x20;&#x20;session.','','AUDIT&#x20;SESSION;','[{\"cis\": [\"6.1.18\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24579,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;USER&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','The&#x20;CREATE&#x20;USER&#x20;statement&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;create&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;accounts&#x20;&#x20;and&#x20;assign&#x20;&#x20;database&#x20;properties&#x20;to&#x20;&#x20;them.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;USER&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;user&#x20;&#x20;accounts,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidences&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;activities&#x20;&#x20;involving&#x20;CREATE&#x20;USER.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;USER;','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24580,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;USER&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','The&#x20;ALTER&#x20;USER&#x20;statement&#x20;&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;change&#x20;&#x20;database&#x20;&#x20;users&rsquo;&#x20;&#x20;password,&#x20;lock&#x20;&#x20;accounts,&#x20;and&#x20;expire&#x20;&#x20;passwords.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;this&#x20;&#x20;statement&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;change&#x20;&#x20;database&#x20;&#x20;properties&#x20;&#x20;of&#x20;&#x20;user&#x20;accounts&#x20;such&#x20;&#x20;as&#x20;&#x20;database&#x20;&#x20;profiles,&#x20;default&#x20;and&#x20;temporary&#x20;tablespaces,&#x20;&#x20;and&#x20;tablespace&#x20;quotas.&#x20;&#x20;This&#x20;&#x20;unified&#x20;audit&#x20;action&#x20;&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;USER&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;user&#x20;&#x20;accounts,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidences&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;activities&#x20;&#x20;involving&#x20;ALTER&#x20;USER.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;USER;','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24581,'Ensure&#x20;the&#x20;&#039;DROP&#x20;USER&#039;&#x20;Audit&#x20;Option&#x20;Is&#x20;Enabled.','The&#x20;DROP&#x20;USER&#x20;statement&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;accounts&#x20;&#x20;and&#x20;schemas&#x20;associated&#x20;with&#x20;them.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;USER&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;the&#x20;&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;user,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;activities&#x20;&#x20;involving&#x20;DROP&#x20;USER.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;USER;','[{\"cis\": [\"6.2.3\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24582,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;ROLE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','An&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;role&#x20;&#x20;is&#x20;&#x20;a&#x20;collection&#x20;&#x20;or&#x20;&#x20;set&#x20;of&#x20;&#x20;privileges&#x20;&#x20;that&#x20;&#x20;can&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;users&#x20;or&#x20;other&#x20;&#x20;roles.&#x20;&#x20;Roles&#x20;may&#x20;include&#x20;system&#x20;&#x20;privileges,&#x20;object&#x20;&#x20;privileges&#x20;&#x20;or&#x20;&#x20;other&#x20;roles.&#x20;&#x20;Enabling&#x20;this&#x20;unified&#x20;audit&#x20;action&#x20;&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;ROLE&#x20;statements,&#x20;whether&#x20;successful&#x20;or&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;roles,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;CREATE&#x20;ROLE.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;ROLE;','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24583,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;ROLE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','An&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;role&#x20;&#x20;is&#x20;&#x20;a&#x20;collection&#x20;&#x20;or&#x20;&#x20;set&#x20;of&#x20;&#x20;privileges&#x20;&#x20;that&#x20;&#x20;can&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;users&#x20;or&#x20;other&#x20;&#x20;roles.&#x20;&#x20;Roles&#x20;may&#x20;include&#x20;system&#x20;&#x20;privileges,&#x20;object&#x20;&#x20;privileges&#x20;&#x20;or&#x20;&#x20;other&#x20;roles.&#x20;&#x20;The&#x20;ALTER&#x20;ROLE&#x20;statement&#x20;&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;change&#x20;&#x20;the&#x20;authorization&#x20;needed&#x20;&#x20;to&#x20;&#x20;enable&#x20;&#x20;a&#x20;role.&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;ROLE&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;roles,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;alteration&#x20;&#x20;of&#x20;&#x20;roles.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;ROLE;','[{\"cis\": [\"6.2.5\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24584,'Ensure&#x20;the&#x20;&#039;DROP&#x20;ROLE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','An&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;role&#x20;&#x20;is&#x20;&#x20;a&#x20;collection&#x20;&#x20;or&#x20;&#x20;set&#x20;of&#x20;&#x20;privileges&#x20;&#x20;that&#x20;&#x20;can&#x20;be&#x20;&#x20;granted&#x20;to&#x20;&#x20;users&#x20;or&#x20;other&#x20;&#x20;roles.&#x20;&#x20;Roles&#x20;may&#x20;include&#x20;system&#x20;&#x20;privileges,&#x20;object&#x20;&#x20;privileges&#x20;&#x20;or&#x20;&#x20;other&#x20;roles.&#x20;&#x20;Enabling&#x20;this&#x20;unified&#x20;audit&#x20;action&#x20;&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;ROLE&#x20;statements,&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;roles,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;DROP&#x20;ROLE.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;ROLE;','[{\"cis\": [\"6.2.6\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24585,'Ensure&#x20;the&#x20;&#039;GRANT&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','GRANT&#x20;statements&#x20;&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;grant&#x20;privileges&#x20;&#x20;to&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;users&#x20;and&#x20;roles,&#x20;&#x20;including&#x20;the&#x20;most&#x20;&#x20;powerful&#x20;&#x20;privileges&#x20;&#x20;and&#x20;roles&#x20;typically&#x20;available&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;administrators.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;GRANT&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','With&#x20;&#x20;unauthorized&#x20;&#x20;grants&#x20;&#x20;and&#x20;permissions,&#x20;&#x20;a&#x20;malicious&#x20;user&#x20;&#x20;may&#x20;be&#x20;&#x20;able&#x20;&#x20;to&#x20;&#x20;change&#x20;&#x20;the&#x20;security&#x20;&#x20;of&#x20;&#x20;the&#x20;database,&#x20;access/update&#x20;confidential&#x20;&#x20;data,&#x20;or&#x20;&#x20;compromise&#x20;&#x20;the&#x20;integrity&#x20;of&#x20;the&#x20;&#x20;database.&#x20;Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;grant&#x20;system&#x20;&#x20;privileges,&#x20;object&#x20;privileges&#x20;or&#x20;&#x20;roles,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;about&#x20;&#x20;potential&#x20;suspicious/unauthorized&#x20;activities&#x20;&#x20;as&#x20;&#x20;well&#x20;&#x20;as&#x20;&#x20;privilege&#x20;escalation&#x20;&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;security&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;activities&#x20;involving&#x20;GRANT.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;GRANT;','[{\"cis\": [\"6.2.7\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24586,'Ensure&#x20;the&#x20;&#039;REVOKE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','REVOKE&#x20;statements&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;revoke&#x20;&#x20;privileges&#x20;&#x20;from&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;users&#x20;and&#x20;roles.&#x20;Enabling&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;REVOKE&#x20;statements,&#x20;&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;revoke&#x20;&#x20;system&#x20;&#x20;privileges,&#x20;object&#x20;&#x20;privileges&#x20;&#x20;or&#x20;roles,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;REVOKE.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;REVOKE;','[{\"cis\": [\"6.2.8\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(24587,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;PROFILE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;profiles&#x20;&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;enforce&#x20;resource&#x20;&#x20;usage&#x20;limits&#x20;&#x20;and&#x20;implement&#x20;password&#x20;&#x20;policies&#x20;&#x20;such&#x20;&#x20;as&#x20;&#x20;password&#x20;&#x20;complexity&#x20;&#x20;rules&#x20;and&#x20;reuse&#x20;restrictions.&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;PROFILE&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;or&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;profiles,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;creation&#x20;&#x20;of&#x20;&#x20;database&#x20;&#x20;profiles.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;PROFILE;','[{\"cis\": [\"6.2.9\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24588,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;PROFILE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;profiles&#x20;&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;enforce&#x20;resource&#x20;&#x20;usage&#x20;limits&#x20;&#x20;and&#x20;implement&#x20;password&#x20;&#x20;policies&#x20;&#x20;such&#x20;&#x20;as&#x20;&#x20;password&#x20;&#x20;complexity&#x20;&#x20;rules&#x20;and&#x20;reuse&#x20;restrictions.&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;PROFILE&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;profiles,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;policies&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;involving&#x20;&#x20;alteration&#x20;&#x20;of&#x20;&#x20;database&#x20;&#x20;profiles.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;PROFILE;','[{\"cis\": [\"6.2.10\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24589,'Ensure&#x20;the&#x20;&#039;DROP&#x20;PROFILE&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled&#x20;.','Oracle&#x20;&#x20;database&#x20;&#x20;profiles&#x20;&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;enforce&#x20;resource&#x20;&#x20;usage&#x20;limits&#x20;&#x20;and&#x20;implement&#x20;password&#x20;&#x20;policies&#x20;&#x20;such&#x20;&#x20;as&#x20;&#x20;password&#x20;&#x20;complexity&#x20;&#x20;rules&#x20;and&#x20;reuse&#x20;restrictions.&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;enables&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;PROFILE&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;profiles,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;dropping&#x20;&#x20;database&#x20;&#x20;profiles.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;PROFILE;','[{\"cis\": [\"6.2.11\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24590,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;DATABASE&#x20;LINK&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;links&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;establish&#x20;database-to-database&#x20;&#x20;connections&#x20;to&#x20;&#x20;other&#x20;databases.&#x20;&#x20;These&#x20;connections&#x20;are&#x20;available&#x20;without&#x20;further&#x20;authentication&#x20;&#x20;once&#x20;&#x20;the&#x20;link&#x20;&#x20;is&#x20;established.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;DATABASE&#x20;and&#x20;CREATE&#x20;PUBLIC&#x20;DATABASE&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;database&#x20;&#x20;links,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;creation&#x20;&#x20;of&#x20;&#x20;database&#x20;&#x20;links.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;DATABASE&#x20;LINK;','[{\"cis\": [\"6.2.12\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24591,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;DATABASE&#x20;LINK&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;links&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;establish&#x20;database-to-database&#x20;&#x20;connections&#x20;to&#x20;&#x20;other&#x20;databases.&#x20;&#x20;These&#x20;connections&#x20;are&#x20;always&#x20;&#x20;available&#x20;without&#x20;further&#x20;authentication&#x20;&#x20;once&#x20;&#x20;the&#x20;link&#x20;&#x20;is&#x20;&#x20;established.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;DATABASE&#x20;and&#x20;&#x20;ALTER&#x20;PUBLIC&#x20;DATABASE&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;database&#x20;&#x20;links,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;alteration&#x20;&#x20;of&#x20;&#x20;database&#x20;&#x20;links.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;DATABASE&#x20;LINK;','[{\"cis\": [\"6.2.13\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24592,'Ensure&#x20;the&#x20;&#039;DROP&#x20;DATABASE&#x20;LINK&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;links&#x20;are&#x20;used&#x20;&#x20;to&#x20;&#x20;establish&#x20;database-to-database&#x20;&#x20;connections&#x20;to&#x20;&#x20;other&#x20;databases.&#x20;&#x20;These&#x20;connections&#x20;are&#x20;always&#x20;&#x20;available&#x20;without&#x20;further&#x20;authentication&#x20;&#x20;once&#x20;&#x20;the&#x20;link&#x20;&#x20;is&#x20;&#x20;established.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;DATABASE&#x20;and&#x20;DROP&#x20;PUBLIC&#x20;DATABASE,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;statements&#x20;&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;database&#x20;&#x20;links,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;dropping&#x20;&#x20;database&#x20;&#x20;links.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;DATABASE&#x20;LINK;','[{\"cis\": [\"6.2.14\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24593,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;SYNONYM&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','An&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;synonym&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;an&#x20;&#x20;alternative&#x20;name&#x20;&#x20;for&#x20;a&#x20;database&#x20;&#x20;object&#x20;such&#x20;as&#x20;&#x20;table,&#x20;&#x20;view,&#x20;procedure,&#x20;&#x20;java&#x20;&#x20;object&#x20;&#x20;or&#x20;&#x20;even&#x20;&#x20;another&#x20;synonym,&#x20;&#x20;etc.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;SYNONYM&#x20;and&#x20;&#x20;CREATE&#x20;PUBLIC&#x20;SYNONYM&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;synonyms,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;creation&#x20;&#x20;of&#x20;&#x20;synonyms&#x20;&#x20;or&#x20;public&#x20;synonyms.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;SYNONYM;','[{\"cis\": [\"6.2.15\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24594,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;SYNONYM&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','An&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;synonym&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;an&#x20;&#x20;alternative&#x20;name&#x20;&#x20;for&#x20;a&#x20;database&#x20;&#x20;object&#x20;such&#x20;as&#x20;&#x20;table,&#x20;&#x20;view,&#x20;procedure,&#x20;&#x20;or&#x20;&#x20;java&#x20;&#x20;object,&#x20;or&#x20;&#x20;even&#x20;&#x20;another&#x20;synonym.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;SYNONYM&#x20;and&#x20;ALTER&#x20;PUBLIC&#x20;SYNONYM&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;synonyms,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;alteration&#x20;&#x20;of&#x20;&#x20;synonyms&#x20;&#x20;or&#x20;public&#x20;synonyms.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;SYNONYM;','[{\"cis\": [\"6.2.16\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24595,'Ensure&#x20;the&#x20;&#039;DROP&#x20;SYNONYM&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','An&#x20;&#x20;Oracle&#x20;&#x20;database&#x20;&#x20;synonym&#x20;is&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;an&#x20;&#x20;alternative&#x20;name&#x20;&#x20;for&#x20;a&#x20;database&#x20;&#x20;object&#x20;such&#x20;as&#x20;&#x20;table,&#x20;&#x20;view,&#x20;procedure,&#x20;&#x20;or&#x20;&#x20;java&#x20;&#x20;object,&#x20;or&#x20;&#x20;even&#x20;&#x20;another&#x20;synonym.&#x20;&#x20;Enabling&#x20;&#x20;his&#x20;unified&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;SYNONYM&#x20;and&#x20;&#x20;DROP&#x20;PUBLIC&#x20;SYNONYM&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;synonyms,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;involving&#x20;&#x20;dropping&#x20;&#x20;of&#x20;&#x20;synonyms&#x20;&#x20;or&#x20;&#x20;public&#x20;&#x20;synonyms.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;SYNONYM;','[{\"cis\": [\"6.2.17\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24596,'Ensure&#x20;the&#x20;&#039;SELECT&#x20;ANY&#x20;DICTIONARY&#039;&#x20;Privilege&#x20;Audit&#x20;Is&#x20;Enabled.','The&#x20;SELECT&#x20;ANY&#x20;DICTIONARY&#x20;system&#x20;&#x20;privilege&#x20;allows&#x20;&#x20;the&#x20;user&#x20;&#x20;to&#x20;&#x20;view&#x20;&#x20;the&#x20;definition&#x20;&#x20;of&#x20;&#x20;all&#x20;schema&#x20;&#x20;objects&#x20;in&#x20;&#x20;the&#x20;database.&#x20;It&#x20;&#x20;grants&#x20;&#x20;SELECT&#x20;privileges&#x20;on&#x20;&#x20;the&#x20;data&#x20;&#x20;dictionary&#x20;&#x20;objects&#x20;to&#x20;the&#x20;&#x20;grantees,&#x20;including&#x20;SELECT&#x20;on&#x20;DBA_&#x20;views,&#x20;V$&#x20;views,&#x20;X$&#x20;views&#x20;&#x20;and&#x20;underlying&#x20;&#x20;SYS&#x20;tables&#x20;such&#x20;as&#x20;&#x20;TAB$&#x20;and&#x20;&#x20;OBJ$.&#x20;This&#x20;&#x20;privilege&#x20;also&#x20;&#x20;allows&#x20;&#x20;grantees&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;stored&#x20;&#x20;objects&#x20;such&#x20;&#x20;as&#x20;procedures,&#x20;&#x20;packages&#x20;&#x20;and&#x20;views&#x20;on&#x20;&#x20;the&#x20;underlying&#x20;&#x20;data&#x20;&#x20;dictionary&#x20;&#x20;objects.&#x20;&#x20;Please&#x20;&#x20;note&#x20;&#x20;that&#x20;this&#x20;privilege&#x20;does&#x20;&#x20;not&#x20;grant&#x20;SELECT&#x20;on&#x20;tables&#x20;&#x20;with&#x20;&#x20;password&#x20;&#x20;hashes&#x20;&#x20;such&#x20;&#x20;as&#x20;&#x20;USER$,&#x20;DEFAULT_PWD$,&#x20;&#x20;LINK$,&#x20;&#x20;and&#x20;USER_HISTORY$.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;activities&#x20;that&#x20;exercise&#x20;&#x20;this&#x20;&#x20;privilege.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;access&#x20;&#x20;a&#x20;data&#x20;&#x20;dictionary,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;access&#x20;&#x20;to&#x20;&#x20;the&#x20;database.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;PRIVILEGES&#x20;SELECT&#x20;ANY&#x20;DICTIONARY;','[{\"cis\": [\"6.2.18\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24597,'Ensure&#x20;the&#x20;&#039;AUDSYS.AUD$UNIFIED&#039;&#x20;Access&#x20;Audit&#x20;Is&#x20;Enabled.','The&#x20;AUDSYS.AUD$UNIFIED&#x20;holds&#x20;&#x20;audit&#x20;trail&#x20;records&#x20;generated&#x20;by&#x20;&#x20;the&#x20;database.&#x20;Enabling&#x20;&#x20;this&#x20;audit&#x20;&#x20;action&#x20;&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;access&#x20;&#x20;attempts&#x20;&#x20;to&#x20;&#x20;the&#x20;AUDSYS.AUD$UNIFIED,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;access&#x20;&#x20;the&#x20;AUDSYS.AUD$UNIFIED,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;access&#x20;&#x20;to&#x20;&#x20;this&#x20;&#x20;table.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALL&#x20;on&#x20;AUDSYS.AUD$UNIFIED;','[{\"cis\": [\"6.2.19\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24598,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;PROCEDURE/FUNCTION/PACKAGE/PACKAGE&#x20;BODY&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;procedures,&#x20;function,&#x20;packages,&#x20;and&#x20;package&#x20;bodies,&#x20;which&#x20;are&#x20;stored&#x20;within&#x20;the&#x20;database,&#x20;are&#x20;created&#x20;to&#x20;&#x20;perform&#x20;business&#x20;&#x20;functions&#x20;and&#x20;access&#x20;&#x20;database&#x20;&#x20;as&#x20;defined&#x20;&#x20;by&#x20;&#x20;PL/SQL&#x20;&#x20;code&#x20;&#x20;and&#x20;SQL&#x20;statements&#x20;&#x20;contained&#x20;within&#x20;&#x20;these&#x20;objects.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;PROCEDURE,&#x20;CREATE&#x20;FUNCTION,&#x20;&#x20;CREATE&#x20;PACKAGE&#x20;and&#x20;&#x20;CREATE&#x20;PACKAGE&#x20;BODY&#x20;statements,&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;statements&#x20;issued&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;package&#x20;&#x20;bodies,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;evidence&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;creation&#x20;&#x20;of&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;&#x20;package&#x20;bodies.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;PROCEDURE,&#x20;CREATE&#x20;FUNCTION,&#x20;CREATE&#x20;PACKAGE,&#x20;CREATE&#x20;PACKAGE&#x20;BODY;','[{\"cis\": [\"6.2.20\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24599,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;PROCEDURE/FUNCTION/PACKAGE/PACKAGE&#x20;BODY&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages,&#x20;and&#x20;package&#x20;bodies,&#x20;which&#x20;are&#x20;stored&#x20;within&#x20;the&#x20;database,&#x20;are&#x20;created&#x20;to&#x20;&#x20;carry&#x20;out&#x20;business&#x20;&#x20;functions&#x20;and&#x20;access&#x20;&#x20;database&#x20;&#x20;as&#x20;defined&#x20;&#x20;by&#x20;&#x20;PL/SQL&#x20;&#x20;code&#x20;&#x20;and&#x20;SQL&#x20;statements&#x20;&#x20;contained&#x20;within&#x20;&#x20;these&#x20;objects.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;PROCEDURE,&#x20;&#x20;ALTER&#x20;FUNCTION,&#x20;ALTER&#x20;PACKAGE&#x20;and&#x20;ALTER&#x20;PACKAGE&#x20;BODY&#x20;statements,&#x20;&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Unauthorized&#x20;&#x20;alteration&#x20;&#x20;of&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;&#x20;package&#x20;bodies&#x20;&#x20;may&#x20;impact&#x20;critical&#x20;business&#x20;&#x20;functions&#x20;or&#x20;&#x20;compromise&#x20;&#x20;integrity&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;to&#x20;&#x20;alter&#x20;procedures,&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;&#x20;package&#x20;bodies&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;alteration&#x20;&#x20;of&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;&#x20;package&#x20;bodies.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;PROCEDURE,&#x20;ALTER&#x20;FUNCTION,&#x20;ALTER&#x20;PACKAGE,&#x20;ALTER&#x20;PACKAGE&#x20;BODY;','[{\"cis\": [\"6.2.21\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24600,'Ensure&#x20;the&#x20;&#039;DROP&#x20;PROCEDURE/FUNCTION/PACKAGE/PACKAGE&#x20;BODY&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages,&#x20;and&#x20;package&#x20;bodies,&#x20;which&#x20;are&#x20;stored&#x20;within&#x20;the&#x20;database,&#x20;are&#x20;created&#x20;to&#x20;&#x20;carry&#x20;out&#x20;business&#x20;&#x20;functions&#x20;and&#x20;access&#x20;&#x20;database&#x20;&#x20;as&#x20;defined&#x20;&#x20;by&#x20;&#x20;PL/SQL&#x20;&#x20;code&#x20;&#x20;and&#x20;SQL&#x20;statements&#x20;&#x20;contained&#x20;within&#x20;&#x20;these&#x20;objects.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;unified&#x20;&#x20;action&#x20;&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;PROCEDURE,&#x20;DROP&#x20;FUNCTION,&#x20;&#x20;DROP&#x20;PACKAGE&#x20;or&#x20;DROP&#x20;PACKAGE&#x20;BODY&#x20;statements,&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;of&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;to&#x20;&#x20;drop&#x20;procedures,&#x20;&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;&#x20;package&#x20;bodies&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;dropping&#x20;&#x20;procedures,&#x20;functions,&#x20;&#x20;packages&#x20;&#x20;or&#x20;&#x20;package&#x20;bodies.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;PROCEDURE,&#x20;DROP&#x20;FUNCTION,&#x20;DROP&#x20;PACKAGE,&#x20;DROP&#x20;PACKAGE&#x20;BODY;','[{\"cis\": [\"6.2.22\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24601,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;SYSTEM&#039;&#x20;Privilege&#x20;Audit&#x20;Is&#x20;Enabled.','The&#x20;ALTER&#x20;SYSTEM&#x20;privilege&#x20;&#x20;allows&#x20;&#x20;the&#x20;user&#x20;&#x20;to&#x20;&#x20;change&#x20;&#x20;instance&#x20;&#x20;settings&#x20;&#x20;which&#x20;could&#x20;impact&#x20;security&#x20;posture,&#x20;&#x20;performance&#x20;or&#x20;&#x20;normal&#x20;&#x20;operation&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Additionally,&#x20;the&#x20;ALTER&#x20;SYSTEM&#x20;privilege&#x20;&#x20;may&#x20;be&#x20;&#x20;used&#x20;&#x20;to&#x20;&#x20;run&#x20;operating&#x20;system&#x20;&#x20;commands&#x20;&#x20;using&#x20;undocumented&#x20;Oracle&#x20;functionality.&#x20;&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;activities&#x20;&#x20;that&#x20;&#x20;involve&#x20;exercise&#x20;&#x20;of&#x20;&#x20;this&#x20;&#x20;privilege,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;execute&#x20;ALTER&#x20;SYSTEM&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;that&#x20;&#x20;involve&#x20;ALTER&#x20;SYSTEM&#x20;statements.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;SYSTEM;','[{\"cis\": [\"6.2.23\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24602,'Ensure&#x20;the&#x20;&#039;CREATE&#x20;TRIGGER&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;triggers&#x20;&#x20;are&#x20;executed&#x20;&#x20;automatically&#x20;when&#x20;&#x20;specified&#x20;conditions&#x20;&#x20;on&#x20;&#x20;the&#x20;underlying&#x20;&#x20;objects&#x20;occur.&#x20;&#x20;Trigger&#x20;bodies&#x20;&#x20;contain&#x20;the&#x20;code,&#x20;quite&#x20;often&#x20;to&#x20;&#x20;perform&#x20;data&#x20;validation,&#x20;&#x20;ensure&#x20;&#x20;data&#x20;&#x20;integrity/security&#x20;&#x20;or&#x20;&#x20;enforce&#x20;critical&#x20;&#x20;constraints&#x20;on&#x20;&#x20;allowable&#x20;actions&#x20;on&#x20;&#x20;data.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;CREATE&#x20;TRIGGER&#x20;statements,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;create&#x20;&#x20;triggers,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;creation&#x20;&#x20;of&#x20;&#x20;triggers.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;CREATE&#x20;TRIGGER;','[{\"cis\": [\"6.2.24\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24603,'Ensure&#x20;the&#x20;&#039;ALTER&#x20;TRIGGER&#039;&#x20;Action&#x20;Audit&#x20;IS&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;triggers&#x20;&#x20;are&#x20;executed&#x20;&#x20;automatically&#x20;when&#x20;&#x20;specified&#x20;conditions&#x20;&#x20;on&#x20;&#x20;the&#x20;underlying&#x20;&#x20;objects&#x20;occur.&#x20;&#x20;Trigger&#x20;bodies&#x20;&#x20;contain&#x20;the&#x20;code,&#x20;quite&#x20;often&#x20;to&#x20;&#x20;perform&#x20;data&#x20;validation,&#x20;&#x20;ensure&#x20;&#x20;data&#x20;&#x20;integrity/security&#x20;&#x20;or&#x20;&#x20;enforce&#x20;critical&#x20;&#x20;constraints&#x20;on&#x20;&#x20;allowable&#x20;actions&#x20;on&#x20;&#x20;data.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;ALTER&#x20;TRIGGER&#x20;statements,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;the&#x20;&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Unauthorized&#x20;&#x20;alteration&#x20;&#x20;of&#x20;&#x20;triggers&#x20;&#x20;may&#x20;impact&#x20;&#x20;critical&#x20;&#x20;business&#x20;&#x20;functions&#x20;or&#x20;&#x20;compromise&#x20;integrity/security&#x20;of&#x20;&#x20;the&#x20;database.&#x20;Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;alter&#x20;triggers,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;may&#x20;provide&#x20;clues&#x20;and&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;&#x20;all&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;alteration&#x20;&#x20;of&#x20;&#x20;triggers.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;ALTER&#x20;TRIGGER;','[{\"cis\": [\"6.2.25\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24604,'Ensure&#x20;the&#x20;&#039;DROP&#x20;TRIGGER&#039;&#x20;Action&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;triggers&#x20;&#x20;are&#x20;executed&#x20;&#x20;automatically&#x20;when&#x20;&#x20;specified&#x20;conditions&#x20;&#x20;on&#x20;&#x20;the&#x20;underlying&#x20;&#x20;objects&#x20;occur.&#x20;&#x20;Trigger&#x20;bodies&#x20;&#x20;contain&#x20;the&#x20;code,&#x20;quite&#x20;often&#x20;to&#x20;&#x20;perform&#x20;data&#x20;validation,&#x20;&#x20;ensure&#x20;&#x20;data&#x20;&#x20;integrity/security&#x20;&#x20;or&#x20;&#x20;enforce&#x20;critical&#x20;&#x20;constraints&#x20;on&#x20;&#x20;allowable&#x20;actions&#x20;on&#x20;&#x20;data.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;DROP&#x20;TRIGGER&#x20;statements,&#x20;whether&#x20;&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;the&#x20;&#x20;users&#x20;to&#x20;&#x20;issue&#x20;such&#x20;&#x20;statements.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;drop&#x20;&#x20;triggers,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;dropping&#x20;&#x20;triggers.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;DROP&#x20;TRIGGER;','[{\"cis\": [\"6.2.26\"]}, {\"cis_csc\": [\"6.2\", \"6.3\"]}]'),(24605,'Ensure&#x20;the&#x20;&#039;LOGON&#039;&#x20;AND&#x20;&#039;LOGOFF&#039;&#x20;Actions&#x20;Audit&#x20;Is&#x20;Enabled.','Oracle&#x20;&#x20;database&#x20;&#x20;users&#x20;log&#x20;on&#x20;&#x20;to&#x20;&#x20;the&#x20;database&#x20;&#x20;to&#x20;&#x20;perform&#x20;their&#x20;work.&#x20;Enabling&#x20;&#x20;this&#x20;&#x20;unified&#x20;audit&#x20;causes&#x20;&#x20;logging&#x20;of&#x20;&#x20;all&#x20;LOGON&#x20;actions,&#x20;&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;&#x20;unsuccessful,&#x20;issued&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;regardless&#x20;&#x20;of&#x20;&#x20;the&#x20;privileges&#x20;&#x20;held&#x20;&#x20;by&#x20;&#x20;the&#x20;users&#x20;to&#x20;&#x20;log&#x20;into&#x20;&#x20;the&#x20;database.&#x20;In&#x20;&#x20;addition,&#x20;LOGOFF&#x20;action&#x20;audit&#x20;captures&#x20;&#x20;logoff&#x20;&#x20;activities.&#x20;This&#x20;&#x20;audit&#x20;action&#x20;&#x20;also&#x20;&#x20;captures&#x20;&#x20;logon/logoff&#x20;&#x20;to&#x20;the&#x20;&#x20;open&#x20;&#x20;database&#x20;&#x20;by&#x20;&#x20;SYSDBA&#x20;and&#x20;&#x20;SYSOPER.','Logging&#x20;and&#x20;monitoring&#x20;&#x20;of&#x20;&#x20;all&#x20;attempts&#x20;&#x20;to&#x20;&#x20;logon&#x20;to&#x20;&#x20;the&#x20;database,&#x20;whether&#x20;successful&#x20;&#x20;or&#x20;unsuccessful,&#x20;&#x20;may&#x20;provide&#x20;forensic&#x20;&#x20;evidence&#x20;&#x20;about&#x20;potential&#x20;suspicious/unauthorized&#x20;activities.&#x20;Any&#x20;such&#x20;&#x20;activities&#x20;&#x20;may&#x20;be&#x20;&#x20;a&#x20;cause&#x20;for&#x20;further&#x20;investigation.&#x20;&#x20;In&#x20;&#x20;addition,&#x20;organization&#x20;&#x20;security&#x20;&#x20;policies&#x20;&#x20;and&#x20;industry/government&#x20;regulations&#x20;may&#x20;require&#x20;logging&#x20;of&#x20;all&#x20;&#x20;user&#x20;&#x20;activities&#x20;&#x20;involving&#x20;LOGON&#x20;and&#x20;LOGOFF.','','ALTER&#x20;AUDIT&#x20;POLICY&#x20;CIS_UNIFIED_AUDIT_POLICY&#x20;ADD&#x20;ACTIONS&#x20;LOGON,&#x20;LOGOFF;','[{\"cis\": [\"6.2.27\"]}, {\"cis_csc\": [\"6.2\", \"16\", \"6.3\"]}]'),(25001,'Install&#x20;and&#x20;configure&#x20;HP-UX&#x20;Secure&#x20;Shell.','OpenSSH&#x20;is&#x20;a&#x20;popular&#x20;free&#x20;distribution&#x20;of&#x20;the&#x20;standards-track&#x20;SSH&#x20;protocols&#x20;which&#x20;allows&#x20;secure&#x20;encrypted&#x20;network&#x20;logins&#x20;and&#x20;file&#x20;transfers.&#x20;HP-UX&#x20;Secure&#x20;Shell&#x20;is&#x20;HP&#039;s&#x20;pre-compiled&#x20;and&#x20;supported&#x20;version&#x20;of&#x20;OpenSSH.','Common&#x20;login&#x20;and&#x20;file&#x20;transfer&#x20;services&#x20;such&#x20;as&#x20;telnet,&#x20;FTP,&#x20;rsh,&#x20;rlogin,&#x20;and&#x20;rcp&#x20;use&#x20;insecure,&#x20;clear-text&#x20;protocols&#x20;that&#x20;are&#x20;vulnerable&#x20;to&#x20;attack.&#x20;OpenSSH&#x20;provides&#x20;a&#x20;secure,&#x20;encrypted&#x20;replacement&#x20;for&#x20;these&#x20;services.&#x20;Security&#x20;is&#x20;improved&#x20;by&#x20;further&#x20;constraining&#x20;services&#x20;in&#x20;the&#x20;default&#x20;configuration.','','Perform&#x20;the&#x20;following&#x20;to&#x20;install&#x20;and&#x20;securely&#x20;configure&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;&#x20;1.&#x20;Download&#x20;and&#x20;install&#x20;HP-UX&#x20;Secure&#x20;Shell&#x20;if&#x20;not&#x20;already&#x20;installed&#x20;on&#x20;the&#x20;system.&#x20;2.&#x20;Perform&#x20;the&#x20;following&#x20;post-installation&#x20;actions&#x20;to&#x20;secure&#x20;the&#x20;SSH&#x20;service:&#x20;a.&#x20;Change&#x20;to&#x20;the&#x20;/opt/ssh/etc&#x20;directory&#x20;b.&#x20;Open&#x20;sshd_config&#x20;c.&#x20;Set&#x20;the&#x20;Protocol&#x20;token&#x20;to&#x20;2.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;d.&#x20;Set&#x20;the&#x20;X11Forwarding&#x20;token&#x20;to&#x20;yes.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;e.&#x20;Set&#x20;the&#x20;IgnoreRhosts&#x20;token&#x20;to&#x20;yes.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;f.&#x20;Set&#x20;the&#x20;RhostsAuthentication&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;g.&#x20;Set&#x20;the&#x20;RhostsRSAAuthentication&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;h.&#x20;Set&#x20;the&#x20;PermitRootLogin&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;i.&#x20;Set&#x20;the&#x20;PermitEmptyPasswords&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;j.&#x20;Set&#x20;the&#x20;Banner&#x20;token&#x20;to&#x20;/etc/issue.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;k.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;sshd_config&#x20;and&#x20;ssh_config.&#x20;l.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;sshd_config&#x20;and&#x20;ssh_config.&#x20;m.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;sshd_config&#x20;and&#x20;ssh_config&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;13&#x20;|&#x20;P&#x20;a&#x20;g&#x20;e&#x20;cd&#x20;/opt/ssh/etc&#x20;cp&#x20;-p&#x20;sshd_config&#x20;sshd_config.tmp&#x20;awk&#x20;&#039;&#x20;/^Protocol/&#x20;/^IgnoreRhosts/&#x20;/^RhostsAuthentication/&#x20;/^RhostsRSAAuthentication/&#x20;{&#x20;$2&#x20;=&quot;no&quot;&#x20;};&#x20;/&#40;^#|^&#41;PermitRootLogin/&#x20;&#x20;&#x20;&#x20;{&#x20;$1&#x20;=&#x20;&quot;PermitRootLogin&quot;;&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;};&#x20;/^PermitEmptyPasswords/&#x20;&#x20;&#x20;&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;};&#x20;/^#Banner/&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;{&#x20;$1&#x20;=&#x20;&quot;Banner&quot;;&#x20;$2&#x20;=&#x20;&quot;/etc/issue&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;sshd_config.tmp&#x20;&gt;&#x20;sshd_config&#x20;{&#x20;$2&#x20;=&quot;2&quot;};&#x20;{&#x20;$2&#x20;=&#x20;&quot;yes&quot;&#x20;};&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;};&#x20;rm&#x20;-f&#x20;sshd_config.tmp&#x20;chown&#x20;root:sys&#x20;ssh_config&#x20;sshd_config&#x20;chmod&#x20;go-w&#x20;ssh_config&#x20;sshd_config','[{\"cis\": [\"1.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(25002,'Disable&#x20;Standard&#x20;Services.','The&#x20;stock&#x20;/etc/inetd.conf&#x20;file&#x20;shipped&#x20;with&#x20;HP-UX&#x20;contains&#x20;many&#x20;services&#x20;which&#x20;are&#x20;rarely&#x20;used,&#x20;or&#x20;which&#x20;have&#x20;more&#x20;secure&#x20;alternatives.&#x20;Indeed,&#x20;after&#x20;enabling&#x20;SSH&#x20;&#40;see&#x20;item&#x20;1.1.2&#41;&#x20;it&#x20;may&#x20;be&#x20;possible&#x20;to&#x20;completely&#x20;do&#x20;away&#x20;with&#x20;all&#x20;inetd-based&#x20;services,&#x20;since&#x20;SSH&#x20;provides&#x20;both&#x20;a&#x20;secure&#x20;login&#x20;mechanism&#x20;and&#x20;a&#x20;means&#x20;of&#x20;transferring&#x20;files&#x20;to&#x20;and&#x20;from&#x20;the&#x20;system.&#x20;The&#x20;steps&#x20;articulated&#x20;in&#x20;the&#x20;Remediation&#x20;section&#x20;will&#x20;disable&#x20;all&#x20;services&#x20;normally&#x20;enabled&#x20;in&#x20;the&#x20;HP-UX&#x20;inetd.conf&#x20;file.&#x20;The&#x20;rest&#x20;of&#x20;the&#x20;actions&#x20;in&#x20;this&#x20;section&#x20;give&#x20;the&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;re-enabling&#x20;certain&#x20;services&mdash;in&#x20;particular,&#x20;the&#x20;services&#x20;that&#x20;are&#x20;disabled&#x20;in&#x20;the&#x20;last&#x20;two&#x20;loops&#x20;in&#x20;the&#x20;Action&#x20;section&#x20;below.','The&#x20;stock&#x20;/etc/inetd.conf&#x20;file&#x20;shipped&#x20;with&#x20;HP-UX&#x20;contains&#x20;services&#x20;that&#x20;are&#x20;rarely&#x20;used&#x20;or&#x20;have&#x20;more&#x20;secure&#x20;alternatives.&#x20;Removing&#x20;these&#x20;from&#x20;inetd&#x20;will&#x20;avoid&#x20;exposure&#x20;to&#x20;possible&#x20;security&#x20;vulnerability&#x20;in&#x20;those&#x20;services.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;standard&#x20;inetd-based&#x20;services:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/etc&#x20;directory&#x20;2.&#x20;Open&#x20;inetd.conf&#x20;3.&#x20;Disable&#x20;the&#x20;following&#x20;services&#x20;by&#x20;adding&#x20;a&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;to&#x20;the&#x20;beginning&#x20;of&#x20;its&#x20;definition:&#x20;a.&#x20;echo&#x20;b.&#x20;discard&#x20;c.&#x20;daytime&#x20;d.&#x20;chargen&#x20;e.&#x20;dtspc&#x20;f.&#x20;exec&#x20;g.&#x20;ntalk&#x20;h.&#x20;finger&#x20;i.&#x20;uucp&#x20;j.&#x20;ident&#x20;k.&#x20;auth&#x20;l.&#x20;instl_boots&#x20;m.&#x20;registrar&#x20;n.&#x20;recserv&#x20;o.&#x20;rpc.rstatd&#x20;p.&#x20;rpc.rusersd&#x20;q.&#x20;rpc.rwalld&#x20;r.&#x20;rpc.sprayd&#x20;s.&#x20;rpc.cmsd&#x20;t.&#x20;kcms_server&#x20;u.&#x20;printer&#x20;v.&#x20;shell&#x20;w.&#x20;login&#x20;h.&#x20;finger&#x20;x.&#x20;telnet&#x20;y.&#x20;ftp&#x20;z.&#x20;tftp&#x20;aa.&#x20;bootps&#x20;bb.&#x20;kshell&#x20;cc.&#x20;klogin&#x20;dd.&#x20;rpc.rquotad&#x20;ee.&#x20;rpc.ttdbserver&#x20;4.&#x20;Save&#x20;inetd.conf.&#x20;5.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;inetd.conf.&#x20;6.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;inetd.conf.&#x20;7.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;inetd.conf&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;8.&#x20;Remove&#x20;the&#x20;executable&#x20;and&#x20;sticky&#x20;bit&#x20;from&#x20;inetd.conf.&#x20;9.&#x20;Invoke&#x20;inetd&#x20;to&#x20;reread&#x20;it&#039;s&#x20;config&#x20;file:&#x20;inetd&#x20;-c&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;cd&#x20;/etc&#x20;for&#x20;svc&#x20;in&#x20;echo&#x20;discard&#x20;daytime&#x20;chargen&#x20;dtspc&#x20;&#x20;exec&#x20;ntalk&#x20;finger&#x20;uucp&#x20;ident&#x20;auth&#x20;&#x20;instl_boots&#x20;registrar&#x20;recserv;&#x20;do&#x20;awk&#x20;&quot;&#40;$1&#x20;==&#x20;&quot;$svc&quot;&#41;&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{print}&quot;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;for&#x20;svc&#x20;in&#x20;rpc.rstatd&#x20;rpc.rusersd&#x20;rpc.rwalld&#x20;&#x20;rpc.sprayd&#x20;rpc.cmsd&#x20;kcms_server;&#x20;do&#x20;awk&#x20;&quot;/&#92;/$svc/&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{&#x20;print&#x20;}&quot;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;for&#x20;svc&#x20;in&#x20;printer&#x20;shell&#x20;login&#x20;telnet&#x20;ftp&#x20;tftp&#x20;&#x20;bootps&#x20;kshell&#x20;klogin;&#x20;do&#x20;awk&#x20;&quot;&#40;$1&#x20;==&#x20;&quot;$svc&quot;&#41;&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{print}&quot;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;for&#x20;svc&#x20;in&#x20;rpc.rquotad&#x20;rpc.ttdbserver;&#x20;do&#x20;awk&#x20;&quot;/^$svc&#92;//&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{&#x20;print&#x20;}&quot;&#x20;&#x20;/etc/inetd.conf&#x20;&gt;&#x20;/etc/inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;chown&#x20;root:sys&#x20;inetd.conf&#x20;chmod&#x20;go-w,a-xs&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new&#x20;inetd&#x20;-c','[{\"cis\": [\"1.2.1\"]}, {\"cis_level\": [\"1\"]}]'),(25003,'Only&#x20;enable&#x20;telnet&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;telnet.&#x20;Telnet&#x20;uses&#x20;an&#x20;unencrypted&#x20;network&#x20;protocol,&#x20;which&#x20;means&#x20;data&#x20;from&#x20;the&#x20;login&#x20;session&#x20;&#40;such&#x20;as&#x20;passwords&#x20;and&#x20;all&#x20;other&#x20;data&#x20;transmitted&#x20;during&#x20;the&#x20;session&#41;&#x20;can&#x20;be&#x20;stolen&#x20;by&#x20;eavesdroppers&#x20;on&#x20;the&#x20;network,&#x20;and&#x20;also&#x20;that&#x20;the&#x20;session&#x20;can&#x20;be&#x20;hijacked&#x20;by&#x20;outsiders&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;remote&#x20;system.&#x20;HP-UX&#x20;Secure&#x20;Shell&#x20;&#40;OpenSSH&#41;&#x20;provides&#x20;an&#x20;encrypted&#x20;alternative&#x20;to&#x20;telnet&#x20;&#40;and&#x20;other&#x20;utilities&#41;&#x20;and&#x20;should&#x20;be&#x20;used&#x20;instead.','There&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;that&#x20;requires&#x20;users&#x20;to&#x20;access&#x20;the&#x20;system&#x20;via&#x20;telnet&#x20;instead&#x20;of&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;protocol.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;telnet:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;telnet&#x20;service&#x20;definition.&#x20;3.&#x20;Add&#x20;-b&#x20;/etc/issue&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;telnet&#x20;service&#x20;definition.&#x20;This&#x20;will&#x20;cause&#x20;telnet&#x20;to&#x20;display&#x20;the&#x20;contents&#x20;of&#x20;/etc/issue&#x20;to&#x20;users&#x20;attempting&#x20;to&#x20;access&#x20;the&#x20;system&#x20;via&#x20;telnet.&#x20;4.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;/^#telnet/&#x20;{&#x20;$1&#x20;=&#x20;&quot;telnet&quot;&#x20;print&#x20;$0&#x20;&quot;&#x20;-b&#x20;/etc/issue&quot;;&#x20;next}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;/etc/inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.2\"]}]'),(25004,'Only&#x20;enable&#x20;FTP&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;ftp.&#x20;Like&#x20;telnet,&#x20;the&#x20;FTP&#x20;protocol&#x20;is&#x20;unencrypted,&#x20;which&#x20;means&#x20;passwords&#x20;and&#x20;other&#x20;data&#x20;transmitted&#x20;during&#x20;the&#x20;session&#x20;can&#x20;be&#x20;captured&#x20;by&#x20;sniffing&#x20;the&#x20;network,&#x20;and&#x20;that&#x20;the&#x20;FTP&#x20;session&#x20;itself&#x20;can&#x20;be&#x20;hijacked&#x20;by&#x20;an&#x20;external&#x20;attacker.&#x20;SSH&#x20;provides&#x20;two&#x20;alternative,&#x20;encrypted&#x20;file&#x20;transfer&#x20;mechanisms,&#x20;scp&#x20;and&#x20;sftp,&#x20;which&#x20;should&#x20;be&#x20;used&#x20;instead&#x20;of&#x20;FTP.&#x20;Even&#x20;if&#x20;FTP&#x20;is&#x20;required&#x20;because&#x20;the&#x20;local&#x20;system&#x20;is&#x20;an&#x20;anonymous&#x20;FTP&#x20;server,&#x20;consider&#x20;requiring&#x20;authenticated&#x20;users&#x20;on&#x20;the&#x20;system&#x20;to&#x20;transfer&#x20;files&#x20;via&#x20;SSH-based&#x20;protocols.&#x20;For&#x20;further&#x20;information&#x20;on&#x20;restricting&#x20;FTP&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;see&#x20;item&#x20;1.6.2&#x20;below.&#x20;Sites&#x20;may&#x20;also&#x20;consider&#x20;augmenting&#x20;the&#x20;&#039;ftpd&#x20;-l&#039;&#x20;below&#x20;with&#x20;&#039;-v&#039;&#x20;&#40;10.x&#x20;and&#x20;11.x&#41;&#x20;or&#x20;&#039;-L&#039;&#x20;&#40;11.x&#x20;only&#41;&#x20;for&#x20;additional&#x20;logging&#x20;of&#x20;FTP&#x20;transactions,&#x20;or&#x20;with&#x20;&#039;-a&#039;&#x20;&#40;11.x&#x20;only&#41;&#x20;for&#x20;fine&#x20;grain&#x20;FTP&#x20;access&#x20;control&#x20;through&#x20;the&#x20;use&#x20;of&#x20;a&#x20;configuration&#x20;file&#x20;-&#x20;see&#x20;the&#x20;ftpd&#40;1M&#41;&#x20;man&#x20;page&#x20;on&#x20;your&#x20;systems&#x20;for&#x20;details.','This&#x20;machine&#x20;serves&#x20;as&#x20;an&#x20;&#40;anonymous&#41;&#x20;FTP&#x20;server&#x20;or&#x20;other&#x20;mission-critical&#x20;role&#x20;where&#x20;data&#x20;must&#x20;be&#x20;transferred&#x20;via&#x20;FTP&#x20;instead&#x20;of&#x20;the&#x20;more&#x20;secure&#x20;alternatives.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;FTP:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;ftp&#x20;service&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;&#x20;/^#ftp/&#x20;{&#x20;$1&#x20;=&#x20;&quot;ftp&quot;;&#x20;print&#x20;$0;&#x20;next}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.3\"]}]'),(25005,'Only&#x20;enable&#x20;rlogin/remsh/rcp&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;rlogin/remsh/rcp.&#x20;SSH&#x20;was&#x20;designed&#x20;to&#x20;be&#x20;a&#x20;drop-in&#x20;replacement&#x20;for&#x20;these&#x20;protocols.&#x20;Given&#x20;the&#x20;wide&#x20;availability&#x20;of&#x20;free&#x20;SSH&#x20;implementations,&#x20;there&#x20;are&#x20;few&#x20;cases&#x20;where&#x20;these&#x20;tools&#x20;cannot&#x20;be&#x20;replaced&#x20;with&#x20;SSH&#x20;&#40;again,&#x20;see&#x20;item&#x20;1.2.1&#x20;-&#x20;Install&#x20;SSH&#41;.','There&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;to&#x20;use&#x20;rlogin/remsh/rcp&#x20;instead&#x20;of&#x20;the&#x20;more&#x20;secure&#x20;ssh/scp.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;rlogin/remsh/rcp:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;shell&#x20;and&#x20;login&#x20;service&#x20;definitions.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#shell/shell/;&#x20;s/^#login/login/&#039;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.4\"]}]'),(25006,'Only&#x20;enable&#x20;TFTP&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;TFTP.&#x20;TFTP&#x20;is&#x20;typically&#x20;used&#x20;for&#x20;network&#x20;booting&#x20;of&#x20;diskless&#x20;workstations,&#x20;X-terminals,&#x20;and&#x20;other&#x20;similar&#x20;devices.&#x20;TFTP&#x20;is&#x20;also&#x20;used&#x20;during&#x20;network&#x20;installs&#x20;of&#x20;systems&#x20;via&#x20;the&#x20;HP-UX&#x20;Ignite&#x20;facility.&#x20;Routers&#x20;and&#x20;other&#x20;network&#x20;devices&#x20;may&#x20;copy&#x20;configuration&#x20;data&#x20;to&#x20;remote&#x20;systems&#x20;via&#x20;TFTP&#x20;for&#x20;backup.','This&#x20;system&#x20;serves&#x20;as&#x20;a&#x20;boot&#x20;server&#x20;or&#x20;has&#x20;other&#x20;mission-critical&#x20;roles&#x20;where&#x20;data&#x20;must&#x20;be&#x20;transferred&#x20;to&#x20;and&#x20;from&#x20;this&#x20;system&#x20;via&#x20;TFTP.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;TFTP:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;tftp&#x20;service&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#tftp/tftp/&#039;&#x20;inetd.conf&#x20;&gt;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new&#x20;mkdir&#x20;-p&#x20;/var/opt/ignite','[{\"cis\": [\"1.2.5\"]}]'),(25007,'Only&#x20;enable&#x20;printer&#x20;service&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;rlpdaemon&#x20;based&#x20;printer&#x20;service.&#x20;rlpdaemon&#x20;provides&#x20;a&#x20;BSD-compatible&#x20;print&#x20;server&#x20;interface.&#x20;Even&#x20;machines&#x20;that&#x20;are&#x20;print&#x20;servers&#x20;may&#x20;wish&#x20;to&#x20;leave&#x20;this&#x20;service&#x20;disabled&#x20;if&#x20;they&#x20;do&#x20;not&#x20;need&#x20;to&#x20;support&#x20;BSD-style&#x20;printing.','This&#x20;machine&#x20;a&#x20;print&#x20;server&#x20;for&#x20;your&#x20;network.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;the&#x20;rlpdaemon&#x20;based&#x20;printer&#x20;service:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;printer&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;&#x20;sed&#x20;&#039;s/^#printer/printer/&#039;&#x20;inetd.conf&#x20;&gt;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.6\"]}]'),(25008,'Only&#x20;enable&#x20;rquotad&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;rquotad.&#x20;rquotad&#x20;allows&#x20;NFS&#x20;clients&#x20;to&#x20;enforce&#x20;disk&#x20;quotas&#x20;on&#x20;file&#x20;systems&#x20;that&#x20;are&#x20;mounted&#x20;from&#x20;the&#x20;local&#x20;system.&#x20;If&#x20;your&#x20;site&#x20;does&#x20;not&#x20;use&#x20;disk&#x20;quotas,&#x20;then&#x20;you&#x20;may&#x20;leave&#x20;the&#x20;rquotad&#x20;service&#x20;disabled.','This&#x20;system&#x20;an&#x20;NFS&#x20;file&#x20;server&#x20;that&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;disk&#x20;quotas.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;rquotad:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;rquotad&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;&#x20;$6&#x20;~&#x20;//rpc.rquotad$/&#x20;{&#x20;sub&#40;/^#/,&#x20;&quot;&quot;&#41;&#x20;}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.7\"]}]'),(25009,'Only&#x20;enable&#x20;CDE-related&#x20;daemons&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;CDE-related&#x20;daemons.&#x20;The&#x20;rpc.ttdbserver&#x20;service&#x20;supports&#x20;HP&#039;s&#x20;CDE&#x20;windowing&#x20;environment.&#x20;This&#x20;service&#x20;has&#x20;a&#x20;history&#x20;of&#x20;security&#x20;problems.&#x20;Not&#x20;only&#x20;is&#x20;it&#x20;vital&#x20;to&#x20;keep&#x20;up&#x20;to&#x20;date&#x20;on&#x20;vendor&#x20;patches,&#x20;but&#x20;also&#x20;never&#x20;enable&#x20;this&#x20;service&#x20;on&#x20;any&#x20;system&#x20;which&#x20;is&#x20;not&#x20;well&#x20;protected&#x20;by&#x20;a&#x20;complete&#x20;network&#x20;security&#x20;infrastructure&#x20;&#40;including&#x20;network&#x20;and&#x20;host-based&#x20;firewalls,&#x20;packet&#x20;filters,&#x20;and&#x20;intrusion&#x20;detection&#x20;infrastructure&#41;.&#x20;Note&#x20;that&#x20;since&#x20;this&#x20;service&#x20;uses&#x20;ONC&#x20;RPC&#x20;mechanisms,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;system&#039;s&#x20;RPC&#x20;portmapper&#x20;&#40;rpcbind&#41;&#x20;also&#x20;be&#x20;enabled&#x20;when&#x20;this&#x20;service&#x20;is&#x20;turned&#x20;on.','There&#x20;a&#x20;mission-critical&#x20;reason&#x20;to&#x20;run&#x20;a&#x20;CDE&#x20;GUI&#x20;on&#x20;this&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;CDE-related&#x20;daemons:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;rpc.ttdbserver&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;&#x20;$6&#x20;~&#x20;//rpc.ttdbserver$/&#x20;{&#x20;sub&#40;/^#/,&#x20;&quot;&quot;&#41;&#x20;}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.8\"]}]'),(25010,'Only&#x20;enable&#x20;Kerberos-related&#x20;daemons&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;Kerberos-related&#x20;daemons.&#x20;Kerberized&#x20;rlogin/remsh&#x20;offers&#x20;a&#x20;higher&#x20;degree&#x20;of&#x20;security&#x20;than&#x20;traditional&#x20;rlogin,&#x20;remsh,&#x20;or&#x20;telnet&#x20;by&#x20;eliminating&#x20;many&#x20;clear-text&#x20;password&#x20;exchanges&#x20;from&#x20;the&#x20;network.&#x20;However&#x20;it&#x20;is&#x20;still&#x20;not&#x20;as&#x20;secure&#x20;as&#x20;SSH,&#x20;which&#x20;encrypts&#x20;all&#x20;traffic.&#x20;Given&#x20;the&#x20;wide&#x20;availability&#x20;of&#x20;free&#x20;SSH&#x20;implementations,&#x20;there&#x20;are&#x20;few&#x20;cases&#x20;where&#x20;these&#x20;tools&#x20;cannot&#x20;be&#x20;replaced&#x20;with&#x20;SSH.','The&#x20;Kerberos&#x20;security&#x20;system&#x20;is&#x20;in&#x20;use&#x20;at&#x20;this&#x20;site&#x20;and&#x20;there&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;that&#x20;requires&#x20;users&#x20;to&#x20;access&#x20;this&#x20;system&#x20;via&#x20;Kerberized&#x20;rlogin/remsh,&#x20;rather&#x20;than&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;protocol.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;Kerberos-related&#x20;daemons:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;klogin&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#kshell/kshell/;&#x20;s/^#klogin/klogin/&#039;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.9\"]}]'),(25011,'Only&#x20;enable&#x20;BOOTP/DHCP&#x20;daemon&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;BOOTP/DHCP&#x20;services.&#x20;BOOTP/DHCP&#x20;is&#x20;a&#x20;popular&#x20;protocol&#x20;for&#x20;dynamically&#x20;assigning&#x20;IP&#x20;addresses&#x20;and&#x20;other&#x20;network&#x20;information&#x20;to&#x20;systems&#x20;on&#x20;the&#x20;network&#x20;&#40;rather&#x20;than&#x20;having&#x20;administrators&#x20;manually&#x20;manage&#x20;this&#x20;information&#x20;on&#x20;each&#x20;host&#41;.&#x20;However,&#x20;if&#x20;this&#x20;system&#x20;is&#x20;not&#x20;a&#x20;BOOTP/DHCP&#x20;server&#x20;for&#x20;the&#x20;network,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;be&#x20;running&#x20;this&#x20;service.','This&#x20;server&#x20;a&#x20;BOOTP/DHCP&#x20;server&#x20;for&#x20;the&#x20;network.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;BOOTP/DHCP&#x20;services:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;bootps&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#bootps/bootps/&#039;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf','[{\"cis\": [\"1.2.10\"]}]'),(25012,'Disable&#x20;login:&#x20;prompts&#x20;on&#x20;serial&#x20;ports.','Disable&#x20;the&#x20;login:&#x20;prompt&#x20;on&#x20;the&#x20;system&#x20;serial&#x20;devices&#x20;to&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;attach&#x20;modems,&#x20;terminals,&#x20;and&#x20;other&#x20;remote&#x20;access&#x20;devices&#x20;to&#x20;these&#x20;ports.','If&#x20;there&#x20;is&#x20;not&#x20;a&#x20;mission-critical&#x20;need&#x20;to&#x20;provide&#x20;login&#x20;capability&#x20;from&#x20;any&#x20;serial&#x20;ports&#x20;&#40;such&#x20;as&#x20;for&#x20;a&#x20;modem&#41;&#x20;then&#x20;disabling&#x20;the&#x20;login:&#x20;prompt&#x20;on&#x20;the&#x20;system&#x20;serial&#x20;devices&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;via&#x20;these&#x20;ports.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;login:&#x20;prompt&#x20;on&#x20;the&#x20;system&#x20;serial&#x20;devices:&#x20;1.&#x20;Open&#x20;/etc/inittab.&#x20;2.&#x20;Disable&#x20;each&#x20;getty&#x20;instance&#x20;associated&#x20;with&#x20;a&#x20;tty&#x20;device&#x20;by&#x20;adding&#x20;a&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;to&#x20;the&#x20;beginning&#x20;of&#x20;the&#x20;line.&#x20;3.&#x20;Save&#x20;/etc/inittab.*&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;cp&#x20;-p&#x20;/etc/inittab&#x20;/etc/inittab.tmp&#x20;sed&#x20;&#039;s/^[^#].*getty.*tty.*$/#&amp;/&#039;&#x20;&#x20;/etc/inittab.tmp&#x20;&#x20;&gt;&#x20;/etc/inittab&#x20;rm&#x20;-f&#x20;/etc/inittab.tmp&#x20;-&#x20;Note&#x20;that&#x20;this&#x20;action&#x20;may&#x20;safely&#x20;be&#x20;performed&#x20;even&#x20;if&#x20;console&#x20;access&#x20;to&#x20;the&#x20;system&#x20;is&#x20;provided&#x20;via&#x20;the&#x20;serial&#x20;ports,&#x20;as&#x20;the&#x20;line&#x20;in&#x20;the&#x20;/etc/inittab&#x20;file&#x20;that&#x20;corresponds&#x20;to&#x20;the&#x20;console&#x20;does&#x20;not&#x20;match&#x20;the&#x20;supplied&#x20;pattern&#x20;&#40;i.e.,&#x20;it&#x20;doesn&#039;t&#x20;contain&#x20;the&#x20;string&#x20;&#039;tty&#039;&#41;.&#x20;-&#x20;Note&#x20;that&#x20;when&#x20;serial&#x20;port&#x20;connectivity&#x20;is&#x20;needed,&#x20;/etc/dialups&#x20;and&#x20;/etc/d_passwd&#x20;can&#x20;be&#x20;set&#x20;to&#x20;require&#x20;an&#x20;extra&#x20;password&#x20;for&#x20;serial&#x20;port&#x20;access.&#x20;See&#x20;the&#x20;dialups&#40;4&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;-&#x20;Note&#x20;that&#x20;by&#x20;default&#x20;in&#x20;HP-UX&#x20;11i,&#x20;only&#x20;the&#x20;console&#x20;has&#x20;a&#x20;getty&#x20;instance&#x20;running&#x20;on&#x20;it.','[{\"cis\": [\"1.3.1\"]}, {\"cis_level\": [\"1\"]}]'),(25013,'Disable&#x20;NIS/NIS+&#x20;related&#x20;processes,&#x20;if&#x20;possible.','Disable&#x20;NIS/NIS+&#x20;related&#x20;processes.&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;is&#x20;a&#x20;distributed&#x20;database&#x20;providing&#x20;centralized&#x20;control&#x20;of&#x20;names,&#x20;addresses,&#x20;services,&#x20;and&#x20;key&#x20;configuration&#x20;files&#x20;throughout&#x20;a&#x20;network&#x20;of&#x20;servers&#x20;and&#x20;clients.&#x20;NIS&#x20;was&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#x20;&#40;YP&#41;.&#x20;NIS+&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;NIS&#x20;services,&#x20;and&#x20;is&#x20;more&#x20;scalable,&#x20;flexible,&#x20;and&#x20;secure.&#x20;It&#x20;adds&#x20;a&#x20;security&#x20;system&#x20;with&#x20;authentication&#x20;and&#x20;authorization&#x20;services&#x20;to&#x20;validate&#x20;users&#x20;on&#x20;the&#x20;network&#x20;and&#x20;to&#x20;determine&#x20;if&#x20;they&#x20;allowed&#x20;to&#x20;access&#x20;or&#x20;modify&#x20;the&#x20;information&#x20;requested.&#x20;However,&#x20;both&#x20;systems&#x20;have&#x20;known&#x20;security&#x20;vulnerabilities,&#x20;and&#x20;have&#x20;been&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;security&#x20;attacks.','Eliminate&#x20;exposure&#x20;to&#x20;NIS/NIS+&#x20;vulnerabilities&#x20;by&#x20;not&#x20;running&#x20;related&#x20;daemons&#x20;on&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;NIS/NIS+&#x20;servers&#x20;or&#x20;clients.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;startup&#x20;of&#x20;NIS/NIS+&#x20;related&#x20;processes:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NIS_MASTER_SERVER=0&#x20;-p&#x20;NIS_SLAVE_SERVER=0&#x20;&#x20;-p&#x20;NIS_CLIENT=0&#x20;-p&#x20;NISPLUS_SERVER=0&#x20;&#x20;-p&#x20;NISPLUS_CLIENT=0&#x20;/etc/rc.config.d/namesvrs','[{\"cis\": [\"1.3.2\"]}, {\"cis_level\": [\"1\"]}]'),(25014,'Disable&#x20;printer&#x20;daemons,&#x20;if&#x20;possible.','Disable&#x20;printer&#x20;daemons.&#x20;The&#x20;Technical&#x20;Print&#x20;Service&#x20;&#40;TPS&#41;&#x20;is&#x20;a&#x20;printer&#x20;service&#x20;used&#x20;in&#x20;the&#x20;X-Windows&#x20;and/or&#x20;CDE&#x20;environment.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;if&#x20;the&#x20;hosting&#x20;system&#x20;does&#x20;not&#x20;participate&#x20;in&#x20;print&#x20;services&#x20;The&#x20;administrator&#x20;may&#x20;wish&#x20;to&#x20;consider&#x20;converting&#x20;to&#x20;the&#x20;LPRng&#x20;print&#x20;system&#x20;&#40;see&#x20;http://www.lprng.org/&#41;&#x20;which&#x20;was&#x20;designed&#x20;with&#x20;security&#x20;in&#x20;mind&#x20;and&#x20;is&#x20;widely&#x20;portable&#x20;across&#x20;many&#x20;different&#x20;Unix&#x20;platforms.&#x20;Note,&#x20;however,&#x20;that&#x20;LPRng&#x20;is&#x20;not&#x20;supported&#x20;by&#x20;Hewlett-Packard.','Disabling&#x20;unused&#x20;services,&#x20;such&#x20;as&#x20;TPS,&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;and&#x20;local&#x20;attack&#x20;surfaces&#x20;of&#x20;the&#x20;hosting&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;printer&#x20;daemons:&#x20;1.&#x20;Set&#x20;the&#x20;LP&#x20;parameter&#x20;to&#x20;zero&#x20;in&#x20;the&#x20;lp&#x20;system&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/lp&#x20;2.&#x20;Set&#x20;the&#x20;XPRINTSERVERS&#x20;parameter&#x20;to&#x20;an&#x20;empty&#x20;string&#x20;in&#x20;the&#x20;tps&#x20;system&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/tps&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;&#x20;ch_rc&#x20;-a&#x20;-p&#x20;XPRINTSERVERS=&quot;&#039;&#039;&quot;&#x20;/etc/rc.config.d/tps&#x20;ch_rc&#x20;-a&#x20;-p&#x20;LP=0&#x20;/etc/rc.config.d/lp','[{\"cis\": [\"1.3.3\"]}, {\"cis_level\": [\"1\"]}]'),(25015,'Disable&#x20;the&#x20;CDE&#x20;GUI&#x20;login,&#x20;if&#x20;possible.','CDE&#x20;stands&#x20;for&#x20;&#039;Common&#x20;Desktop&#x20;Environment,&#039;&#x20;and&#x20;is&#x20;an&#x20;environment&#x20;for&#x20;logging&#x20;on&#x20;to&#x20;and&#x20;interacting&#x20;with&#x20;your&#x20;system&#x20;via&#x20;an&#x20;X-windows&#x20;type&#x20;GUI&#x20;interface&#x20;from&#x20;the&#x20;console.&#x20;Intended&#x20;for&#x20;use&#x20;with&#x20;workstation&#x20;or&#x20;desktop&#x20;systems,&#x20;this&#x20;service&#x20;is&#x20;not&#x20;commonly&#x20;used&#x20;with&#x20;the&#x20;server-class&#x20;systems&#x20;or&#x20;in&#x20;large&#x20;enterprise&#x20;environments.&#x20;The&#x20;X&#x20;Windows-based&#x20;CDE&#x20;GUI&#x20;services&#x20;were&#x20;developed&#x20;with&#x20;a&#x20;different&#x20;set&#x20;of&#x20;security&#x20;expecations&#x20;from&#x20;those&#x20;expected&#x20;in&#x20;many&#x20;enterprise&#x20;deployments,&#x20;and&#x20;have&#x20;had&#x20;a&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;mission-critical&#x20;need&#x20;for&#x20;a&#x20;CDE&#x20;GUI&#x20;login&#x20;to&#x20;the&#x20;system,&#x20;this&#x20;service&#x20;should&#x20;not&#x20;be&#x20;run&#x20;to&#x20;further&#x20;reduce&#x20;opportunities&#x20;for&#x20;security&#x20;attacks.','The&#x20;X&#x20;Windows-based&#x20;CDE&#x20;GUI&#x20;on&#x20;HP-UX&#x20;systems&#x20;has&#x20;had&#x20;a&#x20;history&#x20;of&#x20;security&#x20;issues,&#x20;and&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;unused.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;GUI&#x20;login:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;DESKTOP=&quot;&quot;&#x20;/etc/rc.config.d/desktop','[{\"cis\": [\"1.3.4\"]}, {\"cis_level\": [\"1\"]}]'),(25016,'Disable&#x20;email&#x20;server,&#x20;if&#x20;possible.','Disable&#x20;the&#x20;sendmail&#x20;daemon&#x20;to&#x20;avoid&#x20;processing&#x20;incoming&#x20;email.&#x20;It&#x20;is&#x20;possible&#x20;to&#x20;run&#x20;a&#x20;Unix&#x20;system&#x20;with&#x20;the&#x20;Sendmail&#x20;daemon&#x20;disabled&#x20;and&#x20;still&#x20;allow&#x20;users&#x20;on&#x20;that&#x20;system&#x20;to&#x20;send&#x20;email&#x20;out&#x20;from&#x20;that&#x20;machine.&#x20;Running&#x20;Sendmail&#x20;in&#x20;&#039;daemon&#x20;mode&#039;&#x20;&#40;with&#x20;the&#x20;-bd&#x20;command-line&#x20;option&#41;&#x20;is&#x20;only&#x20;required&#x20;on&#x20;machines&#x20;that&#x20;act&#x20;as&#x20;mail&#x20;servers,&#x20;receiving&#x20;and&#x20;processing&#x20;email&#x20;from&#x20;other&#x20;hosts&#x20;on&#x20;the&#x20;network.&#x20;The&#x20;remediation&#x20;below&#x20;will&#x20;result&#x20;in&#x20;a&#x20;machine&#x20;that&#x20;can&#x20;send&#x20;email&#x20;but&#x20;not&#x20;receive&#x20;it.&#x20;-&#x20;Note&#x20;that&#x20;after&#x20;disabling&#x20;the&#x20;-bd&#x20;option&#x20;on&#x20;the&#x20;local&#x20;mail&#x20;server&#x20;on&#x20;systems&#x20;running&#x20;Sendmail&#x20;v8.12&#x20;or&#x20;later&#x20;&#40;8.13&#x20;is&#x20;currently&#x20;shipped&#x20;as&#x20;part&#x20;of&#x20;HP-UX&#x20;11iv3&#41;,&#x20;it&#x20;is&#x20;also&#x20;necessary&#x20;to&#x20;modify&#x20;the&#x20;/etc/mail/submit.cf&#x20;file.&#x20;Find&#x20;the&#x20;line&#x20;that&#x20;reads&#x20;&#039;D{MTAHost}localhost&#039;&#x20;and&#x20;change&#x20;localhost&#x20;to&#x20;the&#x20;name&#x20;of&#x20;some&#x20;other&#x20;local&#x20;mail&#x20;server&#x20;for&#x20;the&#x20;organization.&#x20;This&#x20;will&#x20;cause&#x20;email&#x20;generated&#x20;on&#x20;the&#x20;local&#x20;system&#x20;to&#x20;be&#x20;relayed&#x20;to&#x20;that&#x20;mail&#x20;server&#x20;for&#x20;further&#x20;processing&#x20;and&#x20;delivery.&#x20;-&#x20;Note&#x20;that&#x20;if&#x20;the&#x20;system&#x20;is&#x20;an&#x20;email&#x20;server,&#x20;the&#x20;administrator&#x20;is&#x20;encouraged&#x20;to&#x20;search&#x20;the&#x20;Web&#x20;for&#x20;additional&#x20;documentation&#x20;on&#x20;Sendmail&#x20;security&#x20;issues.','Avoid&#x20;potential&#x20;vulnerabilities&#x20;in&#x20;the&#x20;sendmail&#x20;server&#x20;if&#x20;incoming&#x20;email&#x20;service&#x20;is&#x20;not&#x20;used.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;sendmail&#x20;server:&#x20;1.&#x20;Set&#x20;the&#x20;SENDMAIL_SERVER&#x20;parameter&#x20;to&#x20;zero&#x20;in&#x20;the&#x20;mailservs&#x20;system&#x20;configuration&#x20;file.&#x20;2.&#x20;Setup&#x20;a&#x20;cron&#x20;job&#x20;to&#x20;run&#x20;sendmail&#x20;at&#x20;regular&#x20;intervals&#x20;&#40;e.g.&#x20;every&#x20;hour&#41;&#x20;in&#x20;order&#x20;to&#x20;process&#x20;queued,&#x20;outgoing&#x20;mail.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SENDMAIL_SERVER=0&#x20;/etc/rc.config.d/mailservs&#x20;cd&#x20;/var/spool/cron/crontabs&#x20;crontab&#x20;-l&#x20;&gt;root.tmp&#x20;echo&#x20;&#039;0&#x20;*&#x20;*&#x20;*&#x20;*&#x20;/usr/lib/sendmail&#x20;-q&#039;&#x20;&gt;&gt;root.tmp&#x20;crontab&#x20;root.tmp&#x20;rm&#x20;-f&#x20;root.tmp','[{\"cis\": [\"1.3.5\"]}, {\"cis_level\": [\"1\"]}]'),(25017,'Disable&#x20;SNMP&#x20;and&#x20;OpenView&#x20;Agents,&#x20;if&#x20;remote&#x20;management&#x20;or&#x20;monitoring&#x20;are&#x20;not&#x20;needed.','Disable&#x20;SNMP&#x20;and&#x20;OpenView&#x20;agents&#x20;if&#x20;they&#x20;are&#x20;not&#x20;needed.&#x20;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;to&#x20;change&#x20;the&#x20;default&#x20;SNMP&#x20;community&#x20;string&#x20;by&#x20;modifying&#x20;the&#x20;get-community&#x20;and&#x20;set-community&#x20;parameters&#x20;in&#x20;the&#x20;SNMP&#x20;configuration&#x20;file&#x20;/etc/SnmpAgent.d/snmpd.conf.','If&#x20;SNMP&#x20;and&#x20;OpenView&#x20;agents&#x20;are&#x20;not&#x20;needed,&#x20;avoid&#x20;potential&#x20;security&#x20;vulnerabilities&#x20;in&#x20;these&#x20;programs&#x20;by&#x20;disabling&#x20;them.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;SNMP&#x20;and&#x20;OpenView&#x20;Agents:&#x20;cd&#x20;/sbin/rc2.d&#x20;mv&#x20;-f&#x20;S570SnmpFddi&#x20;.NOS570SnmpFddi&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_HPUNIX_START=0&#x20;&#x20;/etc/rc.config.d/SnmpHpunix&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_MASTER_START=0&#x20;&#x20;/etc/rc.config.d/SnmpMaster&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_MIB2_START=0&#x20;&#x20;/etc/rc.config.d/SnmpMib2&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_TRAPDEST_START=0&#x20;&#x20;/etc/rc.config.d/SnmpTrpDst&#x20;ch_rc&#x20;-a&#x20;-p&#x20;OSPFMIB=0&#x20;&#x20;/etc/rc.config.d/netdaemons&#x20;ch_rc&#x20;-a&#x20;-p&#x20;OPCAGT=0&#x20;&#x20;/etc/rc.config.d/opcagt','[{\"cis\": [\"1.3.6\"]}, {\"cis_level\": [\"1\"]}]'),(25018,'Disable&#x20;rarely&#x20;used&#x20;standard&#x20;boot&#x20;services.','Disable&#x20;other&#x20;standard&#x20;boot&#x20;services.&#x20;Setting&#x20;these&#x20;variables&#x20;in&#x20;the&#x20;/etc/rc.config.d&#x20;configuration&#x20;files&#x20;will&#x20;effectively&#x20;disable&#x20;a&#x20;wide&#x20;variety&#x20;of&#x20;infrequently&#x20;used&#x20;subsystems.&#x20;Variables&#x20;are&#x20;merely&#x20;set&#x20;&#40;rather&#x20;than&#x20;renaming&#x20;or&#x20;removing&#x20;startup&#x20;scripts&#41;&#x20;so&#x20;that&#x20;the&#x20;local&#x20;administrator&#x20;can&#x20;easily&#x20;&quot;restore&quot;&#x20;any&#x20;of&#x20;these&#x20;services&#x20;if&#x20;they&#x20;discover&#x20;a&#x20;mission-critical&#x20;need&#x20;to&#x20;have&#x20;it.&#x20;Additionally,&#x20;HP-UX&#x20;patches&#x20;tend&#x20;to&#x20;supply&#x20;fresh&#x20;copies&#x20;of&#x20;the&#x20;startup&#x20;scripts,&#x20;so&#x20;they&#x20;may&#x20;get&#x20;inadvertently&#x20;re-&#x20;enabled,&#x20;whereas&#x20;setting&#x20;configuration&#x20;variables&#x20;usually&#x20;survives&#x20;patch&#x20;installs.&#x20;Finally,&#x20;setting&#x20;configuration&#x20;variables&#x20;is&#x20;the&#x20;method&#x20;recommended&#x20;and&#x20;supported&#x20;by&#x20;HP.&#x20;Note&#x20;that&#x20;not&#x20;all&#x20;of&#x20;the&#x20;configuration&#x20;files&#x20;listed&#x20;above&#x20;will&#x20;exist&#x20;on&#x20;all&#x20;systems&#x20;&#40;some&#x20;are&#x20;only&#x20;valid&#x20;for&#x20;certain&#x20;releases,&#x20;others&#x20;only&#x20;exist&#x20;if&#x20;certain&#x20;OEM&#x20;vendor&#x20;software&#x20;is&#x20;installed&#41;.&#x20;The&#x20;rest&#x20;of&#x20;the&#x20;actions&#x20;in&#x20;this&#x20;section&#x20;give&#x20;the&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;re-enabling&#x20;certain&#x20;services&#x20;-&#x20;in&#x20;particular,&#x20;the&#x20;services&#x20;that&#x20;are&#x20;disabled&#x20;in&#x20;the&#x20;second&#x20;block&#x20;of&#x20;the&#x20;remediation&#x20;section&#x20;below.&#x20;Rather&#x20;than&#x20;disabling&#x20;and&#x20;then&#x20;re-enabling&#x20;these&#x20;services,&#x20;experienced&#x20;administrators&#x20;may&#x20;wish&#x20;to&#x20;simply&#x20;disable&#x20;only&#x20;those&#x20;services&#x20;that&#x20;they&#x20;know&#x20;are&#x20;unnecessary&#x20;for&#x20;their&#x20;systems.&#x20;Note:&#x20;that&#x20;HP-UX&#x20;11.31&#x20;was&#x20;the&#x20;first&#x20;version&#x20;to&#x20;support&#x20;disablement&#x20;of&#x20;the&#x20;NFS&#x20;core&#x20;services.&#x20;Disablement&#x20;on&#x20;earlier&#x20;versions&#x20;is&#x20;possible&#x20;by&#x20;moving&#x20;/sbin/rc2.d/S400nfs.core&#x20;to&#x20;/sbin/rc2.d/.NOS400nfs.core,&#x20;but&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;system&#x20;instability.','Avoid&#x20;potential&#x20;security&#x20;vulnerabilities&#x20;in&#x20;infrequently&#x20;used&#x20;subsystems&#x20;by&#x20;disabling&#x20;them.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;START_SNAPLUS=0&#x20;-p&#x20;START_SNANODE=0&#x20;&#x20;-p&#x20;START_SNAINETD=0&#x20;/etc/rc.config.d/snaplus2&#x20;ch_rc&#x20;-a&#x20;-p&#x20;MROUTED=0&#x20;-p&#x20;RWHOD=0&#x20;-p&#x20;DDFA=0&#x20;&#x20;-p&#x20;START_RBOOTD=0&#x20;/etc/rc.config.d/netdaemons&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RARPD=0&#x20;-p&#x20;RDPD=0&#x20;/etc/rc.config.d/netconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PTYDAEMON_START=0&#x20;/etc/rc.config.d/ptydaemon&#x20;ch_rc&#x20;-a&#x20;-p&#x20;VTDAEMON_START=0&#x20;/etc/rc.config.d/vt&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NAMED=0&#x20;/etc/rc.config.d/namesvrs&#x20;ch_rc&#x20;-a&#x20;-p&#x20;START_I4LMD=0&#x20;/etc/rc.config.d/i4lmd&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_X_FONT_SERVER=0&#x20;/etc/rc.config.d/xfs&#x20;ch_rc&#x20;-a&#x20;-p&#x20;AUDIO_SERVER=0&#x20;/etc/rc.config.d/audio&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SLSD_DAEMON=0&#x20;/etc/rc.config.d/slsd&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_SAMBA=0&#x20;/etc/rc.config.d/samba&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_CIFSCLIENT=0&#x20;&#x20;/etc/rc.config.d/cifsclient&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_SERVER=0&#x20;&#x20;-p&#x20;NFS_CLIENT=0&#x20;/etc/rc.config.d/nfsconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_APACHE_START=0&#x20;/etc/rc.config.d/hpws_apacheconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_CORE=0&#x20;/etc/rc.config.d/nfsconf','[{\"cis\": [\"1.3.7\"]}, {\"cis_level\": [\"1\"]}]'),(25019,'Only&#x20;enable&#x20;Windows-compatibility&#x20;server&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;CIFS&#x20;Server&#x20;&#40;Samba&#41;&#x20;services.&#x20;HP-UX&#x20;11i&#x20;includes&#x20;the&#x20;popular&#x20;Open&#x20;Source&#x20;Samba&#x20;server&#x20;&#40;HP-UX&#x20;CIFS&#x20;Server&#41;&#x20;for&#x20;providing&#x20;file&#x20;and&#x20;print&#x20;services&#x20;to&#x20;Windows-based&#x20;systems.&#x20;This&#x20;allows&#x20;an&#x20;HP-UX&#x20;system&#x20;to&#x20;act&#x20;as&#x20;a&#x20;file&#x20;or&#x20;print&#x20;server&#x20;on&#x20;a&#x20;Windows&#x20;network,&#x20;and&#x20;even&#x20;act&#x20;as&#x20;a&#x20;Domain&#x20;Controller&#x20;&#40;authentication&#x20;server&#41;&#x20;to&#x20;older&#x20;Windows&#x20;operating&#x20;systems.&#x20;However,&#x20;if&#x20;this&#x20;functionality&#x20;is&#x20;not&#x20;required&#x20;by&#x20;the&#x20;site,&#x20;this&#x20;service&#x20;should&#x20;be&#x20;disabled.','This&#x20;machine&#x20;provides&#x20;authentication,&#x20;file&#x20;sharing,&#x20;or&#x20;printer&#x20;sharing&#x20;services&#x20;to&#x20;systems&#x20;running&#x20;Microsoft&#x20;Windows&#x20;operating&#x20;systems.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;CIFS&#x20;Server:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_SAMBA=1&#x20;/etc/rc.config.d/samba','[{\"cis\": [\"1.3.8\"]}]'),(25020,'Only&#x20;enable&#x20;Windows-compatibility&#x20;client&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;HP&#x20;CIFS&#x20;Client&#x20;service.','This&#x20;system&#x20;requires&#x20;access&#x20;to&#x20;file&#x20;systems&#x20;from&#x20;remote&#x20;servers&#x20;via&#x20;the&#x20;Windows&#x20;&#40;SMB&#41;&#x20;file&#x20;services.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_CIFSCLIENT=1&#x20;/etc/rc.config.d/cifsclient','[{\"cis\": [\"1.3.9\"]}]'),(25021,'Only&#x20;enable&#x20;NFS&#x20;server&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;NFS&#x20;file&#x20;service.&#x20;NFS&#x20;is&#x20;frequently&#x20;exploited&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;and&#x20;systems.&#x20;Clearly&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;run&#x20;the&#x20;NFS&#x20;server-related&#x20;daemons&#x20;on&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;NFS&#x20;servers.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;an&#x20;NFS&#x20;server,&#x20;the&#x20;admin&#x20;should&#x20;take&#x20;reasonable&#x20;precautions&#x20;when&#x20;exporting&#x20;file&#x20;systems,&#x20;including&#x20;restricting&#x20;NFS&#x20;access&#x20;to&#x20;a&#x20;specific&#x20;range&#x20;of&#x20;local&#x20;IP&#x20;addresses&#x20;and&#x20;exporting&#x20;file&#x20;systems&#x20;&quot;read-only&quot;&#x20;and&#x20;&quot;nosuid&quot;&#x20;where&#x20;appropriate.&#x20;For&#x20;more&#x20;information&#x20;consult&#x20;the&#x20;exportfs&#40;1M&#41;&#x20;manual&#x20;page.&#x20;Much&#x20;higher&#x20;levels&#x20;of&#x20;security&#x20;can&#x20;be&#x20;achieved&#x20;by&#x20;combining&#x20;NFS&#x20;with&#x20;secure&#x20;RPC&#x20;or&#x20;Kerberos,&#x20;although&#x20;there&#x20;is&#x20;significant&#x20;administrative&#x20;overhead&#x20;involved&#x20;in&#x20;this&#x20;transition.&#x20;Note&#x20;that&#x20;since&#x20;this&#x20;service&#x20;uses&#x20;ONC&#x20;RPC&#x20;mechanisms,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;system&#039;s&#x20;RPC&#x20;portmapper&#x20;&#40;rpcbind&#41;&#x20;also&#x20;be&#x20;enabled&#x20;when&#x20;this&#x20;service&#x20;is&#x20;turned&#x20;on.&#x20;For&#x20;more&#x20;information&#x20;see&#x20;Item&#x20;1.3.12&#x20;below.&#x20;Also,&#x20;note&#x20;that&#x20;some&#x20;releases&#x20;of&#x20;Oracle&#x20;software&#x20;for&#x20;HP-UX&#x20;require&#x20;NFS&#x20;services&#x20;in&#x20;order&#x20;to&#x20;install&#x20;properly.&#x20;Therefore,&#x20;the&#x20;NFS&#x20;server&#x20;process&#x20;may&#x20;need&#x20;to&#x20;be&#x20;started&#x20;by&#x20;hand&#x20;on&#x20;systems&#x20;on&#x20;which&#x20;Oracle&#x20;software&#x20;is&#x20;to&#x20;be&#x20;installed/updated.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;performing&#x20;the&#x20;following:&#x20;1.&#x20;Temporarily&#x20;set&#x20;NFS_SERVER=1,&#x20;/etc/rc.config.d/nfsconf&#x20;2.&#x20;Execute:&#x20;&#x20;/sbin/init.d/nfs.core&#x20;start&#x20;/sbin/init.d/nfs.server&#x20;start&#x20;3.&#x20;Install&#x20;Oracle&#x20;4.&#x20;Stop&#x20;the&#x20;NFS&#x20;services:&#x20;&#x20;/sbin/init.d/nfs.core&#x20;stop&#x20;/sbin/init.d/nfs.server&#x20;stop&#x20;5.&#x20;Disable&#x20;the&#x20;NFS&#x20;services&#x20;by&#x20;resetting&#x20;NFS_SERVER=0,&#x20;NUM_NFSD=0,&#x20;and&#x20;NUM_NFSIOD=0&#x20;in&#x20;/etc/rc.config.d/nfsconf.','This&#x20;machine&#x20;is&#x20;a&#x20;NFS&#x20;file&#x20;server.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_SERVER=1&#x20;/etc/rc.config.d/nfsconf','[{\"cis\": [\"1.3.10\"]}]'),(25022,'Only&#x20;enable&#x20;NFS&#x20;client&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;NFS&#x20;Client&#x20;service.&#x20;Again,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;significant&#x20;need&#x20;for&#x20;this&#x20;system&#x20;to&#x20;acquire&#x20;data&#x20;via&#x20;NFS,&#x20;administrators&#x20;should&#x20;disable&#x20;NFS-related&#x20;services.&#x20;Note&#x20;that&#x20;other&#x20;file&#x20;transfer&#x20;schemes&#x20;&#40;such&#x20;as&#x20;rdist&#x20;via&#x20;SSH&#41;&#x20;can&#x20;often&#x20;be&#x20;more&#x20;secure&#x20;than&#x20;NFS&#x20;for&#x20;certain&#x20;applications,&#x20;although&#x20;again&#x20;the&#x20;use&#x20;of&#x20;secure&#x20;RPC&#x20;or&#x20;Kerberos&#x20;can&#x20;significantly&#x20;improve&#x20;NFS&#x20;security.&#x20;Also&#x20;note&#x20;that&#x20;if&#x20;the&#x20;machine&#x20;will&#x20;be&#x20;an&#x20;NFS&#x20;client,&#x20;then&#x20;the&#x20;rpcbind&#x20;process&#x20;must&#x20;be&#x20;running&#x20;&#40;see&#x20;Item&#x20;3.12&#x20;below&#41;.&#x20;-&#x20;Note&#x20;that&#x20;since&#x20;this&#x20;service&#x20;uses&#x20;ONC&#x20;RPC&#x20;mechanisms,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;system&#039;s&#x20;RPC&#x20;portmapper&#x20;&#40;rpcbind&#41;&#x20;also&#x20;be&#x20;enabled&#x20;when&#x20;this&#x20;service&#x20;is&#x20;turned&#x20;on.&#x20;For&#x20;more&#x20;information&#x20;see&#x20;Item&#x20;3.12&#x20;below.','This&#x20;system&#x20;must&#x20;access&#x20;file&#x20;systems&#x20;from&#x20;remote&#x20;servers&#x20;via&#x20;NFS.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_CLIENT=1&#x20;/etc/rc.config.d/nfsconf','[{\"cis\": [\"1.3.11\"]}]'),(25023,'Only&#x20;enable&#x20;RPC-based&#x20;services&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;RPC-based&#x20;services.&#x20;RPC-based&#x20;services&#x20;typically&#x20;use&#x20;very&#x20;weak&#x20;or&#x20;non-existent&#x20;authentication&#x20;and&#x20;yet&#x20;may&#x20;share&#x20;very&#x20;sensitive&#x20;information.&#x20;Unless&#x20;one&#x20;of&#x20;the&#x20;services&#x20;listed&#x20;above&#x20;is&#x20;required&#x20;on&#x20;this&#x20;machine,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;disable&#x20;RPC-based&#x20;tools&#x20;completely.&#x20;If&#x20;you&#x20;are&#x20;unsure&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;particular&#x20;third-party&#x20;application&#x20;requires&#x20;RPC&#x20;services,&#x20;consult&#x20;with&#x20;the&#x20;application&#x20;vendor.&#x20;Note&#x20;that&#x20;disabling&#x20;this&#x20;service&#x20;by&#x20;renaming&#x20;the&#x20;startup&#x20;file&#x20;may&#x20;not&#x20;survive&#x20;the&#x20;install&#x20;of&#x20;RPC-related&#x20;patches.','RPC-based&#x20;services&#x20;are&#x20;used&#x20;such&#x20;as:&#x20;-&#x20;This&#x20;machine&#x20;is&#x20;an&#x20;NFS&#x20;client&#x20;or&#x20;server.&#x20;-&#x20;This&#x20;machine&#x20;is&#x20;an&#x20;NIS&#x20;&#40;YP&#41;&#x20;or&#x20;NIS+&#x20;client&#x20;or&#x20;server.&#x20;-&#x20;This&#x20;machine&#x20;runs&#x20;a&#x20;GUI&#x20;or&#x20;GUI-based&#x20;administration&#x20;tool.&#x20;-&#x20;The&#x20;machine&#x20;runs&#x20;a&#x20;third-party&#x20;software&#x20;application&#x20;which&#x20;is&#x20;dependent&#x20;on&#x20;RPC&#x20;support&#x20;&#40;example:&#x20;FlexLM&#x20;License&#x20;managers&#41;.','','Perform&#x20;the&#x20;following&#x20;for&#x20;11.31&#x20;and&#x20;later:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_CORE=1&#x20;/etc/rc.config.d/nfsconf&#x20;For&#x20;11.23&#x20;and&#x20;prior:&#x20;&#x20;mv&#x20;-f&#x20;/sbin/rc2.d/.NOS400nfs.core&#x20;&#x20;/sbin/rc2.d/400nfs.core','[{\"cis\": [\"1.3.12\"]}]'),(25024,'Only&#x20;enable&#x20;Web&#x20;server&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;Web&#x20;server&#x20;suite.&#x20;Even&#x20;if&#x20;this&#x20;machine&#x20;is&#x20;a&#x20;Web&#x20;server,&#x20;the&#x20;local&#x20;site&#x20;may&#x20;choose&#x20;not&#x20;to&#x20;use&#x20;the&#x20;Web&#x20;server&#x20;provided&#x20;with&#x20;HP-UX&#x20;in&#x20;favor&#x20;of&#x20;a&#x20;locally&#x20;developed&#x20;and&#x20;supported&#x20;Web&#x20;environment.&#x20;If&#x20;the&#x20;machine&#x20;is&#x20;a&#x20;Web&#x20;server,&#x20;the&#x20;administrator&#x20;is&#x20;encouraged&#x20;to&#x20;search&#x20;the&#x20;Web&#x20;for&#x20;additional&#x20;documentation&#x20;on&#x20;Web&#x20;server&#x20;security.&#x20;A&#x20;good&#x20;starting&#x20;point&#x20;is&#x20;http://httpd.apache.org/docs-2.0/misc/security_tips.html.&#x20;Note&#x20;that&#x20;this&#x20;action&#x20;only&#x20;disables&#x20;the&#x20;default&#x20;web&#x20;server&#x20;shipped&#x20;with&#x20;the&#x20;system.&#x20;Other&#x20;webservers&#x20;instances&#x20;may&#x20;still&#x20;be&#x20;running.','There&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;why&#x20;this&#x20;system&#x20;must&#x20;run&#x20;a&#x20;Web&#x20;server.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NS_FTRACK=1&#x20;/etc/rc.config.d/ns-ftrack&#x20;ch_rc&#x20;-a&#x20;-p&#x20;APACHE_START=1&#x20;/etc/rc.config.d/apacheconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_APACHE32_START=1&#x20;/etc/rc.config.d/hpws_apache32conf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_TOMCAT_START=1&#x20;/etc/rc.config.d/hpws_tomcatconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NS_FTRACK=1&#x20;/etc/rc.config.d/ns-ftrack&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_WEBMIN_START=1&#x20;/etc/rc.config.d/hpws_webminconf','[{\"cis\": [\"1.3.13\"]}]'),(25025,'Only&#x20;enable&#x20;BIND&#x20;DNS&#x20;server&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;BIND&#x20;DNS&#x20;service.&#x20;The&#x20;BIND&#x20;DNS&#x20;server,&#x20;or&#x20;named,&#x20;maps&#x20;IP&#x20;addresses&#x20;to&#x20;hostnames&#x20;across&#x20;the&#x20;Internet&#x20;and&#x20;supplies&#x20;these&#x20;services&#x20;to&#x20;other&#x20;hosts&#x20;on&#x20;the&#x20;local&#x20;local&#x20;network.&#x20;Though&#x20;it&#x20;has&#x20;been&#x20;widely&#x20;implemented,&#x20;BIND&#x20;has&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;flaws,&#x20;especially&#x20;in&#x20;the&#x20;BIND&#x20;8.x&#x20;release&#x20;tree&#x20;generally&#x20;shipped&#x20;with&#x20;HP-UX&#x20;11.x&#x20;systems.&#x20;Therefore,&#x20;if&#x20;you&#x20;are&#x20;going&#x20;to&#x20;run&#x20;BIND,&#x20;you&#x20;should&#x20;strongly&#x20;consider&#x20;moving&#x20;to&#x20;the&#x20;BIND&#x20;9.x&#x20;release-tree.&#x20;HP&#x20;has&#x20;supported&#x20;BIND&#x20;9&#x20;packages&#x20;available&#x20;from&#x20;http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=BIND9.2&#x20;.&#x20;Or&#x20;it&#x20;is&#x20;available&#x20;directly&#x20;from&#x20;the&#x20;Internet&#x20;Software&#x20;Consortium&#x20;&#40;the&#x20;developers&#x20;of&#x20;BIND&#41;,&#x20;whose&#x20;website&#x20;is&#x20;at&#x20;http://www.isc.org.','There&#x20;exists&#x20;a&#x20;mission-critical&#x20;reason&#x20;why&#x20;this&#x20;system&#x20;must&#x20;run&#x20;a&#x20;DNS&#x20;server.','','Perform&#x20;the&#x20;following:&#x20;11.23&#x20;and&#x20;prior:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NAMED=1&#x20;/etc/rc.config.d/namesvrs&#x20;11.31&#x20;and&#x20;later:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NAMED=1&#x20;/etc/rc.config.d/namesvrs_dns','[{\"cis\": [\"1.3.14\"]}]'),(25026,'Enable&#x20;stack&#x20;protection.','Enabling&#x20;stack&#x20;protection&#x20;prevents&#x20;certain&#x20;classes&#x20;of&#x20;buffer&#x20;overflow&#x20;attacks&#x20;and&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;enhancement.&#x20;-&#x20;Note&#x20;that&#x20;HP-UX&#x20;11i&#x20;is&#x20;much&#x20;more&#x20;capable&#x20;in&#x20;this&#x20;and&#x20;other&#x20;security&#x20;areas&#x20;than&#x20;older&#x20;releases;&#x20;therefore,&#x20;administrators&#x20;should&#x20;strongly&#x20;consider&#x20;upgrading&#x20;from&#x20;older&#x20;releases.&#x20;-&#x20;Note&#x20;that&#x20;this&#x20;action&#x20;requires&#x20;a&#x20;subsequent&#x20;reboot&#x20;to&#x20;take&#x20;effect&#x20;in&#x20;some&#x20;versions&#x20;of&#x20;HP-UX.','Buffer&#x20;overflow&#x20;exploits&#x20;have&#x20;been&#x20;the&#x20;basis&#x20;for&#x20;many&#x20;of&#x20;the&#x20;recent&#x20;highly&#x20;publicized&#x20;compromises&#x20;and&#x20;defacements&#x20;of&#x20;large&#x20;numbers&#x20;of&#x20;Internet&#x20;connected&#x20;systems.&#x20;Many&#x20;of&#x20;the&#x20;automated&#x20;tools&#x20;in&#x20;use&#x20;by&#x20;system&#x20;crackers&#x20;exploit&#x20;well-known&#x20;buffer&#x20;overflow&#x20;problems&#x20;in&#x20;vendor-supplied&#x20;and&#x20;third-party&#x20;software.&#x20;Enabling&#x20;stack&#x20;protection&#x20;prevents&#x20;certain&#x20;classes&#x20;of&#x20;buffer&#x20;overflow&#x20;attacks&#x20;and&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;enhancement.','','For&#x20;11i&#x20;v2&#x20;and&#x20;later:&#x20;kctune&#x20;-K&#x20;executable_stack=0&#x20;For&#x20;11i&#x20;v1:&#x20;/usr/sbin/kmtune&#x20;-s&#x20;executable_stack=0&#x20;&amp;&amp;&#x20;mk_kernel&#x20;&amp;&amp;&#x20;kmupdate','[{\"cis\": [\"1.4.1\"]}, {\"cis_level\": [\"1\"]}]'),(25027,'Network&#x20;parameter&#x20;modifications.','Modify&#x20;the&#x20;network&#x20;parameter&#x20;boot&#x20;configuration&#x20;file&#x20;to&#x20;meet&#x20;current&#x20;best&#x20;practices.&#x20;Note:&#x20;HP-UX&#x20;11.11&#x20;systems&#x20;require&#x20;patch&#x20;PHNE_25644&#x20;for&#x20;ndd&#x20;to&#x20;set&#x20;arp_cleanup_interval&#x20;from&#x20;/etc/rc.config.d/nddconf.&#x20;-&#x20;Bastille&#x20;Note:&#x20;Bastille&#x20;performs&#x20;a&#x20;similar&#x20;action&#x20;but&#x20;does&#x20;not&#x20;support&#x20;the&#x20;exact&#x20;same&#x20;changes.','Network&#x20;parameter&#x20;default&#x20;values&#x20;should&#x20;align&#x20;with&#x20;current&#x20;best&#x20;practices&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;to&#x20;use&#x20;other&#x20;values.','','Perform&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;default&#x20;network&#x20;parameter&#x20;values:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/etc/rc.config.d&#x20;directory&#x20;2.&#x20;Open&#x20;nddconf&#x20;and&#x20;review&#x20;the&#x20;comment&#x20;lines&#x20;on&#x20;how&#x20;to&#x20;use&#x20;the&#x20;configuration&#x20;file&#x20;3.&#x20;Set&#x20;each&#x20;of&#x20;the&#x20;following&#x20;network&#x20;parameters&#x20;to&#x20;the&#x20;recommended&#x20;value.&#x20;If&#x20;a&#x20;parameter&#x20;does&#x20;not&#x20;have&#x20;an&#x20;entry&#x20;in&#x20;nddconf&#x20;then&#x20;add&#x20;a&#x20;new&#x20;entry&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file&#x20;while&#x20;properly&#x20;incrementing&#x20;the&#x20;parameter&#x20;index.&#x20;4.&#x20;Save&#x20;nddconf.&#x20;-&#x20;If&#x20;creating&#x20;this&#x20;file&#x20;for&#x20;the&#x20;first&#x20;time:&#x20;1.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;nddconf.&#x20;2.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;nddconf.&#x20;3.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;nddconf&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;4.&#x20;Remove&#x20;the&#x20;executable&#x20;and&#x20;sticky&#x20;bit&#x20;from&#x20;nddconf.&#x20;If&#x20;the&#x20;existing&#x20;nddconf&#x20;file&#x20;contains&#x20;no&#x20;entries,&#x20;then&#x20;the&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;cd&#x20;/etc/rc.config.d&#x20;cat&#x20;&lt;&lt;EOF&#x20;&gt;&#x20;nddconf&#x20;#&#x20;Increase&#x20;size&#x20;of&#x20;half-open&#x20;connection&#x20;queue&#x20;TRANSPORT_NAME[0]=tcp&#x20;NDD_NAME[0]=tcp_syn_rcvd_max&#x20;NDD_VALUE[0]=4096&#x20;#&#x20;Reduce&#x20;timeouts&#x20;on&#x20;ARP&#x20;cache&#x20;TRANSPORT_NAME[1]=arp&#x20;NDD_NAME[1]=arp_cleanup_interval&#x20;NDD_VALUE[1]=60000&#x20;#&#x20;Drop&#x20;source-routed&#x20;packets&#x20;TRANSPORT_NAME[2]=ip&#x20;NDD_NAME[2]=ip_forward_src_routed&#x20;NDD_VALUE[2]=0&#x20;#&#x20;Don&#039;t&#x20;forward&#x20;directed&#x20;broadcasts&#x20;TRANSPORT_NAME[3]=ip&#x20;NDD_NAME[3]=ip_forward_directed_broadcasts&#x20;NDD_VALUE[3]=0&#x20;#&#x20;Don&#039;t&#x20;respond&#x20;to&#x20;unicast&#x20;ICMP&#x20;timestamp&#x20;requests&#x20;TRANSPORT_NAME[4]=ip&#x20;NDD_NAME[4]=ip_respond_to_timestamp&#x20;NDD_VALUE[4]=0&#x20;#&#x20;Don&#039;t&#x20;respond&#x20;to&#x20;broadcast&#x20;ICMP&#x20;tstamp&#x20;reqs&#x20;TRANSPORT_NAME[5]=ip&#x20;NDD_NAME[5]=ip_respond_to_timestamp_broadcast&#x20;NDD_VALUE[5]=0&#x20;#&#x20;Don&#039;t&#x20;respond&#x20;to&#x20;ICMP&#x20;address&#x20;mask&#x20;requests&#x20;TRANSPORT_NAME[6]=ip&#x20;NDD_NAME[6]=ip_respond_to_address_mask_broadcast&#x20;NDD_VALUE[6]=0&#x20;#&#x20;Don‟t&#x20;respond&#x20;to&#x20;broadcast&#x20;echo&#x20;requests&#x20;TRANSPORT_NAME[7]=ip&#x20;NDD_NAME[7]=ip_respond_to_echo_broadcast&#x20;NDD_VALUE[7]=0&#x20;EOF&#x20;chown&#x20;root:sys&#x20;nddconf&#x20;chmod&#x20;go-w,ug-s&#x20;nddconf','[{\"cis\": [\"1.4.2\"]}, {\"cis_level\": [\"1\"]}]'),(25028,'Use&#x20;more&#x20;random&#x20;TCP&#x20;sequence&#x20;numbers.','Generate&#x20;initial&#x20;TCP&#x20;sequence&#x20;numbers&#x20;that&#x20;comply&#x20;with&#x20;RFC1948.&#x20;-&#x20;Note:&#x20;In&#x20;HP-UX&#x20;11i&#x20;v1&#x20;and&#x20;later,&#x20;an&#x20;algorithm&#x20;largely&#x20;compliant&#x20;with&#x20;RFC1948&#x20;is&#x20;already&#x20;used.&#x20;However,&#x20;setting&#x20;the&#x20;isn&#x20;passphrase&#x20;closes&#x20;the&#x20;small&#x20;remaining&#x20;gap,&#x20;and&#x20;adds&#x20;entropy&#x20;to&#x20;the&#x20;seed.','Makes&#x20;remote&#x20;off-net&#x20;session&#x20;hijacking&#x20;attacks&#x20;more&#x20;difficult.','','Perform&#x20;the&#x20;following&#x20;to&#x20;use&#x20;more&#x20;random&#x20;TCP&#x20;sequence&#x20;numbers&#x20;upon&#x20;system&#x20;startup:&#x20;1.&#x20;Create/open&#x20;the&#x20;file&#x20;/sbin/rc2.d/S999tcpisn&#x20;2.&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;ndd&#x20;-set&#x20;/dev/tcp&#x20;tcp_isn_passprase=&lt;random&#x20;string&gt;&#x20;replacing&#x20;&lt;random&#x20;string&gt;&#x20;with&#x20;a&#x20;string&#x20;of&#x20;random&#x20;characters.&#x20;3.&#x20;Save&#x20;the&#x20;file.&#x20;4.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;and&#x20;bin&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file.&#x20;5.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;the&#x20;file.&#x20;6.&#x20;Set&#x20;the&#x20;execution&#x20;bit&#x20;for&#x20;the&#x20;file.','[{\"cis\": [\"1.4.3\"]}, {\"cis_level\": [\"1\"]}]'),(25029,'Additional&#x20;network&#x20;parameter&#x20;modifications.','Configure&#x20;networking&#x20;to&#x20;NOT&#x20;forward&#x20;TCP/IP&#x20;packets&#x20;between&#x20;multiple&#x20;networks,&#x20;even&#x20;if&#x20;the&#x20;machine&#x20;has&#x20;multiple&#x20;network&#x20;adapters&#x20;connected&#x20;to&#x20;multiple&#x20;networks.','System&#x20;is&#x20;not&#x20;going&#x20;to&#x20;be&#x20;used&#x20;as&#x20;a&#x20;firewall&#x20;or&#x20;gateway&#x20;to&#x20;pass&#x20;network&#x20;traffic&#x20;between&#x20;different&#x20;networks.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;forwarding&#x20;TCP/IP&#x20;packets&#x20;between&#x20;networks:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/etc/rc.config.d&#x20;directory&#x20;2.&#x20;Open&#x20;nddconf&#x20;and&#x20;review&#x20;the&#x20;comment&#x20;lines&#x20;on&#x20;how&#x20;to&#x20;use&#x20;the&#x20;configuration&#x20;file&#x20;3.&#x20;Set&#x20;each&#x20;of&#x20;the&#x20;following&#x20;network&#x20;parameters&#x20;to&#x20;the&#x20;recommended&#x20;value.&#x20;If&#x20;a&#x20;parameter&#x20;does&#x20;not&#x20;have&#x20;an&#x20;entry&#x20;in&#x20;nddconf&#x20;then&#x20;add&#x20;a&#x20;new&#x20;entry&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file&#x20;while&#x20;properly&#x20;incrementing&#x20;the&#x20;parameter&#x20;index.&#x20;4.&#x20;Save&#x20;nddconf.&#x20;If&#x20;creating&#x20;this&#x20;file&#x20;for&#x20;the&#x20;first&#x20;time:&#x20;5.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;nddconf.&#x20;6.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;nddconf.&#x20;7.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;nddconf&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;8.&#x20;Remove&#x20;the&#x20;executable&#x20;and&#x20;sticky&#x20;bit&#x20;from&#x20;nddconf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure&#x20;properly&#x20;if&#x20;used&#x20;as&#x20;a&#x20;follow-on&#x20;from&#x20;the&#x20;script&#x20;in&#x20;item&#x20;1.4.2:&#x20;cat&#x20;&lt;&lt;EOF&#x20;&gt;&gt;&#x20;/etc/rc.config.d/nddconf&#x20;#&#x20;Don‟t&#x20;act&#x20;as&#x20;a&#x20;router&#x20;TRANSPORT_NAME[8]=ip&#x20;NDD_NAME[8]=ip_forwarding&#x20;NDD_VALUE[8]=0&#x20;TRANSPORT_NAME[9]=ip&#x20;NDD_NAME[9]=ip_send_redirects&#x20;NDD_VALUE[9]=0&#x20;EOF','[{\"cis\": [\"1.4.4\"]}, {\"cis_level\": [\"1\"]}]'),(25030,'Resolve&#x20;&#039;unowned&#039;&#x20;files&#x20;and&#x20;directories.','Evaluate&#x20;ownership&#x20;of&#x20;any&#x20;files&#x20;that&#x20;are&#x20;not&#x20;owned&#x20;by&#x20;a&#x20;locally&#x20;defined&#x20;user,&#x20;and&#x20;consider&#x20;reassignment&#x20;to&#x20;an&#x20;active&#x20;user.','Sometimes&#x20;when&#x20;administrators&#x20;delete&#x20;users&#x20;from&#x20;the&#x20;system&#x20;they&#x20;neglect&#x20;to&#x20;remove&#x20;all&#x20;files&#x20;owned&#x20;by&#x20;those&#x20;users&#x20;from&#x20;the&#x20;system.&#x20;A&#x20;new&#x20;user&#x20;who&#x20;is&#x20;assigned&#x20;the&#x20;deleted&#x20;user&#039;s&#x20;user&#x20;ID&#x20;or&#x20;group&#x20;ID&#x20;may&#x20;then&#x20;end&#x20;up&#x20;&#039;owning&#039;&#x20;these&#x20;files,&#x20;and&#x20;thus&#x20;have&#x20;more&#x20;access&#x20;on&#x20;the&#x20;system&#x20;than&#x20;was&#x20;intended.&#x20;It&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;locate&#x20;files&#x20;that&#x20;are&#x20;owned&#x20;by&#x20;users&#x20;or&#x20;groups&#x20;not&#x20;listed&#x20;in&#x20;the&#x20;system&#x20;configuration&#x20;files,&#x20;and&#x20;make&#x20;sure&#x20;to&#x20;reset&#x20;the&#x20;ownership&#x20;of&#x20;these&#x20;files&#x20;to&#x20;some&#x20;active&#x20;user&#x20;on&#x20;the&#x20;system&#x20;&#40;in&#x20;this&#x20;example,&#x20;&#039;bin&#039;&#41;&#x20;as&#x20;appropriate.','','Perform&#x20;the&#x20;following&#x20;to&#x20;identify&#x20;&quot;unowned&quot;&#x20;files&#x20;and&#x20;directories,&#x20;and&#x20;consider&#x20;resetting&#x20;ownership&#x20;to&#x20;a&#x20;default&#x20;owner&#x20;and&#x20;restricting&#x20;access&#x20;permissions:&#x20;1.&#x20;Locate&#x20;all&#x20;local&#x20;files&#x20;that&#x20;are&#x20;owned&#x20;by&#x20;users&#x20;or&#x20;groups&#x20;not&#x20;listed&#x20;in&#x20;the&#x20;system&#x20;configuration&#x20;files.&#x20;find&#x20;/&#x20;&#40;&#x20;-nouser&#x20;-o&#x20;-nogroup&#x20;&#41;&#x20;2.&#x20;Consider&#x20;resetting&#x20;user&#x20;and&#x20;group&#x20;ownership&#x20;of&#x20;these&#x20;files&#x20;to&#x20;a&#x20;default&#x20;active&#x20;user&#x20;&#40;e.g.&#x20;bin&#41;&#x20;chown&#x20;bin:bin&#x20;&lt;filename&gt;&#x20;3.&#x20;Consider&#x20;restricting&#x20;world-write&#x20;permissions,&#x20;and&#x20;removing&#x20;any&#x20;SUID/SGID&#x20;bits&#x20;on&#x20;these&#x20;files.&#x20;chmod&#x20;ug-s,o-w&#x20;&lt;filename&gt;&#x20;-&#x20;Note:&#x20;there&#x20;is&#x20;no&#x20;reason&#x20;for&#x20;an&#x20;application&#x20;to&#x20;require&#x20;an&#x20;unowned&#x20;file,&#x20;so&#x20;these&#x20;changes&#x20;should&#x20;be&#x20;application-safe.','[{\"cis\": [\"1.5.3\"]}, {\"cis_level\": [\"1\"]}]'),(25031,'Enable&#x20;Hidden&#x20;Passwords.','Enable&#x20;hidden&#x20;passwords&#x20;by&#x20;converting&#x20;the&#x20;system&#x20;to&#x20;a&#x20;Trusted&#x20;System&#x20;or&#x20;to&#x20;use&#x20;Shadow&#x20;Passwords.&#x20;-&#x20;Note:&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;if&#x20;the&#x20;system&#x20;runs&#x20;applications&#x20;that&#x20;read&#x20;the&#x20;encrypted&#x20;password&#x20;entries&#x20;in&#x20;/etc/passwd&#x20;directly.','Without&#x20;hidden&#x20;passwords,&#x20;an&#x20;intruder&#x20;could&#x20;use&#x20;any&#x20;user&#039;s&#x20;account&#x20;to&#x20;obtain&#x20;hashed&#x20;passwords&#x20;and&#x20;use&#x20;crack&#x20;or&#x20;similar&#x20;utilities&#x20;to&#x20;find&#x20;easily&#x20;guessed&#x20;passwords.&#x20;Password&#x20;aging&#x20;&#40;covered&#x20;in&#x20;item&#x20;1.8.3&#41;&#x20;ensures&#x20;that&#x20;users&#x20;change&#x20;their&#x20;passwords&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;helps&#x20;stop&#x20;the&#x20;use&#x20;of&#x20;stolen&#x20;passwords.','','Perform&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;convert&#x20;the&#x20;system&#x20;to&#x20;trusted&#x20;mode&#x20;or&#x20;shadowed&#x20;mode:&#x20;A.&#x20;Use&#x20;the&#x20;system&#x20;management&#x20;program&#x20;smh&#x20;or&#x20;sam&#x20;to&#x20;convert&#x20;to&#x20;a&#x20;trusted&#x20;system&#x20;-or-&#x20;B.&#x20;Use&#x20;the&#x20;command&#x20;pwconv&#x20;to&#x20;convert&#x20;to&#x20;shadowed&#x20;passwords.','[{\"cis\": [\"1.6.1\"]}, {\"cis_level\": [\"1\"]}]'),(25032,'Restrict&#x20;users&#x20;who&#x20;can&#x20;access&#x20;to&#x20;FTP.','Configure&#x20;FTP&#x20;to&#x20;prevent&#x20;certain&#x20;users&#x20;from&#x20;accessing&#x20;the&#x20;system&#x20;via&#x20;FTP.&#x20;The&#x20;file&#x20;ftpusers&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;users&#x20;who&#x20;are&#x20;not&#x20;allowed&#x20;to&#x20;access&#x20;the&#x20;system&#x20;via&#x20;FTP.&#x20;Generally,&#x20;only&#x20;normal&#x20;users&#x20;should&#x20;ever&#x20;access&#x20;the&#x20;system&#x20;via&#x20;FTP&#x20;-&#x20;there&#x20;should&#x20;be&#x20;no&#x20;reason&#x20;for&#x20;&#039;system&#039;&#x20;type&#x20;accounts&#x20;to&#x20;be&#x20;transferring&#x20;information&#x20;via&#x20;this&#x20;mechanism.&#x20;Certainly,&#x20;the&#x20;root&#x20;account&#x20;should&#x20;never&#x20;be&#x20;allowed&#x20;to&#x20;transfer&#x20;files&#x20;directly&#x20;via&#x20;FTP.&#x20;-&#x20;Note:&#x20;more&#x20;fine-grained&#x20;FTP&#x20;access&#x20;controls&#x20;can&#x20;be&#x20;placed&#x20;in&#x20;/etc/ftpd/ftpaccess.','Privileged&#x20;users&#x20;such&#x20;as&#x20;root&#x20;and&#x20;other&#x20;&#039;system&#039;&#x20;type&#x20;accounts&#x20;should&#x20;never&#x20;be&#x20;transferring&#x20;information&#x20;via&#x20;such&#x20;an&#x20;insecure&#x20;service&#x20;as&#x20;FTP.','','Perform&#x20;the&#x20;following&#x20;to&#x20;restrict&#x20;default&#x20;priviledged&#x20;users&#x20;from&#x20;access&#x20;to&#x20;FTP:&#x20;1.&#x20;Add&#x20;the&#x20;users&#x20;root&#x20;daemon&#x20;bin&#x20;sys&#x20;adm&#x20;lp&#x20;uucp&#x20;nuucp&#x20;nobody&#x20;hpdb&#x20;useradm&#x20;to&#x20;the&#x20;file&#x20;/etc/ftpd/ftpusers&#x20;&#40;each&#x20;user&#x20;on&#x20;a&#x20;single&#x20;line&#41;.&#x20;2.&#x20;Set&#x20;the&#x20;file&#x20;owner&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;the&#x20;user&#x20;bin.&#x20;3.&#x20;Set&#x20;the&#x20;file&#x20;permissions&#x20;so&#x20;that&#x20;only&#x20;the&#x20;file&#x20;owner&#x20;has&#x20;read&#x20;or&#x20;write&#x20;perms&#x20;and&#x20;no&#x20;user&#x20;has&#x20;execute&#x20;permission&#x20;&#40;600&#41;.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;create&#x20;and&#x20;populate&#x20;the&#x20;ftpusers&#x20;file&#x20;as&#x20;described&#x20;above:&#x20;for&#x20;name&#x20;in&#x20;root&#x20;daemon&#x20;bin&#x20;sys&#x20;adm&#x20;lp&#x20;&#x20;uucp&#x20;nuucp&#x20;nobody&#x20;hpdb&#x20;useradm&#x20;do&#x20;echo&#x20;$name&#x20;done&#x20;&gt;&gt;&#x20;$ftpusers&#x20;sort&#x20;-u&#x20;$ftpusers&#x20;&gt;&#x20;$ftpusers.tmp&#x20;cp&#x20;$ftpusers.tmp&#x20;$ftpusers&#x20;rm&#x20;-f&#x20;$ftpusers.tmp&#x20;chown&#x20;bin:bin&#x20;$ftpusers&#x20;chmod&#x20;600&#x20;$ftpusers','[{\"cis\": [\"1.6.2\"]}, {\"cis_level\": [\"1\"]}]'),(25033,'Prevent&#x20;Syslog&#x20;from&#x20;accepting&#x20;messages&#x20;from&#x20;the&#x20;network.','Prevent&#x20;syslogd&#x20;from&#x20;accepting&#x20;messages&#x20;from&#x20;the&#x20;network.&#x20;By&#x20;default&#x20;the&#x20;system&#x20;logging&#x20;daemon,&#x20;syslogd,&#x20;listens&#x20;for&#x20;log&#x20;messages&#x20;from&#x20;other&#x20;systems&#x20;on&#x20;network&#x20;port&#x20;514/udp.&#x20;Unfortunately,&#x20;the&#x20;protocol&#x20;used&#x20;to&#x20;transfer&#x20;these&#x20;messages&#x20;does&#x20;not&#x20;include&#x20;any&#x20;form&#x20;of&#x20;authentication,&#x20;so&#x20;a&#x20;malicious&#x20;outsider&#x20;could&#x20;simply&#x20;barrage&#x20;the&#x20;local&#x20;system&#039;s&#x20;Syslog&#x20;port&#x20;with&#x20;spurious&#x20;traffic&mdash;either&#x20;as&#x20;a&#x20;denial-of-service&#x20;attack&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;to&#x20;fill&#x20;up&#x20;the&#x20;local&#x20;system&#039;s&#x20;logging&#x20;file&#x20;systems&#x20;so&#x20;that&#x20;subsequent&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;logged.&#x20;-&#x20;Note:&#x20;Do&#x20;not&#x20;perform&#x20;this&#x20;action&#x20;if&#x20;this&#x20;machine&#x20;is&#x20;a&#x20;log&#x20;server,&#x20;or&#x20;needs&#x20;to&#x20;receive&#x20;Syslog&#x20;messages&#x20;via&#x20;the&#x20;network&#x20;from&#x20;other&#x20;systems.&#x20;-&#x20;Note:&#x20;It&#x20;is&#x20;considered&#x20;good&#x20;practice&#x20;to&#x20;setup&#x20;one&#x20;or&#x20;more&#x20;machines&#x20;as&#x20;central&#x20;&#039;log&#x20;servers&#039;&#x20;to&#x20;aggregate&#x20;log&#x20;traffic&#x20;from&#x20;all&#x20;machines&#x20;at&#x20;a&#x20;site.&#x20;However,&#x20;unless&#x20;a&#x20;system&#x20;is&#x20;set&#x20;up&#x20;to&#x20;be&#x20;one&#x20;of&#x20;these&#x20;&#039;log&#x20;server&#039;&#x20;systems,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;on&#x20;514/udp&#x20;for&#x20;incoming&#x20;log&#x20;messages.','Disabling&#x20;unused&#x20;network&#x20;services&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surfaces&#x20;of&#x20;the&#x20;hosting&#x20;system.','','Disable&#x20;the&#x20;syslog&#x20;network&#x20;option&#x20;by&#x20;doing&#x20;the&#x20;following:&#x20;1.&#x20;Open&#x20;the&#x20;syslogd&#x20;startup&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/syslogd&#x20;2.&#x20;Add&#x20;the&#x20;parameter&#x20;&quot;-N&quot;&#x20;to&#x20;the&#x20;SYSLOGD_OPTS=&#x20;line&#x20;if&#x20;it&#x20;is&#x20;not&#x20;already&#x20;present&#x20;3.&#x20;Save&#x20;and&#x20;close&#x20;the&#x20;file.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;SYSLOGD_OPTS=&quot;`sh&#x20;-c&#x20;&quot;.&#x20;/etc/rc.config.d/syslogd&#x20;;&#x20;&#x20;echo&#x20;&quot;$SYSLOGD_OPTS&quot;&#039;`&quot;&#x20;if&#x20;[[&#x20;&quot;$SYSLOGD_OPTS&quot;&#x20;=&#x20;*-N*&#x20;]];&#x20;then&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SYSLOGD_OPTS=&quot;-N&#x20;$SYSLOGD_OPTS&quot;&#x20;&#x20;/etc/rc.config.d/syslogd&#x20;fi','[{\"cis\": [\"1.6.3\"]}, {\"cis_level\": [\"1\"]}]'),(25034,'Disable&#x20;XDMCP&#x20;port.','Disable&#x20;the&#x20;XDMCP&#x20;port&#x20;for&#x20;remote&#x20;login&#x20;services.&#x20;The&#x20;standard&#x20;GUI&#x20;login&#x20;provided&#x20;on&#x20;most&#x20;Unix&#x20;systems&#x20;can&#x20;act&#x20;as&#x20;a&#x20;remote&#x20;login&#x20;server&#x20;to&#x20;other&#x20;devices&#x20;&#40;including&#x20;X&#x20;terminals&#x20;and&#x20;other&#x20;workstations&#41;.&#x20;Access&#x20;control&#x20;is&#x20;handled&#x20;via&#x20;the&#x20;Xaccess&#x20;file&mdash;by&#x20;default&#x20;under&#x20;HP-UX,&#x20;this&#x20;file&#x20;allows&#x20;any&#x20;system&#x20;on&#x20;the&#x20;network&#x20;to&#x20;get&#x20;a&#x20;remote&#x20;login&#x20;screen&#x20;from&#x20;the&#x20;local&#x20;system.&#x20;This&#x20;behavior&#x20;can&#x20;be&#x20;overridden&#x20;in&#x20;the&#x20;/etc/dt/config/Xaccess&#x20;file.','XDMCP&#x20;is&#x20;an&#x20;unencrypted&#x20;protocol&#x20;that&#x20;may&#x20;reduce&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;data&#x20;that&#x20;traverses&#x20;it.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;XDMCP&#x20;port:&#x20;1.&#x20;Open&#x20;the&#x20;file&#x20;/etc/dt/config/Xconfig.&#x20;If&#x20;it&#x20;does&#x20;not&#x20;exist,&#x20;copy&#x20;it&#x20;from&#x20;/usr/dt/config/Xconfig.&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;Dtlogin.requestPort:0&#x20;to&#x20;the&#x20;file&#x20;and&#x20;close.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;if&#x20;[&#x20;!&#x20;-f&#x20;/etc/dt/config/Xconfig&#x20;];&#x20;then&#x20;mkdir&#x20;-p&#x20;/etc/dt/config&#x20;cp&#x20;-p&#x20;/usr/dt/config/Xconfig&#x20;/etc/dt/config&#x20;fi&#x20;cd&#x20;/etc/dt/config&#x20;awk&#x20;&#039;/Dtlogin.requestPort:/&#x20;&#x20;{&#x20;print&#x20;&quot;Dtlogin.requestPort:&#x20;0&quot;;&#x20;next&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;Xconfig&#x20;&gt;&#x20;Xconfig.new&#x20;cp&#x20;Xconfig.new&#x20;Xconfig&#x20;rm&#x20;-f&#x20;Xconfig.new','[{\"cis\": [\"1.6.4\"]}, {\"cis_level\": [\"1\"]}]'),(25035,'Configure&#x20;IPFilter&#x20;to&#x20;allow&#x20;only&#x20;select&#x20;communication.','HP-UX&#x20;IPFilter&#x20;&#40;B9901AA&#41;&#x20;is&#x20;a&#x20;stateful&#x20;system&#x20;firewall&#x20;that&#x20;controls&#x20;IP&#x20;packet&#x20;flow&#x20;in&#x20;or&#x20;out&#x20;of&#x20;a&#x20;machine.&#x20;It&#x20;is&#x20;installed&#x20;by&#x20;default&#x20;on&#x20;HP-UX&#x20;11iv2&#x20;&#40;11.23&#41;&#x20;and&#x20;later.&#x20;On&#x20;older&#x20;systems,&#x20;IPFilter&#x20;can&#x20;be&#x20;obtained&#x20;from&#x20;http://www.hp.com/go/ipfilter.&#x20;The&#x20;rules&#x20;below&#x20;will&#x20;work&#x20;in&#x20;an&#x20;otherwise-empty&#x20;ipf.conf&#x20;file,&#x20;or,&#x20;if&#x20;there&#x20;are&#x20;rules&#x20;already&#x20;present,&#x20;it&#x20;will&#x20;block&#x20;all&#x20;that&#x20;were&#x20;not&#x20;passed&#x20;earlier&#x20;in&#x20;the&#x20;ruleset.&#x20;This&#x20;is&#x20;less&#x20;likely&#x20;to&#x20;break&#x20;things,&#x20;but&#x20;will&#x20;allow&#x20;more&#x20;traffic&#x20;through.&#x20;Alternatively,&#x20;you&#x20;can&#x20;instead&#x20;take&#x20;the&#x20;pass&#x20;lines&#x20;below&#x20;&#40;not&#x20;using&#x20;the&#x20;block&#x20;rule&#41;,&#x20;and&#x20;change&#x20;them&#x20;into&#x20;&#039;block&#x20;in&#x20;quick&#039;&#x20;rules,&#x20;and&#x20;place&#x20;those&#x20;at&#x20;the&#x20;top&#x20;of&#x20;the&#x20;file.&#x20;This&#x20;will&#x20;error&#x20;on&#x20;the&#x20;side&#x20;of&#x20;blocking&#x20;traffic.&#x20;See&#x20;ipf&#40;5&#41;&#x20;for&#x20;detail.&#x20;Your&#x20;ruleset&#x20;can&#x20;be&#x20;tested&#x20;using&#x20;ipftest&#40;1&#41;.&#x20;Bastille&#x20;note:&#x20;if&#x20;using&#x20;to&#x20;change&#x20;and&#x20;monitor&#x20;the&#x20;IPFilter&#x20;firewall,&#x20;ensure&#x20;that&#x20;rules&#x20;are&#x20;added&#x20;to&#x20;/etc/opt/sec_mgmt/bastille/ipf.customrules,&#x20;and&#x20;that&#x20;Bastille&#x20;is&#x20;rerun&#x20;with&#x20;the&#x20;last&#x20;config&#x20;file,&#x20;so&#x20;they&#x20;will&#x20;not&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;subsequent&#x20;lockdown.','Restricting&#x20;incoming&#x20;network&#x20;traffic&#x20;to&#x20;explicitly&#x20;allowed&#x20;hosts&#x20;will&#x20;help&#x20;prevent&#x20;unauthorized&#x20;access&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;add&#x20;enable&#x20;ipfilter&#x20;and&#x20;install&#x20;a&#x20;default&#x20;ruleset&#x20;to&#x20;block&#x20;unauthorized&#x20;incoming&#x20;connections:&#x20;1.&#x20;Enable&#x20;ipfilter:&#x20;ipfilter&#x20;-e&#x20;2.&#x20;Append&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;/etc/opt/ipf/ipf.conf:&#x20;&#x20;block&#x20;in&#x20;all&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;replacing&#x20;each&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;with&#x20;an&#x20;authorized&#x20;IP&#x20;address&#x20;and&#x20;mask.&#x20;3.&#x20;Flush&#x20;the&#x20;old&#x20;rules&#x20;and&#x20;read&#x20;in&#x20;the&#x20;updated&#x20;rules:&#x20;ipf&#x20;-Fa&#x20;-f&#x20;/etc/opt/ipf/ipf.conf&#x20;The&#x20;following&#x20;script&#x20;can&#x20;be&#x20;used&#x20;to&#x20;as&#x20;a&#x20;template&#x20;for&#x20;creating&#x20;your&#x20;own&#x20;script&#x20;to&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;ipfilter&#x20;-e&#x20;cat&#x20;&lt;&lt;EOF&#x20;&gt;&gt;&#x20;/etc/opt/ipf/ipf.conf&#x20;block&#x20;in&#x20;all&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;EOF&#x20;ipf&#x20;-Fa&#x20;-f&#x20;/etc/opt/ipf/ipf.conf','[{\"cis\": [\"1.6.6\"]}, {\"cis_level\": [\"1\"]}]'),(25036,'Restrict&#x20;at/cron&#x20;to&#x20;authorized&#x20;users.','The&#x20;cron.allow&#x20;and&#x20;at.allow&#x20;files&#x20;are&#x20;a&#x20;list&#x20;of&#x20;users&#x20;who&#x20;are&#x20;allowed&#x20;to&#x20;run&#x20;the&#x20;crontab&#x20;and&#x20;at&#x20;commands&#x20;to&#x20;submit&#x20;jobs&#x20;to&#x20;be&#x20;run&#x20;at&#x20;scheduled&#x20;intervals.&#x20;-&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;cron.allow&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;needs&#x20;the&#x20;ability&#x20;to&#x20;schedule&#x20;jobs.','','Perform&#x20;the&#x20;following&#x20;to&#x20;restrict&#x20;at/cron&#x20;to&#x20;root&#x20;only:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/var/adm/cron&#x20;directory&#x20;2.&#x20;Archive&#x20;or&#x20;delete&#x20;any&#x20;existing&#x20;cron.deny&#x20;and&#x20;at.deny&#x20;files&#x20;3.&#x20;Create&#x20;or&#x20;replace&#x20;the&#x20;cron.allow&#x20;and&#x20;at.allow&#x20;files&#x20;with&#x20;a&#x20;single&#x20;line&#x20;file&#x20;containing&#x20;just&#x20;root&#x20;4.&#x20;Ensure&#x20;that&#x20;the&#x20;files&#x20;are&#x20;owned&#x20;by&#x20;root&#x20;and&#x20;group&#x20;owned&#x20;by&#x20;sys&#x20;5.&#x20;Ensure&#x20;that&#x20;no&#x20;users&#x20;have&#x20;write/execute&#x20;permission&#x20;to&#x20;the&#x20;files,&#x20;and&#x20;that&#x20;only&#x20;root&#x20;has&#x20;read&#x20;access&#x20;to&#x20;the&#x20;files.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedures&#x20;above:&#x20;cd&#x20;/var/adm/cron&#x20;rm&#x20;-f&#x20;cron.deny&#x20;at.deny&#x20;echo&#x20;root&#x20;&gt;cron.allow&#x20;echo&#x20;root&#x20;&gt;at.allow&#x20;chown&#x20;root:sys&#x20;cron.allow&#x20;at.allow&#x20;chmod&#x20;400&#x20;cron.allow&#x20;at.allow','[{\"cis\": [\"1.6.7\"]}, {\"cis_level\": [\"1\"]}]'),(25037,'Restrict&#x20;crontab&#x20;file&#x20;permissions.','The&#x20;system&#x20;crontab&#x20;files&#x20;are&#x20;only&#x20;accessed&#x20;by&#x20;the&#x20;cron&#x20;daemon&#x20;&#40;which&#x20;runs&#x20;with&#x20;superuser&#x20;privileges&#41;&#x20;and&#x20;the&#x20;crontab&#x20;command&#x20;&#40;which&#x20;is&#x20;set-UID&#x20;to&#x20;root&#41;.','Allowing&#x20;unprivileged&#x20;users&#x20;to&#x20;read&#x20;or&#x20;&#40;even&#x20;worse&#41;&#x20;modify&#x20;system&#x20;crontab&#x20;files&#x20;can&#x20;create&#x20;the&#x20;potential&#x20;for&#x20;a&#x20;local&#x20;user&#x20;on&#x20;the&#x20;system&#x20;to&#x20;gain&#x20;elevated&#x20;privileges.','','Perform&#x20;the&#x20;following&#x20;so&#x20;that&#x20;only&#x20;root&#x20;has&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;files:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/var/spool/cron/crontabs&#x20;directory&#x20;2.&#x20;Change&#x20;the&#x20;file&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;file&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;3.&#x20;Set&#x20;file&#x20;permissions&#x20;so&#x20;that&#x20;only&#x20;root&#x20;has&#x20;access&#x20;to&#x20;the&#x20;files.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;cd&#x20;/var/spool/cron/crontabs&#x20;chown&#x20;root:sys&#x20;*&#x20;chmod&#x20;og-rwx&#x20;*','[{\"cis\": [\"1.6.8\"]}, {\"cis_level\": [\"1\"]}]'),(25038,'Restrict&#x20;root&#x20;logins&#x20;to&#x20;system&#x20;console.','Anonymous&#x20;root&#x20;logins&#x20;should&#x20;never&#x20;be&#x20;allowed&#x20;except&#x20;on&#x20;the&#x20;system&#x20;console&#x20;in&#x20;emergency&#x20;situations.&#x20;At&#x20;all&#x20;other&#x20;times,&#x20;the&#x20;administrator&#x20;should&#x20;access&#x20;the&#x20;system&#x20;via&#x20;an&#x20;unprivileged&#x20;account&#x20;and&#x20;use&#x20;some&#x20;authorized&#x20;mechanism&#x20;to&#x20;gain&#x20;additional&#x20;privilege,&#x20;such&#x20;as&#x20;the&#x20;su&#x20;command,&#x20;the&#x20;freely-available&#x20;sudo&#x20;package&#x20;discussed&#x20;in&#x20;item&#x20;SN.6,&#x20;or&#x20;the&#x20;HP&#x20;Role&#x20;Based&#x20;Authorization&#x20;system&#x20;also&#x20;discussed&#x20;in&#x20;item&#x20;SN.6.&#x20;These&#x20;mechanisms&#x20;provide&#x20;at&#x20;least&#x20;a&#x20;limited&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;problems.','Anonymous&#x20;root&#x20;logins&#x20;do&#x20;not&#x20;provide&#x20;an&#x20;audit&#x20;trail,&#x20;nor&#x20;are&#x20;subject&#x20;to&#x20;additional&#x20;authorization&#x20;provisions.','','Perform&#x20;the&#x20;following&#x20;to&#x20;restrict&#x20;root&#x20;logins&#x20;to&#x20;the&#x20;system&#x20;console&#x20;only:&#x20;1.&#x20;Replace&#x20;the&#x20;file&#x20;/etc/securetty&#x20;with&#x20;a&#x20;single&#x20;line&#x20;file&#x20;containing&#x20;console&#x20;2.&#x20;Change&#x20;the&#x20;file&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;file&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;3.&#x20;Set&#x20;file&#x20;permissions&#x20;so&#x20;that&#x20;only&#x20;root&#x20;has&#x20;access&#x20;to&#x20;the&#x20;file.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;&#x20;echo&#x20;console&#x20;&gt;&#x20;/etc/securetty&#x20;chown&#x20;root:sys&#x20;/etc/securetty&#x20;chmod&#x20;og-rwx&#x20;/etc/securetty','[{\"cis\": [\"1.6.9\"]}, {\"cis_level\": [\"1\"]}]'),(25039,'Disable&#x20;nobody&#x20;access&#x20;for&#x20;secure&#x20;RPC.','The&#x20;keyserv&#x20;process&#x20;stores&#x20;user&#x20;keys&#x20;that&#x20;are&#x20;utilized&#x20;with&#x20;the&#x20;ONC&#x20;secure&#x20;RPC&#x20;mechanism.&#x20;The&#x20;action&#x20;below&#x20;prevents&#x20;keyserv&#x20;from&#x20;using&#x20;default&#x20;keys&#x20;for&#x20;the&#x20;&quot;nobody&quot;&#x20;user,&#x20;effectively&#x20;stopping&#x20;this&#x20;user&#x20;from&#x20;accessing&#x20;information&#x20;via&#x20;secure&#x20;RPC.','The&#x20;default&#x20;&#039;nobody&#039;&#x20;user&#x20;should&#x20;not&#x20;be&#x20;accessing&#x20;information&#x20;via&#x20;secure&#x20;RPC.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;nobody&#x20;access&#x20;for&#x20;secure&#x20;RPC:&#x20;1.&#x20;Add&#x20;the&#x20;&#039;-d&#039;&#x20;option&#x20;to&#x20;the&#x20;KEYSERV_OPTIONS&#x20;parameter&#x20;in&#x20;the&#x20;system&#x20;startup&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/namesvrs&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;KEYSERV_OPTIONS=&quot;`sh&#x20;-c&#x20;&#039;.&#x20;/etc/rc.config.d/namesvrs&#x20;;&#x20;echo&#x20;&quot;$KEYSERV_OPTIONS&quot;&#039;`&quot;&#x20;ch_rc&#x20;-a&#x20;-p&#x20;KEYSERV_OPTIONS=&quot;-d&#x20;$KEYSERV_OPTIONS&#x20;&quot;&#x20;&#x20;/etc/rc.config.d/namesvrs','[{\"cis\": [\"1.6.11\"]}, {\"cis_level\": [\"1\"]}]'),(25040,'Enable&#x20;logging&#x20;from&#x20;inetd.','If&#x20;inetd&#x20;is&#x20;running,&#x20;it&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;make&#x20;use&#x20;of&#x20;the&#x20;&quot;logging&quot;&#x20;&#40;-l&#41;&#x20;feature&#x20;of&#x20;the&#x20;HP-UX&#x20;inetd&#x20;that&#x20;logs&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;any&#x20;network&#x20;connections&#x20;seen&#x20;by&#x20;the&#x20;daemon,&#x20;allowing&#x20;the&#x20;administrator&#x20;&#40;or&#x20;software&#41;&#x20;to&#x20;scan&#x20;the&#x20;logs&#x20;for&#x20;unusual&#x20;activity.&#x20;This&#x20;is&#x20;especially&#x20;powerful&#x20;when&#x20;combined&#x20;with&#x20;the&#x20;access&#x20;control&#x20;capabilities&#x20;accessible&#x20;through&#x20;inetd&#039;s&#x20;/var/adm/inetd.sec&#x20;configuration&#x20;file.&#x20;This&#x20;information&#x20;is&#x20;logged&#x20;via&#x20;Syslog&#x20;and&#x20;by&#x20;default&#x20;HP-UX&#x20;systems&#x20;deposit&#x20;this&#x20;logging&#x20;information&#x20;in&#x20;var/adm/syslog/syslog.log&#x20;with&#x20;other&#x20;system&#x20;log&#x20;messages.&#x20;Should&#x20;the&#x20;administrator&#x20;wish&#x20;to&#x20;capture&#x20;this&#x20;information&#x20;in&#x20;a&#x20;separate&#x20;file,&#x20;simply&#x20;modify&#x20;/etc/syslog.conf&#x20;to&#x20;log&#x20;daemon.notice&#x20;to&#x20;some&#x20;other&#x20;log&#x20;file&#x20;destination.&#x20;IPFilter,&#x20;which&#x20;comes&#x20;with&#x20;HP-UX,&#x20;can&#x20;log&#x20;inetd&#x20;and&#x20;other&#x20;connections&#x20;or&#x20;attempted&#x20;connections&#x20;with&#x20;its&#x20;&quot;ipmon&quot;&#x20;daemon&#x20;as&#x20;either&#x20;a&#x20;compliment&#x20;or&#x20;alternative&#x20;to&#x20;inetd&#x20;logging.','Logging&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;inetd&#x20;network&#x20;connections&#x20;assists&#x20;in&#x20;the&#x20;detection&#x20;and&#x20;identification&#x20;of&#x20;unusual&#x20;activity&#x20;that&#x20;may&#x20;be&#x20;associated&#x20;with&#x20;security&#x20;intrusions.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;INETD_ARGS=-l&#x20;/etc/rc.config.d/netdaemons','[{\"cis\": [\"1.7.2\"]}, {\"cis_level\": [\"1\"]}]'),(25042,'Block&#x20;system&#x20;accounts.','Accounts&#x20;that&#x20;are&#x20;not&#x20;being&#x20;used&#x20;by&#x20;regular&#x20;users&#x20;should&#x20;be&#x20;locked.&#x20;Not&#x20;only&#x20;should&#x20;the&#x20;password&#x20;field&#x20;for&#x20;the&#x20;account&#x20;be&#x20;set&#x20;to&#x20;an&#x20;invalid&#x20;string,&#x20;but&#x20;the&#x20;shell&#x20;field&#x20;in&#x20;the&#x20;password&#x20;file&#x20;should&#x20;contain&#x20;an&#x20;invalid&#x20;shell.&#x20;Access&#x20;to&#x20;the&#x20;uucp&#x20;and&#x20;nuucp&#x20;accounts&#x20;is&#x20;only&#x20;needed&#x20;when&#x20;the&#x20;deprecated&#x20;Unix&#x20;to&#x20;Unix&#x20;Copy&#x20;&#40;UUCP&#41;&#x20;service&#x20;is&#x20;in&#x20;use.&#x20;The&#x20;other&#x20;listed&#x20;accounts&#x20;should&#x20;never&#x20;require&#x20;direct&#x20;access.&#x20;The&#x20;actions&#x20;below&#x20;locks&#x20;the&#x20;passwords&#x20;to&#x20;these&#x20;accounts&#x20;&#40;on&#x20;systems&#x20;converted&#x20;to&#x20;Trusted&#x20;Mode&#x20;only&#41;&#x20;and&#x20;sets&#x20;the&#x20;login&#x20;shell&#x20;to&#x20;/bin/false.&#x20;Note&#x20;that&#x20;the&#x20;above&#x20;is&#x20;not&#x20;an&#x20;exhaustive&#x20;list&#x20;of&#x20;possible&#x20;system/application&#x20;accounts&#x20;that&#x20;could&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;system.&#x20;An&#x20;audit&#x20;of&#x20;all&#x20;users&#x20;on&#x20;the&#x20;system&#x20;is&#x20;the&#x20;only&#x20;way&#x20;to&#x20;be&#x20;sure&#x20;that&#x20;only&#x20;authorized&#x20;accounts&#x20;are&#x20;in&#x20;place.','System&#x20;accounts&#x20;are&#x20;not&#x20;used&#x20;by&#x20;regular&#x20;users,&#x20;and&#x20;almost&#x20;never&#x20;require&#x20;direct&#x20;access;&#x20;thus,&#x20;they&#x20;should&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;malicious&#x20;usage.','','Perform&#x20;the&#x20;following&#x20;to&#x20;properly&#x20;lock&#x20;the&#x20;following&#x20;known&#x20;system&#x20;users:&#x20;www&#x20;sys&#x20;smbnull&#x20;iwww&#x20;owww&#x20;sshd&#x20;hpsmh&#x20;named&#x20;uucp&#x20;nuucp&#x20;adm&#x20;daemon&#x20;bin&#x20;lp&#x20;nobody&#x20;noaccess&#x20;hpdb&#x20;useradm&#x20;1.&#x20;Lock&#x20;the&#x20;account:&#x20;passwd&#x20;-l&#x20;&lt;user&gt;&#x20;2.&#x20;Set&#x20;the&#x20;login&#x20;shell&#x20;to&#x20;an&#x20;invalid&#x20;program:&#x20;/usr/sbin/usermod&#x20;-s&#x20;/bin/false&#x20;&lt;user&gt;&#x20;3.&#x20;If&#x20;a&#x20;trusted&#x20;system,&#x20;set&#x20;the&#x20;adminstrator&#x20;lock:&#x20;/usr/lbin/modprpw&#x20;-m&#x20;alock=YES&#x20;&lt;user&gt;&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;for&#x20;user&#x20;in&#x20;www&#x20;sys&#x20;smbnull&#x20;iwww&#x20;owww&#x20;sshd&#x20;&#x20;hpsmh&#x20;named&#x20;uucp&#x20;nuucp&#x20;adm&#x20;daemon&#x20;bin&#x20;lp&#x20;&#x20;nobody&#x20;noaccess&#x20;hpdb&#x20;useradm;&#x20;do&#x20;passwd&#x20;-l&#x20;&quot;$user&quot;&#x20;/usr/sbin/usermod&#x20;-s&#x20;/bin/false&#x20;&quot;$user&quot;&#x20;if&#x20;[[&#x20;-f&#x20;/tcb&#x20;]];&#x20;then&#x20;/usr/lbin/modprpw&#x20;-m&#x20;alock=YES&#x20;&quot;$user&quot;&#x20;fi&#x20;done','[{\"cis\": [\"1.8.1\"]}, {\"cis_level\": [\"1\"]}]'),(25043,'Verify&#x20;that&#x20;there&#x20;are&#x20;no&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;fields.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password&#x20;at&#x20;all.&#x20;All&#x20;accounts&#x20;should&#x20;have&#x20;strong&#x20;passwords&#x20;or&#x20;should&#x20;be&#x20;locked&#x20;by&#x20;using&#x20;a&#x20;password&#x20;string&#x20;like&#x20;&quot;*&quot;,&#x20;&quot;NP&quot;,&#x20;or&#x20;&quot;*LOCKED*&quot;','User&#x20;accounts&#x20;should&#x20;have&#x20;passwords,&#x20;or&#x20;be&#x20;locked.','','Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;no&#x20;accounts&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;field:&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field:&#x20;logins&#x20;-p&#x20;2.&#x20;Lock&#x20;each&#x20;account:&#x20;passwd&#x20;-l&#x20;&lt;user&gt;&#x20;3.&#x20;If&#x20;a&#x20;trusted&#x20;system,&#x20;set&#x20;the&#x20;administrator&#x20;lock:&#x20;/usr/lbin/modprpw&#x20;-m&#x20;alock=YES&#x20;&lt;user&gt;','[{\"cis\": [\"1.8.2\"]}, {\"cis_level\": [\"1\"]}]'),(25044,'Set&#x20;account&#x20;expiration&#x20;parameters&#x20;on&#x20;active&#x20;accounts.','The&#x20;commands&#x20;below&#x20;will&#x20;set&#x20;all&#x20;active&#x20;accounts&#x20;&#40;except&#x20;the&#x20;root&#x20;account&#41;&#x20;to&#x20;force&#x20;password&#x20;changes&#x20;every&#x20;90&#x20;days&#x20;&#40;91&#x20;days&#x20;when&#x20;not&#x20;running&#x20;in&#x20;HP-UX&#x20;Trusted&#x20;Mode&#41;&#x20;and&#x20;then&#x20;prevent&#x20;password&#x20;changes&#x20;for&#x20;seven&#x20;days&#x20;&#40;one&#x20;week&#41;&#x20;thereafter.&#x20;Users&#x20;will&#x20;begin&#x20;receiving&#x20;warnings&#x20;30&#x20;days&#x20;&#40;28&#x20;days&#x20;when&#x20;not&#x20;running&#x20;in&#x20;HP-UX&#x20;Trusted&#x20;Mode&#41;&#x20;before&#x20;their&#x20;password&#x20;expires.&#x20;Sites&#x20;also&#x20;have&#x20;the&#x20;option&#x20;of&#x20;expiring&#x20;idle&#x20;accounts&#x20;after&#x20;a&#x20;certain&#x20;number&#x20;of&#x20;days&#x20;&#40;see&#x20;the&#x20;on-line&#x20;manual&#x20;page&#x20;for&#x20;the&#x20;usermod&#x20;command,&#x20;particularly&#x20;the&#x20;-f&#x20;option&#41;.&#x20;These&#x20;are&#x20;recommended&#x20;starting&#x20;values,&#x20;but&#x20;sites&#x20;may&#x20;choose&#x20;to&#x20;make&#x20;them&#x20;more&#x20;restrictive&#x20;depending&#x20;on&#x20;local&#x20;policies.','It&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;force&#x20;users&#x20;to&#x20;change&#x20;passwords&#x20;on&#x20;a&#x20;regular&#x20;basis.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;password&#x20;expiration&#x20;parameters&#x20;on&#x20;all&#x20;active&#x20;accounts:&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts&#x20;excluding&#x20;root&#x20;that&#x20;are&#x20;not&#x20;locked,&#x20;and&#x20;for&#x20;each:&#x20;2.&#x20;Set&#x20;password&#x20;expiration&#x20;parameters&#x20;for&#x20;the&#x20;account&#x20;&#40;logname&#41;&#x20;by&#x20;executing&#x20;the&#x20;following:&#x20;passwd&#x20;-x&#x20;91&#x20;-n&#x20;7&#x20;-w&#x20;28&#x20;&lt;logname&gt;&#x20;for&#x20;trusted&#x20;systems,&#x20;perform&#x20;the&#x20;following:&#x20;/usr/lbin/modprpw&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30&#x20;&lt;logname&gt;&#x20;3.&#x20;Set&#x20;the&#x20;default&#x20;account&#x20;expiration&#x20;parameters&#x20;by&#x20;appending&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;/etc/default/security:&#x20;a.&#x20;PASSWORD_MAXDAYS=91&#x20;b.&#x20;PASSWORD_MINDAYS=7&#x20;c.&#x20;PASSWORD_WARNDAYS=28&#x20;4.&#x20;Set&#x20;the&#x20;default&#x20;parameters&#x20;for&#x20;trusted&#x20;systems&#x20;with:&#x20;/usr/lbin/modprdef&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above.&#x20;logins&#x20;-ox&#x20;&#x20;|&#x20;awk&#x20;-F:&#x20;&#039;&#40;$8&#x20;!=&#x20;&quot;LK&quot;&#x20;&amp;&amp;&#x20;$1&#x20;!=&#x20;&quot;root&quot;&#41;&#x20;{&#x20;print&#x20;$1&#x20;}&#039;&#x20;&#x20;|&#x20;while&#x20;read&#x20;logname;&#x20;do&#x20;passwd&#x20;-x&#x20;91&#x20;-n&#x20;7&#x20;-w&#x20;28&#x20;&quot;$logname&quot;&#x20;/usr/lbin/modprpw&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30&#x20;&#x20;&quot;$logname&quot;&#x20;done&#x20;echo&#x20;PASSWORD_MAXDAYS=91&#x20;&gt;&gt;&#x20;/etc/default/security&#x20;echo&#x20;PASSWORD_MINDAYS=7&#x20;&gt;&gt;&#x20;/etc/default/security&#x20;echo&#x20;PASSWORD_WARNDAYS=28&#x20;&gt;&gt;&#x20;/etc/default/security&#x20;/usr/lbin/modprdef&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30','[{\"cis\": [\"1.8.3\"]}, {\"cis_level\": [\"1\"]}]'),(25045,'Set&#x20;strong&#x20;password&#x20;enforcement&#x20;policies.','The&#x20;policies&#x20;set&#x20;here&#x20;are&#x20;designed&#x20;to&#x20;force&#x20;users&#x20;to&#x20;make&#x20;better&#x20;password&#x20;choices&#x20;when&#x20;changing&#x20;their&#x20;passwords.&#x20;Sites&#x20;often&#x20;have&#x20;differing&#x20;opinions&#x20;on&#x20;the&#x20;optimal&#x20;value&#x20;of&#x20;the&#x20;MIN_PASSWORD_LENGTH&#x20;and&#x20;PASSWORD_HISTORY_DEPTH&#x20;parameters.&#x20;A&#x20;minimum&#x20;password&#x20;length&#x20;of&#x20;seven&#x20;is&#x20;in&#x20;line&#x20;with&#x20;industry&#x20;standards,&#x20;especially&#x20;the&#x20;Payment&#x20;Card&#x20;Industry&#x20;&#40;PCI&#41;&#x20;Security&#x20;Standard;&#x20;however,&#x20;a&#x20;longer&#x20;value&#x20;may&#x20;be&#x20;warranted&#x20;if&#x20;account&#x20;locks&#x20;are&#x20;not&#x20;enabled&#x20;&#40;item&#x20;1.6.10&#41;.&#x20;A&#x20;password&#x20;history&#x20;depth&#x20;of&#x20;ten&#x20;combined&#x20;with&#x20;passwords&#x20;that&#x20;expire&#x20;four&#x20;times&#x20;per&#x20;year&#x20;&#40;item&#x20;1.8.3&#41;&#x20;means&#x20;users&#x20;will&#x20;typically&#x20;not&#x20;re-use&#x20;the&#x20;same&#x20;password&#x20;in&#x20;any&#x20;given&#x20;year.&#x20;Requiring&#x20;an&#x20;upper/lowercase&#x20;and&#x20;special&#x20;character&#x20;password&#x20;will&#x20;dramatically&#x20;increase&#x20;the&#x20;password&#x20;search&#x20;space&#x20;and&#x20;lower&#x20;the&#x20;chances&#x20;for&#x20;brute-force&#x20;attack&#x20;significantly.&#x20;-&#x20;Note:&#x20;these&#x20;settings&#x20;are&#x20;known&#x20;to&#x20;exist&#x20;for&#x20;HP-UX&#x20;11iv2,&#x20;0512&#x20;and&#x20;later.&#x20;The&#x20;man&#x20;page&#x20;for&#x20;security&#40;5&#41;&#x20;will&#x20;indicate&#x20;if&#x20;these&#x20;exist&#x20;on&#x20;your&#x20;particular&#x20;system.&#x20;Be&#x20;sure&#x20;to&#x20;consult&#x20;you&#x20;local&#x20;security&#x20;standards&#x20;before&#x20;adopting&#x20;the&#x20;values&#x20;given&#x20;above.','All&#x20;users&#x20;should&#x20;use&#x20;strong&#x20;passwords.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;strong&#x20;password&#x20;enforcement&#x20;policies:&#x20;1.&#x20;Change&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;the&#x20;/etc/default/security&#x20;file&#x20;to&#x20;establish&#x20;default&#x20;password&#x20;policies&#x20;for&#x20;new&#x20;users:&#x20;a.&#x20;MIN_PASSORD_LENGTH=7&#x20;b.&#x20;PASSWORD_HISTORY_DEPTH=10&#x20;c.&#x20;PASSWORD_MIN_UPPER_CASE_CHARS=1&#x20;d.&#x20;PASSWORD_MIN_DIGIT_CHARS=1&#x20;e.&#x20;PASSWORD_MIN_SPECIAL_CHARS=1&#x20;f.&#x20;PASSWORD_MIN_LOWER_CASE_CHARS=1&#x20;2.&#x20;If&#x20;using&#x20;a&#x20;trusted&#x20;system,&#x20;issue&#x20;the&#x20;following&#x20;modprdef&#x20;commands&#x20;to&#x20;disallow&#x20;null&#x20;or&#x20;trivial&#x20;passwords:&#x20;&#x20;modprdef&#x20;-m&#x20;nullpw=NO&#x20;modprdef&#x20;-m&#x20;rstrpw=YES&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;modprdef&#x20;-m&#x20;nullpw=NO&#x20;modprdef&#x20;-m&#x20;rstrpw=YES&#x20;ch_rc&#x20;-a&#x20;-p&#x20;MIN_PASSORD_LENGTH=7&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_HISTORY_DEPTH=10&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_UPPER_CASE_CHARS=1&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_DIGIT_CHARS=1&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_SPECIAL_CHARS=1&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_LOWER_CASE_CHARS=1&#x20;&#x20;/etc/default/security&#x20;modprdef&#x20;-m&#x20;nullpw=NO&#x20;modprdef&#x20;-m&#x20;rstrpw=YES','[{\"cis\": [\"1.8.4\"]}, {\"cis_level\": [\"1\"]}]'),(25046,'Verify&#x20;no&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;exist&#x20;in&#x20;passwd&#x20;and&#x20;group&#x20;files.','&#039;+&#039;&#x20;entries&#x20;in&#x20;various&#x20;passwd&#x20;and&#x20;group&#x20;files&#x20;served&#x20;as&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;HP-UX&#x20;does&#x20;not&#x20;use&#x20;these&#x20;markers,&#x20;but&#x20;they&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.&#x20;They&#x20;should&#x20;be&#x20;deleted&#x20;if&#x20;they&#x20;exist.','Legacy&#x20;&#039;+&#039;&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;HP-UX&#x20;systems,&#x20;and&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;in&#x20;passwd&#x20;and&#x20;group&#x20;files:&#x20;1.&#x20;Display&#x20;legacy&#x20;&#039;+&#039;&#x20;entries:&#x20;grep&#x20;&#039;^+:&#039;&#x20;/etc/passwd&#x20;/etc/group&#x20;2.&#x20;Remove&#x20;any&#x20;entries&#x20;found&#x20;from&#x20;the&#x20;passwd&#x20;and&#x20;group&#x20;files.','[{\"cis\": [\"1.8.5\"]}, {\"cis_level\": [\"1\"]}]'),(25047,'Set&#x20;default&#x20;umask&#x20;for&#x20;users.','Set&#x20;the&#x20;default&#x20;umask&#x20;to&#x20;077&#x20;so&#x20;that&#x20;files&#x20;created&#x20;by&#x20;users&#x20;will&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;Bastille&#x20;Note:&#x20;sets&#x20;the&#x20;default&#x20;umask,&#x20;but&#x20;uses&#x20;a&#x20;umask&#x20;of&#x20;027&#x20;rather&#x20;than&#x20;the&#x20;077.','Restricting&#x20;access&#x20;to&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;a&#x20;user&#x20;from&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system&#x20;reduces&#x20;the&#x20;possibility&#x20;of&#x20;an&#x20;unauthorized&#x20;account&#x20;accessing&#x20;that&#x20;user&#039;s&#x20;files.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;.profile,&#x20;.cshrc,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;a&#x20;default&#x20;umask&#x20;for&#x20;users:&#x20;1.&#x20;Change&#x20;directory&#x20;to&#x20;/etc&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;umask&#x20;077&#x20;to&#x20;the&#x20;following&#x20;files:&#x20;a.&#x20;profile&#x20;b.&#x20;csh.login&#x20;c.&#x20;d.profile&#x20;d.&#x20;d.login&#x20;3.&#x20;Update&#x20;the&#x20;UMASK&#x20;parameter&#x20;to&#x20;077&#x20;in&#x20;the&#x20;file&#x20;/etc/default/security&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;cd&#x20;/etc&#x20;for&#x20;file&#x20;in&#x20;profile&#x20;csh.login&#x20;d.profile&#x20;d.login&#x20;do&#x20;echo&#x20;umask&#x20;077&#x20;&gt;&gt;&#x20;&quot;$file&quot;&#x20;done&#x20;ch_rc&#x20;-a&#x20;-p&#x20;UMASK=077&#x20;/etc/default/security','[{\"cis\": [\"1.8.10\"]}, {\"cis_level\": [\"1\"]}]'),(25048,'Set&#x20;&#039;mesg&#x20;n&#039;&#x20;as&#x20;default&#x20;for&#x20;all&#x20;users.','Block&#x20;the&#x20;use&#x20;of&#x20;write&#x20;or&#x20;talk&#x20;commands&#x20;to&#x20;contact&#x20;the&#x20;user&#x20;at&#x20;their&#x20;terminal&#x20;in&#x20;order&#x20;to&#x20;slightly&#x20;strengthen&#x20;permissions&#x20;on&#x20;the&#x20;user&#039;s&#x20;tty&#x20;device.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;is&#x20;the&#x20;default&#x20;on&#x20;HP-UX&#x20;11i.','Since&#x20;write&#x20;and&#x20;talk&#x20;are&#x20;no&#x20;longer&#x20;widely&#x20;used&#x20;at&#x20;most&#x20;sites,&#x20;the&#x20;incremental&#x20;security&#x20;increase&#x20;is&#x20;worth&#x20;the&#x20;loss&#x20;of&#x20;functionality.','','Perform&#x20;the&#x20;following:&#x20;1.&#x20;Change&#x20;directory&#x20;to&#x20;/etc&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;mesg&#x20;n&#x20;to&#x20;the&#x20;following&#x20;files:&#x20;a.&#x20;profile&#x20;b.&#x20;csh.login&#x20;c.&#x20;d.profile&#x20;d.&#x20;d.login&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;&#x20;cd&#x20;/etc&#x20;for&#x20;file&#x20;in&#x20;profile&#x20;csh.login&#x20;d.profile&#x20;d.login&#x20;do&#x20;&#x20;echo&#x20;mesg&#x20;n&#x20;&gt;&gt;&#x20;&quot;$file&quot;&#x20;done','[{\"cis\": [\"1.8.11\"]}, {\"cis_level\": [\"1\"]}]'),(25049,'Create&#x20;warning&#x20;banners&#x20;for&#x20;terminal-session&#x20;logins.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;prior&#x20;to&#x20;the&#x20;login&#x20;prompt&#x20;on&#x20;the&#x20;system&#039;s&#x20;console&#x20;and&#x20;serial&#x20;devices,&#x20;as&#x20;well&#x20;as&#x20;for&#x20;remote&#x20;terminal-session&#x20;logins&#x20;such&#x20;as&#x20;through&#x20;SSH&#x20;or&#x20;Telnet.&#x20;/etc/motd&#x20;is&#x20;generally&#x20;displayed&#x20;after&#x20;all&#x20;successful&#x20;logins,&#x20;no&#x20;matter&#x20;where&#x20;the&#x20;user&#x20;is&#x20;logging&#x20;in&#x20;from,&#x20;but&#x20;is&#x20;thought&#x20;to&#x20;be&#x20;less&#x20;useful&#x20;because&#x20;it&#x20;only&#x20;provides&#x20;notification&#x20;to&#x20;the&#x20;user&#x20;after&#x20;the&#x20;machine&#x20;has&#x20;been&#x20;accessed.','Presenting&#x20;some&#x20;sort&#x20;of&#x20;statutory&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;logon&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.&#x20;Changing&#x20;some&#x20;of&#x20;these&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;hiding&#x20;OS&#x20;version&#x20;information&#x20;and&#x20;other&#x20;detailed&#x20;system&#x20;information&#x20;from&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;attacks&#x20;at&#x20;a&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;create&#x20;warning&#x20;banners&#x20;for&#x20;terminal-session&#x20;logins:&#x20;1.&#x20;Compose&#x20;a&#x20;default&#x20;banner&#x20;text&#x20;string&#x20;2.&#x20;Append&#x20;this&#x20;string&#x20;to&#x20;the&#x20;files&#x20;/etc/motd&#x20;and&#x20;/etc/motd&#x20;3.&#x20;Change&#x20;the&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;for&#x20;the&#x20;file&#x20;/etc/motd&#x20;4.&#x20;Change&#x20;the&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;root&#x20;for&#x20;the&#x20;file&#x20;/etc/issue&#x20;5.&#x20;Change&#x20;file&#x20;permissions&#x20;to&#x20;&#40;644&#41;&#x20;for&#x20;the&#x20;files&#x20;/etc/motd&#x20;and&#x20;/etc/issue&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;banner=&quot;Authorized&#x20;users&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;echo&#x20;&quot;$banner&quot;&#x20;&gt;&gt;&#x20;/etc/motd&#x20;echo&#x20;&quot;$banner&quot;&#x20;&gt;&gt;&#x20;/etc/issue&#x20;chown&#x20;root:sys&#x20;/etc/motd&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;chmod&#x20;644&#x20;/etc/motd&#x20;/etc/issue','[{\"cis\": [\"1.9.1\"]}, {\"cis_level\": [\"1\"]}]'),(25050,'Create&#x20;warning&#x20;banners&#x20;for&#x20;FTP&#x20;daemon.','The&#x20;FTP&#x20;daemon&#x20;in&#x20;HP-UX&#x20;11&#x20;is&#x20;based&#x20;on&#x20;the&#x20;popular&#x20;Washington&#x20;University&#x20;FTP&#x20;daemon&#x20;&#40;WU-FTPD&#41;,&#x20;which&#x20;is&#x20;an&#x20;Open&#x20;Source&#x20;program&#x20;widely&#x20;distributed&#x20;on&#x20;the&#x20;Internet.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;if&#x20;the&#x20;FTP&#x20;daemon&#x20;remains&#x20;de-activated&#x20;from&#x20;item&#x20;1.2.1.','Presenting&#x20;some&#x20;sort&#x20;of&#x20;statutory&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;logon&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.&#x20;Changing&#x20;some&#x20;of&#x20;these&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;hiding&#x20;OS&#x20;version&#x20;information&#x20;and&#x20;other&#x20;detailed&#x20;system&#x20;information&#x20;from&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;attacks&#x20;at&#x20;a&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;install&#x20;a&#x20;default&#x20;warning&#x20;banner&#x20;for&#x20;the&#x20;FTP&#x20;daemon:&#x20;1.&#x20;Ensure&#x20;that&#x20;an&#x20;appropriate&#x20;warning&#x20;message&#x20;exists&#x20;in&#x20;the&#x20;/etc/issue&#x20;file&#x20;.&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;&quot;banner&#x20;/etc/issue&quot;&#x20;to&#x20;the&#x20;file&#x20;/etc/ftpd/ftpaccess&#x20;3.&#x20;Change&#x20;file&#x20;permissions&#x20;to&#x20;600&#x20;for&#x20;/etc/ftpd/ftpaccess&#x20;4.&#x20;Change&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;for&#x20;both&#x20;/etc/ftpd&#x20;and&#x20;/etc/ftpd/ftpaccess&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;if&#x20;[&#x20;-d&#x20;/etc/ftpd&#x20;];&#x20;then&#x20;echo&#x20;&quot;banner&#x20;/etc/issue&quot;&#x20;&gt;&gt;/etc/ftpd/ftpaccess&#x20;chmod&#x20;600&#x20;/etc/ftpd/ftpaccess&#x20;chown&#x20;root:sys&#x20;/etc/ftpd&#x20;/etc/ftpd/ftpaccess&#x20;fi','[{\"cis\": [\"1.9.3\"]}, {\"cis_level\": [\"1\"]}]'),(25141,'Turn&#x20;on&#x20;additional&#x20;logging&#x20;for&#x20;FTP&#x20;daemon.','If&#x20;the&#x20;FTP&#x20;daemon&#x20;is&#x20;left&#x20;on,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;command&#x20;logging&#x20;&#40;-L&#41;&#x20;and&#x20;connection&#x20;logging&#x20;&#40;-l&#41;&#x20;flags&#x20;also&#x20;be&#x20;enabled&#x20;to&#x20;track&#x20;FTP&#x20;activity&#x20;on&#x20;the&#x20;system,&#x20;allowing&#x20;the&#x20;administrator&#x20;&#40;or&#x20;software&#41;&#x20;to&#x20;scan&#x20;the&#x20;logs&#x20;for&#x20;unusual&#x20;activity.&#x20;This&#x20;is&#x20;especially&#x20;powerful&#x20;when&#x20;combined&#x20;with&#x20;the&#x20;access&#x20;control&#x20;capabilities&#x20;accessible&#x20;through&#x20;inetd&#039;s&#x20;/var/adm/inetd.sec&#x20;configuration&#x20;file.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;if&#x20;the&#x20;FTP&#x20;daemon&#x20;remains&#x20;de-activated&#x20;from&#x20;item&#x20;2.1.&#x20;Also&#x20;note&#x20;that&#x20;enabling&#x20;command&#x20;logging&#x20;on&#x20;the&#x20;FTP&#x20;daemon&#x20;&#40;HP-UX&#x20;11.x&#x20;only&#41;&#x20;can&#x20;cause&#x20;user&#x20;passwords&#x20;to&#x20;appear&#x20;in&#x20;clear-text&#x20;form&#x20;in&#x20;the&#x20;system&#x20;logs,&#x20;if&#x20;the&#x20;user&#x20;accidentally&#x20;types&#x20;their&#x20;password&#x20;at&#x20;the&#x20;username&#x20;prompt.&#x20;Information&#x20;about&#x20;FTP&#x20;sessions&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;Syslog&#x20;and&#x20;by&#x20;default&#x20;HP-UX&#x20;systems&#x20;deposit&#x20;this&#x20;logging&#x20;information&#x20;in&#x20;/var/adm/syslog/syslog.log&#x20;with&#x20;other&#x20;system&#x20;log&#x20;messages.&#x20;Should&#x20;the&#x20;administrator&#x20;wish&#x20;to&#x20;capture&#x20;this&#x20;information&#x20;in&#x20;a&#x20;separate&#x20;file,&#x20;simply&#x20;modify&#x20;/etc/syslog.conf&#x20;to&#x20;log&#x20;daemon.notice&#x20;to&#x20;some&#x20;other&#x20;log&#x20;file&#x20;destination.','Logging&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;ftp&#x20;network&#x20;connections&#x20;assists&#x20;in&#x20;the&#x20;detection&#x20;and&#x20;identification&#x20;of&#x20;unusual&#x20;activity&#x20;that&#x20;may&#x20;be&#x20;associated&#x20;with&#x20;security&#x20;intrusions.','','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;logging&#x20;for&#x20;the&#x20;FTP&#x20;daemon:&#x20;1.&#x20;Change&#x20;directory&#x20;to&#x20;/etc.&#x20;2.&#x20;Open&#x20;the&#x20;inetd.conf&#x20;file&#x20;and&#x20;locate&#x20;the&#x20;ftpd&#x20;configuration&#x20;entry&#x20;line.&#x20;3.&#x20;Add&#x20;the&#x20;&quot;-L&quot;&#x20;and&#x20;&quot;-l&quot;&#x20;flags&#x20;to&#x20;the&#x20;ftpd&#x20;entry&#x20;if&#x20;not&#x20;already&#x20;present.&#x20;4.&#x20;Save&#x20;and&#x20;close&#x20;file.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;cd&#x20;/etc&#x20;awk&#x20;&#039;/^ftpd/&#x20;&amp;&amp;&#x20;!/-L/&#x20;{&#x20;$NF&#x20;=&#x20;$NF&#x20;&quot;&#x20;-L&quot;&#x20;}&#x20;/^ftpd/&#x20;&amp;&amp;&#x20;!/-l/&#x20;{&#x20;$NF&#x20;=&#x20;$NF&#x20;&quot;&#x20;-l&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.tmp&#x20;cp&#x20;inetd.conf.tmp&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;inetd.conf.tmp','[{\"cis\": [\"1.7.3\"]}, {\"cis_level\": [\"1\"]}]'),(26000,'Ensure&#x20;&#039;Enforce&#x20;password&#x20;history&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;24&#x20;or&#x20;more&#x20;password&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;renewed,&#x20;unique&#x20;passwords&#x20;that&#x20;have&#x20;to&#x20;be&#x20;associated&#x20;with&#x20;a&#x20;user&#x20;account&#x20;before&#x20;you&#x20;can&#x20;reuse&#x20;an&#x20;old&#x20;password.&#x20;The&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;must&#x20;be&#x20;between&#x20;0&#x20;and&#x20;24&#x20;passwords.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;Windows&#x20;Vista&#x20;is&#x20;0&#x20;passwords,&#x20;but&#x20;the&#x20;default&#x20;setting&#x20;in&#x20;a&#x20;domain&#x20;is&#x20;24&#x20;passwords.&#x20;To&#x20;maintain&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;policy&#x20;setting,&#x20;use&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;24&#x20;or&#x20;more&#x20;password&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.&#x20;Note&#x20;#2:&#x20;As&#x20;of&#x20;the&#x20;publication&#x20;of&#x20;this&#x20;benchmark,&#x20;Microsoft&#x20;currently&#x20;has&#x20;a&#x20;maximum&#x20;limit&#x20;of&#x20;24&#x20;saved&#x20;passwords.&#x20;For&#x20;more&#x20;information,&#x20;please&#x20;visit&#x20;Enforce&#x20;password&#x20;history&#x20;&#40;Windows&#x20;10&#41;&#x20;-&#x20;Windows&#x20;security&#x20;|&#x20;Microsoft&#x20;Docs','The&#x20;longer&#x20;a&#x20;user&#x20;uses&#x20;the&#x20;same&#x20;password,&#x20;the&#x20;greater&#x20;the&#x20;chance&#x20;that&#x20;an&#x20;attacker&#x20;can&#x20;determine&#x20;the&#x20;password&#x20;through&#x20;brute&#x20;force&#x20;attacks.&#x20;Also,&#x20;any&#x20;accounts&#x20;that&#x20;may&#x20;have&#x20;been&#x20;compromised&#x20;will&#x20;remain&#x20;exploitable&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;password&#x20;is&#x20;left&#x20;unchanged.&#x20;If&#x20;password&#x20;changes&#x20;are&#x20;required&#x20;but&#x20;password&#x20;reuse&#x20;is&#x20;not&#x20;prevented,&#x20;or&#x20;if&#x20;users&#x20;continually&#x20;reuse&#x20;a&#x20;small&#x20;number&#x20;of&#x20;passwords,&#x20;the&#x20;effectiveness&#x20;of&#x20;a&#x20;good&#x20;password&#x20;policy&#x20;is&#x20;greatly&#x20;reduced.&#x20;If&#x20;you&#x20;specify&#x20;a&#x20;low&#x20;number&#x20;for&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;use&#x20;the&#x20;same&#x20;small&#x20;number&#x20;of&#x20;passwords&#x20;repeatedly.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;also&#x20;configure&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting,&#x20;users&#x20;might&#x20;repeatedly&#x20;change&#x20;their&#x20;passwords&#x20;until&#x20;they&#x20;can&#x20;reuse&#x20;their&#x20;original&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;24&#x20;or&#x20;more&#x20;password&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyEnforce&#x20;password&#x20;history','[{\"cis\": [\"1.1.1\"]}, {\"cis_csc\": [\"5.2\"]}]'),(26001,'Ensure&#x20;&#039;Maximum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;defines&#x20;how&#x20;long&#x20;a&#x20;user&#x20;can&#x20;use&#x20;their&#x20;password&#x20;before&#x20;it&#x20;expires.&#x20;Values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;range&#x20;from&#x20;0&#x20;to&#x20;999&#x20;days.&#x20;If&#x20;you&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0,&#x20;the&#x20;password&#x20;will&#x20;never&#x20;expire.&#x20;Because&#x20;attackers&#x20;can&#x20;crack&#x20;passwords,&#x20;the&#x20;more&#x20;frequently&#x20;you&#x20;change&#x20;the&#x20;password&#x20;the&#x20;less&#x20;opportunity&#x20;an&#x20;attacker&#x20;has&#x20;to&#x20;use&#x20;a&#x20;cracked&#x20;password.&#x20;However,&#x20;the&#x20;lower&#x20;this&#x20;value&#x20;is&#x20;set,&#x20;the&#x20;higher&#x20;the&#x20;potential&#x20;for&#x20;an&#x20;increase&#x20;in&#x20;calls&#x20;to&#x20;help&#x20;desk&#x20;support&#x20;due&#x20;to&#x20;users&#x20;having&#x20;to&#x20;change&#x20;their&#x20;password&#x20;or&#x20;forgetting&#x20;which&#x20;password&#x20;is&#x20;current.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','The&#x20;longer&#x20;a&#x20;password&#x20;exists&#x20;the&#x20;higher&#x20;the&#x20;likelihood&#x20;that&#x20;it&#x20;will&#x20;be&#x20;compromised&#x20;by&#x20;a&#x20;brute&#x20;force&#x20;attack,&#x20;by&#x20;an&#x20;attacker&#x20;gaining&#x20;general&#x20;knowledge&#x20;about&#x20;the&#x20;user,&#x20;or&#x20;by&#x20;the&#x20;user&#x20;sharing&#x20;the&#x20;password.&#x20;Configuring&#x20;the&#x20;Maximum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;0&#x20;so&#x20;that&#x20;users&#x20;are&#x20;never&#x20;required&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;is&#x20;a&#x20;major&#x20;security&#x20;risk&#x20;because&#x20;that&#x20;allows&#x20;a&#x20;compromised&#x20;password&#x20;to&#x20;be&#x20;used&#x20;by&#x20;the&#x20;malicious&#x20;user&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;valid&#x20;user&#x20;has&#x20;authorized&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMaximum&#x20;password&#x20;age','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.2\"]}]'),(26002,'Ensure&#x20;&#039;Minimum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#x20;or&#x20;more&#x20;day&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;days&#x20;that&#x20;you&#x20;must&#x20;use&#x20;a&#x20;password&#x20;before&#x20;you&#x20;can&#x20;change&#x20;it.&#x20;The&#x20;range&#x20;of&#x20;values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;between&#x20;1&#x20;and&#x20;999&#x20;days.&#x20;&#40;You&#x20;may&#x20;also&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0&#x20;to&#x20;allow&#x20;immediate&#x20;password&#x20;changes.&#41;&#x20;The&#x20;default&#x20;value&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;0&#x20;days.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;1&#x20;or&#x20;more&#x20;day&#40;s&#41;&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Users&#x20;may&#x20;have&#x20;favorite&#x20;passwords&#x20;that&#x20;they&#x20;like&#x20;to&#x20;use&#x20;because&#x20;they&#x20;are&#x20;easy&#x20;to&#x20;remember&#x20;and&#x20;they&#x20;believe&#x20;that&#x20;their&#x20;password&#x20;choice&#x20;is&#x20;secure&#x20;from&#x20;compromise.&#x20;Unfortunately,&#x20;passwords&#x20;are&#x20;compromised&#x20;and&#x20;if&#x20;an&#x20;attacker&#x20;is&#x20;targeting&#x20;a&#x20;specific&#x20;individual&#039;s&#x20;user&#x20;account,&#x20;with&#x20;foreknowledge&#x20;of&#x20;data&#x20;about&#x20;that&#x20;user,&#x20;reuse&#x20;of&#x20;old&#x20;passwords&#x20;can&#x20;cause&#x20;a&#x20;security&#x20;breach.&#x20;To&#x20;address&#x20;password&#x20;reuse&#x20;a&#x20;combination&#x20;of&#x20;security&#x20;settings&#x20;is&#x20;required.&#x20;Using&#x20;this&#x20;policy&#x20;setting&#x20;with&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;prevents&#x20;the&#x20;easy&#x20;reuse&#x20;of&#x20;old&#x20;passwords.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;configure&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;reuse&#x20;any&#x20;of&#x20;their&#x20;last&#x20;12&#x20;passwords,&#x20;they&#x20;could&#x20;change&#x20;their&#x20;password&#x20;13&#x20;times&#x20;in&#x20;a&#x20;few&#x20;minutes&#x20;and&#x20;reuse&#x20;the&#x20;password&#x20;they&#x20;started&#x20;with,&#x20;unless&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;a&#x20;number&#x20;that&#x20;is&#x20;greater&#x20;than&#x20;0.&#x20;You&#x20;must&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;a&#x20;number&#x20;that&#x20;is&#x20;greater&#x20;than&#x20;0&#x20;for&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;to&#x20;be&#x20;effective.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;1&#x20;or&#x20;more&#x20;day&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMinimum&#x20;password&#x20;age','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.2\"]}]'),(26003,'Ensure&#x20;&#039;Minimum&#x20;password&#x20;length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;14&#x20;or&#x20;more&#x20;character&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;least&#x20;number&#x20;of&#x20;characters&#x20;that&#x20;make&#x20;up&#x20;a&#x20;password&#x20;for&#x20;a&#x20;user&#x20;account.&#x20;There&#x20;are&#x20;many&#x20;different&#x20;theories&#x20;about&#x20;how&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;password&#x20;length&#x20;for&#x20;an&#x20;organization,&#x20;but&#x20;perhaps&#x20;&#039;passphrase&#039;&#x20;is&#x20;a&#x20;better&#x20;term&#x20;than&#x20;&#039;password.&#039;&#x20;In&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;and&#x20;newer,&#x20;passphrases&#x20;can&#x20;be&#x20;quite&#x20;long&#x20;and&#x20;can&#x20;include&#x20;spaces.&#x20;Therefore,&#x20;a&#x20;phrase&#x20;such&#x20;as&#x20;&#039;I&#x20;want&#x20;to&#x20;drink&#x20;a&#x20;$5&#x20;milkshake&#039;&#x20;is&#x20;a&#x20;valid&#x20;passphrase;&#x20;it&#x20;is&#x20;a&#x20;considerably&#x20;stronger&#x20;password&#x20;than&#x20;an&#x20;8&#x20;or&#x20;10&#x20;character&#x20;string&#x20;of&#x20;random&#x20;numbers&#x20;and&#x20;letters,&#x20;and&#x20;yet&#x20;is&#x20;easier&#x20;to&#x20;remember.&#x20;Users&#x20;must&#x20;be&#x20;educated&#x20;about&#x20;the&#x20;proper&#x20;selection&#x20;and&#x20;maintenance&#x20;of&#x20;passwords,&#x20;especially&#x20;with&#x20;regard&#x20;to&#x20;password&#x20;length.&#x20;In&#x20;enterprise&#x20;environments,&#x20;the&#x20;ideal&#x20;value&#x20;for&#x20;the&#x20;Minimum&#x20;password&#x20;length&#x20;setting&#x20;is&#x20;14&#x20;characters,&#x20;however&#x20;you&#x20;should&#x20;adjust&#x20;this&#x20;value&#x20;to&#x20;meet&#x20;your&#x20;organization&#039;s&#x20;business&#x20;requirements.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;14&#x20;or&#x20;more&#x20;character&#40;s&#41;.&#x20;Note:&#x20;In&#x20;Windows&#x20;Server&#x20;2016&#x20;and&#x20;older&#x20;versions&#x20;of&#x20;Windows&#x20;Server,&#x20;the&#x20;GUI&#x20;of&#x20;the&#x20;Local&#x20;Security&#x20;Policy&#x20;&#40;LSP&#41;,&#x20;Local&#x20;Group&#x20;Policy&#x20;Editor&#x20;&#40;LGPE&#41;&#x20;and&#x20;Group&#x20;Policy&#x20;Management&#x20;Editor&#x20;&#40;GPME&#41;&#x20;would&#x20;not&#x20;let&#x20;you&#x20;set&#x20;this&#x20;value&#x20;higher&#x20;than&#x20;14&#x20;characters.&#x20;However,&#x20;starting&#x20;with&#x20;Windows&#x20;Server&#x20;2019,&#x20;Microsoft&#x20;changed&#x20;the&#x20;GUI&#x20;to&#x20;allow&#x20;up&#x20;to&#x20;a&#x20;20&#x20;character&#x20;minimum&#x20;password&#x20;length.&#x20;Note&#x20;#2:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Types&#x20;of&#x20;password&#x20;attacks&#x20;include&#x20;dictionary&#x20;attacks&#x20;&#40;which&#x20;attempt&#x20;to&#x20;use&#x20;common&#x20;words&#x20;and&#x20;phrases&#41;&#x20;and&#x20;brute&#x20;force&#x20;attacks&#x20;&#40;which&#x20;try&#x20;every&#x20;possible&#x20;combination&#x20;of&#x20;characters&#41;.&#x20;Also,&#x20;attackers&#x20;sometimes&#x20;try&#x20;to&#x20;obtain&#x20;the&#x20;account&#x20;database&#x20;so&#x20;they&#x20;can&#x20;use&#x20;tools&#x20;to&#x20;discover&#x20;the&#x20;accounts&#x20;and&#x20;passwords.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;14&#x20;or&#x20;more&#x20;character&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMinimum&#x20;password&#x20;length','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.2\"]}]'),(26004,'Ensure&#x20;&#039;Password&#x20;must&#x20;meet&#x20;complexity&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;checks&#x20;all&#x20;new&#x20;passwords&#x20;to&#x20;ensure&#x20;that&#x20;they&#x20;meet&#x20;basic&#x20;requirements&#x20;for&#x20;strong&#x20;passwords.&#x20;When&#x20;this&#x20;policy&#x20;is&#x20;enabled,&#x20;passwords&#x20;must&#x20;meet&#x20;the&#x20;following&#x20;minimum&#x20;requirements:&#x20;-&#x20;Not&#x20;contain&#x20;the&#x20;user&#039;s&#x20;account&#x20;name&#x20;or&#x20;parts&#x20;of&#x20;the&#x20;user&#039;s&#x20;full&#x20;name&#x20;that&#x20;exceed&#x20;two&#x20;consecutive&#x20;characters&#x20;-&#x20;Be&#x20;at&#x20;least&#x20;six&#x20;characters&#x20;in&#x20;length&#x20;-&#x20;Contain&#x20;characters&#x20;from&#x20;three&#x20;of&#x20;the&#x20;following&#x20;categories:&#x20;-&#x20;English&#x20;uppercase&#x20;characters&#x20;&#40;A&#x20;through&#x20;Z&#41;&#x20;-&#x20;English&#x20;lowercase&#x20;characters&#x20;&#40;a&#x20;through&#x20;z&#41;&#x20;-&#x20;Base&#x20;10&#x20;digits&#x20;&#40;0&#x20;through&#x20;9&#41;&#x20;-&#x20;Non-alphabetic&#x20;characters&#x20;&#40;for&#x20;example,&#x20;!,&#x20;$,&#x20;#,&#x20;%&#41;&#x20;o&#x20;A&#x20;catch-all&#x20;category&#x20;of&#x20;any&#x20;Unicode&#x20;character&#x20;that&#x20;does&#x20;not&#x20;fall&#x20;under&#x20;the&#x20;&#x20;&#x20;&#x20;previous&#x20;four&#x20;categories.&#x20;This&#x20;fifth&#x20;category&#x20;can&#x20;be&#x20;regionally&#x20;specific.&#x20;Each&#x20;additional&#x20;character&#x20;in&#x20;a&#x20;password&#x20;increases&#x20;its&#x20;complexity&#x20;exponentially.&#x20;For&#x20;instance,&#x20;a&#x20;seven-character,&#x20;all&#x20;lower-case&#x20;alphabetic&#x20;password&#x20;would&#x20;have&#x20;267&#x20;&#40;approximately&#x20;8&#x20;x&#x20;109&#x20;or&#x20;8&#x20;billion&#41;&#x20;possible&#x20;combinations.&#x20;At&#x20;1,000,000&#x20;attempts&#x20;per&#x20;second&#x20;&#40;a&#x20;capability&#x20;of&#x20;many&#x20;password-cracking&#x20;utilities&#41;,&#x20;it&#x20;would&#x20;only&#x20;take&#x20;133&#x20;minutes&#x20;to&#x20;crack.&#x20;A&#x20;seven-character&#x20;alphabetic&#x20;password&#x20;with&#x20;case&#x20;sensitivity&#x20;has&#x20;527&#x20;combinations.&#x20;A&#x20;seven-character&#x20;case-sensitive&#x20;alphanumeric&#x20;password&#x20;without&#x20;punctuation&#x20;has&#x20;627&#x20;combinations.&#x20;An&#x20;eight-character&#x20;password&#x20;has&#x20;268&#x20;&#40;or&#x20;2&#x20;x&#x20;1011&#41;&#x20;possible&#x20;combinations.&#x20;Although&#x20;this&#x20;might&#x20;seem&#x20;to&#x20;be&#x20;a&#x20;large&#x20;number,&#x20;at&#x20;1,000,000&#x20;attempts&#x20;per&#x20;second&#x20;it&#x20;would&#x20;take&#x20;only&#x20;59&#x20;hours&#x20;to&#x20;try&#x20;all&#x20;possible&#x20;passwords.&#x20;Remember,&#x20;these&#x20;times&#x20;will&#x20;significantly&#x20;increase&#x20;for&#x20;passwords&#x20;that&#x20;use&#x20;ALT&#x20;characters&#x20;and&#x20;other&#x20;special&#x20;keyboard&#x20;characters&#x20;such&#x20;as&#x20;&#039;!&#039;&#039;&#x20;or&#x20;&#039;@&#039;&#039;.&#x20;Proper&#x20;use&#x20;of&#x20;the&#x20;password&#x20;settings&#x20;can&#x20;help&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;mount&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Passwords&#x20;that&#x20;contain&#x20;only&#x20;alphanumeric&#x20;characters&#x20;are&#x20;extremely&#x20;easy&#x20;to&#x20;discover&#x20;with&#x20;several&#x20;publicly&#x20;available&#x20;tools.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyPassword&#x20;must&#x20;meet&#x20;complexity&#x20;requirements','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.2\"]}]'),(26005,'Ensure&#x20;&#039;Relax&#x20;minimum&#x20;password&#x20;length&#x20;limits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;minimum&#x20;password&#x20;length&#x20;setting&#x20;can&#x20;be&#x20;increased&#x20;beyond&#x20;the&#x20;legacy&#x20;limit&#x20;of&#x20;14&#x20;characters.&#x20;For&#x20;more&#x20;information&#x20;please&#x20;see&#x20;the&#x20;following&#x20;Microsoft&#x20;Security&#x20;Blog.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;only&#x20;affects&#x20;local&#x20;accounts&#x20;on&#x20;the&#x20;computer.&#x20;Domain&#x20;accounts&#x20;are&#x20;only&#x20;affected&#x20;by&#x20;settings&#x20;on&#x20;the&#x20;Domain&#x20;Controllers,&#x20;because&#x20;that&#x20;is&#x20;where&#x20;domain&#x20;accounts&#x20;are&#x20;stored.','This&#x20;setting&#x20;will&#x20;enable&#x20;the&#x20;enforcement&#x20;of&#x20;longer&#x20;and&#x20;generally&#x20;stronger&#x20;passwords&#x20;or&#x20;passphrases&#x20;where&#x20;MFA&#x20;is&#x20;not&#x20;in&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyRelax&#x20;minimum&#x20;password&#x20;length&#x20;limits.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;available&#x20;within&#x20;the&#x20;built-in&#x20;OS&#x20;security&#x20;template&#x20;of&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;and&#x20;Server&#x20;2022&#x20;&#40;or&#x20;newer&#41;,&#x20;and&#x20;is&#x20;not&#x20;available&#x20;via&#x20;older&#x20;versions&#x20;of&#x20;the&#x20;OS,&#x20;or&#x20;via&#x20;downloadable&#x20;Administrative&#x20;Templates&#x20;&#40;ADMX/ADML&#41;.&#x20;Therefore,&#x20;you&#x20;must&#x20;use&#x20;a&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;or&#x20;Server&#x20;2022&#x20;system&#x20;&#40;or&#x20;newer&#41;&#x20;to&#x20;view&#x20;or&#x20;edit&#x20;this&#x20;setting&#x20;with&#x20;the&#x20;Group&#x20;Policy&#x20;Management&#x20;Console&#x20;&#40;GPMC&#41;&#x20;or&#x20;Group&#x20;Policy&#x20;Management&#x20;Editor&#x20;&#40;GPME&#41;.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.2\"]}]'),(26006,'Ensure&#x20;&#039;Account&#x20;lockout&#x20;duration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;length&#x20;of&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;before&#x20;a&#x20;locked&#x20;account&#x20;is&#x20;unlocked&#x20;and&#x20;a&#x20;user&#x20;can&#x20;try&#x20;to&#x20;log&#x20;on&#x20;again.&#x20;The&#x20;setting&#x20;does&#x20;this&#x20;by&#x20;specifying&#x20;the&#x20;number&#x20;of&#x20;minutes&#x20;a&#x20;locked&#x20;out&#x20;account&#x20;will&#x20;remain&#x20;unavailable.&#x20;If&#x20;the&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;0,&#x20;locked&#x20;out&#x20;accounts&#x20;will&#x20;remain&#x20;locked&#x20;out&#x20;until&#x20;an&#x20;administrator&#x20;manually&#x20;unlocks&#x20;them.&#x20;Although&#x20;it&#x20;might&#x20;seem&#x20;like&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;configure&#x20;the&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;a&#x20;high&#x20;value,&#x20;such&#x20;a&#x20;configuration&#x20;will&#x20;likely&#x20;increase&#x20;the&#x20;number&#x20;of&#x20;calls&#x20;that&#x20;the&#x20;help&#x20;desk&#x20;receives&#x20;to&#x20;unlock&#x20;accounts&#x20;locked&#x20;by&#x20;mistake.&#x20;Users&#x20;should&#x20;be&#x20;aware&#x20;of&#x20;the&#x20;length&#x20;of&#x20;time&#x20;a&#x20;lock&#x20;remains&#x20;in&#x20;place,&#x20;so&#x20;that&#x20;they&#x20;realize&#x20;they&#x20;only&#x20;need&#x20;to&#x20;call&#x20;the&#x20;help&#x20;desk&#x20;if&#x20;they&#x20;have&#x20;an&#x20;extremely&#x20;urgent&#x20;need&#x20;to&#x20;regain&#x20;access&#x20;to&#x20;their&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','A&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;condition&#x20;can&#x20;be&#x20;created&#x20;if&#x20;an&#x20;attacker&#x20;abuses&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;and&#x20;repeatedly&#x20;attempts&#x20;to&#x20;log&#x20;on&#x20;with&#x20;a&#x20;specific&#x20;account.&#x20;Once&#x20;you&#x20;configure&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;setting,&#x20;the&#x20;account&#x20;will&#x20;be&#x20;locked&#x20;out&#x20;after&#x20;the&#x20;specified&#x20;number&#x20;of&#x20;failed&#x20;attempts.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Account&#x20;lockout&#x20;duration&#x20;setting&#x20;to&#x20;0,&#x20;then&#x20;the&#x20;account&#x20;will&#x20;remain&#x20;locked&#x20;out&#x20;until&#x20;an&#x20;administrator&#x20;unlocks&#x20;it&#x20;manually.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyAccount&#x20;lockout&#x20;duration','[{\"cis\": [\"1.2.1\"]}, {\"cis_csc\": [\"4.10\"]}]'),(26007,'Ensure&#x20;&#039;Account&#x20;lockout&#x20;threshold&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;5&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;Setting&#x20;this&#x20;policy&#x20;to&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;doing&#x20;so&#x20;disables&#x20;the&#x20;account&#x20;lockout&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;5&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Setting&#x20;an&#x20;account&#x20;lockout&#x20;threshold&#x20;reduces&#x20;the&#x20;likelihood&#x20;that&#x20;an&#x20;online&#x20;password&#x20;brute&#x20;force&#x20;attack&#x20;will&#x20;be&#x20;successful.&#x20;Setting&#x20;the&#x20;account&#x20;lockout&#x20;threshold&#x20;too&#x20;low&#x20;introduces&#x20;risk&#x20;of&#x20;increased&#x20;accidental&#x20;lockouts&#x20;and/or&#x20;a&#x20;malicious&#x20;actor&#x20;intentionally&#x20;locking&#x20;out&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;5&#x20;or&#x20;fewer&#x20;invalid&#x20;login&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyAccount&#x20;lockout&#x20;threshold','[{\"cis\": [\"1.2.2\"]}, {\"cis_csc\": [\"4.10\"]}]'),(26008,'Ensure&#x20;&#039;Reset&#x20;account&#x20;lockout&#x20;counter&#x20;after&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;length&#x20;of&#x20;time&#x20;before&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;resets&#x20;to&#x20;zero.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;Not&#x20;Defined.&#x20;If&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;is&#x20;defined,&#x20;this&#x20;reset&#x20;time&#x20;must&#x20;be&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;the&#x20;value&#x20;for&#x20;the&#x20;Account&#x20;lockout&#x20;duration&#x20;setting.&#x20;If&#x20;you&#x20;leave&#x20;this&#x20;policy&#x20;setting&#x20;at&#x20;its&#x20;default&#x20;value&#x20;or&#x20;configure&#x20;the&#x20;value&#x20;to&#x20;an&#x20;interval&#x20;that&#x20;is&#x20;too&#x20;long,&#x20;your&#x20;environment&#x20;could&#x20;be&#x20;vulnerable&#x20;to&#x20;a&#x20;DoS&#x20;attack.&#x20;An&#x20;attacker&#x20;could&#x20;maliciously&#x20;perform&#x20;a&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;on&#x20;all&#x20;users&#x20;in&#x20;the&#x20;organization,&#x20;which&#x20;will&#x20;lock&#x20;out&#x20;their&#x20;accounts.&#x20;If&#x20;no&#x20;policy&#x20;were&#x20;determined&#x20;to&#x20;reset&#x20;the&#x20;account&#x20;lockout,&#x20;it&#x20;would&#x20;be&#x20;a&#x20;manual&#x20;task&#x20;for&#x20;administrators.&#x20;Conversely,&#x20;if&#x20;a&#x20;reasonable&#x20;time&#x20;value&#x20;is&#x20;configured&#x20;for&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;would&#x20;be&#x20;locked&#x20;out&#x20;for&#x20;a&#x20;set&#x20;period&#x20;until&#x20;all&#x20;of&#x20;the&#x20;accounts&#x20;are&#x20;unlocked&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Users&#x20;can&#x20;accidentally&#x20;lock&#x20;themselves&#x20;out&#x20;of&#x20;their&#x20;accounts&#x20;if&#x20;they&#x20;mistype&#x20;their&#x20;password&#x20;multiple&#x20;times.&#x20;To&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;such&#x20;accidental&#x20;lockouts,&#x20;the&#x20;Reset&#x20;account&#x20;lockout&#x20;counter&#x20;after&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;minutes&#x20;that&#x20;must&#x20;elapse&#x20;before&#x20;the&#x20;counter&#x20;that&#x20;tracks&#x20;failed&#x20;logon&#x20;attempts&#x20;and&#x20;triggers&#x20;lockouts&#x20;is&#x20;reset&#x20;to&#x20;0.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyReset&#x20;account&#x20;lockout&#x20;counter&#x20;after','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"4.10\"]}]'),(26009,'Ensure&#x20;&#039;Accounts:&#x20;Administrator&#x20;account&#x20;status&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;Administrator&#x20;account&#x20;during&#x20;normal&#x20;operation.&#x20;When&#x20;a&#x20;computer&#x20;is&#x20;booted&#x20;into&#x20;safe&#x20;mode,&#x20;the&#x20;Administrator&#x20;account&#x20;is&#x20;always&#x20;enabled,&#x20;regardless&#x20;of&#x20;how&#x20;this&#x20;setting&#x20;is&#x20;configured.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;when&#x20;applied&#x20;to&#x20;the&#x20;Domain&#x20;Controllers&#x20;organizational&#x20;unit&#x20;via&#x20;group&#x20;policy&#x20;because&#x20;Domain&#x20;Controllers&#x20;have&#x20;no&#x20;local&#x20;account&#x20;database.&#x20;It&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;domain&#x20;level&#x20;via&#x20;group&#x20;policy,&#x20;similar&#x20;to&#x20;account&#x20;lockout&#x20;and&#x20;password&#x20;policy&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;some&#x20;organizations,&#x20;it&#x20;can&#x20;be&#x20;a&#x20;daunting&#x20;management&#x20;challenge&#x20;to&#x20;maintain&#x20;a&#x20;regular&#x20;schedule&#x20;for&#x20;periodic&#x20;password&#x20;changes&#x20;for&#x20;local&#x20;accounts.&#x20;Therefore,&#x20;you&#x20;may&#x20;want&#x20;to&#x20;disable&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;instead&#x20;of&#x20;relying&#x20;on&#x20;regular&#x20;password&#x20;changes&#x20;to&#x20;protect&#x20;it&#x20;from&#x20;attack.&#x20;Another&#x20;reason&#x20;to&#x20;disable&#x20;this&#x20;built-in&#x20;account&#x20;is&#x20;that&#x20;it&#x20;cannot&#x20;be&#x20;locked&#x20;out&#x20;no&#x20;matter&#x20;how&#x20;many&#x20;failed&#x20;logons&#x20;it&#x20;accrues,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;prime&#x20;target&#x20;for&#x20;brute&#x20;force&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;guess&#x20;passwords.&#x20;Also,&#x20;this&#x20;account&#x20;has&#x20;a&#x20;well-known&#x20;security&#x20;identifier&#x20;&#40;SID&#41;&#x20;and&#x20;there&#x20;are&#x20;third-party&#x20;tools&#x20;that&#x20;allow&#x20;authentication&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;rather&#x20;than&#x20;the&#x20;account&#x20;name.&#x20;This&#x20;capability&#x20;means&#x20;that&#x20;even&#x20;if&#x20;you&#x20;rename&#x20;the&#x20;Administrator&#x20;account,&#x20;an&#x20;attacker&#x20;could&#x20;launch&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Administrator&#x20;account&#x20;status','[{\"cis\": [\"2.3.1.1\"]}, {\"cis_csc\": [\"4.7\"]}]'),(26010,'Ensure&#x20;&#039;Accounts:&#x20;Block&#x20;Microsoft&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;adding&#x20;new&#x20;Microsoft&#x20;accounts&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;onto&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Block&#x20;Microsoft&#x20;accounts','[{\"cis\": [\"2.3.1.2\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26011,'Ensure&#x20;&#039;Accounts:&#x20;Guest&#x20;account&#x20;status&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;enabled&#x20;or&#x20;disabled.&#x20;The&#x20;Guest&#x20;account&#x20;allows&#x20;unauthenticated&#x20;network&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;when&#x20;applied&#x20;to&#x20;the&#x20;Domain&#x20;Controllers&#x20;organizational&#x20;unit&#x20;via&#x20;group&#x20;policy&#x20;because&#x20;Domain&#x20;Controllers&#x20;have&#x20;no&#x20;local&#x20;account&#x20;database.&#x20;It&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;domain&#x20;level&#x20;via&#x20;group&#x20;policy,&#x20;similar&#x20;to&#x20;account&#x20;lockout&#x20;and&#x20;password&#x20;policy&#x20;settings.','The&#x20;default&#x20;Guest&#x20;account&#x20;allows&#x20;unauthenticated&#x20;network&#x20;users&#x20;to&#x20;log&#x20;on&#x20;as&#x20;Guest&#x20;with&#x20;no&#x20;password.&#x20;These&#x20;unauthorized&#x20;users&#x20;could&#x20;access&#x20;any&#x20;resources&#x20;that&#x20;are&#x20;accessible&#x20;to&#x20;the&#x20;Guest&#x20;account&#x20;over&#x20;the&#x20;network.&#x20;This&#x20;capability&#x20;means&#x20;that&#x20;any&#x20;network&#x20;shares&#x20;with&#x20;permissions&#x20;that&#x20;allow&#x20;access&#x20;to&#x20;the&#x20;Guest&#x20;account,&#x20;the&#x20;Guests&#x20;group,&#x20;or&#x20;the&#x20;Everyone&#x20;group&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Guest&#x20;account&#x20;status','[{\"cis\": [\"2.3.1.3\"]}, {\"cis_csc\": [\"4.7\"]}]'),(26012,'Ensure&#x20;&#039;Accounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;local&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;password&#x20;protected&#x20;can&#x20;be&#x20;used&#x20;to&#x20;log&#x20;on&#x20;from&#x20;locations&#x20;other&#x20;than&#x20;the&#x20;physical&#x20;computer&#x20;console.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;local&#x20;accounts&#x20;that&#x20;have&#x20;blank&#x20;passwords&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;network&#x20;from&#x20;remote&#x20;client&#x20;computers.&#x20;Such&#x20;accounts&#x20;will&#x20;only&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;at&#x20;the&#x20;keyboard&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blank&#x20;passwords&#x20;are&#x20;a&#x20;serious&#x20;threat&#x20;to&#x20;computer&#x20;security&#x20;and&#x20;should&#x20;be&#x20;forbidden&#x20;through&#x20;both&#x20;organizational&#x20;policy&#x20;and&#x20;suitable&#x20;technical&#x20;measures.&#x20;In&#x20;fact,&#x20;the&#x20;default&#x20;settings&#x20;for&#x20;Active&#x20;Directory&#x20;domains&#x20;require&#x20;complex&#x20;passwords&#x20;of&#x20;at&#x20;least&#x20;seven&#x20;characters.&#x20;However,&#x20;if&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;create&#x20;new&#x20;accounts&#x20;bypass&#x20;your&#x20;domain-based&#x20;password&#x20;policies,&#x20;they&#x20;could&#x20;create&#x20;accounts&#x20;with&#x20;blank&#x20;passwords.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;could&#x20;build&#x20;a&#x20;stand-alone&#x20;computer,&#x20;create&#x20;one&#x20;or&#x20;more&#x20;accounts&#x20;with&#x20;blank&#x20;passwords,&#x20;and&#x20;then&#x20;join&#x20;the&#x20;computer&#x20;to&#x20;the&#x20;domain.&#x20;The&#x20;local&#x20;accounts&#x20;with&#x20;blank&#x20;passwords&#x20;would&#x20;still&#x20;function.&#x20;Anyone&#x20;who&#x20;knows&#x20;the&#x20;name&#x20;of&#x20;one&#x20;of&#x20;these&#x20;unprotected&#x20;accounts&#x20;could&#x20;then&#x20;use&#x20;it&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only','[{\"cis\": [\"2.3.1.4\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26013,'Configure&#x20;&#039;Accounts:&#x20;Rename&#x20;administrator&#x20;account&#039;.','The&#x20;built-in&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;a&#x20;well-known&#x20;account&#x20;name&#x20;that&#x20;attackers&#x20;will&#x20;target.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;choose&#x20;another&#x20;name&#x20;for&#x20;this&#x20;account,&#x20;and&#x20;to&#x20;avoid&#x20;names&#x20;that&#x20;denote&#x20;administrative&#x20;or&#x20;elevated&#x20;access&#x20;accounts.&#x20;Be&#x20;sure&#x20;to&#x20;also&#x20;change&#x20;the&#x20;default&#x20;description&#x20;for&#x20;the&#x20;local&#x20;administrator&#x20;&#40;through&#x20;the&#x20;Computer&#x20;Management&#x20;console&#41;.','The&#x20;Administrator&#x20;account&#x20;exists&#x20;on&#x20;all&#x20;computers&#x20;that&#x20;run&#x20;the&#x20;Windows&#x20;2000&#x20;or&#x20;newer&#x20;operating&#x20;systems.&#x20;If&#x20;you&#x20;rename&#x20;this&#x20;account,&#x20;it&#x20;is&#x20;slightly&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;guess&#x20;this&#x20;privileged&#x20;user&#x20;name&#x20;and&#x20;password&#x20;combination.&#x20;The&#x20;built-in&#x20;Administrator&#x20;account&#x20;cannot&#x20;be&#x20;locked&#x20;out,&#x20;regardless&#x20;of&#x20;how&#x20;many&#x20;times&#x20;an&#x20;attacker&#x20;might&#x20;use&#x20;a&#x20;bad&#x20;password.&#x20;This&#x20;capability&#x20;makes&#x20;the&#x20;Administrator&#x20;account&#x20;a&#x20;popular&#x20;target&#x20;for&#x20;brute&#x20;force&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;guess&#x20;passwords.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;lessened&#x20;because&#x20;this&#x20;account&#x20;has&#x20;a&#x20;well-known&#x20;SID,&#x20;and&#x20;there&#x20;are&#x20;third-party&#x20;tools&#x20;that&#x20;allow&#x20;authentication&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;rather&#x20;than&#x20;the&#x20;account&#x20;name.&#x20;Therefore,&#x20;even&#x20;if&#x20;you&#x20;rename&#x20;the&#x20;Administrator&#x20;account,&#x20;an&#x20;attacker&#x20;could&#x20;launch&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Rename&#x20;administrator&#x20;account','[{\"cis\": [\"2.3.1.5\"]}, {\"cis_csc\": [\"4.7\"]}]'),(26014,'Configure&#x20;&#039;Accounts:&#x20;Rename&#x20;guest&#x20;account&#039;.','The&#x20;built-in&#x20;local&#x20;guest&#x20;account&#x20;is&#x20;another&#x20;well-known&#x20;name&#x20;to&#x20;attackers.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;rename&#x20;this&#x20;account&#x20;to&#x20;something&#x20;that&#x20;does&#x20;not&#x20;indicate&#x20;its&#x20;purpose.&#x20;Even&#x20;if&#x20;you&#x20;disable&#x20;this&#x20;account,&#x20;which&#x20;is&#x20;recommended,&#x20;ensure&#x20;that&#x20;you&#x20;rename&#x20;it&#x20;for&#x20;added&#x20;security.','The&#x20;Guest&#x20;account&#x20;exists&#x20;on&#x20;all&#x20;computers&#x20;that&#x20;run&#x20;the&#x20;Windows&#x20;2000&#x20;or&#x20;newer&#x20;operating&#x20;systems.&#x20;If&#x20;you&#x20;rename&#x20;this&#x20;account,&#x20;it&#x20;is&#x20;slightly&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;guess&#x20;this&#x20;privileged&#x20;user&#x20;name&#x20;and&#x20;password&#x20;combination.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Rename&#x20;guest&#x20;account','[{\"cis\": [\"2.3.1.6\"]}, {\"cis_csc\": [\"4.7\"]}]'),(26015,'Ensure&#x20;&#039;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#0','This&#x20;policy&#x20;setting&#x20;allows&#x20;administrators&#x20;to&#x20;enable&#x20;the&#x20;more&#x20;precise&#x20;auditing&#x20;capabilities&#x20;present&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;Audit&#x20;Policy&#x20;settings&#x20;available&#x20;in&#x20;Windows&#x20;Server&#x20;2003&#x20;Active&#x20;Directory&#x20;do&#x20;not&#x20;yet&#x20;contain&#x20;settings&#x20;for&#x20;managing&#x20;the&#x20;new&#x20;auditing&#x20;subcategories.&#x20;To&#x20;properly&#x20;apply&#x20;the&#x20;auditing&#x20;policies&#x20;prescribed&#x20;in&#x20;this&#x20;baseline,&#x20;the&#x20;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#x20;setting&#x20;needs&#x20;to&#x20;be&#x20;configured&#x20;to&#x20;Enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Important:&#x20;Be&#x20;very&#x20;cautious&#x20;about&#x20;audit&#x20;settings&#x20;that&#x20;can&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;traffic.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;enable&#x20;either&#x20;success&#x20;or&#x20;failure&#x20;auditing&#x20;for&#x20;all&#x20;of&#x20;the&#x20;Privilege&#x20;Use&#x20;subcategories,&#x20;the&#x20;high&#x20;volume&#x20;of&#x20;audit&#x20;events&#x20;generated&#x20;can&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;find&#x20;other&#x20;types&#x20;of&#x20;entries&#x20;in&#x20;the&#x20;Security&#x20;log.&#x20;Such&#x20;a&#x20;configuration&#x20;could&#x20;also&#x20;have&#x20;a&#x20;significant&#x20;impact&#x20;on&#x20;system&#x20;performance.','Prior&#x20;to&#x20;the&#x20;introduction&#x20;of&#x20;auditing&#x20;subcategories&#x20;in&#x20;Windows&#x20;Vista,&#x20;it&#x20;was&#x20;difficult&#x20;to&#x20;track&#x20;events&#x20;at&#x20;a&#x20;per-system&#x20;or&#x20;per-user&#x20;level.&#x20;The&#x20;larger&#x20;event&#x20;categories&#x20;created&#x20;too&#x20;many&#x20;events&#x20;and&#x20;the&#x20;key&#x20;information&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;audited&#x20;was&#x20;difficult&#x20;to&#x20;find.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc\": [\"8.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26016,'Ensure&#x20;&#039;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;system&#x20;shuts&#x20;down&#x20;if&#x20;it&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;Security&#x20;events.&#x20;It&#x20;is&#x20;a&#x20;requirement&#x20;for&#x20;Trusted&#x20;Computer&#x20;System&#x20;Evaluation&#x20;Criteria&#x20;&#40;TCSEC&#41;-C2&#x20;and&#x20;Common&#x20;Criteria&#x20;certification&#x20;to&#x20;prevent&#x20;auditable&#x20;events&#x20;from&#x20;occurring&#x20;if&#x20;the&#x20;audit&#x20;system&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;them.&#x20;Microsoft&#x20;has&#x20;chosen&#x20;to&#x20;meet&#x20;this&#x20;requirement&#x20;by&#x20;halting&#x20;the&#x20;system&#x20;and&#x20;displaying&#x20;a&#x20;stop&#x20;message&#x20;if&#x20;the&#x20;auditing&#x20;system&#x20;experiences&#x20;a&#x20;failure.&#x20;When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;system&#x20;will&#x20;be&#x20;shut&#x20;down&#x20;if&#x20;a&#x20;security&#x20;audit&#x20;cannot&#x20;be&#x20;logged&#x20;for&#x20;any&#x20;reason.&#x20;If&#x20;the&#x20;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#x20;setting&#x20;is&#x20;enabled,&#x20;unplanned&#x20;system&#x20;failures&#x20;can&#x20;occur.&#x20;The&#x20;administrative&#x20;burden&#x20;can&#x20;be&#x20;significant,&#x20;especially&#x20;if&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Retention&#x20;method&#x20;for&#x20;the&#x20;Security&#x20;log&#x20;to&#x20;Do&#x20;not&#x20;overwrite&#x20;events&#x20;&#40;clear&#x20;log&#x20;manually&#41;.&#x20;This&#x20;configuration&#x20;causes&#x20;a&#x20;repudiation&#x20;threat&#x20;&#40;a&#x20;backup&#x20;operator&#x20;could&#x20;deny&#x20;that&#x20;they&#x20;backed&#x20;up&#x20;or&#x20;restored&#x20;data&#41;&#x20;to&#x20;become&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;vulnerability,&#x20;because&#x20;a&#x20;server&#x20;could&#x20;be&#x20;forced&#x20;to&#x20;shut&#x20;down&#x20;if&#x20;it&#x20;is&#x20;overwhelmed&#x20;with&#x20;logon&#x20;events&#x20;and&#x20;other&#x20;security&#x20;events&#x20;that&#x20;are&#x20;written&#x20;to&#x20;the&#x20;Security&#x20;log.&#x20;Also,&#x20;because&#x20;the&#x20;shutdown&#x20;is&#x20;not&#x20;graceful,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;irreparable&#x20;damage&#x20;to&#x20;the&#x20;operating&#x20;system,&#x20;applications,&#x20;or&#x20;data&#x20;could&#x20;result.&#x20;Although&#x20;the&#x20;NTFS&#x20;file&#x20;system&#x20;guarantees&#x20;its&#x20;integrity&#x20;when&#x20;an&#x20;ungraceful&#x20;computer&#x20;shutdown&#x20;occurs,&#x20;it&#x20;cannot&#x20;guarantee&#x20;that&#x20;every&#x20;data&#x20;file&#x20;for&#x20;every&#x20;application&#x20;will&#x20;still&#x20;be&#x20;in&#x20;a&#x20;usable&#x20;form&#x20;when&#x20;the&#x20;computer&#x20;restarts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;the&#x20;computer&#x20;is&#x20;unable&#x20;to&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;critical&#x20;evidence&#x20;or&#x20;important&#x20;troubleshooting&#x20;information&#x20;may&#x20;not&#x20;be&#x20;available&#x20;for&#x20;review&#x20;after&#x20;a&#x20;security&#x20;incident.&#x20;Also,&#x20;an&#x20;attacker&#x20;could&#x20;potentially&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;Security&#x20;log&#x20;events&#x20;to&#x20;purposely&#x20;force&#x20;a&#x20;computer&#x20;shutdown.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(26017,'Ensure&#x20;&#039;Devices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators&#x20;and&#x20;Interactive&#x20;Users&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;NTFS&#x20;media.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;unauthorized&#x20;users&#x20;from&#x20;removing&#x20;data&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;access&#x20;it&#x20;on&#x20;another&#x20;computer&#x20;on&#x20;which&#x20;they&#x20;have&#x20;local&#x20;administrator&#x20;privileges.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users.','Users&#x20;may&#x20;be&#x20;able&#x20;to&#x20;move&#x20;data&#x20;on&#x20;removable&#x20;disks&#x20;to&#x20;a&#x20;different&#x20;computer&#x20;where&#x20;they&#x20;have&#x20;administrative&#x20;privileges.&#x20;The&#x20;user&#x20;could&#x20;then&#x20;take&#x20;ownership&#x20;of&#x20;any&#x20;file,&#x20;grant&#x20;themselves&#x20;full&#x20;control,&#x20;and&#x20;view&#x20;or&#x20;modify&#x20;any&#x20;file.&#x20;The&#x20;fact&#x20;that&#x20;most&#x20;removable&#x20;storage&#x20;devices&#x20;will&#x20;eject&#x20;media&#x20;by&#x20;pressing&#x20;a&#x20;mechanical&#x20;button&#x20;diminishes&#x20;the&#x20;advantage&#x20;of&#x20;this&#x20;policy&#x20;setting.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators&#x20;and&#x20;Interactive&#x20;Users:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media','[{\"cis\": [\"2.3.4.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26018,'Ensure&#x20;&#039;Devices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','For&#x20;a&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;a&#x20;shared&#x20;printer,&#x20;the&#x20;driver&#x20;for&#x20;that&#x20;shared&#x20;printer&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;This&#x20;security&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;install&#x20;a&#x20;printer&#x20;driver&#x20;as&#x20;part&#x20;of&#x20;connecting&#x20;to&#x20;a&#x20;shared&#x20;printer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;ability&#x20;to&#x20;add&#x20;a&#x20;local&#x20;printer.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;Administrators.','It&#x20;may&#x20;be&#x20;appropriate&#x20;in&#x20;some&#x20;organizations&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;install&#x20;printer&#x20;drivers&#x20;on&#x20;their&#x20;own&#x20;workstations.&#x20;However,&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;you&#x20;should&#x20;allow&#x20;only&#x20;Administrators,&#x20;not&#x20;users,&#x20;to&#x20;do&#x20;this,&#x20;because&#x20;printer&#x20;driver&#x20;installation&#x20;may&#x20;unintentionally&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;become&#x20;less&#x20;stable.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;install&#x20;inappropriate&#x20;printer&#x20;drivers&#x20;in&#x20;a&#x20;deliberate&#x20;attempt&#x20;to&#x20;damage&#x20;the&#x20;computer,&#x20;or&#x20;a&#x20;user&#x20;might&#x20;accidentally&#x20;install&#x20;malicious&#x20;software&#x20;that&#x20;masquerades&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;It&#x20;is&#x20;feasible&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;disguise&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;The&#x20;program&#x20;may&#x20;appear&#x20;to&#x20;users&#x20;as&#x20;if&#x20;they&#x20;must&#x20;use&#x20;it&#x20;to&#x20;print,&#x20;but&#x20;such&#x20;a&#x20;program&#x20;could&#x20;unleash&#x20;malicious&#x20;code&#x20;on&#x20;your&#x20;computer&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers','[{\"cis\": [\"2.3.4.2\"]}, {\"pci_dss\": [\"2.2.4\", \"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\", \"CC5.2\"]}]'),(26019,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;is&#x20;initiated&#x20;by&#x20;the&#x20;domain&#x20;member&#x20;must&#x20;be&#x20;signed&#x20;or&#x20;encrypted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.6.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26020,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;encryption&#x20;for&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;','[{\"cis\": [\"2.3.6.2\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26021,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates&#x20;must&#x20;be&#x20;digitally&#x20;signed.&#x20;Digital&#x20;signatures&#x20;protect&#x20;the&#x20;traffic&#x20;from&#x20;being&#x20;modified&#x20;by&#x20;anyone&#x20;who&#x20;captures&#x20;the&#x20;data&#x20;as&#x20;it&#x20;traverses&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated-and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted-but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;','[{\"cis\": [\"2.3.6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26022,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;can&#x20;periodically&#x20;change&#x20;its&#x20;computer&#x20;account&#x20;password.&#x20;Computers&#x20;that&#x20;cannot&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;passwords&#x20;are&#x20;potentially&#x20;vulnerable,&#x20;because&#x20;an&#x20;attacker&#x20;might&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;system&#039;s&#x20;domain&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','The&#x20;default&#x20;configuration&#x20;for&#x20;Windows&#x20;Server&#x20;2003-based&#x20;computers&#x20;that&#x20;belong&#x20;to&#x20;a&#x20;domain&#x20;is&#x20;that&#x20;they&#x20;are&#x20;automatically&#x20;required&#x20;to&#x20;change&#x20;the&#x20;passwords&#x20;for&#x20;their&#x20;accounts&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;computers&#x20;that&#x20;run&#x20;Windows&#x20;Server&#x20;2003&#x20;will&#x20;retain&#x20;the&#x20;same&#x20;passwords&#x20;as&#x20;their&#x20;computer&#x20;accounts.&#x20;Computers&#x20;that&#x20;are&#x20;no&#x20;longer&#x20;able&#x20;to&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;password&#x20;are&#x20;at&#x20;risk&#x20;from&#x20;an&#x20;attacker&#x20;who&#x20;could&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;computer&#039;s&#x20;domain&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes','[{\"cis\": [\"2.3.6.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26023,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Maximum&#x20;machine&#x20;account&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;maximum&#x20;allowable&#x20;age&#x20;for&#x20;a&#x20;computer&#x20;account&#x20;password.&#x20;By&#x20;default,&#x20;domain&#x20;members&#x20;automatically&#x20;change&#x20;their&#x20;domain&#x20;passwords&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;increase&#x20;this&#x20;interval&#x20;significantly&#x20;so&#x20;that&#x20;the&#x20;computers&#x20;no&#x20;longer&#x20;change&#x20;their&#x20;passwords,&#x20;an&#x20;attacker&#x20;would&#x20;have&#x20;more&#x20;time&#x20;to&#x20;undertake&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;against&#x20;one&#x20;of&#x20;the&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;maximum&#x20;password&#x20;age.&#x20;Note&#x20;#2:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','In&#x20;Active&#x20;Directory-based&#x20;domains,&#x20;each&#x20;computer&#x20;has&#x20;an&#x20;account&#x20;and&#x20;password&#x20;just&#x20;like&#x20;every&#x20;user.&#x20;By&#x20;default,&#x20;the&#x20;domain&#x20;members&#x20;automatically&#x20;change&#x20;their&#x20;domain&#x20;password&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;increase&#x20;this&#x20;interval&#x20;significantly,&#x20;or&#x20;set&#x20;it&#x20;to&#x20;0&#x20;so&#x20;that&#x20;the&#x20;computers&#x20;no&#x20;longer&#x20;change&#x20;their&#x20;passwords,&#x20;an&#x20;attacker&#x20;will&#x20;have&#x20;more&#x20;time&#x20;to&#x20;undertake&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;guess&#x20;the&#x20;password&#x20;of&#x20;one&#x20;or&#x20;more&#x20;computer&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Maximum&#x20;machine&#x20;account&#x20;password&#x20;age','[{\"cis\": [\"2.3.6.5\"]}]'),(26024,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;secure&#x20;channel&#x20;can&#x20;only&#x20;be&#x20;established&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;encrypting&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;&#40;128-bit&#41;&#x20;session&#x20;key.&#x20;To&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;the&#x20;domain&#x20;must&#x20;be&#x20;able&#x20;to&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;key,&#x20;which&#x20;means&#x20;all&#x20;Domain&#x20;Controllers&#x20;must&#x20;be&#x20;running&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;or&#x20;newer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;keys&#x20;that&#x20;are&#x20;used&#x20;to&#x20;establish&#x20;secure&#x20;channel&#x20;communications&#x20;between&#x20;Domain&#x20;Controllers&#x20;and&#x20;member&#x20;computers&#x20;are&#x20;much&#x20;stronger&#x20;in&#x20;Windows&#x20;2000&#x20;than&#x20;they&#x20;were&#x20;in&#x20;previous&#x20;Microsoft&#x20;operating&#x20;systems.&#x20;Whenever&#x20;possible,&#x20;you&#x20;should&#x20;take&#x20;advantage&#x20;of&#x20;these&#x20;stronger&#x20;session&#x20;keys&#x20;to&#x20;help&#x20;protect&#x20;secure&#x20;channel&#x20;communications&#x20;from&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;hijack&#x20;network&#x20;sessions&#x20;and&#x20;eavesdropping.&#x20;&#40;Eavesdropping&#x20;is&#x20;a&#x20;form&#x20;of&#x20;hacking&#x20;in&#x20;which&#x20;network&#x20;data&#x20;is&#x20;read&#x20;or&#x20;altered&#x20;in&#x20;transit.&#x20;The&#x20;data&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;hide&#x20;or&#x20;change&#x20;the&#x20;sender,&#x20;or&#x20;be&#x20;redirected.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key','[{\"cis\": [\"2.3.6.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26025,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;must&#x20;press&#x20;CTRL+ALT+DEL&#x20;before&#x20;they&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Microsoft&#x20;developed&#x20;this&#x20;feature&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;users&#x20;with&#x20;certain&#x20;types&#x20;of&#x20;physical&#x20;impairments&#x20;to&#x20;log&#x20;on&#x20;to&#x20;computers&#x20;that&#x20;run&#x20;Windows.&#x20;If&#x20;users&#x20;are&#x20;not&#x20;required&#x20;to&#x20;press&#x20;CTRL+ALT+DEL,&#x20;they&#x20;are&#x20;susceptible&#x20;to&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;intercept&#x20;their&#x20;passwords.&#x20;If&#x20;CTRL+ALT+DEL&#x20;is&#x20;required&#x20;before&#x20;logon,&#x20;user&#x20;passwords&#x20;are&#x20;communicated&#x20;by&#x20;means&#x20;of&#x20;a&#x20;trusted&#x20;path.&#x20;An&#x20;attacker&#x20;could&#x20;install&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;that&#x20;looks&#x20;like&#x20;the&#x20;standard&#x20;Windows&#x20;logon&#x20;dialog&#x20;box&#x20;and&#x20;capture&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;attacker&#x20;would&#x20;then&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;compromised&#x20;account&#x20;with&#x20;whatever&#x20;level&#x20;of&#x20;privilege&#x20;that&#x20;user&#x20;has.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL','[{\"cis\": [\"2.3.7.1\"]}]'),(26026,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;account&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;client&#x20;computers&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;be&#x20;displayed&#x20;in&#x20;each&#x20;computer&#039;s&#x20;respective&#x20;Windows&#x20;logon&#x20;screen.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;intruders&#x20;from&#x20;collecting&#x20;account&#x20;names&#x20;visually&#x20;from&#x20;the&#x20;screens&#x20;of&#x20;desktop&#x20;or&#x20;laptop&#x20;computers&#x20;in&#x20;your&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in.&#x20;Note:&#x20;In&#x20;older&#x20;versions&#x20;of&#x20;Microsoft&#x20;Windows,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;Windows&#x20;10&#x20;Release&#x20;1703.','[{\"cis\": [\"2.3.7.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26027,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;account&#x20;lockout&#x20;threshold&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;10&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempts,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;security&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;that&#x20;causes&#x20;the&#x20;machine&#x20;to&#x20;be&#x20;locked&#x20;out.&#x20;Failed&#x20;password&#x20;attempts&#x20;against&#x20;workstations&#x20;or&#x20;member&#x20;servers&#x20;that&#x20;have&#x20;been&#x20;locked&#x20;using&#x20;either&#x20;CTRL+ALT+DELETE&#x20;or&#x20;password&#x20;protected&#x20;screen&#x20;savers&#x20;counts&#x20;as&#x20;failed&#x20;logon&#x20;attempts.&#x20;The&#x20;machine&#x20;lockout&#x20;policy&#x20;is&#x20;enforced&#x20;only&#x20;on&#x20;those&#x20;machines&#x20;that&#x20;have&#x20;BitLocker&#x20;enabled&#x20;for&#x20;protecting&#x20;OS&#x20;volumes.&#x20;Please&#x20;ensure&#x20;that&#x20;appropriate&#x20;recovery&#x20;password&#x20;backup&#x20;policies&#x20;are&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;10&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempts,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;account&#x20;lockout&#x20;threshold.&#x20;Values&#x20;from&#x20;1&#x20;to&#x20;3&#x20;will&#x20;be&#x20;interpreted&#x20;as&#x20;4.','If&#x20;a&#x20;machine&#x20;is&#x20;lost&#x20;or&#x20;stolen,&#x20;or&#x20;if&#x20;an&#x20;insider&#x20;threat&#x20;attempts&#x20;a&#x20;brute&#x20;force&#x20;password&#x20;attack&#x20;against&#x20;the&#x20;computer,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;BitLocker&#x20;will&#x20;lock&#x20;the&#x20;computer&#x20;and&#x20;therefore&#x20;prevent&#x20;a&#x20;successful&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;10&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempts,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;account&#x20;lockout&#x20;threshold','[{\"cis\": [\"2.3.7.3\"]}, {\"cis_csc\": [\"4.10\"]}]'),(26028,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;.','Windows&#x20;notices&#x20;inactivity&#x20;of&#x20;a&#x20;logon&#x20;session,&#x20;and&#x20;if&#x20;the&#x20;amount&#x20;of&#x20;inactive&#x20;time&#x20;exceeds&#x20;the&#x20;inactivity&#x20;limit,&#x20;then&#x20;the&#x20;screen&#x20;saver&#x20;will&#x20;run,&#x20;locking&#x20;the&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;inactivity&#x20;limit.','If&#x20;a&#x20;user&#x20;forgets&#x20;to&#x20;lock&#x20;their&#x20;computer&#x20;when&#x20;they&#x20;walk&#x20;away&#x20;it&#039;s&#x20;possible&#x20;that&#x20;a&#x20;passerby&#x20;will&#x20;hijack&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;900&#x20;or&#x20;fewer&#x20;seconds,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit','[{\"cis\": [\"2.3.7.4\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26029,'Configure&#x20;&#039;Interactive&#x20;logon:&#x20;Message&#x20;text&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;a&#x20;text&#x20;message&#x20;that&#x20;displays&#x20;to&#x20;users&#x20;when&#x20;they&#x20;log&#x20;on.&#x20;Set&#x20;the&#x20;following&#x20;group&#x20;policy&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization.','Displaying&#x20;a&#x20;warning&#x20;message&#x20;before&#x20;logon&#x20;may&#x20;help&#x20;prevent&#x20;an&#x20;attack&#x20;by&#x20;warning&#x20;the&#x20;attacker&#x20;about&#x20;the&#x20;consequences&#x20;of&#x20;their&#x20;misconduct&#x20;before&#x20;it&#x20;happens.&#x20;It&#x20;may&#x20;also&#x20;help&#x20;to&#x20;reinforce&#x20;corporate&#x20;policy&#x20;by&#x20;notifying&#x20;employees&#x20;of&#x20;the&#x20;appropriate&#x20;policy&#x20;during&#x20;the&#x20;logon&#x20;process.&#x20;This&#x20;text&#x20;is&#x20;often&#x20;used&#x20;for&#x20;legal&#x20;reasons&mdash;for&#x20;example,&#x20;to&#x20;warn&#x20;users&#x20;about&#x20;the&#x20;ramifications&#x20;of&#x20;misusing&#x20;company&#x20;information&#x20;or&#x20;to&#x20;warn&#x20;them&#x20;that&#x20;their&#x20;actions&#x20;may&#x20;be&#x20;audited.&#x20;Note:&#x20;Any&#x20;warning&#x20;that&#x20;you&#x20;display&#x20;should&#x20;first&#x20;be&#x20;approved&#x20;by&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;and&#x20;human&#x20;resources&#x20;representatives.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Message&#x20;text&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.7.5\"]}]'),(26030,'Configure&#x20;&#039;Interactive&#x20;logon:&#x20;Message&#x20;title&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;text&#x20;displayed&#x20;in&#x20;the&#x20;title&#x20;bar&#x20;of&#x20;the&#x20;window&#x20;that&#x20;users&#x20;see&#x20;when&#x20;they&#x20;log&#x20;on&#x20;to&#x20;the&#x20;system.&#x20;Configure&#x20;this&#x20;setting&#x20;in&#x20;a&#x20;manner&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization.','Displaying&#x20;a&#x20;warning&#x20;message&#x20;before&#x20;logon&#x20;may&#x20;help&#x20;prevent&#x20;an&#x20;attack&#x20;by&#x20;warning&#x20;the&#x20;attacker&#x20;about&#x20;the&#x20;consequences&#x20;of&#x20;their&#x20;misconduct&#x20;before&#x20;it&#x20;happens.&#x20;It&#x20;may&#x20;also&#x20;help&#x20;to&#x20;reinforce&#x20;corporate&#x20;policy&#x20;by&#x20;notifying&#x20;employees&#x20;of&#x20;the&#x20;appropriate&#x20;policy&#x20;during&#x20;the&#x20;logon&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Message&#x20;title&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.7.6\"]}]'),(26031,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;4&#x20;or&#x20;few','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;user&#x20;can&#x20;log&#x20;on&#x20;to&#x20;a&#x20;Windows&#x20;domain&#x20;using&#x20;cached&#x20;account&#x20;information.&#x20;Logon&#x20;information&#x20;for&#x20;domain&#x20;accounts&#x20;can&#x20;be&#x20;cached&#x20;locally&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;log&#x20;on&#x20;even&#x20;if&#x20;a&#x20;Domain&#x20;Controller&#x20;cannot&#x20;be&#x20;contacted.&#x20;This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;unique&#x20;users&#x20;for&#x20;whom&#x20;logon&#x20;information&#x20;is&#x20;cached&#x20;locally.&#x20;If&#x20;this&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;the&#x20;logon&#x20;cache&#x20;feature&#x20;is&#x20;disabled.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;server&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;.','The&#x20;number&#x20;that&#x20;is&#x20;assigned&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;indicates&#x20;the&#x20;number&#x20;of&#x20;users&#x20;whose&#x20;logon&#x20;information&#x20;the&#x20;computer&#x20;will&#x20;cache&#x20;locally.&#x20;If&#x20;the&#x20;number&#x20;is&#x20;set&#x20;to&#x20;4,&#x20;then&#x20;the&#x20;computer&#x20;caches&#x20;logon&#x20;information&#x20;for&#x20;4&#x20;users.&#x20;When&#x20;a&#x20;5th&#x20;user&#x20;logs&#x20;on&#x20;to&#x20;the&#x20;computer,&#x20;the&#x20;server&#x20;overwrites&#x20;the&#x20;oldest&#x20;cached&#x20;logon&#x20;session.&#x20;Users&#x20;who&#x20;access&#x20;the&#x20;computer&#x20;console&#x20;will&#x20;have&#x20;their&#x20;logon&#x20;credentials&#x20;cached&#x20;on&#x20;that&#x20;computer.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;computer&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;attempt&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;To&#x20;mitigate&#x20;this&#x20;type&#x20;of&#x20;attack,&#x20;Windows&#x20;encrypts&#x20;the&#x20;information&#x20;and&#x20;obscures&#x20;its&#x20;physical&#x20;location.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;','[{\"cis\": [\"2.3.7.7\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26032,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;between&#x20;5&#x20;and&#x20;14&#x20;days&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;far&#x20;in&#x20;advance&#x20;users&#x20;are&#x20;warned&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;at&#x20;least&#x20;5&#x20;days&#x20;but&#x20;no&#x20;more&#x20;than&#x20;14&#x20;days&#x20;to&#x20;sufficiently&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;passwords&#x20;will&#x20;expire.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days.','Users&#x20;will&#x20;need&#x20;to&#x20;be&#x20;warned&#x20;that&#x20;their&#x20;passwords&#x20;are&#x20;going&#x20;to&#x20;expire,&#x20;or&#x20;they&#x20;may&#x20;inadvertently&#x20;be&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;computer&#x20;when&#x20;their&#x20;passwords&#x20;expire.&#x20;This&#x20;condition&#x20;could&#x20;lead&#x20;to&#x20;confusion&#x20;for&#x20;users&#x20;who&#x20;access&#x20;the&#x20;network&#x20;locally,&#x20;or&#x20;make&#x20;it&#x20;impossible&#x20;for&#x20;users&#x20;to&#x20;access&#x20;your&#x20;organization&#039;s&#x20;network&#x20;through&#x20;dial-up&#x20;or&#x20;virtual&#x20;private&#x20;network&#x20;&#40;VPN&#41;&#x20;connections.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration','[{\"cis\": [\"2.3.7.8\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26033,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Lock&#x20;Workstation&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;happens&#x20;when&#x20;the&#x20;smart&#x20;card&#x20;for&#x20;a&#x20;logged-on&#x20;user&#x20;is&#x20;removed&#x20;from&#x20;the&#x20;smart&#x20;card&#x20;reader.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Lock&#x20;Workstation.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Users&#x20;sometimes&#x20;forget&#x20;to&#x20;lock&#x20;their&#x20;workstations&#x20;when&#x20;they&#x20;are&#x20;away&#x20;from&#x20;them,&#x20;allowing&#x20;the&#x20;possibility&#x20;for&#x20;malicious&#x20;users&#x20;to&#x20;access&#x20;their&#x20;computers.&#x20;If&#x20;smart&#x20;cards&#x20;are&#x20;used&#x20;for&#x20;authentication,&#x20;the&#x20;computer&#x20;should&#x20;automatically&#x20;lock&#x20;itself&#x20;when&#x20;the&#x20;card&#x20;is&#x20;removed&#x20;to&#x20;ensure&#x20;that&#x20;only&#x20;the&#x20;user&#x20;with&#x20;the&#x20;smart&#x20;card&#x20;is&#x20;accessing&#x20;resources&#x20;using&#x20;those&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Lock&#x20;Workstation&#x20;&#40;or,&#x20;if&#x20;applicable&#x20;for&#x20;your&#x20;environment,&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior','[{\"cis\": [\"2.3.7.9\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26034,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;client&#x20;component.&#x20;Note:&#x20;When&#x20;Windows&#x20;Vista-based&#x20;computers&#x20;have&#x20;this&#x20;policy&#x20;setting&#x20;enabled&#x20;and&#x20;they&#x20;connect&#x20;to&#x20;file&#x20;or&#x20;print&#x20;shares&#x20;on&#x20;remote&#x20;servers,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;setting&#x20;is&#x20;synchronized&#x20;with&#x20;its&#x20;companion&#x20;setting,&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;,&#x20;on&#x20;those&#x20;servers.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;these&#x20;settings,&#x20;see&#x20;the&#x20;&quot;Microsoft&#x20;network&#x20;client&#x20;and&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;four&#x20;related&#x20;settings&#41;&quot;&#x20;section&#x20;in&#x20;Chapter&#x20;5&#x20;of&#x20;the&#x20;Threats&#x20;and&#x20;Countermeasures&#x20;guide.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.8.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26035,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;attempt&#x20;to&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing.&#x20;Note:&#x20;Enabling&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;makes&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;','[{\"cis\": [\"2.3.8.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26036,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;redirector&#x20;will&#x20;send&#x20;plaintext&#x20;passwords&#x20;during&#x20;authentication&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#x20;that&#x20;do&#x20;not&#x20;support&#x20;password&#x20;encryption.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;strong&#x20;business&#x20;case&#x20;to&#x20;enable&#x20;it.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;unencrypted&#x20;passwords&#x20;will&#x20;be&#x20;allowed&#x20;across&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;the&#x20;server&#x20;can&#x20;transmit&#x20;passwords&#x20;in&#x20;plaintext&#x20;across&#x20;the&#x20;network&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;offer&#x20;SMB&#x20;services,&#x20;which&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;risk.&#x20;These&#x20;other&#x20;computers&#x20;may&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;SMB&#x20;security&#x20;mechanisms&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;Server&#x20;2003.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers','[{\"cis\": [\"2.3.8.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26037,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;amount&#x20;of&#x20;continuous&#x20;idle&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;in&#x20;an&#x20;SMB&#x20;session&#x20;before&#x20;the&#x20;session&#x20;is&#x20;suspended&#x20;because&#x20;of&#x20;inactivity.&#x20;Administrators&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;control&#x20;when&#x20;a&#x20;computer&#x20;suspends&#x20;an&#x20;inactive&#x20;SMB&#x20;session.&#x20;If&#x20;client&#x20;activity&#x20;resumes,&#x20;the&#x20;session&#x20;is&#x20;automatically&#x20;reestablished.&#x20;The&#x20;maximum&#x20;value&#x20;is&#x20;99999,&#x20;which&#x20;is&#x20;over&#x20;69&#x20;days;&#x20;in&#x20;effect,&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;.','Each&#x20;SMB&#x20;session&#x20;consumes&#x20;server&#x20;resources,&#x20;and&#x20;numerous&#x20;null&#x20;sessions&#x20;will&#x20;slow&#x20;the&#x20;server&#x20;or&#x20;possibly&#x20;cause&#x20;it&#x20;to&#x20;fail.&#x20;An&#x20;attacker&#x20;could&#x20;repeatedly&#x20;establish&#x20;SMB&#x20;sessions&#x20;until&#x20;the&#x20;server&#039;s&#x20;SMB&#x20;services&#x20;become&#x20;slow&#x20;or&#x20;unresponsive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session','[{\"cis\": [\"2.3.9.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26038,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;server&#x20;component.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;in&#x20;a&#x20;mixed&#x20;environment&#x20;to&#x20;prevent&#x20;downstream&#x20;clients&#x20;from&#x20;using&#x20;the&#x20;workstation&#x20;as&#x20;a&#x20;network&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26039,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;server&#x20;will&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing&#x20;with&#x20;clients&#x20;that&#x20;request&#x20;it.&#x20;If&#x20;no&#x20;signing&#x20;request&#x20;comes&#x20;from&#x20;the&#x20;client,&#x20;a&#x20;connection&#x20;will&#x20;be&#x20;allowed&#x20;without&#x20;a&#x20;signature&#x20;if&#x20;the&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#x20;setting&#x20;is&#x20;not&#x20;enabled.&#x20;Note:&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;to&#x20;make&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;','[{\"cis\": [\"2.3.9.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26040,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.11.6&#41;.&#x20;If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;necessary&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;effective.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;then&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting.&#x20;Otherwise,&#x20;users&#x20;who&#x20;should&#x20;not&#x20;have&#x20;access&#x20;to&#x20;network&#x20;resources&#x20;outside&#x20;of&#x20;their&#x20;logon&#x20;hours&#x20;may&#x20;actually&#x20;be&#x20;able&#x20;to&#x20;continue&#x20;to&#x20;use&#x20;those&#x20;resources&#x20;with&#x20;sessions&#x20;that&#x20;were&#x20;established&#x20;during&#x20;allowed&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire','[{\"cis\": [\"2.3.9.4\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26041,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;level&#x20;of&#x20;validation&#x20;a&#x20;computer&#x20;with&#x20;shared&#x20;folders&#x20;or&#x20;printers&#x20;&#40;the&#x20;server&#41;&#x20;performs&#x20;on&#x20;the&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;that&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;client&#x20;computer&#x20;when&#x20;it&#x20;establishes&#x20;a&#x20;session&#x20;using&#x20;the&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;The&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;provides&#x20;the&#x20;basis&#x20;for&#x20;file&#x20;and&#x20;print&#x20;sharing&#x20;and&#x20;other&#x20;networking&#x20;operations,&#x20;such&#x20;as&#x20;remote&#x20;Windows&#x20;administration.&#x20;The&#x20;SMB&#x20;protocol&#x20;supports&#x20;validating&#x20;the&#x20;SMB&#x20;server&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;within&#x20;the&#x20;authentication&#x20;blob&#x20;provided&#x20;by&#x20;a&#x20;SMB&#x20;client&#x20;to&#x20;prevent&#x20;a&#x20;class&#x20;of&#x20;attacks&#x20;against&#x20;SMB&#x20;servers&#x20;referred&#x20;to&#x20;as&#x20;SMB&#x20;relay&#x20;attacks.&#x20;This&#x20;setting&#x20;will&#x20;affect&#x20;both&#x20;SMB1&#x20;and&#x20;SMB2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','The&#x20;identity&#x20;of&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;spoofed&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;network&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;&#40;configuring&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level','[{\"cis\": [\"2.3.9.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26042,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Allow&#x20;anonymous&#x20;SID/Name&#x20;translation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;an&#x20;anonymous&#x20;user&#x20;can&#x20;request&#x20;security&#x20;identifier&#x20;&#40;SID&#41;&#x20;attributes&#x20;for&#x20;another&#x20;user,&#x20;or&#x20;use&#x20;a&#x20;SID&#x20;to&#x20;obtain&#x20;its&#x20;corresponding&#x20;user&#x20;name.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;user&#x20;with&#x20;local&#x20;access&#x20;could&#x20;use&#x20;the&#x20;well-known&#x20;Administrator&#039;s&#x20;SID&#x20;to&#x20;learn&#x20;the&#x20;real&#x20;name&#x20;of&#x20;the&#x20;built-in&#x20;Administrator&#x20;account,&#x20;even&#x20;if&#x20;it&#x20;has&#x20;been&#x20;renamed.&#x20;That&#x20;person&#x20;could&#x20;then&#x20;use&#x20;the&#x20;account&#x20;name&#x20;to&#x20;initiate&#x20;a&#x20;password&#x20;guessing&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Allow&#x20;anonymous&#x20;SID/Name&#x20;translation','[{\"cis\": [\"2.3.10.1\"]}]'),(26043,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;the&#x20;accounts&#x20;in&#x20;the&#x20;Security&#x20;Accounts&#x20;Manager&#x20;&#40;SAM&#41;.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;with&#x20;anonymous&#x20;connections&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;allows&#x20;additional&#x20;restrictions&#x20;on&#x20;anonymous&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts','[{\"cis\": [\"2.3.10.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26044,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;SAM&#x20;accounts&#x20;as&#x20;well&#x20;as&#x20;shares.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;anonymous&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;and&#x20;network&#x20;share&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares','[{\"cis\": [\"2.3.10.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26045,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Credential&#x20;Manager&#x20;&#40;formerly&#x20;called&#x20;Stored&#x20;User&#x20;Names&#x20;and&#x20;Passwords&#41;&#x20;saves&#x20;passwords&#x20;or&#x20;credentials&#x20;for&#x20;later&#x20;use&#x20;when&#x20;it&#x20;gains&#x20;domain&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Changes&#x20;to&#x20;this&#x20;setting&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;Windows&#x20;is&#x20;restarted.','Passwords&#x20;that&#x20;are&#x20;cached&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;the&#x20;user&#x20;when&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;computer.&#x20;Although&#x20;this&#x20;information&#x20;may&#x20;sound&#x20;obvious,&#x20;a&#x20;problem&#x20;can&#x20;arise&#x20;if&#x20;the&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;reads&#x20;the&#x20;passwords&#x20;and&#x20;forwards&#x20;them&#x20;to&#x20;another,&#x20;unauthorized&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication','[{\"cis\": [\"2.3.10.4\"]}, {\"pci_dss\": [\"3.1\"]}]'),(26046,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;additional&#x20;permissions&#x20;are&#x20;assigned&#x20;for&#x20;anonymous&#x20;connections&#x20;to&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords,&#x20;perform&#x20;social&#x20;engineering&#x20;attacks,&#x20;or&#x20;launch&#x20;DoS&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users','[{\"cis\": [\"2.3.10.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26047,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26048,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;There&#x20;was&#x20;a&#x20;setting&#x20;with&#x20;that&#x20;name&#x20;in&#x20;Windows&#x20;XP,&#x20;but&#x20;it&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;&#x20;in&#x20;Windows&#x20;Server&#x20;2003,&#x20;Windows&#x20;Vista,&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;SystemCurrentControlSetControlProductOptions&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion','The&#x20;registry&#x20;is&#x20;a&#x20;database&#x20;that&#x20;contains&#x20;computer&#x20;configuration&#x20;information,&#x20;and&#x20;much&#x20;of&#x20;the&#x20;information&#x20;is&#x20;sensitive.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;information&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack,&#x20;suitable&#x20;ACLs&#x20;are&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;to&#x20;help&#x20;protect&#x20;it&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;in&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;Configuration&#92;Policies&#92;Windows&#x20;Settings&#92;Security&#x20;Settings&#92;Local&#x20;Policies&#92;Security&#x20;Options&#92;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths.&quot;&#x20;Set&#x20;these&#x20;values:&#x20;-&quot;System&#92;CurrentControlSet&#92;Control&#92;ProductOptions&quot;&#x20;-&quot;System&#92;CurrentControlSet&#92;Control&#92;Server&#x20;Applications&quot;&#x20;-&quot;SOFTWARE&#92;Microsoft&#92;Windows&#x20;NT&#92;CurrentVersion&quot;&#x0a;','[{\"cis\": [\"2.3.10.7\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26049,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;In&#x20;Windows&#x20;XP&#x20;this&#x20;setting&#x20;is&#x20;called&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths,&#039;&#x20;the&#x20;setting&#x20;with&#x20;that&#x20;same&#x20;name&#x20;in&#x20;Windows&#x20;Vista,&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;and&#x20;Windows&#x20;Server&#x20;2003&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;SystemCurrentControlSetServicesSysmonLog','The&#x20;registry&#x20;contains&#x20;sensitive&#x20;computer&#x20;configuration&#x20;information&#x20;that&#x20;could&#x20;be&#x20;used&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;The&#x20;fact&#x20;that&#x20;the&#x20;default&#x20;ACLs&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;are&#x20;fairly&#x20;restrictive&#x20;and&#x20;help&#x20;to&#x20;protect&#x20;the&#x20;registry&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;in&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;Configuration&#92;Policies&#92;Windows&#x20;Settings&#92;Security&#x20;Settings&#92;Local&#x20;Policies&#92;Security&#x20;Options&#92;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;Set&#x20;the&#x20;following&#x20;values:&#x20;-&quot;System&#92;CurrentControlSet&#92;Control&#92;Print&#92;Printers&quot;&#x20;-&quot;System&#92;CurrentControlSet&#92;Services&#92;Eventlog&quot;&#x20;-&quot;SOFTWARE&#92;Microsoft&#92;OLAP&#x20;Server&#x20;SOFTWARE&#92;Microsoft&#92;Windows&#x20;NT&#92;CurrentVersion&#92;Print&quot;&#x20;-&quot;SOFTWARE&#92;Microsoft&#92;Windows&#x20;NT&#92;CurrentVersion&#92;Windows&#x20;System&#92;CurrentControlSet&#92;Control&#92;ContentIndex&quot;&#x20;-&quot;System&#92;CurrentControlSet&#92;Control&#92;Terminal&#x20;Server&#x20;System&#92;CurrentControlSet&#92;Control&#92;Terminal&#x20;Server&#92;UserConfig&quot;&#x20;-&quot;System&#92;CurrentControlSet&#92;Control&#92;Terminal&#x20;Server&#92;DefaultUserConfiguration&quot;&#x20;-&quot;SOFTWARE&#92;Microsoft&#92;Windows&#x20;NT&#92;CurrentVersion&#92;Perflib&#x20;System&#92;CurrentControlSet&#92;Services&#92;SysmonLog&quot;&#x0a;','[{\"cis\": [\"2.3.10.8\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26050,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;enabled,&#x20;this&#x20;policy&#x20;setting&#x20;restricts&#x20;anonymous&#x20;access&#x20;to&#x20;only&#x20;those&#x20;shares&#x20;and&#x20;pipes&#x20;that&#x20;are&#x20;named&#x20;in&#x20;the&#x20;Network&#x20;access:&#x20;Named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;and&#x20;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;settings.&#x20;This&#x20;policy&#x20;setting&#x20;controls&#x20;null&#x20;session&#x20;access&#x20;to&#x20;shares&#x20;on&#x20;your&#x20;computers&#x20;by&#x20;adding&#x20;RestrictNullSessAccess&#x20;with&#x20;the&#x20;value&#x20;1&#x20;in&#x20;the&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanManServerParameters&#x20;registry&#x20;key.&#x20;This&#x20;registry&#x20;value&#x20;toggles&#x20;null&#x20;session&#x20;shares&#x20;on&#x20;or&#x20;off&#x20;to&#x20;control&#x20;whether&#x20;the&#x20;server&#x20;service&#x20;restricts&#x20;unauthenticated&#x20;clients&#039;&#x20;access&#x20;to&#x20;named&#x20;resources.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Null&#x20;sessions&#x20;are&#x20;a&#x20;weakness&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;through&#x20;shares&#x20;&#40;including&#x20;the&#x20;default&#x20;shares&#41;&#x20;on&#x20;computers&#x20;in&#x20;your&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares','[{\"cis\": [\"2.3.10.9\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26051,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;remote&#x20;RPC&#x20;connections&#x20;to&#x20;SAM.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow.&#x20;Note:&#x20;A&#x20;Windows&#x20;10&#x20;R1607,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.&#x20;Note&#x20;#2:&#x20;If&#x20;your&#x20;organization&#x20;is&#x20;using&#x20;Azure&#x20;Advanced&#x20;Threat&#x20;Protection&#x20;&#40;APT&#41;,&#x20;the&#x20;service&#x20;account,&#x20;&quot;AATP&#x20;Service&quot;&#x20;will&#x20;need&#x20;to&#x20;be&#x20;added&#x20;to&#x20;the&#x20;recommendation&#x20;configuration.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;adding&#x20;the&#x20;&quot;AATP&#x20;Service&quot;&#x20;account&#x20;please&#x20;see&#x20;Configure&#x20;SAM-R&#x20;to&#x20;enable&#x20;lateral&#x20;movement&#x20;path&#x20;detection&#x20;in&#x20;Microsoft&#x20;Defender&#x20;for&#x20;Identity&#x20;|&#x20;Microsoft&#x20;Docs.','To&#x20;ensure&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;cannot&#x20;anonymously&#x20;list&#x20;local&#x20;account&#x20;names&#x20;or&#x20;groups&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM','[{\"cis\": [\"2.3.10.10\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26052,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;network&#x20;shares&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;anonymous&#x20;users.&#x20;The&#x20;default&#x20;configuration&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;has&#x20;little&#x20;effect&#x20;because&#x20;all&#x20;users&#x20;have&#x20;to&#x20;be&#x20;authenticated&#x20;before&#x20;they&#x20;can&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;.','It&#x20;is&#x20;very&#x20;dangerous&#x20;to&#x20;allow&#x20;any&#x20;values&#x20;in&#x20;this&#x20;setting.&#x20;Any&#x20;shares&#x20;that&#x20;are&#x20;listed&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;any&#x20;network&#x20;user,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.11\"]}, {\"cis_csc\": [\"3.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26053,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;network&#x20;logons&#x20;that&#x20;use&#x20;local&#x20;accounts&#x20;are&#x20;authenticated.&#x20;The&#x20;Classic&#x20;option&#x20;allows&#x20;precise&#x20;control&#x20;over&#x20;access&#x20;to&#x20;resources,&#x20;including&#x20;the&#x20;ability&#x20;to&#x20;assign&#x20;different&#x20;types&#x20;of&#x20;access&#x20;to&#x20;different&#x20;users&#x20;for&#x20;the&#x20;same&#x20;resource.&#x20;The&#x20;Guest&#x20;only&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;treat&#x20;all&#x20;users&#x20;equally.&#x20;In&#x20;this&#x20;context,&#x20;all&#x20;users&#x20;authenticate&#x20;as&#x20;Guest&#x20;only&#x20;to&#x20;receive&#x20;the&#x20;same&#x20;access&#x20;level&#x20;to&#x20;a&#x20;given&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;interactive&#x20;logons&#x20;that&#x20;are&#x20;performed&#x20;remotely&#x20;by&#x20;using&#x20;such&#x20;services&#x20;as&#x20;Telnet&#x20;or&#x20;Remote&#x20;Desktop&#x20;Services&#x20;&#40;formerly&#x20;called&#x20;Terminal&#x20;Services&#41;.','With&#x20;the&#x20;Guest&#x20;only&#x20;model,&#x20;any&#x20;user&#x20;who&#x20;can&#x20;authenticate&#x20;to&#x20;your&#x20;computer&#x20;over&#x20;the&#x20;network&#x20;does&#x20;so&#x20;with&#x20;guest&#x20;privileges,&#x20;which&#x20;probably&#x20;means&#x20;that&#x20;they&#x20;will&#x20;not&#x20;have&#x20;write&#x20;access&#x20;to&#x20;shared&#x20;resources&#x20;on&#x20;that&#x20;computer.&#x20;Although&#x20;this&#x20;restriction&#x20;does&#x20;increase&#x20;security,&#x20;it&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;authorized&#x20;users&#x20;to&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;those&#x20;computers&#x20;because&#x20;ACLs&#x20;on&#x20;those&#x20;resources&#x20;must&#x20;include&#x20;access&#x20;control&#x20;entries&#x20;&#40;ACEs&#41;&#x20;for&#x20;the&#x20;Guest&#x20;account.&#x20;With&#x20;the&#x20;Classic&#x20;model,&#x20;local&#x20;accounts&#x20;should&#x20;be&#x20;password&#x20;protected.&#x20;Otherwise,&#x20;if&#x20;Guest&#x20;access&#x20;is&#x20;enabled,&#x20;anyone&#x20;can&#x20;use&#x20;those&#x20;user&#x20;accounts&#x20;to&#x20;access&#x20;shared&#x20;system&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts','[{\"cis\": [\"2.3.10.12\"]}, {\"pci_dss\": [\"7.1.3\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26054,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Local&#x20;System&#x20;services&#x20;that&#x20;use&#x20;Negotiate&#x20;when&#x20;reverting&#x20;to&#x20;NTLM&#x20;authentication&#x20;can&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;This&#x20;policy&#x20;is&#x20;supported&#x20;on&#x20;at&#x20;least&#x20;Windows&#x20;7&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;R2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;connecting&#x20;to&#x20;computers&#x20;running&#x20;versions&#x20;of&#x20;Windows&#x20;earlier&#x20;than&#x20;Windows&#x20;Vista&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;services&#x20;running&#x20;as&#x20;Local&#x20;System&#x20;and&#x20;using&#x20;SPNEGO&#x20;&#40;Negotiate&#41;&#x20;that&#x20;revert&#x20;to&#x20;NTLM&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;In&#x20;Windows&#x20;7,&#x20;if&#x20;you&#x20;are&#x20;connecting&#x20;to&#x20;a&#x20;computer&#x20;running&#x20;Windows&#x20;Server&#x20;2008&#x20;or&#x20;Windows&#x20;Vista,&#x20;then&#x20;a&#x20;system&#x20;service&#x20;uses&#x20;either&#x20;the&#x20;computer&#x20;identity&#x20;or&#x20;a&#x20;NULL&#x20;session.&#x20;When&#x20;connecting&#x20;with&#x20;a&#x20;NULL&#x20;session,&#x20;a&#x20;system-generated&#x20;session&#x20;key&#x20;is&#x20;created,&#x20;which&#x20;provides&#x20;no&#x20;protection&#x20;but&#x20;allows&#x20;applications&#x20;to&#x20;sign&#x20;and&#x20;encrypt&#x20;data&#x20;without&#x20;errors.&#x20;When&#x20;connecting&#x20;with&#x20;the&#x20;computer&#x20;identity,&#x20;both&#x20;signing&#x20;and&#x20;encryption&#x20;is&#x20;supported&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;data&#x20;protection.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM','[{\"cis\": [\"2.3.11.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26055,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;NTLM&#x20;is&#x20;allowed&#x20;to&#x20;fall&#x20;back&#x20;to&#x20;a&#x20;NULL&#x20;session&#x20;when&#x20;used&#x20;with&#x20;LocalSystem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','NULL&#x20;sessions&#x20;are&#x20;less&#x20;secure&#x20;because&#x20;by&#x20;definition&#x20;they&#x20;are&#x20;unauthenticated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback','[{\"cis\": [\"2.3.11.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26056,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;determines&#x20;if&#x20;online&#x20;identities&#x20;are&#x20;able&#x20;to&#x20;authenticate&#x20;to&#x20;this&#x20;computer.&#x20;The&#x20;Public&#x20;Key&#x20;Cryptography&#x20;Based&#x20;User-to-User&#x20;&#40;PKU2U&#41;&#x20;protocol&#x20;introduced&#x20;in&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;R2&#x20;is&#x20;implemented&#x20;as&#x20;a&#x20;security&#x20;support&#x20;provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;enables&#x20;peer-to-peer&#x20;authentication,&#x20;particularly&#x20;through&#x20;the&#x20;Windows&#x20;7&#x20;media&#x20;and&#x20;file&#x20;sharing&#x20;feature&#x20;called&#x20;HomeGroup,&#x20;which&#x20;permits&#x20;sharing&#x20;between&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;members&#x20;of&#x20;a&#x20;domain.&#x20;With&#x20;PKU2U,&#x20;a&#x20;new&#x20;extension&#x20;was&#x20;introduced&#x20;to&#x20;the&#x20;Negotiate&#x20;authentication&#x20;package,&#x20;Spnego.dll.&#x20;In&#x20;previous&#x20;versions&#x20;of&#x20;Windows,&#x20;Negotiate&#x20;decided&#x20;whether&#x20;to&#x20;use&#x20;Kerberos&#x20;or&#x20;NTLM&#x20;for&#x20;authentication.&#x20;The&#x20;extension&#x20;SSP&#x20;for&#x20;Negotiate,&#x20;Negoexts.dll,&#x20;which&#x20;is&#x20;treated&#x20;as&#x20;an&#x20;authentication&#x20;protocol&#x20;by&#x20;Windows,&#x20;supports&#x20;Microsoft&#x20;SSPs&#x20;including&#x20;PKU2U.&#x20;When&#x20;computers&#x20;are&#x20;configured&#x20;to&#x20;accept&#x20;authentication&#x20;requests&#x20;by&#x20;using&#x20;online&#x20;IDs,&#x20;Negoexts.dll&#x20;calls&#x20;the&#x20;PKU2U&#x20;SSP&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;PKU2U&#x20;SSP&#x20;obtains&#x20;a&#x20;local&#x20;certificate&#x20;and&#x20;exchanges&#x20;the&#x20;policy&#x20;between&#x20;the&#x20;peer&#x20;computers.&#x20;When&#x20;validated&#x20;on&#x20;the&#x20;peer&#x20;computer,&#x20;the&#x20;certificate&#x20;within&#x20;the&#x20;metadata&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;logon&#x20;peer&#x20;for&#x20;validation&#x20;and&#x20;associates&#x20;the&#x20;user&#039;s&#x20;certificate&#x20;to&#x20;a&#x20;security&#x20;token&#x20;and&#x20;the&#x20;logon&#x20;process&#x20;completes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;PKU2U&#x20;protocol&#x20;is&#x20;a&#x20;peer-to-peer&#x20;authentication&#x20;protocol&#x20;-&#x20;authentication&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;in&#x20;most&#x20;managed&#x20;networks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities','[{\"cis\": [\"2.3.11.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26057,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;encryption&#x20;types&#x20;that&#x20;Kerberos&#x20;is&#x20;allowed&#x20;to&#x20;use.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types.&#x20;Note:&#x20;Some&#x20;legacy&#x20;applications&#x20;and&#x20;OSes&#x20;may&#x20;still&#x20;require&#x20;RC4_HMAC_MD5&#x20;-&#x20;we&#x20;recommend&#x20;you&#x20;test&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;verify&#x20;whether&#x20;you&#x20;can&#x20;safely&#x20;remove&#x20;it.','The&#x20;strength&#x20;of&#x20;each&#x20;encryption&#x20;algorithm&#x20;varies&#x20;from&#x20;one&#x20;to&#x20;the&#x20;next,&#x20;choosing&#x20;stronger&#x20;algorithms&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;compromise&#x20;however&#x20;doing&#x20;so&#x20;may&#x20;cause&#x20;issues&#x20;when&#x20;the&#x20;computer&#x20;attempts&#x20;to&#x20;authenticate&#x20;with&#x20;systems&#x20;that&#x20;do&#x20;not&#x20;support&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos','[{\"cis\": [\"2.3.11.4\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26058,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;hash&#x20;value&#x20;for&#x20;the&#x20;new&#x20;password&#x20;is&#x20;stored&#x20;when&#x20;the&#x20;password&#x20;is&#x20;changed.&#x20;The&#x20;LM&#x20;hash&#x20;is&#x20;relatively&#x20;weak&#x20;and&#x20;prone&#x20;to&#x20;attack&#x20;compared&#x20;to&#x20;the&#x20;cryptographically&#x20;stronger&#x20;Microsoft&#x20;Windows&#x20;NT&#x20;hash.&#x20;Since&#x20;LM&#x20;hashes&#x20;are&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;in&#x20;the&#x20;security&#x20;database,&#x20;passwords&#x20;can&#x20;then&#x20;be&#x20;easily&#x20;compromised&#x20;if&#x20;the&#x20;database&#x20;is&#x20;attacked.&#x20;Note:&#x20;Older&#x20;operating&#x20;systems&#x20;and&#x20;some&#x20;third-party&#x20;applications&#x20;may&#x20;fail&#x20;when&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled.&#x20;Also,&#x20;note&#x20;that&#x20;the&#x20;password&#x20;will&#x20;need&#x20;to&#x20;be&#x20;changed&#x20;on&#x20;all&#x20;accounts&#x20;after&#x20;you&#x20;enable&#x20;this&#x20;setting&#x20;to&#x20;gain&#x20;the&#x20;proper&#x20;benefit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;SAM&#x20;file&#x20;can&#x20;be&#x20;targeted&#x20;by&#x20;attackers&#x20;who&#x20;seek&#x20;access&#x20;to&#x20;username&#x20;and&#x20;password&#x20;hashes.&#x20;Such&#x20;attacks&#x20;use&#x20;special&#x20;tools&#x20;to&#x20;crack&#x20;passwords,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;users&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;resources&#x20;on&#x20;your&#x20;network.&#x20;These&#x20;types&#x20;of&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;prevented&#x20;if&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;but&#x20;it&#x20;will&#x20;be&#x20;much&#x20;more&#x20;difficult&#x20;for&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;to&#x20;succeed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change','[{\"cis\": [\"2.3.11.5\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26059,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.9.4&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;a&#x20;user&#x20;could&#x20;remain&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;outside&#x20;of&#x20;their&#x20;allotted&#x20;logon&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire','[{\"cis\": [\"2.3.11.6\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26060,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM&#039;.','LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;was&#x20;a&#x20;family&#x20;of&#x20;early&#x20;Microsoft&#x20;client/server&#x20;software&#x20;&#40;predating&#x20;Windows&#x20;NT&#41;&#x20;that&#x20;allowed&#x20;users&#x20;to&#x20;link&#x20;personal&#x20;computers&#x20;together&#x20;on&#x20;a&#x20;single&#x20;network.&#x20;LM&#x20;network&#x20;capabilities&#x20;included&#x20;transparent&#x20;file&#x20;and&#x20;print&#x20;sharing,&#x20;user&#x20;security&#x20;features,&#x20;and&#x20;network&#x20;administration&#x20;tools.&#x20;In&#x20;Active&#x20;Directory&#x20;domains,&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;the&#x20;default&#x20;authentication&#x20;protocol.&#x20;However,&#x20;if&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;not&#x20;negotiated&#x20;for&#x20;some&#x20;reason,&#x20;Active&#x20;Directory&#x20;will&#x20;use&#x20;LM,&#x20;NTLM,&#x20;or&#x20;NTLMv2.&#x20;LAN&#x20;Manager&#x20;authentication&#x20;includes&#x20;the&#x20;LM,&#x20;NTLM,&#x20;and&#x20;NTLM&#x20;version&#x20;2&#x20;&#40;NTLMv2&#41;&#x20;variants,&#x20;and&#x20;is&#x20;the&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;to&#x20;authenticate&#x20;all&#x20;Windows&#x20;clients&#x20;when&#x20;they&#x20;perform&#x20;the&#x20;following&#x20;operations:&#x20;-Join&#x20;a&#x20;domain&#x20;-Authenticate&#x20;between&#x20;Active&#x20;Directory&#x20;forests&#x20;-Authenticate&#x20;to&#x20;down-level&#x20;domains&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;do&#x20;not&#x20;run&#x20;Windows&#x20;2000,&#x20;Windows&#x20;Server&#x20;2003,&#x20;or&#x20;Windows&#x20;XP&#x20;-Authenticate&#x20;to&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;in&#x20;the&#x20;domain.&#x20;The&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#x20;setting&#x20;determines&#x20;which&#x20;challenge/response&#x20;authentication&#x20;protocol&#x20;is&#x20;used&#x20;for&#x20;network&#x20;logons.&#x20;This&#x20;choice&#x20;affects&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;protocol&#x20;used&#x20;by&#x20;clients,&#x20;the&#x20;level&#x20;of&#x20;session&#x20;security&#x20;negotiated,&#x20;and&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;accepted&#x20;by&#x20;servers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM.','Windows&#x20;2000&#x20;and&#x20;Windows&#x20;XP&#x20;clients&#x20;were&#x20;configured&#x20;by&#x20;default&#x20;to&#x20;send&#x20;LM&#x20;and&#x20;NTLM&#x20;authentication&#x20;responses&#x20;&#40;Windows&#x20;95-based&#x20;and&#x20;Windows&#x20;98-based&#x20;clients&#x20;only&#x20;send&#x20;LM&#41;.&#x20;The&#x20;default&#x20;settings&#x20;in&#x20;OSes&#x20;predating&#x20;Windows&#x20;Vista&#x20;/&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-&#x20;R2&#41;&#x20;allowed&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;with&#x20;servers&#x20;and&#x20;use&#x20;their&#x20;resources.&#x20;However,&#x20;this&#x20;meant&#x20;that&#x20;LM&#x20;responses&#x20;-&#x20;the&#x20;weakest&#x20;form&#x20;of&#x20;authentication&#x20;response&#x20;-&#x20;were&#x20;sent&#x20;over&#x20;the&#x20;network,&#x20;and&#x20;it&#x20;was&#x20;potentially&#x20;possible&#x20;for&#x20;attackers&#x20;to&#x20;sniff&#x20;that&#x20;traffic&#x20;to&#x20;more&#x20;easily&#x20;reproduce&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;operating&#x20;systems&#x20;cannot&#x20;use&#x20;the&#x20;Kerberos&#x20;version&#x20;5&#x20;protocol&#x20;for&#x20;authentication.&#x20;For&#x20;this&#x20;reason,&#x20;in&#x20;a&#x20;Windows&#x20;Server&#x20;2003&#x20;domain,&#x20;these&#x20;computers&#x20;authenticate&#x20;by&#x20;default&#x20;with&#x20;both&#x20;the&#x20;LM&#x20;and&#x20;NTLM&#x20;protocols&#x20;for&#x20;network&#x20;authentication.&#x20;You&#x20;can&#x20;enforce&#x20;a&#x20;more&#x20;secure&#x20;authentication&#x20;protocol&#x20;for&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;by&#x20;using&#x20;NTLMv2.&#x20;For&#x20;the&#x20;logon&#x20;process,&#x20;NTLMv2&#x20;uses&#x20;a&#x20;secure&#x20;channel&#x20;to&#x20;protect&#x20;the&#x20;authentication&#x20;process.&#x20;Even&#x20;if&#x20;you&#x20;use&#x20;NTLMv2&#x20;for&#x20;older&#x20;clients&#x20;and&#x20;servers,&#x20;Windows-based&#x20;clients&#x20;and&#x20;servers&#x20;that&#x20;are&#x20;members&#x20;of&#x20;the&#x20;domain&#x20;will&#x20;use&#x20;the&#x20;Kerberos&#x20;authentication&#x20;protocol&#x20;to&#x20;authenticate&#x20;with&#x20;Windows&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;Domain&#x20;Controllers.&#x20;For&#x20;these&#x20;reasons,&#x20;it&#x20;is&#x20;strongly&#x20;preferred&#x20;to&#x20;restrict&#x20;the&#x20;use&#x20;of&#x20;LM&#x20;&amp;&#x20;NTLM&#x20;&#40;non-v2&#41;&#x20;as&#x20;much&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level','[{\"cis\": [\"2.3.11.7\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26061,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Negotiate&#x20;signing&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;data&#x20;signing&#x20;that&#x20;is&#x20;requested&#x20;on&#x20;behalf&#x20;of&#x20;clients&#x20;that&#x20;issue&#x20;LDAP&#x20;BIND&#x20;requests.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;ldap_simple_bind&#x20;or&#x20;ldap_simple_bind_s&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Negotiate&#x20;signing.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x20;in&#x20;which&#x20;an&#x20;intruder&#x20;captures&#x20;the&#x20;packets&#x20;between&#x20;the&#x20;client&#x20;and&#x20;server,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;server.&#x20;For&#x20;an&#x20;LDAP&#x20;server,&#x20;this&#x20;susceptibility&#x20;means&#x20;that&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;server&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;or&#x20;altered&#x20;data&#x20;from&#x20;the&#x20;LDAP&#x20;queries.&#x20;To&#x20;lower&#x20;this&#x20;risk&#x20;in&#x20;your&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;can&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult&#x20;if&#x20;you&#x20;require&#x20;digital&#x20;signatures&#x20;on&#x20;all&#x20;network&#x20;packets&#x20;by&#x20;means&#x20;of&#x20;IPsec&#x20;authentication&#x20;headers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Negotiate&#x20;signing&#x20;&#40;configuring&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements','[{\"cis\": [\"2.3.11.8\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26062,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;clients&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;both&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;In&#x20;other&#x20;words,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients','[{\"cis\": [\"2.3.11.9\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26063,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;servers&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;all&#x20;of&#x20;the&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;That&#x20;is,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers','[{\"cis\": [\"2.3.11.10\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26064,'Ensure&#x20;&#039;System&#x20;cryptography:&#x20;Force&#x20;strong&#x20;key&#x20;protection&#x20;for&#x20;user&#x20;keys&#x20;stored&#x20;on&#x20;the&#x20;computer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;User&#x20;is&#x20;prompted&#x20;when&#x20;the&#x2','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#039;&#x20;private&#x20;keys&#x20;&#40;such&#x20;as&#x20;their&#x20;S-MIME&#x20;keys&#41;&#x20;require&#x20;a&#x20;password&#x20;to&#x20;be&#x20;used.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;User&#x20;is&#x20;prompted&#x20;when&#x20;the&#x20;key&#x20;is&#x20;first&#x20;used.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;User&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;each&#x20;time&#x20;they&#x20;use&#x20;a&#x20;key&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','If&#x20;a&#x20;user&#039;s&#x20;account&#x20;is&#x20;compromised&#x20;or&#x20;their&#x20;computer&#x20;is&#x20;inadvertently&#x20;left&#x20;unsecured&#x20;the&#x20;malicious&#x20;user&#x20;can&#x20;use&#x20;the&#x20;keys&#x20;stored&#x20;for&#x20;the&#x20;user&#x20;to&#x20;access&#x20;protected&#x20;resources.&#x20;You&#x20;can&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;so&#x20;that&#x20;users&#x20;must&#x20;provide&#x20;a&#x20;password&#x20;that&#x20;is&#x20;distinct&#x20;from&#x20;their&#x20;domain&#x20;password&#x20;every&#x20;time&#x20;they&#x20;use&#x20;a&#x20;key.&#x20;This&#x20;configuration&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;access&#x20;locally&#x20;stored&#x20;user&#x20;keys,&#x20;even&#x20;if&#x20;the&#x20;attacker&#x20;takes&#x20;control&#x20;of&#x20;the&#x20;user&#039;s&#x20;computer&#x20;and&#x20;determines&#x20;their&#x20;logon&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;User&#x20;is&#x20;prompted&#x20;when&#x20;the&#x20;key&#x20;is&#x20;first&#x20;used&#x20;&#40;configuring&#x20;to&#x20;User&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;each&#x20;time&#x20;they&#x20;use&#x20;a&#x20;key&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;cryptography:&#x20;Force&#x20;strong&#x20;key&#x20;protection&#x20;for&#x20;user&#x20;keys&#x20;stored&#x20;on&#x20;the&#x20;computer','[{\"cis\": [\"2.3.14.1\"]}, {\"cis_csc\": [\"3.11\"]}]'),(26065,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;case&#x20;insensitivity&#x20;is&#x20;enforced&#x20;for&#x20;all&#x20;subsystems.&#x20;The&#x20;Microsoft&#x20;Win32&#x20;subsystem&#x20;is&#x20;case&#x20;insensitive.&#x20;However,&#x20;the&#x20;kernel&#x20;supports&#x20;case&#x20;sensitivity&#x20;for&#x20;other&#x20;subsystems,&#x20;such&#x20;as&#x20;the&#x20;Portable&#x20;Operating&#x20;System&#x20;Interface&#x20;for&#x20;UNIX&#x20;&#40;POSIX&#41;.&#x20;Because&#x20;Windows&#x20;is&#x20;case&#x20;insensitive&#x20;&#40;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity&#41;,&#x20;failure&#x20;to&#x20;enforce&#x20;this&#x20;policy&#x20;setting&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;the&#x20;POSIX&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;by&#x20;using&#x20;mixed&#x20;case&#x20;to&#x20;label&#x20;it.&#x20;Such&#x20;a&#x20;situation&#x20;can&#x20;block&#x20;access&#x20;to&#x20;these&#x20;files&#x20;by&#x20;another&#x20;user&#x20;who&#x20;uses&#x20;typical&#x20;Win32&#x20;tools,&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Because&#x20;Windows&#x20;is&#x20;case-insensitive&#x20;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity,&#x20;failure&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;would&#x20;make&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;that&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;but&#x20;with&#x20;a&#x20;different&#x20;mix&#x20;of&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letters.&#x20;Such&#x20;a&#x20;situation&#x20;could&#x20;potentially&#x20;confuse&#x20;users&#x20;when&#x20;they&#x20;try&#x20;to&#x20;access&#x20;such&#x20;files&#x20;from&#x20;normal&#x20;Win32&#x20;tools&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-Windows&#x20;subsystems','[{\"cis\": [\"2.3.15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26066,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;discretionary&#x20;access&#x20;control&#x20;list&#x20;&#40;DACL&#41;&#x20;for&#x20;objects.&#x20;Active&#x20;Directory&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;system&#x20;resources,&#x20;such&#x20;as&#x20;DOS&#x20;device&#x20;names,&#x20;mutexes,&#x20;and&#x20;semaphores.&#x20;In&#x20;this&#x20;way,&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;what&#x20;permissions&#x20;are&#x20;granted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;DACL&#x20;for&#x20;objects.&#x20;Windows&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;computer&#x20;resources&#x20;so&#x20;that&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;with&#x20;what&#x20;permissions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;','[{\"cis\": [\"2.3.15.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26067,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;built-in&#x20;Administrator&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;An&#x20;attack&#x20;vector&#x20;for&#x20;these&#x20;programs&#x20;was&#x20;to&#x20;discover&#x20;the&#x20;password&#x20;of&#x20;the&#x20;account&#x20;named&#x20;&#039;Administrator&#039;&#x20;because&#x20;that&#x20;user&#x20;account&#x20;was&#x20;created&#x20;for&#x20;all&#x20;installations&#x20;of&#x20;Windows.&#x20;To&#x20;address&#x20;this&#x20;risk,&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;newer,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;is&#x20;now&#x20;disabled&#x20;by&#x20;default.&#x20;In&#x20;a&#x20;default&#x20;installation&#x20;of&#x20;a&#x20;new&#x20;computer,&#x20;accounts&#x20;with&#x20;administrative&#x20;control&#x20;over&#x20;the&#x20;computer&#x20;are&#x20;initially&#x20;set&#x20;up&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;not&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;the&#x20;first&#x20;user&#x20;account&#x20;you&#x20;create&#x20;has&#x20;the&#x20;equivalent&#x20;permissions&#x20;as&#x20;a&#x20;local&#x20;administrator.&#x20;-&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;no&#x20;local&#x20;administrator&#x20;accounts&#x20;are&#x20;created.&#x20;The&#x20;Enterprise&#x20;or&#x20;Domain&#x20;Administrator&#x20;must&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;and&#x20;create&#x20;one&#x20;if&#x20;a&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;warranted.&#x20;Once&#x20;Windows&#x20;is&#x20;installed,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;may&#x20;be&#x20;manually&#x20;enabled,&#x20;but&#x20;we&#x20;strongly&#x20;recommend&#x20;that&#x20;this&#x20;account&#x20;remain&#x20;disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account','[{\"cis\": [\"2.3.17.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26068,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Prompt&#x20;for&#x20;consent&#x20','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;administrator&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;permits&#x20;the&#x20;administrator&#x20;to&#x20;prevent&#x20;a&#x20;malicious&#x20;program&#x20;from&#x20;elevating&#x20;its&#x20;privilege&#x20;when&#x20;the&#x20;program&#x20;attempts&#x20;to&#x20;do&#x20;so.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode','[{\"cis\": [\"2.3.17.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26069,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Automatically&#x20;deny&#x20;elevation&#x20;requests&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;programs&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;their&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;user&#x20;that&#x20;a&#x20;program&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;requires&#x20;that&#x20;the&#x20;user&#x20;be&#x20;able&#x20;to&#x20;supply&#x20;administrative&#x20;credentials&#x20;in&#x20;order&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users','[{\"cis\": [\"2.3.17.3\"]}, {\"pci_dss\": [\"7.1.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26070,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;application&#x20;installation&#x20;detection&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Some&#x20;malicious&#x20;software&#x20;will&#x20;attempt&#x20;to&#x20;install&#x20;itself&#x20;after&#x20;being&#x20;given&#x20;permission&#x20;to&#x20;run.&#x20;For&#x20;example,&#x20;malicious&#x20;software&#x20;with&#x20;a&#x20;trusted&#x20;application&#x20;shell.&#x20;The&#x20;user&#x20;may&#x20;have&#x20;given&#x20;permission&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run&#x20;because&#x20;the&#x20;program&#x20;is&#x20;trusted,&#x20;but&#x20;if&#x20;they&#x20;are&#x20;then&#x20;prompted&#x20;for&#x20;installation&#x20;of&#x20;an&#x20;unknown&#x20;component&#x20;this&#x20;provides&#x20;another&#x20;way&#x20;of&#x20;trapping&#x20;the&#x20;software&#x20;before&#x20;it&#x20;can&#x20;do&#x20;damage','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation','[{\"cis\": [\"2.3.17.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26071,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;applications&#x20;that&#x20;request&#x20;to&#x20;run&#x20;with&#x20;a&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#41;&#x20;integrity&#x20;level&#x20;must&#x20;reside&#x20;in&#x20;a&#x20;secure&#x20;location&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;Secure&#x20;locations&#x20;are&#x20;limited&#x20;to&#x20;the&#x20;following:&#x20;-&#x20;...Program&#x20;Files,&#x20;including&#x20;subfolders&#x20;&#x20;-&#x20;...Windowssystem32;&#x20;-&#x20;...Program&#x20;Files&#x20;&#40;x86&#41;,&#x20;including&#x20;subfolders&#x20;&#40;for&#x20;64-bit&#x20;versions&#x20;of&#x20;Windows&#41;.&#x20;Note:&#x20;Windows&#x20;enforces&#x20;a&#x20;public&#x20;key&#x20;infrastructure&#x20;&#40;PKI&#41;&#x20;signature&#x20;check&#x20;on&#x20;any&#x20;interactive&#x20;application&#x20;that&#x20;requests&#x20;to&#x20;run&#x20;with&#x20;a&#x20;UIAccess&#x20;integrity&#x20;level&#x20;regardless&#x20;of&#x20;the&#x20;state&#x20;of&#x20;this&#x20;security&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','UIAccess&#x20;Integrity&#x20;allows&#x20;an&#x20;application&#x20;to&#x20;bypass&#x20;User&#x20;Interface&#x20;Privilege&#x20;Isolation&#x20;&#40;UIPI&#41;&#x20;restrictions&#x20;when&#x20;an&#x20;application&#x20;is&#x20;elevated&#x20;in&#x20;privilege&#x20;from&#x20;a&#x20;standard&#x20;user&#x20;to&#x20;an&#x20;administrator.&#x20;This&#x20;is&#x20;required&#x20;to&#x20;support&#x20;accessibility&#x20;features&#x20;such&#x20;as&#x20;screen&#x20;readers&#x20;that&#x20;are&#x20;transmitting&#x20;user&#x20;interfaces&#x20;to&#x20;alternative&#x20;forms.&#x20;A&#x20;process&#x20;that&#x20;is&#x20;started&#x20;with&#x20;UIAccess&#x20;rights&#x20;has&#x20;the&#x20;following&#x20;abilities:&#x20;-&#x20;To&#x20;set&#x20;the&#x20;foreground&#x20;window.&#x20;-&#x20;To&#x20;drive&#x20;any&#x20;application&#x20;window&#x20;using&#x20;SendInput&#x20;function.&#x20;-&#x20;To&#x20;use&#x20;read&#x20;input&#x20;for&#x20;all&#x20;integrity&#x20;levels&#x20;using&#x20;low-level&#x20;hooks,&#x20;raw&#x20;input,&#x20;GetKeyState,&#x20;GetAsyncKeyState,&#x20;and&#x20;GetKeyboardInput.&#x20;-&#x20;To&#x20;set&#x20;journal&#x20;hooks.&#x20;-&#x20;To&#x20;uses&#x20;AttachThreadInput&#x20;to&#x20;attach&#x20;a&#x20;thread&#x20;to&#x20;a&#x20;higher&#x20;integrity&#x20;input&#x20;queue.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations','[{\"cis\": [\"2.3.17.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26072,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;all&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;policy&#x20;settings&#x20;for&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;change&#x20;this&#x20;policy&#x20;setting,&#x20;you&#x20;must&#x20;restart&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;Security&#x20;Center&#x20;notifies&#x20;you&#x20;that&#x20;the&#x20;overall&#x20;security&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;reduced.','This&#x20;is&#x20;the&#x20;setting&#x20;that&#x20;turns&#x20;on&#x20;or&#x20;off&#x20;UAC.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;used&#x20;and&#x20;any&#x20;security&#x20;benefits&#x20;and&#x20;risk&#x20;mitigations&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;present&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode','[{\"cis\": [\"2.3.17.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26073,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;elevation&#x20;request&#x20;prompt&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;interactive&#x20;user&#039;s&#x20;desktop&#x20;or&#x20;the&#x20;secure&#x20;desktop.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Standard&#x20;elevation&#x20;prompt&#x20;dialog&#x20;boxes&#x20;can&#x20;be&#x20;spoofed,&#x20;which&#x20;may&#x20;cause&#x20;users&#x20;to&#x20;disclose&#x20;their&#x20;passwords&#x20;to&#x20;malicious&#x20;software.&#x20;The&#x20;secure&#x20;desktop&#x20;presents&#x20;a&#x20;very&#x20;distinct&#x20;appearance&#x20;when&#x20;prompting&#x20;for&#x20;elevation,&#x20;where&#x20;the&#x20;user&#x20;desktop&#x20;dims,&#x20;and&#x20;the&#x20;elevation&#x20;prompt&#x20;UI&#x20;is&#x20;more&#x20;prominent.&#x20;This&#x20;increases&#x20;the&#x20;likelihood&#x20;that&#x20;users&#x20;who&#x20;become&#x20;accustomed&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;will&#x20;recognize&#x20;a&#x20;spoofed&#x20;elevation&#x20;prompt&#x20;dialog&#x20;box&#x20;and&#x20;not&#x20;fall&#x20;for&#x20;the&#x20;trick.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation','[{\"cis\": [\"2.3.17.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26074,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;application&#x20;write&#x20;failures&#x20;are&#x20;redirected&#x20;to&#x20;defined&#x20;registry&#x20;and&#x20;file&#x20;system&#x20;locations.&#x20;This&#x20;policy&#x20;setting&#x20;mitigates&#x20;applications&#x20;that&#x20;run&#x20;as&#x20;administrator&#x20;and&#x20;write&#x20;run-time&#x20;application&#x20;data&#x20;to:&#x20;-&#x20;%ProgramFiles%&#x20;-&#x20;%windir%&#x20;-&#x20;%windir%System32&#x20;-&#x20;HKEY_LOCAL_MACHINESOFTWARE.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;reduces&#x20;vulnerabilities&#x20;by&#x20;ensuring&#x20;that&#x20;legacy&#x20;applications&#x20;only&#x20;write&#x20;data&#x20;to&#x20;permitted&#x20;locations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations','[{\"cis\": [\"2.3.17.8\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26075,'Ensure&#x20;&#039;Bluetooth&#x20;Audio&#x20;Gateway&#x20;Service&#x20;&#40;BTAGService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Service&#x20;supporting&#x20;the&#x20;audio&#x20;gateway&#x20;role&#x20;of&#x20;the&#x20;Bluetooth&#x20;Handsfree&#x20;Profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Bluetooth&#x20;technology&#x20;has&#x20;inherent&#x20;security&#x20;risks&#x20;-&#x20;especially&#x20;prior&#x20;to&#x20;the&#x20;v2.1&#x20;standard.&#x20;Wireless&#x20;Bluetooth&#x20;traffic&#x20;is&#x20;not&#x20;well&#x20;encrypted&#x20;&#40;if&#x20;at&#x20;all&#41;,&#x20;so&#x20;in&#x20;a&#x20;high-security&#x20;environment,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;permitted,&#x20;in&#x20;spite&#x20;of&#x20;the&#x20;added&#x20;inconvenience&#x20;of&#x20;not&#x20;being&#x20;able&#x20;to&#x20;use&#x20;Bluetooth&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesBluetooth&#x20;Audio&#x20;Gateway&#x20;Service.&#x20;Note:&#x20;This&#x20;service&#x20;was&#x20;first&#x20;introduced&#x20;in&#x20;Windows&#x20;10&#x20;Release&#x20;1803.&#x20;It&#x20;appears&#x20;to&#x20;have&#x20;replaced&#x20;the&#x20;older&#x20;Bluetooth&#x20;Handsfree&#x20;Service&#x20;&#40;BthHFSrv&#41;,&#x20;which&#x20;was&#x20;removed&#x20;from&#x20;Windows&#x20;in&#x20;that&#x20;release&#x20;&#40;it&#x20;is&#x20;not&#x20;simply&#x20;a&#x20;rename,&#x20;but&#x20;a&#x20;different&#x20;service&#41;.','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26076,'Ensure&#x20;&#039;Bluetooth&#x20;Support&#x20;Service&#x20;&#40;bthserv&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','The&#x20;Bluetooth&#x20;service&#x20;supports&#x20;discovery&#x20;and&#x20;association&#x20;of&#x20;remote&#x20;Bluetooth&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Bluetooth&#x20;technology&#x20;has&#x20;inherent&#x20;security&#x20;risks&#x20;-&#x20;especially&#x20;prior&#x20;to&#x20;the&#x20;v2.1&#x20;standard.&#x20;Wireless&#x20;Bluetooth&#x20;traffic&#x20;is&#x20;not&#x20;well&#x20;encrypted&#x20;&#40;if&#x20;at&#x20;all&#41;,&#x20;so&#x20;in&#x20;a&#x20;high-security&#x20;environment,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;permitted,&#x20;in&#x20;spite&#x20;of&#x20;the&#x20;added&#x20;inconvenience&#x20;of&#x20;not&#x20;being&#x20;able&#x20;to&#x20;use&#x20;Bluetooth&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesBluetooth&#x20;Support&#x20;Service','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26077,'Ensure&#x20;&#039;Downloaded&#x20;Maps&#x20;Manager&#x20;&#40;MapsBroker&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Windows&#x20;service&#x20;for&#x20;application&#x20;access&#x20;to&#x20;downloaded&#x20;maps.&#x20;This&#x20;service&#x20;is&#x20;started&#x20;on-demand&#x20;by&#x20;application&#x20;accessing&#x20;downloaded&#x20;maps.','Mapping&#x20;technologies&#x20;can&#x20;unwillingly&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;attackers&#x20;and&#x20;other&#x20;software&#x20;that&#x20;picks&#x20;up&#x20;the&#x20;information.&#x20;In&#x20;addition,&#x20;automatic&#x20;downloads&#x20;of&#x20;data&#x20;from&#x20;3rd-party&#x20;sources&#x20;should&#x20;be&#x20;minimized&#x20;when&#x20;not&#x20;needed.&#x20;Therefore&#x20;this&#x20;service&#x20;should&#x20;not&#x20;be&#x20;needed&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesDownloaded&#x20;Maps&#x20;Manager','[{\"cis\": [\"5.4\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26078,'Ensure&#x20;&#039;Geolocation&#x20;Service&#x20;&#40;lfsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;monitors&#x20;the&#x20;current&#x20;location&#x20;of&#x20;the&#x20;system&#x20;and&#x20;manages&#x20;geofences&#x20;&#40;a&#x20;geographical&#x20;location&#x20;with&#x20;associated&#x20;events&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&rsquo;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesGeolocation&#x20;Service','[{\"cis\": [\"5.5\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26079,'Ensure&#x20;&#039;IIS&#x20;Admin&#x20;Service&#x20;&#40;IISADMIN&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Enables&#x20;the&#x20;server&#x20;to&#x20;administer&#x20;the&#x20;IIS&#x20;metabase.&#x20;The&#x20;IIS&#x20;metabase&#x20;stores&#x20;configuration&#x20;for&#x20;the&#x20;SMTP&#x20;and&#x20;FTP&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#41;.&#x20;Note&#x20;#2:&#x20;An&#x20;organization&#x20;may&#x20;choose&#x20;to&#x20;selectively&#x20;grant&#x20;exceptions&#x20;to&#x20;web&#x20;developers&#x20;to&#x20;allow&#x20;IIS&#x20;&#40;or&#x20;another&#x20;web&#x20;server&#41;&#x20;on&#x20;their&#x20;workstation,&#x20;in&#x20;order&#x20;for&#x20;them&#x20;to&#x20;locally&#x20;test&#x20;&amp;&#x20;develop&#x20;web&#x20;pages.&#x20;However,&#x20;the&#x20;organization&#x20;should&#x20;track&#x20;those&#x20;machines&#x20;and&#x20;ensure&#x20;the&#x20;security&#x20;controls&#x20;and&#x20;mitigations&#x20;are&#x20;kept&#x20;up&#x20;to&#x20;date,&#x20;to&#x20;reduce&#x20;risk&#x20;of&#x20;compromise.','Hosting&#x20;a&#x20;website&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;If&#x20;proper&#x20;security&#x20;mitigations&#x20;are&#x20;not&#x20;followed,&#x20;the&#x20;chance&#x20;of&#x20;successful&#x20;attack&#x20;increases&#x20;significantly.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;web&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;IIS.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesIIS&#x20;Admin&#x20;Service','[{\"cis\": [\"5.6\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26080,'Ensure&#x20;&#039;Infrared&#x20;monitor&#x20;service&#x20;&#40;irmon&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Detects&#x20;other&#x20;Infrared&#x20;devices&#x20;that&#x20;are&#x20;in&#x20;range&#x20;and&#x20;launches&#x20;the&#x20;file&#x20;transfer&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.','Infrared&#x20;connections&#x20;can&#x20;potentially&#x20;be&#x20;a&#x20;source&#x20;of&#x20;data&#x20;compromise&#x20;-&#x20;especially&#x20;via&#x20;the&#x20;automatic&#x20;&#039;file&#x20;transfer&#x20;application&#039;&#x20;functionality.&#x20;Enterprise-managed&#x20;systems&#x20;should&#x20;utilize&#x20;a&#x20;more&#x20;secure&#x20;method&#x20;of&#x20;connection&#x20;than&#x20;infrared.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesInfrared&#x20;monitor&#x20;service','[{\"cis\": [\"5.7\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26081,'Ensure&#x20;&#039;Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;&#40;SharedAccess&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;network&#x20;access&#x20;translation,&#x20;addressing,&#x20;name&#x20;resolution&#x20;and/or&#x20;intrusion&#x20;prevention&#x20;services&#x20;for&#x20;a&#x20;home&#x20;or&#x20;small&#x20;office&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;is&#x20;a&#x20;feature&#x20;that&#x20;allows&#x20;someone&#x20;to&#x20;&#039;share&#039;&#x20;their&#x20;Internet&#x20;connection&#x20;with&#x20;other&#x20;machines&#x20;on&#x20;the&#x20;network&#x20;-&#x20;it&#x20;was&#x20;designed&#x20;for&#x20;home&#x20;or&#x20;small&#x20;office&#x20;environments&#x20;where&#x20;only&#x20;one&#x20;machine&#x20;has&#x20;Internet&#x20;access&#x20;-&#x20;it&#x20;effectively&#x20;turns&#x20;that&#x20;machine&#x20;into&#x20;an&#x20;Internet&#x20;router.&#x20;This&#x20;feature&#x20;causes&#x20;the&#x20;bridging&#x20;of&#x20;networks&#x20;and&#x20;likely&#x20;bypassing&#x20;other,&#x20;more&#x20;secure&#x20;pathways.&#x20;It&#x20;should&#x20;not&#x20;be&#x20;used&#x20;on&#x20;any&#x20;enterprise-managed&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesInternet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;','[{\"cis\": [\"5.8\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26082,'Ensure&#x20;&#039;Link-Layer&#x20;Topology&#x20;Discovery&#x20;Mapper&#x20;&#40;lltdsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Creates&#x20;a&#x20;Network&#x20;Map,&#x20;consisting&#x20;of&#x20;PC&#x20;and&#x20;device&#x20;topology&#x20;&#40;connectivity&#41;&#x20;information,&#x20;and&#x20;metadata&#x20;describing&#x20;each&#x20;PC&#x20;and&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;feature&#x20;that&#x20;this&#x20;service&#x20;enables&#x20;could&#x20;potentially&#x20;be&#x20;used&#x20;for&#x20;unauthorized&#x20;discovery&#x20;and&#x20;connection&#x20;to&#x20;network&#x20;devices.&#x20;Disabling&#x20;the&#x20;service&#x20;helps&#x20;to&#x20;prevent&#x20;responses&#x20;to&#x20;requests&#x20;for&#x20;network&#x20;topology&#x20;discovery&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesLink-Layer&#x20;Topology&#x20;Discovery&#x20;Mapper','[{\"cis\": [\"5.9\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26083,'Ensure&#x20;&#039;LxssManager&#x20;&#40;LxssManager&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','The&#x20;LXSS&#x20;Manager&#x20;service&#x20;supports&#x20;running&#x20;native&#x20;ELF&#x20;binaries.&#x20;The&#x20;service&#x20;provides&#x20;the&#x20;infrastructure&#x20;necessary&#x20;for&#x20;ELF&#x20;binaries&#x20;to&#x20;run&#x20;on&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Windows&#x20;Subsystem&#x20;for&#x20;Linux&#41;.','The&#x20;Linux&#x20;Subsystem&#x20;&#40;LXSS&#41;&#x20;Manager&#x20;allows&#x20;full&#x20;system&#x20;access&#x20;to&#x20;Linux&#x20;applications&#x20;on&#x20;Windows,&#x20;including&#x20;the&#x20;file&#x20;system.&#x20;While&#x20;this&#x20;can&#x20;certainly&#x20;have&#x20;some&#x20;functionality&#x20;and&#x20;performance&#x20;benefits&#x20;for&#x20;running&#x20;those&#x20;applications,&#x20;it&#x20;also&#x20;creates&#x20;new&#x20;security&#x20;risks&#x20;in&#x20;the&#x20;event&#x20;that&#x20;a&#x20;hacker&#x20;injects&#x20;malicious&#x20;code&#x20;into&#x20;a&#x20;Linux&#x20;application.&#x20;For&#x20;best&#x20;security,&#x20;it&#x20;is&#x20;preferred&#x20;to&#x20;run&#x20;Linux&#x20;applications&#x20;on&#x20;Linux,&#x20;and&#x20;Windows&#x20;applications&#x20;on&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesLxssManager','[{\"cis\": [\"5.10\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26084,'Ensure&#x20;&#039;Microsoft&#x20;FTP&#x20;Service&#x20;&#40;FTPSVC&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Enables&#x20;the&#x20;server&#x20;to&#x20;be&#x20;a&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#x20;-&#x20;FTP&#x20;Server&#41;.','Hosting&#x20;an&#x20;FTP&#x20;server&#x20;&#40;especially&#x20;a&#x20;non-secure&#x20;FTP&#x20;server&#41;&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;FTP&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;IIS.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesMicrosoft&#x20;FTP&#x20;Service','[{\"cis\": [\"5.11\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26085,'Ensure&#x20;&#039;Microsoft&#x20;iSCSI&#x20;Initiator&#x20;Service&#x20;&#40;MSiSCSI&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Manages&#x20;Internet&#x20;SCSI&#x20;&#40;iSCSI&#41;&#x20;sessions&#x20;from&#x20;this&#x20;computer&#x20;to&#x20;remote&#x20;target&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;service&#x20;is&#x20;critically&#x20;necessary&#x20;in&#x20;order&#x20;to&#x20;directly&#x20;attach&#x20;to&#x20;an&#x20;iSCSI&#x20;device.&#x20;However,&#x20;iSCSI&#x20;itself&#x20;uses&#x20;a&#x20;very&#x20;weak&#x20;authentication&#x20;protocol&#x20;&#40;CHAP&#41;,&#x20;which&#x20;means&#x20;that&#x20;the&#x20;passwords&#x20;for&#x20;iSCSI&#x20;communication&#x20;are&#x20;easily&#x20;exposed,&#x20;unless&#x20;all&#x20;of&#x20;the&#x20;traffic&#x20;is&#x20;isolated&#x20;and/or&#x20;encrypted&#x20;using&#x20;another&#x20;technology&#x20;like&#x20;IPsec.&#x20;This&#x20;service&#x20;is&#x20;generally&#x20;more&#x20;appropriate&#x20;for&#x20;servers&#x20;in&#x20;a&#x20;controlled&#x20;environment&#x20;then&#x20;on&#x20;workstations&#x20;requiring&#x20;high&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesMicrosoft&#x20;iSCSI&#x20;Initiator&#x20;Service','[{\"cis\": [\"5.12\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26086,'Ensure&#x20;&#039;OpenSSH&#x20;SSH&#x20;Server&#x20;&#40;sshd&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','SSH&#x20;protocol&#x20;based&#x20;service&#x20;to&#x20;provide&#x20;secure&#x20;encrypted&#x20;communications&#x20;between&#x20;two&#x20;untrusted&#x20;hosts&#x20;over&#x20;an&#x20;insecure&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;it&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;OpenSSH&#x20;Server&#41;.','Hosting&#x20;an&#x20;SSH&#x20;server&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;SSH&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;the&#x20;one&#x20;supplied&#x20;with&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesOpenSSH&#x20;SSH&#x20;Server','[{\"cis\": [\"5.13\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26087,'Ensure&#x20;&#039;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRPsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Enables&#x20;serverless&#x20;peer&#x20;name&#x20;resolution&#x20;over&#x20;the&#x20;Internet&#x20;using&#x20;the&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPeer&#x20;Name&#x20;Resolution&#x20;Protocol','[{\"cis\": [\"5.14\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26088,'Ensure&#x20;&#039;Peer&#x20;Networking&#x20;Grouping&#x20;&#40;p2psvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Enables&#x20;multi-party&#x20;communication&#x20;using&#x20;Peer-to-Peer&#x20;Grouping.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPeer&#x20;Networking&#x20;Grouping','[{\"cis\": [\"5.15\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26089,'Ensure&#x20;&#039;Peer&#x20;Networking&#x20;Identity&#x20;Manager&#x20;&#40;p2pimsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;identity&#x20;services&#x20;for&#x20;the&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;and&#x20;Peer-to-Peer&#x20;Grouping&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPeer&#x20;Networking&#x20;Identity&#x20;Manager','[{\"cis\": [\"5.16\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26090,'Ensure&#x20;&#039;PNRP&#x20;Machine&#x20;Name&#x20;Publication&#x20;Service&#x20;&#40;PNRPAutoReg&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;publishes&#x20;a&#x20;machine&#x20;name&#x20;using&#x20;the&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol.&#x20;Configuration&#x20;is&#x20;managed&#x20;via&#x20;the&#x20;netsh&#x20;context&#x20;&lsquo;p2p&#x20;pnrp&#x20;peer&rsquo;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;is&#x20;a&#x20;distributed&#x20;and&#x20;&#40;mostly&#41;&#x20;serverless&#x20;way&#x20;to&#x20;handle&#x20;name&#x20;resolution&#x20;of&#x20;clients&#x20;with&#x20;each&#x20;other.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;more&#x20;secure&#x20;to&#x20;rely&#x20;on&#x20;centralized&#x20;name&#x20;resolution&#x20;methods&#x20;maintained&#x20;by&#x20;authorized&#x20;staff.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPNRP&#x20;Machine&#x20;Name&#x20;Publication&#x20;Service','[{\"cis\": [\"5.17\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26091,'Ensure&#x20;&#039;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;spools&#x20;print&#x20;jobs&#x20;and&#x20;handles&#x20;interaction&#x20;with&#x20;printers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;unnecessary&#x20;services&#x20;especially&#x20;those&#x20;with&#x20;known&#x20;vulnerabilities&#x20;should&#x20;be&#x20;disabled.&#x20;Disabling&#x20;the&#x20;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#x20;service&#x20;mitigates&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;attacks&#x20;against&#x20;the&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPrint&#x20;Spooler','[{\"cis\": [\"5.18\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26092,'Ensure&#x20;&#039;Problem&#x20;Reports&#x20;and&#x20;Solutions&#x20;Control&#x20;Panel&#x20;Support&#x20;&#40;wercplsupport&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;provides&#x20;support&#x20;for&#x20;viewing,&#x20;sending&#x20;and&#x20;deletion&#x20;of&#x20;system-level&#x20;problem&#x20;reports&#x20;for&#x20;the&#x20;Problem&#x20;Reports&#x20;and&#x20;Solutions&#x20;control&#x20;panel.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;service&#x20;is&#x20;involved&#x20;in&#x20;the&#x20;process&#x20;of&#x20;displaying/reporting&#x20;issues&#x20;&amp;&#x20;solutions&#x20;to/from&#x20;Microsoft.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;for&#x20;sensitive&#x20;corporate&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesProblem&#x20;Reports&#x20;and&#x20;Solutions&#x20;Control&#x20;Panel&#x20;Support','[{\"cis\": [\"5.19\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26093,'Ensure&#x20;&#039;Remote&#x20;Access&#x20;Auto&#x20;Connection&#x20;Manager&#x20;&#40;RasAuto&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Creates&#x20;a&#x20;connection&#x20;to&#x20;a&#x20;remote&#x20;network&#x20;whenever&#x20;a&#x20;program&#x20;references&#x20;a&#x20;remote&#x20;DNS&#x20;or&#x20;NetBIOS&#x20;name&#x20;or&#x20;address.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;function&#x20;of&#x20;this&#x20;service&#x20;is&#x20;to&#x20;provide&#x20;a&#x20;&#039;demand&#x20;dial&#039;&#x20;type&#x20;of&#x20;functionality.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;it&#x20;is&#x20;preferred&#x20;that&#x20;any&#x20;remote&#x20;&#039;dial&#039;&#x20;connections&#x20;&#40;whether&#x20;they&#x20;be&#x20;legacy&#x20;dial-in&#x20;POTS&#x20;or&#x20;VPN&#41;&#x20;are&#x20;initiated&#x20;by&#x20;the&#x20;user,&#x20;not&#x20;automatically&#x20;by&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Access&#x20;Auto&#x20;Connection&#x20;Manager','[{\"cis\": [\"5.20\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26094,'Ensure&#x20;&#039;Remote&#x20;Desktop&#x20;Configuration&#x20;&#40;SessionEnv&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Remote&#x20;Desktop&#x20;Configuration&#x20;service&#x20;&#40;RDCS&#41;&#x20;is&#x20;responsible&#x20;for&#x20;all&#x20;Remote&#x20;Desktop&#x20;related&#x20;configuration&#x20;and&#x20;session&#x20;maintenance&#x20;activities&#x20;that&#x20;require&#x20;SYSTEM&#x20;context.&#x20;These&#x20;include&#x20;per-session&#x20;temporary&#x20;folders,&#x20;RD&#x20;themes,&#x20;and&#x20;RD&#x20;certificates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;Remote&#x20;Desktop&#x20;access&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk.&#x20;For&#x20;these&#x20;environments,&#x20;only&#x20;local&#x20;console&#x20;access&#x20;should&#x20;be&#x20;permitted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Desktop&#x20;Configuration','[{\"cis\": [\"5.21\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26095,'Ensure&#x20;&#039;Remote&#x20;Desktop&#x20;Services&#x20;&#40;TermService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;users&#x20;to&#x20;connect&#x20;interactively&#x20;to&#x20;a&#x20;remote&#x20;computer.&#x20;Remote&#x20;Desktop&#x20;and&#x20;Remote&#x20;Desktop&#x20;Session&#x20;Host&#x20;Server&#x20;depend&#x20;on&#x20;this&#x20;service.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;Remote&#x20;Desktop&#x20;access&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk.&#x20;For&#x20;these&#x20;environments,&#x20;only&#x20;local&#x20;console&#x20;access&#x20;should&#x20;be&#x20;permitted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Desktop&#x20;Services','[{\"cis\": [\"5.22\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26096,'Ensure&#x20;&#039;Remote&#x20;Desktop&#x20;Services&#x20;UserMode&#x20;Port&#x20;Redirector&#x20;&#40;UmRdpService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;the&#x20;redirection&#x20;of&#x20;Printers/Drives/Ports&#x20;for&#x20;RDP&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface&#x20;-&#x20;preventing&#x20;the&#x20;redirection&#x20;of&#x20;COM,&#x20;LPT&#x20;and&#x20;PnP&#x20;ports&#x20;will&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer&#x20;within&#x20;an&#x20;RDP&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Desktop&#x20;Services&#x20;UserMode&#x20;Port&#x20;Redirector','[{\"cis\": [\"5.23\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26097,'Ensure&#x20;&#039;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;Locator&#x20;&#40;RpcLocator&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','In&#x20;Windows&#x20;2003&#x20;and&#x20;older&#x20;versions&#x20;of&#x20;Windows,&#x20;the&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;Locator&#x20;service&#x20;manages&#x20;the&#x20;RPC&#x20;name&#x20;service&#x20;database.&#x20;In&#x20;Windows&#x20;Vista&#x20;and&#x20;newer&#x20;versions&#x20;of&#x20;Windows,&#x20;this&#x20;service&#x20;does&#x20;not&#x20;provide&#x20;any&#x20;functionality&#x20;and&#x20;is&#x20;present&#x20;for&#x20;application&#x20;compatibility.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;is&#x20;a&#x20;legacy&#x20;service&#x20;that&#x20;has&#x20;no&#x20;value&#x20;or&#x20;purpose&#x20;other&#x20;than&#x20;application&#x20;compatibility&#x20;for&#x20;very&#x20;old&#x20;software.&#x20;It&#x20;should&#x20;be&#x20;disabled&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;old&#x20;application&#x20;still&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;that&#x20;requires&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;Locator','[{\"cis\": [\"5.24\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26098,'Ensure&#x20;&#039;Remote&#x20;Registry&#x20;&#40;RemoteRegistry&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Enables&#x20;remote&#x20;users&#x20;to&#x20;view&#x20;and&#x20;modify&#x20;registry&#x20;settings&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;exposing&#x20;the&#x20;registry&#x20;to&#x20;remote&#x20;access&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRemote&#x20;Registry','[{\"cis\": [\"5.25\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26099,'Ensure&#x20;&#039;Routing&#x20;and&#x20;Remote&#x20;Access&#x20;&#40;RemoteAccess&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Offers&#x20;routing&#x20;services&#x20;to&#x20;businesses&#x20;in&#x20;local&#x20;area&#x20;and&#x20;wide&#x20;area&#x20;network&#x20;environments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;service&#039;s&#x20;main&#x20;purpose&#x20;is&#x20;to&#x20;provide&#x20;Windows&#x20;router&#x20;functionality&#x20;-&#x20;this&#x20;is&#x20;not&#x20;an&#x20;appropriate&#x20;use&#x20;of&#x20;workstations&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesRouting&#x20;and&#x20;Remote&#x20;Access','[{\"cis\": [\"5.26\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26100,'Ensure&#x20;&#039;Server&#x20;&#40;LanmanServer&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Supports&#x20;file,&#x20;print,&#x20;and&#x20;named-pipe&#x20;sharing&#x20;over&#x20;the&#x20;network&#x20;for&#x20;this&#x20;computer.&#x20;If&#x20;this&#x20;service&#x20;is&#x20;stopped,&#x20;these&#x20;functions&#x20;will&#x20;be&#x20;unavailable.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;a&#x20;secure&#x20;workstation&#x20;should&#x20;only&#x20;be&#x20;a&#x20;client,&#x20;not&#x20;a&#x20;server.&#x20;Sharing&#x20;workstation&#x20;resources&#x20;for&#x20;remote&#x20;access&#x20;increases&#x20;security&#x20;risk&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;is&#x20;notably&#x20;higher.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesServer','[{\"cis\": [\"5.27\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26101,'Ensure&#x20;&#039;Simple&#x20;TCP/IP&#x20;Services&#x20;&#40;simptcp&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Supports&#x20;the&#x20;following&#x20;TCP/IP&#x20;services:&#x20;Character&#x20;Generator,&#x20;Daytime,&#x20;Discard,&#x20;Echo,&#x20;and&#x20;Quote&#x20;of&#x20;the&#x20;Day.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Simple&#x20;TCPIP&#x20;services&#x20;&#40;i.e.&#x20;echo,&#x20;daytime&#x20;etc&#41;&#41;.','The&#x20;Simple&#x20;TCP/IP&#x20;Services&#x20;have&#x20;very&#x20;little&#x20;purpose&#x20;in&#x20;a&#x20;modern&#x20;enterprise&#x20;environment&#x20;-&#x20;allowing&#x20;them&#x20;might&#x20;increase&#x20;exposure&#x20;and&#x20;risk&#x20;for&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSimple&#x20;TCP/IP&#x20;Services','[{\"cis\": [\"5.28\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26102,'Ensure&#x20;&#039;SNMP&#x20;Service&#x20;&#40;SNMP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Enables&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;requests&#x20;to&#x20;be&#x20;processed&#x20;by&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#41;.','Features&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;increase&#x20;the&#x20;attack&#x20;surface.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;management&#x20;of&#x20;secure&#x20;workstations&#x20;should&#x20;be&#x20;handled&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSNMP&#x20;Service','[{\"cis\": [\"5.29\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26103,'Ensure&#x20;&#039;Special&#x20;Administration&#x20;Console&#x20;Helper&#x20;&#40;sacsvr&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','This&#x20;service&#x20;allows&#x20;administrators&#x20;to&#x20;remotely&#x20;access&#x20;a&#x20;command&#x20;prompt&#x20;using&#x20;Emergency&#x20;Management&#x20;Services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;it&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;capability&#x20;&#40;Windows&#x20;Emergency&#x20;Management&#x20;Services&#x20;and&#x20;Serial&#x20;Console&#41;.','Allowing&#x20;the&#x20;use&#x20;of&#x20;a&#x20;remotely&#x20;accessible&#x20;command&#x20;prompt&#x20;that&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;perform&#x20;remote&#x20;management&#x20;tasks&#x20;on&#x20;a&#x20;computer&#x20;is&#x20;a&#x20;security&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSpecial&#x20;Administration&#x20;Console&#x20;Helper','[{\"cis\": [\"5.30\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26104,'Ensure&#x20;&#039;SSDP&#x20;Discovery&#x20;&#40;SSDPSRV&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Discovers&#x20;networked&#x20;devices&#x20;and&#x20;services&#x20;that&#x20;use&#x20;the&#x20;SSDP&#x20;discovery&#x20;protocol,&#x20;such&#x20;as&#x20;UPnP&#x20;devices.&#x20;Also&#x20;announces&#x20;SSDP&#x20;devices&#x20;and&#x20;services&#x20;running&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Universal&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;UPnP&#41;&#x20;is&#x20;a&#x20;real&#x20;security&#x20;risk&#x20;-&#x20;it&#x20;allows&#x20;automatic&#x20;discovery&#x20;and&#x20;attachment&#x20;to&#x20;network&#x20;devices.&#x20;Note&#x20;that&#x20;UPnP&#x20;is&#x20;different&#x20;than&#x20;regular&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;PnP&#41;.&#x20;Workstations&#x20;should&#x20;not&#x20;be&#x20;advertising&#x20;their&#x20;services&#x20;&#40;or&#x20;automatically&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;networked&#x20;services&#41;&#x20;in&#x20;a&#x20;security-conscious&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesSSDP&#x20;Discovery','[{\"cis\": [\"5.31\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26105,'Ensure&#x20;&#039;UPnP&#x20;Device&#x20;Host&#x20;&#40;upnphost&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;UPnP&#x20;devices&#x20;to&#x20;be&#x20;hosted&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Universal&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;UPnP&#41;&#x20;is&#x20;a&#x20;real&#x20;security&#x20;risk&#x20;-&#x20;it&#x20;allows&#x20;automatic&#x20;discovery&#x20;and&#x20;attachment&#x20;to&#x20;network&#x20;devices.&#x20;Notes&#x20;that&#x20;UPnP&#x20;is&#x20;different&#x20;than&#x20;regular&#x20;Plug&#x20;n&#x20;Play&#x20;&#40;PnP&#41;.&#x20;Workstations&#x20;should&#x20;not&#x20;be&#x20;advertising&#x20;their&#x20;services&#x20;&#40;or&#x20;automatically&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;networked&#x20;services&#41;&#x20;in&#x20;a&#x20;security-conscious&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesUPnP&#x20;Device&#x20;Host','[{\"cis\": [\"5.32\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26106,'Ensure&#x20;&#039;Web&#x20;Management&#x20;Service&#x20;&#40;WMSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','The&#x20;Web&#x20;Management&#x20;Service&#x20;enables&#x20;remote&#x20;and&#x20;delegated&#x20;management&#x20;capabilities&#x20;for&#x20;administrators&#x20;to&#x20;manage&#x20;for&#x20;the&#x20;Web&#x20;server,&#x20;sites&#x20;and&#x20;applications&#x20;present&#x20;on&#x20;the&#x20;machine.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#x20;-&#x20;Web&#x20;Management&#x20;Tools&#x20;-&#x20;IIS&#x20;Management&#x20;Service&#41;.','Remote&#x20;web&#x20;administration&#x20;of&#x20;IIS&#x20;on&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;If&#x20;proper&#x20;security&#x20;mitigations&#x20;are&#x20;not&#x20;followed,&#x20;the&#x20;chance&#x20;of&#x20;successful&#x20;attack&#x20;increases&#x20;significantly.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWeb&#x20;Management&#x20;Service','[{\"cis\": [\"5.33\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26107,'Ensure&#x20;&#039;Windows&#x20;Error&#x20;Reporting&#x20;Service&#x20;&#40;WerSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Allows&#x20;errors&#x20;to&#x20;be&#x20;reported&#x20;when&#x20;programs&#x20;stop&#x20;working&#x20;or&#x20;responding&#x20;and&#x20;allows&#x20;existing&#x20;solutions&#x20;to&#x20;be&#x20;delivered.&#x20;Also&#x20;allows&#x20;logs&#x20;to&#x20;be&#x20;generated&#x20;for&#x20;diagnostic&#x20;and&#x20;repair&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Error&#x20;Reporting&#x20;Service','[{\"cis\": [\"5.34\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26108,'Ensure&#x20;&#039;Windows&#x20;Event&#x20;Collector&#x20;&#40;Wecsvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;manages&#x20;persistent&#x20;subscriptions&#x20;to&#x20;events&#x20;from&#x20;remote&#x20;sources&#x20;that&#x20;support&#x20;WS-Management&#x20;protocol.&#x20;This&#x20;includes&#x20;Windows&#x20;Vista&#x20;event&#x20;logs,&#x20;hardware&#x20;and&#x20;IPMI-enabled&#x20;event&#x20;sources.&#x20;The&#x20;service&#x20;stores&#x20;forwarded&#x20;events&#x20;in&#x20;a&#x20;local&#x20;Event&#x20;Log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;remote&#x20;connections&#x20;to&#x20;secure&#x20;workstations&#x20;should&#x20;be&#x20;minimized,&#x20;and&#x20;management&#x20;functions&#x20;should&#x20;be&#x20;done&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Event&#x20;Collector','[{\"cis\": [\"5.35\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26109,'Ensure&#x20;&#039;Windows&#x20;Media&#x20;Player&#x20;Network&#x20;Sharing&#x20;Service&#x20;&#40;WMPNetworkSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Shares&#x20;Windows&#x20;Media&#x20;Player&#x20;libraries&#x20;to&#x20;other&#x20;networked&#x20;players&#x20;and&#x20;media&#x20;devices&#x20;using&#x20;Universal&#x20;Plug&#x20;and&#x20;Play.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.','Network&#x20;sharing&#x20;of&#x20;media&#x20;from&#x20;Media&#x20;Player&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Media&#x20;Player&#x20;Network&#x20;Sharing&#x20;Service','[{\"cis\": [\"5.36\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26110,'Ensure&#x20;&#039;Windows&#x20;Mobile&#x20;Hotspot&#x20;Service&#x20;&#40;icssvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;the&#x20;ability&#x20;to&#x20;share&#x20;a&#x20;cellular&#x20;data&#x20;connection&#x20;with&#x20;another&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;capability&#x20;to&#x20;run&#x20;a&#x20;mobile&#x20;hotspot&#x20;from&#x20;a&#x20;domain-connected&#x20;computer&#x20;could&#x20;easily&#x20;expose&#x20;the&#x20;internal&#x20;network&#x20;to&#x20;wardrivers&#x20;or&#x20;other&#x20;hackers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Mobile&#x20;Hotspot&#x20;Service','[{\"cis\": [\"5.37\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26111,'Ensure&#x20;&#039;Windows&#x20;Push&#x20;Notifications&#x20;System&#x20;Service&#x20;&#40;WpnService&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;runs&#x20;in&#x20;session&#x20;0&#x20;and&#x20;hosts&#x20;the&#x20;notification&#x20;platform&#x20;and&#x20;connection&#x20;provider&#x20;which&#x20;handles&#x20;the&#x20;connection&#x20;between&#x20;the&#x20;device&#x20;and&#x20;WNS&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;the&#x20;first&#x20;two&#x20;releases&#x20;of&#x20;Windows&#x20;10&#x20;&#40;R1507&#x20;&amp;&#x20;R1511&#41;,&#x20;the&#x20;display&#x20;name&#x20;of&#x20;this&#x20;service&#x20;was&#x20;initially&#x20;named&#x20;Windows&#x20;Push&#x20;Notifications&#x20;Service&#x20;-&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Windows&#x20;Push&#x20;Notifications&#x20;System&#x20;Service&#x20;starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607.','Windows&#x20;Push&#x20;Notification&#x20;Services&#x20;&#40;WNS&#41;&#x20;is&#x20;a&#x20;mechanism&#x20;to&#x20;receive&#x20;3rd-party&#x20;notifications&#x20;and&#x20;updates&#x20;from&#x20;the&#x20;cloud/Internet.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;external&#x20;systems,&#x20;especially&#x20;those&#x20;hosted&#x20;outside&#x20;the&#x20;organization,&#x20;should&#x20;be&#x20;prevented&#x20;from&#x20;having&#x20;an&#x20;impact&#x20;on&#x20;the&#x20;secure&#x20;workstations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Push&#x20;Notifications&#x20;System&#x20;Service','[{\"cis\": [\"5.38\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26112,'Ensure&#x20;&#039;Windows&#x20;PushToInstall&#x20;Service&#x20;&#40;PushToInstall&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;manages&#x20;Apps&#x20;that&#x20;are&#x20;pushed&#x20;to&#x20;the&#x20;device&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;App&#x20;running&#x20;on&#x20;other&#x20;devices&#x20;or&#x20;the&#x20;web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;PushToInstall&#x20;Service&#x20;&#40;PushToInstall&#41;','[{\"cis\": [\"5.39\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26113,'Ensure&#x20;&#039;Windows&#x20;Remote&#x20;Management&#x20;&#40;WS-Management&#41;&#x20;&#40;WinRM&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;implements&#x20;the&#x20;WS-Management&#x20;protocol&#x20;for&#x20;remote&#x20;management.&#x20;WS-Management&#x20;is&#x20;a&#x20;standard&#x20;web&#x20;services&#x20;protocol&#x20;used&#x20;for&#x20;remote&#x20;software&#x20;and&#x20;hardware&#x20;management.&#x20;The&#x20;WinRM&#x20;service&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;WS-Management&#x20;requests&#x20;and&#x20;processes&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Features&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;increase&#x20;the&#x20;attack&#x20;surface.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;management&#x20;of&#x20;secure&#x20;workstations&#x20;should&#x20;be&#x20;handled&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWindows&#x20;Remote&#x20;Management&#x20;&#40;WS-Management&#41;','[{\"cis\": [\"5.40\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26114,'Ensure&#x20;&#039;World&#x20;Wide&#x20;Web&#x20;Publishing&#x20;Service&#x20;&#40;W3SVC&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;or&#x20;&#039;Not&#x20;Installed&#039;.','Provides&#x20;Web&#x20;connectivity&#x20;and&#x20;administration&#x20;through&#x20;the&#x20;Internet&#x20;Information&#x20;Services&#x20;Manager.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;or&#x20;Not&#x20;Installed.&#x20;Note:&#x20;This&#x20;service&#x20;is&#x20;not&#x20;installed&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;supplied&#x20;with&#x20;Windows,&#x20;but&#x20;is&#x20;installed&#x20;by&#x20;enabling&#x20;an&#x20;optional&#x20;Windows&#x20;feature&#x20;&#40;Internet&#x20;Information&#x20;Services&#x20;-&#x20;World&#x20;Wide&#x20;Web&#x20;Services&#41;.&#x20;Note&#x20;#2:&#x20;An&#x20;organization&#x20;may&#x20;choose&#x20;to&#x20;selectively&#x20;grant&#x20;exceptions&#x20;to&#x20;web&#x20;developers&#x20;to&#x20;allow&#x20;IIS&#x20;&#40;or&#x20;another&#x20;web&#x20;server&#41;&#x20;on&#x20;their&#x20;workstation,&#x20;in&#x20;order&#x20;for&#x20;them&#x20;to&#x20;locally&#x20;test&#x20;&amp;&#x20;develop&#x20;web&#x20;pages.&#x20;However,&#x20;the&#x20;organization&#x20;should&#x20;track&#x20;those&#x20;machines&#x20;and&#x20;ensure&#x20;the&#x20;security&#x20;controls&#x20;and&#x20;mitigations&#x20;are&#x20;kept&#x20;up&#x20;to&#x20;date,&#x20;to&#x20;reduce&#x20;risk&#x20;of&#x20;compromise.','Hosting&#x20;a&#x20;website&#x20;from&#x20;a&#x20;workstation&#x20;is&#x20;an&#x20;increased&#x20;security&#x20;risk,&#x20;as&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;that&#x20;workstation&#x20;is&#x20;then&#x20;greatly&#x20;increased.&#x20;If&#x20;proper&#x20;security&#x20;mitigations&#x20;are&#x20;not&#x20;followed,&#x20;the&#x20;chance&#x20;of&#x20;successful&#x20;attack&#x20;increases&#x20;significantly.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;web&#x20;server&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;IIS.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled&#x20;or&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;not&#x20;installed.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesWorld&#x20;Wide&#x20;Web&#x20;Publishing&#x20;Service','[{\"cis\": [\"5.41\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26115,'Ensure&#x20;&#039;Xbox&#x20;Accessory&#x20;Management&#x20;Service&#x20;&#40;XboxGipSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;manages&#x20;connected&#x20;Xbox&#x20;Accessories.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Accessory&#x20;Management&#x20;Service','[{\"cis\": [\"5.42\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26116,'Ensure&#x20;&#039;Xbox&#x20;Live&#x20;Auth&#x20;Manager&#x20;&#40;XblAuthManager&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Provides&#x20;authentication&#x20;and&#x20;authorization&#x20;services&#x20;for&#x20;interacting&#x20;with&#x20;Xbox&#x20;Live.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Live&#x20;Auth&#x20;Manager','[{\"cis\": [\"5.43\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26117,'Ensure&#x20;&#039;Xbox&#x20;Live&#x20;Game&#x20;Save&#x20;&#40;XblGameSave&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;syncs&#x20;save&#x20;data&#x20;for&#x20;Xbox&#x20;Live&#x20;save&#x20;enabled&#x20;games.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Live&#x20;Game&#x20;Save','[{\"cis\": [\"5.44\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26118,'Ensure&#x20;&#039;Xbox&#x20;Live&#x20;Networking&#x20;Service&#x20;&#40;XboxNetApiSvc&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;service&#x20;supports&#x20;the&#x20;Windows.Networking.XboxLive&#x20;application&#x20;programming&#x20;interface.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Xbox&#x20;Live&#x20;is&#x20;a&#x20;gaming&#x20;service&#x20;and&#x20;has&#x20;no&#x20;place&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;&#40;perhaps&#x20;unless&#x20;it&#x20;is&#x20;a&#x20;gaming&#x20;company&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesXbox&#x20;Live&#x20;Networking&#x20;Service','[{\"cis\": [\"5.45\"]}, {\"cis_csc\": [\"4.8\"]}]'),(26119,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.1.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26120,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.1.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26121,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.1.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26122,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.1.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26123,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewalldomainfw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewalldomainfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewalldomainfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.1.5\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26124,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.1.6\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26125,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.1.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26126,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.1.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26127,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.2.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26128,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.2.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26129,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.2.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26130,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.2.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26131,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewallprivatefw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewallprivatefw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewallprivatefw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.2.5\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26132,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.2.6\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26133,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.2.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26134,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.2.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26135,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.3.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26136,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26137,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.3.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26138,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;avoid&#x20;alarming&#x20;users&#x20;when&#x20;firewall&#x20;rules&#x20;block&#x20;certain&#x20;types&#x20;of&#x20;network&#x20;activity.&#x20;However,&#x20;notifications&#x20;can&#x20;be&#x20;helpful&#x20;when&#x20;troubleshooting&#x20;network&#x20;issues&#x20;involving&#x20;the&#x20;firewall.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;No&#039;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.3.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26139,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;local&#x20;firewall&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;firewall&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','When&#x20;in&#x20;the&#x20;Public&#x20;profile,&#x20;there&#x20;should&#x20;be&#x20;no&#x20;special&#x20;local&#x20;firewall&#x20;exceptions&#x20;per&#x20;computer.&#x20;These&#x20;settings&#x20;should&#x20;be&#x20;managed&#x20;by&#x20;a&#x20;centralized&#x20;policy.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;firewall&#x20;rules','[{\"cis\": [\"9.3.5\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26140,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;connection&#x20;security&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;connection&#x20;security&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;connection&#x20;security&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Users&#x20;with&#x20;administrative&#x20;privileges&#x20;might&#x20;create&#x20;firewall&#x20;rules&#x20;that&#x20;expose&#x20;the&#x20;system&#x20;to&#x20;remote&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;connection&#x20;security&#x20;rules','[{\"cis\": [\"9.3.6\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26141,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewallpublicfw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewallpublicfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewallpublicfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.3.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26142,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.3.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26143,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.3.9\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26144,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes.&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.3.10\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26145,'Ensure&#x20;&#039;Audit&#x20;Credential&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;results&#x20;of&#x20;validation&#x20;tests&#x20;on&#x20;credentials&#x20;submitted&#x20;for&#x20;a&#x20;user&#x20;account&#x20;logon&#x20;request.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;authoritative&#x20;for&#x20;the&#x20;credentials.&#x20;For&#x20;domain&#x20;accounts,&#x20;the&#x20;Domain&#x20;Controller&#x20;is&#x20;authoritative,&#x20;whereas&#x20;for&#x20;local&#x20;accounts,&#x20;the&#x20;local&#x20;computer&#x20;is&#x20;authoritative.&#x20;In&#x20;domain&#x20;environments,&#x20;most&#x20;of&#x20;the&#x20;Account&#x20;Logon&#x20;events&#x20;occur&#x20;in&#x20;the&#x20;Security&#x20;log&#x20;of&#x20;the&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;authoritative&#x20;for&#x20;the&#x20;domain&#x20;accounts.&#x20;However,&#x20;these&#x20;events&#x20;can&#x20;occur&#x20;on&#x20;other&#x20;computers&#x20;in&#x20;the&#x20;organization&#x20;when&#x20;local&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4774:&#x20;An&#x20;account&#x20;was&#x20;mapped&#x20;for&#x20;logon.&#x20;-&#x20;&#x20;4775:&#x20;An&#x20;account&#x20;could&#x20;not&#x20;be&#x20;mapped&#x20;for&#x20;logon.&#x20;-&#x20;4776:&#x20;The&#x20;Domain&#x20;Controller&#x20;attempted&#x20;to&#x20;validate&#x20;the&#x20;credentials&#x20;for&#x20;an&#x20;account.&#x20;-&#x20;4777:&#x20;The&#x20;Domain&#x20;Controller&#x20;failed&#x20;to&#x20;validate&#x20;the&#x20;credentials&#x20;for&#x20;an&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;LogonAudit&#x20;Credential&#x20;Validation','[{\"cis\": [\"17.1.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26146,'Ensure&#x20;&#039;Audit&#x20;Application&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;events&#x20;generated&#x20;by&#x20;changes&#x20;to&#x20;application&#x20;groups&#x20;such&#x20;as&#x20;the&#x20;following:&#x20;-&#x20;Application&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted.&#x20;-&#x20;Member&#x20;is&#x20;added&#x20;or&#x20;removed&#x20;from&#x20;an&#x20;application&#x20;group.&#x20;Application&#x20;groups&#x20;are&#x20;utilized&#x20;by&#x20;Windows&#x20;Authorization&#x20;Manager,&#x20;which&#x20;is&#x20;a&#x20;flexible&#x20;framework&#x20;created&#x20;by&#x20;Microsoft&#x20;for&#x20;integrating&#x20;role-based&#x20;access&#x20;control&#x20;&#40;RBAC&#41;&#x20;into&#x20;applications.&#x20;More&#x20;information&#x20;on&#x20;Windows&#x20;Authorization&#x20;Manager&#x20;is&#x20;available&#x20;at&#x20;MSDN&#x20;-&#x20;Windows&#x20;Authorization&#x20;Manager.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;events&#x20;in&#x20;this&#x20;category&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Application&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26147,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;security&#x20;group&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;security&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted&#x20;or&#x20;when&#x20;a&#x20;member&#x20;is&#x20;added&#x20;to&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;security&#x20;group.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;security&#x20;group&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4727:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;created.&#x20;-&#x20;4728:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;global&#x20;group.&#x20;-&#x20;4729:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;global&#x20;group.&#x20;-&#x20;4730:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;deleted.&#x20;-&#x20;4731:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;created.&#x20;-&#x20;4732:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;local&#x20;group.&#x20;-&#x20;4733:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;local&#x20;group.&#x20;-&#x20;4734:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;deleted.&#x20;-&#x20;4735:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;changed.&#x20;-&#x20;4737:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;changed.&#x20;-&#x20;4754:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;created.&#x20;-&#x20;4755:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;changed.&#x20;-&#x20;4756:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;universal&#x20;group.&#x20;-&#x20;4757:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;universal&#x20;group.&#x20;-&#x20;4758:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;deleted.&#x20;-&#x20;4764:&#x20;A&#x20;group&#039;s&#x20;type&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Security&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26148,'Ensure&#x20;&#039;Audit&#x20;User&#x20;Account&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;user&#x20;account&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;user&#x20;account&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted;&#x20;a&#x20;user&#x20;account&#x20;is&#x20;renamed,&#x20;disabled,&#x20;or&#x20;enabled;&#x20;or&#x20;a&#x20;password&#x20;is&#x20;set&#x20;or&#x20;changed.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;user&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4720:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;created.&#x20;-&#x20;4722:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;enabled.&#x20;-&#x20;4723:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;change&#x20;an&#x20;account&#039;s&#x20;password.&#x20;-&#x20;4724:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;reset&#x20;an&#x20;account&#039;s&#x20;password.&#x20;-&#x20;4725:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;disabled.&#x20;-&#x20;4726:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;deleted.&#x20;-&#x20;4738:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;changed.&#x20;-&#x20;4740:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;locked&#x20;out.&#x20;-&#x20;4765:&#x20;SID&#x20;History&#x20;was&#x20;added&#x20;to&#x20;an&#x20;account.&#x20;-&#x20;4766:&#x20;An&#x20;attempt&#x20;to&#x20;add&#x20;SID&#x20;History&#x20;to&#x20;an&#x20;account&#x20;failed.&#x20;-&#x20;4767:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;unlocked.&#x20;-&#x20;4780:&#x20;The&#x20;ACL&#x20;was&#x20;set&#x20;on&#x20;accounts&#x20;which&#x20;are&#x20;members&#x20;of&#x20;administrators&#x20;groups.&#x20;-&#x20;4781:&#x20;The&#x20;name&#x20;of&#x20;an&#x20;account&#x20;was&#x20;changed:&#x20;-&#x20;4794:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;set&#x20;the&#x20;Directory&#x20;Services&#x20;Restore&#x20;Mode.&#x20;-&#x20;5376:&#x20;Credential&#x20;Manager&#x20;credentials&#x20;were&#x20;backed&#x20;up.&#x20;-&#x20;5377:&#x20;Credential&#x20;Manager&#x20;credentials&#x20;were&#x20;restored&#x20;from&#x20;a&#x20;backup.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;User&#x20;Account&#x20;Management','[{\"cis\": [\"17.2.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26149,'Ensure&#x20;&#039;Audit&#x20;PNP&#x20;Activity&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;when&#x20;plug&#x20;and&#x20;play&#x20;detects&#x20;an&#x20;external&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.&#x20;Note:&#x20;A&#x20;Windows&#x20;10,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Enabling&#x20;this&#x20;setting&#x20;will&#x20;allow&#x20;a&#x20;user&#x20;to&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;device&#x20;is&#x20;plugged&#x20;into&#x20;a&#x20;system.&#x20;This&#x20;can&#x20;help&#x20;alert&#x20;IT&#x20;staff&#x20;if&#x20;unapproved&#x20;devices&#x20;are&#x20;plugged&#x20;in.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDetailed&#x20;TrackingAudit&#x20;PNP&#x20;Activity','[{\"cis\": [\"17.3.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26150,'Ensure&#x20;&#039;Audit&#x20;Process&#x20;Creation&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;process&#x20;and&#x20;the&#x20;name&#x20;of&#x20;the&#x20;program&#x20;or&#x20;user&#x20;that&#x20;created&#x20;it.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4688:&#x20;A&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;-&#x20;4696:&#x20;A&#x20;primary&#x20;token&#x20;was&#x20;assigned&#x20;to&#x20;process.&#x20;Refer&#x20;to&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;947226:&#x20;Description&#x20;of&#x20;security&#x20;events&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2008&#x20;for&#x20;the&#x20;most&#x20;recent&#x20;information&#x20;about&#x20;this&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDetailed&#x20;TrackingAudit&#x20;Process&#x20;Creation','[{\"cis\": [\"17.3.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26151,'Ensure&#x20;&#039;Audit&#x20;Account&#x20;Lockout&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#039;s&#x20;account&#x20;is&#x20;locked&#x20;out&#x20;as&#x20;a&#x20;result&#x20;of&#x20;too&#x20;many&#x20;failed&#x20;logon&#x20;attempts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4625:&#x20;An&#x20;account&#x20;failed&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Account&#x20;Lockout','[{\"cis\": [\"17.5.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26152,'Ensure&#x20;&#039;Audit&#x20;Group&#x20;Membership&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;policy&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;the&#x20;group&#x20;membership&#x20;information&#x20;in&#x20;the&#x20;user&rsquo;s&#x20;logon&#x20;token.&#x20;Events&#x20;in&#x20;this&#x20;subcategory&#x20;are&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;on&#x20;which&#x20;a&#x20;logon&#x20;session&#x20;is&#x20;created.&#x20;For&#x20;an&#x20;interactive&#x20;logon,&#x20;the&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;the&#x20;user&#x20;logged&#x20;on&#x20;to.&#x20;For&#x20;a&#x20;network&#x20;logon,&#x20;such&#x20;as&#x20;accessing&#x20;a&#x20;shared&#x20;folder&#x20;on&#x20;the&#x20;network,&#x20;the&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;hosting&#x20;the&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.&#x20;Note:&#x20;A&#x20;Windows&#x20;10,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Group&#x20;Membership','[{\"cis\": [\"17.5.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26153,'Ensure&#x20;&#039;Audit&#x20;Logoff&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;the&#x20;system.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;accessed&#x20;computer.&#x20;For&#x20;interactive&#x20;logons,&#x20;the&#x20;generation&#x20;of&#x20;these&#x20;events&#x20;occurs&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;logged&#x20;on&#x20;to.&#x20;If&#x20;a&#x20;network&#x20;logon&#x20;takes&#x20;place&#x20;to&#x20;access&#x20;a&#x20;share,&#x20;these&#x20;events&#x20;generate&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;hosts&#x20;the&#x20;accessed&#x20;resource.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;No&#x20;auditing,&#x20;it&#x20;is&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;which&#x20;user&#x20;has&#x20;accessed&#x20;or&#x20;attempted&#x20;to&#x20;access&#x20;organization&#x20;computers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4634:&#x20;An&#x20;account&#x20;was&#x20;logged&#x20;off.&#x20;-&#x20;4647:&#x20;User&#x20;initiated&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Logoff','[{\"cis\": [\"17.5.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26154,'Ensure&#x20;&#039;Audit&#x20;Logon&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;system.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;accessed&#x20;computer.&#x20;For&#x20;interactive&#x20;logons,&#x20;the&#x20;generation&#x20;of&#x20;these&#x20;events&#x20;occurs&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;logged&#x20;on&#x20;to.&#x20;If&#x20;a&#x20;network&#x20;logon&#x20;takes&#x20;place&#x20;to&#x20;access&#x20;a&#x20;share,&#x20;these&#x20;events&#x20;generate&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;hosts&#x20;the&#x20;accessed&#x20;resource.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;No&#x20;auditing,&#x20;it&#x20;is&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;which&#x20;user&#x20;has&#x20;accessed&#x20;or&#x20;attempted&#x20;to&#x20;access&#x20;organization&#x20;computers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4624:&#x20;An&#x20;account&#x20;was&#x20;successfully&#x20;logged&#x20;on.&#x20;-&#x20;4625:&#x20;An&#x20;account&#x20;failed&#x20;to&#x20;log&#x20;on.&#x20;-&#x20;4648:&#x20;A&#x20;logon&#x20;was&#x20;attempted&#x20;using&#x20;explicit&#x20;credentials.&#x20;-&#x20;4675:&#x20;SIDs&#x20;were&#x20;filtered.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Logon','[{\"cis\": [\"17.5.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26155,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Logon/Logoff&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;other&#x20;logon/logoff-related&#x20;events,&#x20;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;disconnects&#x20;and&#x20;reconnects,&#x20;using&#x20;RunAs&#x20;to&#x20;run&#x20;processes&#x20;under&#x20;a&#x20;different&#x20;account,&#x20;and&#x20;locking&#x20;and&#x20;unlocking&#x20;a&#x20;workstation.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4649:&#x20;A&#x20;replay&#x20;attack&#x20;was&#x20;detected.&#x20;-&#x20;4778:&#x20;A&#x20;session&#x20;was&#x20;reconnected&#x20;to&#x20;a&#x20;Window&#x20;Station.&#x20;-&#x20;4779:&#x20;A&#x20;session&#x20;was&#x20;disconnected&#x20;from&#x20;a&#x20;Window&#x20;Station.&#x20;-&#x20;4800:&#x20;The&#x20;workstation&#x20;was&#x20;locked.&#x20;-&#x20;4801:&#x20;The&#x20;workstation&#x20;was&#x20;unlocked.&#x20;-&#x20;4802:&#x20;The&#x20;screen&#x20;saver&#x20;was&#x20;invoked.&#x20;-&#x20;4803:&#x20;The&#x20;screen&#x20;saver&#x20;was&#x20;dismissed.&#x20;-&#x20;5378:&#x20;The&#x20;requested&#x20;credentials&#x20;delegation&#x20;was&#x20;disallowed&#x20;by&#x20;policy.&#x20;-&#x20;5632:&#x20;A&#x20;request&#x20;was&#x20;made&#x20;to&#x20;authenticate&#x20;to&#x20;a&#x20;wireless&#x20;network.&#x20;-&#x20;5633:&#x20;A&#x20;request&#x20;was&#x20;made&#x20;to&#x20;authenticate&#x20;to&#x20;a&#x20;wired&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Other&#x20;Logon/Logoff&#x20;Events','[{\"cis\": [\"17.5.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26156,'Ensure&#x20;&#039;Audit&#x20;Special&#x20;Logon&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;special&#x20;logon&#x20;is&#x20;used.&#x20;A&#x20;special&#x20;logon&#x20;is&#x20;a&#x20;logon&#x20;that&#x20;has&#x20;administrator-equivalent&#x20;privileges&#x20;and&#x20;can&#x20;be&#x20;used&#x20;to&#x20;elevate&#x20;a&#x20;process&#x20;to&#x20;a&#x20;higher&#x20;level.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4964&#x20;:&#x20;Special&#x20;groups&#x20;have&#x20;been&#x20;assigned&#x20;to&#x20;a&#x20;new&#x20;logon.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Special&#x20;Logon','[{\"cis\": [\"17.5.6\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26157,'Ensure&#x20;&#039;Audit&#x20;Detailed&#x20;File&#x20;Share&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;attempts&#x20;to&#x20;access&#x20;files&#x20;and&#x20;folders&#x20;on&#x20;a&#x20;shared&#x20;folder.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;5145:&#x20;network&#x20;share&#x20;object&#x20;was&#x20;checked&#x20;to&#x20;see&#x20;whether&#x20;client&#x20;can&#x20;be&#x20;granted&#x20;desired&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','Auditing&#x20;the&#x20;Failures&#x20;will&#x20;log&#x20;which&#x20;unauthorized&#x20;users&#x20;attempted&#x20;&#40;and&#x20;failed&#41;&#x20;to&#x20;get&#x20;access&#x20;to&#x20;a&#x20;file&#x20;or&#x20;folder&#x20;on&#x20;a&#x20;network&#x20;share&#x20;on&#x20;this&#x20;computer,&#x20;which&#x20;could&#x20;possibly&#x20;be&#x20;an&#x20;indication&#x20;of&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Detailed&#x20;File&#x20;Share','[{\"cis\": [\"17.6.1\"]}, {\"cis_csc\": [\"3.3\", \"8.5\"]}]'),(26158,'Ensure&#x20;&#039;Audit&#x20;File&#x20;Share&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;attempts&#x20;to&#x20;access&#x20;a&#x20;shared&#x20;folder.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.&#x20;Note:&#x20;There&#x20;are&#x20;no&#x20;system&#x20;access&#x20;control&#x20;lists&#x20;&#40;SACLs&#41;&#x20;for&#x20;shared&#x20;folders.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;access&#x20;to&#x20;all&#x20;shared&#x20;folders&#x20;on&#x20;the&#x20;system&#x20;is&#x20;audited.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;workstations&#x20;should&#x20;have&#x20;limited&#x20;file&#x20;sharing&#x20;activity,&#x20;as&#x20;file&#x20;servers&#x20;would&#x20;normally&#x20;handle&#x20;the&#x20;overall&#x20;burden&#x20;of&#x20;file&#x20;sharing&#x20;activities.&#x20;Any&#x20;unusual&#x20;file&#x20;sharing&#x20;activity&#x20;on&#x20;workstations&#x20;may&#x20;therefore&#x20;be&#x20;useful&#x20;in&#x20;an&#x20;investigation&#x20;of&#x20;potentially&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;File&#x20;Share','[{\"cis\": [\"17.6.2\"]}, {\"cis_csc\": [\"3.3\", \"8.5\"]}]'),(26159,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Object&#x20;Access&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;events&#x20;generated&#x20;by&#x20;the&#x20;management&#x20;of&#x20;task&#x20;scheduler&#x20;jobs&#x20;or&#x20;COM+&#x20;objects.&#x20;For&#x20;scheduler&#x20;jobs,&#x20;the&#x20;following&#x20;are&#x20;audited:&#x20;-&#x20;Job&#x20;created.&#x20;-&#x20;Job&#x20;deleted.&#x20;-&#x20;Job&#x20;enabled.&#x20;-&#x20;Job&#x20;disabled.&#x20;-&#x20;Job&#x20;updated.&#x20;For&#x20;COM+&#x20;objects,&#x20;the&#x20;following&#x20;are&#x20;audited:&#x20;-&#x20;Catalog&#x20;object&#x20;added.&#x20;-&#x20;Catalog&#x20;object&#x20;updated.&#x20;-&#x20;Catalog&#x20;object&#x20;deleted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','The&#x20;unexpected&#x20;creation&#x20;of&#x20;scheduled&#x20;tasks&#x20;and&#x20;COM+&#x20;objects&#x20;could&#x20;potentially&#x20;be&#x20;an&#x20;indication&#x20;of&#x20;malicious&#x20;activity.&#x20;Since&#x20;these&#x20;types&#x20;of&#x20;actions&#x20;are&#x20;generally&#x20;low&#x20;volume,&#x20;it&#x20;may&#x20;be&#x20;useful&#x20;to&#x20;capture&#x20;them&#x20;in&#x20;the&#x20;audit&#x20;logs&#x20;for&#x20;use&#x20;during&#x20;an&#x20;investigation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Other&#x20;Object&#x20;Access&#x20;Events','[{\"cis\": [\"17.6.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26160,'Ensure&#x20;&#039;Audit&#x20;Removable&#x20;Storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;user&#x20;attempts&#x20;to&#x20;access&#x20;file&#x20;system&#x20;objects&#x20;on&#x20;a&#x20;removable&#x20;storage&#x20;device.&#x20;A&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;only&#x20;for&#x20;all&#x20;objects&#x20;for&#x20;all&#x20;types&#x20;of&#x20;access&#x20;requested.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting,&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;each&#x20;time&#x20;an&#x20;account&#x20;accesses&#x20;a&#x20;file&#x20;system&#x20;object&#x20;on&#x20;a&#x20;removable&#x20;storage.&#x20;Success&#x20;audits&#x20;record&#x20;successful&#x20;attempts&#x20;and&#x20;Failure&#x20;audits&#x20;record&#x20;unsuccessful&#x20;attempts.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;configure&#x20;this&#x20;policy&#x20;setting,&#x20;no&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;when&#x20;an&#x20;account&#x20;accesses&#x20;a&#x20;file&#x20;system&#x20;object&#x20;on&#x20;a&#x20;removable&#x20;storage.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.&#x20;Note:&#x20;A&#x20;Windows&#x20;8.0,&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Auditing&#x20;removable&#x20;storage&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.&#x20;For&#x20;example,&#x20;if&#x20;an&#x20;individual&#x20;is&#x20;suspected&#x20;of&#x20;copying&#x20;sensitive&#x20;information&#x20;onto&#x20;a&#x20;USB&#x20;drive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Removable&#x20;Storage','[{\"cis\": [\"17.6.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26161,'Ensure&#x20;&#039;Audit&#x20;Audit&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;audit&#x20;policy&#x20;including&#x20;SACL&#x20;changes.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4715:&#x20;The&#x20;audit&#x20;policy&#x20;&#40;SACL&#41;&#x20;on&#x20;an&#x20;object&#x20;was&#x20;changed.&#x20;-&#x20;4719:&#x20;System&#x20;audit&#x20;policy&#x20;was&#x20;changed.&#x20;-&#x20;4902:&#x20;The&#x20;Per-user&#x20;audit&#x20;policy&#x20;table&#x20;was&#x20;created.&#x20;-&#x20;4904:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;register&#x20;a&#x20;security&#x20;event&#x20;source.&#x20;-&#x20;4905:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;unregister&#x20;a&#x20;security&#x20;event&#x20;source.&#x20;-&#x20;4906:&#x20;The&#x20;CrashOnAuditFail&#x20;value&#x20;has&#x20;changed.&#x20;-&#x20;4907:&#x20;Auditing&#x20;settings&#x20;on&#x20;object&#x20;were&#x20;changed.&#x20;-&#x20;4908:&#x20;Special&#x20;Groups&#x20;Logon&#x20;table&#x20;modified.&#x20;-&#x20;4912:&#x20;Per&#x20;User&#x20;Audit&#x20;Policy&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Audit&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26162,'Ensure&#x20;&#039;Audit&#x20;Authentication&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;authentication&#x20;policy.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4706:&#x20;A&#x20;new&#x20;trust&#x20;was&#x20;created&#x20;to&#x20;a&#x20;domain.&#x20;-&#x20;4707:&#x20;A&#x20;trust&#x20;to&#x20;a&#x20;domain&#x20;was&#x20;removed.&#x20;-&#x20;4713:&#x20;Kerberos&#x20;policy&#x20;was&#x20;changed.&#x20;-&#x20;4716:&#x20;Trusted&#x20;domain&#x20;information&#x20;was&#x20;modified.&#x20;-&#x20;4717:&#x20;System&#x20;security&#x20;access&#x20;was&#x20;granted&#x20;to&#x20;an&#x20;account.&#x20;-&#x20;4718:&#x20;System&#x20;security&#x20;access&#x20;was&#x20;removed&#x20;from&#x20;an&#x20;account.&#x20;-&#x20;4739:&#x20;Domain&#x20;Policy&#x20;was&#x20;changed.&#x20;-&#x20;4864:&#x20;A&#x20;namespace&#x20;collision&#x20;was&#x20;detected.&#x20;-&#x20;4865:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;added.&#x20;-&#x20;4866:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;removed.&#x20;-&#x20;4867:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;modified.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Authentication&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26163,'Ensure&#x20;&#039;Audit&#x20;Authorization&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;authorization&#x20;policy.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4704:&#x20;A&#x20;user&#x20;right&#x20;was&#x20;assigned.&#x20;-&#x20;4705:&#x20;A&#x20;user&#x20;right&#x20;was&#x20;removed.&#x20;-&#x20;4706:&#x20;A&#x20;new&#x20;trust&#x20;was&#x20;created&#x20;to&#x20;a&#x20;domain.&#x20;-&#x20;4707:&#x20;A&#x20;trust&#x20;to&#x20;a&#x20;domain&#x20;was&#x20;removed.&#x20;-&#x20;4714:&#x20;Encrypted&#x20;data&#x20;recovery&#x20;policy&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Authorization&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26164,'Ensure&#x20;&#039;Audit&#x20;MPSSVC&#x20;Rule-Level&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;determines&#x20;whether&#x20;the&#x20;operating&#x20;system&#x20;generates&#x20;audit&#x20;events&#x20;when&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;policy&#x20;rules&#x20;for&#x20;the&#x20;Microsoft&#x20;Protection&#x20;Service&#x20;&#40;MPSSVC.exe&#41;.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4944:&#x20;The&#x20;following&#x20;policy&#x20;was&#x20;active&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;started.&#x20;-&#x20;4945:&#x20;A&#x20;rule&#x20;was&#x20;listed&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;started.&#x20;-&#x20;4946:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;added.&#x20;-&#x20;4947:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;modified.&#x20;-&#x20;4948:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;deleted.&#x20;-&#x20;4949:&#x20;Windows&#x20;Firewall&#x20;settings&#x20;were&#x20;restored&#x20;to&#x20;the&#x20;default&#x20;values.&#x20;-&#x20;4950:&#x20;A&#x20;Windows&#x20;Firewall&#x20;setting&#x20;has&#x20;changed.&#x20;-&#x20;4951:&#x20;A&#x20;rule&#x20;has&#x20;been&#x20;ignored&#x20;because&#x20;its&#x20;major&#x20;version&#x20;number&#x20;was&#x20;not&#x20;recognized&#x20;by&#x20;Windows&#x20;Firewall.&#x20;-&#x20;4952:&#x20;Parts&#x20;of&#x20;a&#x20;rule&#x20;have&#x20;been&#x20;ignored&#x20;because&#x20;its&#x20;minor&#x20;version&#x20;number&#x20;was&#x20;not&#x20;recognized&#x20;by&#x20;Windows&#x20;Firewall.&#x20;The&#x20;other&#x20;parts&#x20;of&#x20;the&#x20;rule&#x20;will&#x20;be&#x20;enforced.&#x20;-&#x20;4953:&#x20;A&#x20;rule&#x20;has&#x20;been&#x20;ignored&#x20;by&#x20;Windows&#x20;Firewall&#x20;because&#x20;it&#x20;could&#x20;not&#x20;parse&#x20;the&#x20;rule.&#x20;-&#x20;4954:&#x20;Windows&#x20;Firewall&#x20;Group&#x20;Policy&#x20;settings&#x20;have&#x20;changed.&#x20;The&#x20;new&#x20;settings&#x20;have&#x20;been&#x20;applied.&#x20;-&#x20;4956:&#x20;Windows&#x20;Firewall&#x20;has&#x20;changed&#x20;the&#x20;active&#x20;profile.&#x20;-&#x20;4957:&#x20;Windows&#x20;Firewall&#x20;did&#x20;not&#x20;apply&#x20;the&#x20;following&#x20;rule.&#x20;-&#x20;4958:&#x20;Windows&#x20;Firewall&#x20;did&#x20;not&#x20;apply&#x20;the&#x20;following&#x20;rule&#x20;because&#x20;the&#x20;rule&#x20;referred&#x20;to&#x20;items&#x20;not&#x20;configured&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;:&#x20;Success&#x20;and&#x20;Failure','Changes&#x20;to&#x20;firewall&#x20;rules&#x20;are&#x20;important&#x20;for&#x20;understanding&#x20;the&#x20;security&#x20;state&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;how&#x20;well&#x20;it&#x20;is&#x20;protected&#x20;against&#x20;network&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;MPSSVC&#x20;Rule-Level&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26165,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Policy&#x20;Change&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;contains&#x20;events&#x20;about&#x20;EFS&#x20;Data&#x20;Recovery&#x20;Agent&#x20;policy&#x20;changes,&#x20;changes&#x20;in&#x20;Windows&#x20;Filtering&#x20;Platform&#x20;filter,&#x20;status&#x20;on&#x20;Security&#x20;policy&#x20;settings&#x20;updates&#x20;for&#x20;local&#x20;Group&#x20;Policy&#x20;settings,&#x20;Central&#x20;Access&#x20;Policy&#x20;changes,&#x20;and&#x20;detailed&#x20;troubleshooting&#x20;events&#x20;for&#x20;Cryptographic&#x20;Next&#x20;Generation&#x20;&#40;CNG&#41;&#x20;operations.&#x20;-&#x20;5063:&#x20;A&#x20;cryptographic&#x20;provider&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5064:&#x20;A&#x20;cryptographic&#x20;context&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5065:&#x20;A&#x20;cryptographic&#x20;context&#x20;modification&#x20;was&#x20;attempted.&#x20;-&#x20;5066:&#x20;A&#x20;cryptographic&#x20;function&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5067:&#x20;A&#x20;cryptographic&#x20;function&#x20;modification&#x20;was&#x20;attempted.&#x20;-&#x20;5068:&#x20;A&#x20;cryptographic&#x20;function&#x20;provider&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5069:&#x20;A&#x20;cryptographic&#x20;function&#x20;property&#x20;operation&#x20;was&#x20;attempted.&#x20;-&#x20;5070:&#x20;A&#x20;cryptographic&#x20;function&#x20;property&#x20;modification&#x20;was&#x20;attempted.&#x20;-&#x20;6145:&#x20;One&#x20;or&#x20;more&#x20;errors&#x20;occurred&#x20;while&#x20;processing&#x20;security&#x20;policy&#x20;in&#x20;the&#x20;group&#x20;policy&#x20;objects.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','This&#x20;setting&#x20;can&#x20;help&#x20;detect&#x20;errors&#x20;in&#x20;applied&#x20;Security&#x20;settings&#x20;which&#x20;came&#x20;from&#x20;Group&#x20;Policy,&#x20;and&#x20;failure&#x20;events&#x20;related&#x20;to&#x20;Cryptographic&#x20;Next&#x20;Generation&#x20;&#40;CNG&#41;&#x20;functions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Other&#x20;Policy&#x20;Change&#x20;Events','[{\"cis\": [\"17.7.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26166,'Ensure&#x20;&#039;Audit&#x20;Sensitive&#x20;Privilege&#x20;Use&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;account&#x20;or&#x20;service&#x20;uses&#x20;a&#x20;sensitive&#x20;privilege.&#x20;A&#x20;sensitive&#x20;privilege&#x20;includes&#x20;the&#x20;following&#x20;user&#x20;rights:&#x20;-&#x20;Act&#x20;as&#x20;part&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;-&#x20;Back&#x20;up&#x20;files&#x20;and&#x20;directories&#x20;-&#x20;Create&#x20;a&#x20;token&#x20;object&#x20;-&#x20;Debug&#x20;programs&#x20;-&#x20;Enable&#x20;computer&#x20;and&#x20;user&#x20;accounts&#x20;to&#x20;be&#x20;trusted&#x20;for&#x20;delegation&#x20;-&#x20;Generate&#x20;security&#x20;audits&#x20;-&#x20;Impersonate&#x20;a&#x20;client&#x20;after&#x20;authentication&#x20;-&#x20;Load&#x20;and&#x20;unload&#x20;device&#x20;drivers&#x20;-&#x20;Manage&#x20;auditing&#x20;and&#x20;security&#x20;log&#x20;-&#x20;Modify&#x20;firmware&#x20;environment&#x20;values&#x20;-&#x20;Replace&#x20;a&#x20;process-level&#x20;token&#x20;-&#x20;Restore&#x20;files&#x20;and&#x20;directories&#x20;-&#x20;Take&#x20;ownership&#x20;of&#x20;files&#x20;or&#x20;other&#x20;objects&#x20;Auditing&#x20;this&#x20;subcategory&#x20;will&#x20;create&#x20;a&#x20;high&#x20;volume&#x20;of&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4672:&#x20;Special&#x20;privileges&#x20;assigned&#x20;to&#x20;new&#x20;logon.&#x20;-&#x20;4673:&#x20;A&#x20;privileged&#x20;service&#x20;was&#x20;called.&#x20;-&#x20;4674:&#x20;An&#x20;operation&#x20;was&#x20;attempted&#x20;on&#x20;a&#x20;privileged&#x20;object.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPrivilege&#x20;UseAudit&#x20;Sensitive&#x20;Privilege&#x20;Use','[{\"cis\": [\"17.8.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26167,'Ensure&#x20;&#039;Audit&#x20;IPsec&#x20;Driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;the&#x20;activities&#x20;of&#x20;the&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;driver.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4960:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;an&#x20;integrity&#x20;check.&#x20;If&#x20;this&#x20;problem&#x20;persists,&#x20;it&#x20;could&#x20;indicate&#x20;a&#x20;network&#x20;issue&#x20;or&#x20;that&#x20;packets&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;transit&#x20;to&#x20;this&#x20;computer.&#x20;Verify&#x20;that&#x20;the&#x20;packets&#x20;sent&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;are&#x20;the&#x20;same&#x20;as&#x20;those&#x20;received&#x20;by&#x20;this&#x20;computer.&#x20;This&#x20;error&#x20;might&#x20;also&#x20;indicate&#x20;interoperability&#x20;problems&#x20;with&#x20;other&#x20;IPsec&#x20;implementations.&#x20;-&#x20;4961:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;a&#x20;replay&#x20;check.&#x20;If&#x20;this&#x20;problem&#x20;persists,&#x20;it&#x20;could&#x20;indicate&#x20;a&#x20;replay&#x20;attack&#x20;against&#x20;this&#x20;computer.&#x20;-&#x20;4962:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;a&#x20;replay&#x20;check.&#x20;The&#x20;inbound&#x20;packet&#x20;had&#x20;too&#x20;low&#x20;a&#x20;sequence&#x20;number&#x20;to&#x20;ensure&#x20;it&#x20;was&#x20;not&#x20;a&#x20;replay.&#x20;-&#x20;4963:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;clear&#x20;text&#x20;packet&#x20;that&#x20;should&#x20;have&#x20;been&#x20;secured.&#x20;This&#x20;is&#x20;usually&#x20;due&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;changing&#x20;its&#x20;IPsec&#x20;policy&#x20;without&#x20;informing&#x20;this&#x20;computer.&#x20;This&#x20;could&#x20;also&#x20;be&#x20;a&#x20;spoofing&#x20;attack&#x20;attempt.&#x20;-&#x20;4965:&#x20;IPsec&#x20;received&#x20;a&#x20;packet&#x20;from&#x20;a&#x20;remote&#x20;computer&#x20;with&#x20;an&#x20;incorrect&#x20;Security&#x20;Parameter&#x20;Index&#x20;&#40;SPI&#41;.&#x20;This&#x20;is&#x20;usually&#x20;caused&#x20;by&#x20;malfunctioning&#x20;hardware&#x20;that&#x20;is&#x20;corrupting&#x20;packets.&#x20;If&#x20;these&#x20;errors&#x20;persist,&#x20;verify&#x20;that&#x20;the&#x20;packets&#x20;sent&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;are&#x20;the&#x20;same&#x20;as&#x20;those&#x20;received&#x20;by&#x20;this&#x20;computer.&#x20;This&#x20;error&#x20;may&#x20;also&#x20;indicate&#x20;interoperability&#x20;problems&#x20;with&#x20;other&#x20;IPsec&#x20;implementations.&#x20;In&#x20;that&#x20;case,&#x20;if&#x20;connectivity&#x20;is&#x20;not&#x20;impeded,&#x20;then&#x20;these&#x20;events&#x20;can&#x20;be&#x20;ignored.&#x20;-&#x20;5478:&#x20;IPsec&#x20;Services&#x20;has&#x20;started&#x20;successfully.&#x20;-&#x20;5479:&#x20;IPsec&#x20;Services&#x20;has&#x20;been&#x20;shut&#x20;down&#x20;successfully.&#x20;The&#x20;shutdown&#x20;of&#x20;IPsec&#x20;Services&#x20;can&#x20;put&#x20;the&#x20;computer&#x20;at&#x20;greater&#x20;risk&#x20;of&#x20;network&#x20;attack&#x20;or&#x20;expose&#x20;the&#x20;computer&#x20;to&#x20;potential&#x20;security&#x20;risks.&#x20;-&#x20;5480:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;get&#x20;the&#x20;complete&#x20;list&#x20;of&#x20;network&#x20;interfaces&#x20;on&#x20;the&#x20;computer.&#x20;This&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;because&#x20;some&#x20;of&#x20;the&#x20;network&#x20;interfaces&#x20;may&#x20;not&#x20;get&#x20;the&#x20;protection&#x20;provided&#x20;by&#x20;the&#x20;applied&#x20;IPsec&#x20;filters.&#x20;Use&#x20;the&#x20;IP&#x20;Security&#x20;Monitor&#x20;snap-in&#x20;to&#x20;diagnose&#x20;the&#x20;problem.&#x20;-&#x20;5483:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;initialize&#x20;RPC&#x20;server.&#x20;IPsec&#x20;Services&#x20;could&#x20;not&#x20;be&#x20;started.&#x20;-&#x20;5484:&#x20;IPsec&#x20;Services&#x20;has&#x20;experienced&#x20;a&#x20;critical&#x20;failure&#x20;and&#x20;has&#x20;been&#x20;shut&#x20;down.&#x20;The&#x20;shutdown&#x20;of&#x20;IPsec&#x20;Services&#x20;can&#x20;put&#x20;the&#x20;computer&#x20;at&#x20;greater&#x20;risk&#x20;of&#x20;network&#x20;attack&#x20;or&#x20;expose&#x20;the&#x20;computer&#x20;to&#x20;potential&#x20;security&#x20;risks.&#x20;-&#x20;5485:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;process&#x20;some&#x20;IPsec&#x20;filters&#x20;on&#x20;a&#x20;plug-and-play&#x20;event&#x20;for&#x20;network&#x20;interfaces.&#x20;This&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;because&#x20;some&#x20;of&#x20;the&#x20;network&#x20;interfaces&#x20;may&#x20;not&#x20;get&#x20;the&#x20;protection&#x20;provided&#x20;by&#x20;the&#x20;applied&#x20;IPsec&#x20;filters.&#x20;Use&#x20;the&#x20;IP&#x20;Security&#x20;Monitor&#x20;snap-in&#x20;to&#x20;diagnose&#x20;the&#x20;problem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;IPsec&#x20;Driver','[{\"cis\": [\"17.9.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26168,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;System&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;other&#x20;system&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;5024&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;has&#x20;started&#x20;successfully.&#x20;-&#x20;5025&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;has&#x20;been&#x20;stopped.&#x20;-&#x20;5027&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;was&#x20;unable&#x20;to&#x20;retrieve&#x20;the&#x20;security&#x20;policy&#x20;from&#x20;the&#x20;local&#x20;storage.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;enforcing&#x20;the&#x20;current&#x20;policy.&#x20;-&#x20;5028&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;was&#x20;unable&#x20;to&#x20;parse&#x20;the&#x20;new&#x20;security&#x20;policy.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;with&#x20;currently&#x20;enforced&#x20;policy.&#x20;-&#x20;5029:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;failed&#x20;to&#x20;initialize&#x20;the&#x20;driver.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;to&#x20;enforce&#x20;the&#x20;current&#x20;policy.&#x20;-&#x20;5030:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;failed&#x20;to&#x20;start.&#x20;-&#x20;5032:&#x20;Windows&#x20;Firewall&#x20;was&#x20;unable&#x20;to&#x20;notify&#x20;the&#x20;user&#x20;that&#x20;it&#x20;blocked&#x20;an&#x20;application&#x20;from&#x20;accepting&#x20;incoming&#x20;connections&#x20;on&#x20;the&#x20;network.&#x20;-&#x20;5033&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;has&#x20;started&#x20;successfully.&#x20;-&#x20;5034&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;has&#x20;been&#x20;stopped.&#x20;-&#x20;5035&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;failed&#x20;to&#x20;start.&#x20;-&#x20;5037&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;detected&#x20;critical&#x20;runtime&#x20;error.&#x20;Terminating.&#x20;-&#x20;5058:&#x20;Key&#x20;file&#x20;operation.&#x20;-&#x20;5059:&#x20;Key&#x20;migration&#x20;operation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Capturing&#x20;these&#x20;audit&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;for&#x20;identifying&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;is&#x20;not&#x20;performing&#x20;as&#x20;expected.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Other&#x20;System&#x20;Events','[{\"cis\": [\"17.9.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26169,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;State&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;security&#x20;state&#x20;of&#x20;the&#x20;system,&#x20;such&#x20;as&#x20;when&#x20;the&#x20;security&#x20;subsystem&#x20;starts&#x20;and&#x20;stops.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4608:&#x20;Windows&#x20;is&#x20;starting&#x20;up.&#x20;-&#x20;4609:&#x20;Windows&#x20;is&#x20;shutting&#x20;down.&#x20;-&#x20;4616:&#x20;The&#x20;system&#x20;time&#x20;was&#x20;changed.&#x20;-&#x20;4621:&#x20;Administrator&#x20;recovered&#x20;system&#x20;from&#x20;CrashOnAuditFail.&#x20;Users&#x20;who&#x20;are&#x20;not&#x20;administrators&#x20;will&#x20;now&#x20;be&#x20;allowed&#x20;to&#x20;log&#x20;on.&#x20;Some&#x20;audit-able&#x20;activity&#x20;might&#x20;not&#x20;have&#x20;been&#x20;recorded.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Security&#x20;State&#x20;Change','[{\"cis\": [\"17.9.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26170,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;System&#x20;Extension&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;loading&#x20;of&#x20;extension&#x20;code&#x20;such&#x20;as&#x20;authentication&#x20;packages&#x20;by&#x20;the&#x20;security&#x20;subsystem.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4610:&#x20;An&#x20;authentication&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;-&#x20;4611:&#x20;A&#x20;trusted&#x20;logon&#x20;process&#x20;has&#x20;been&#x20;registered&#x20;with&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;-&#x20;4614:&#x20;A&#x20;notification&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Security&#x20;Account&#x20;Manager.&#x20;-&#x20;4622:&#x20;A&#x20;security&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;-&#x20;4697:&#x20;A&#x20;service&#x20;was&#x20;installed&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Security&#x20;System&#x20;Extension','[{\"cis\": [\"17.9.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26171,'Ensure&#x20;&#039;Audit&#x20;System&#x20;Integrity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;violations&#x20;of&#x20;integrity&#x20;of&#x20;the&#x20;security&#x20;subsystem.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;-&#x20;4612&#x20;:&#x20;Internal&#x20;resources&#x20;allocated&#x20;for&#x20;the&#x20;queuing&#x20;of&#x20;audit&#x20;messages&#x20;have&#x20;been&#x20;exhausted,&#x20;leading&#x20;to&#x20;the&#x20;loss&#x20;of&#x20;some&#x20;audits.&#x20;-&#x20;4615&#x20;:&#x20;Invalid&#x20;use&#x20;of&#x20;LPC&#x20;port.&#x20;-&#x20;4618&#x20;:&#x20;A&#x20;monitored&#x20;security&#x20;event&#x20;pattern&#x20;has&#x20;occurred.&#x20;-&#x20;4816&#x20;:&#x20;RPC&#x20;detected&#x20;an&#x20;integrity&#x20;violation&#x20;while&#x20;decrypting&#x20;an&#x20;incoming&#x20;message.&#x20;-&#x20;5038&#x20;:&#x20;Code&#x20;integrity&#x20;determined&#x20;that&#x20;the&#x20;image&#x20;hash&#x20;of&#x20;a&#x20;file&#x20;is&#x20;not&#x20;valid.&#x20;The&#x20;file&#x20;could&#x20;be&#x20;corrupt&#x20;due&#x20;to&#x20;unauthorized&#x20;modification&#x20;or&#x20;the&#x20;invalid&#x20;hash&#x20;could&#x20;indicate&#x20;a&#x20;potential&#x20;disk&#x20;device&#x20;error.&#x20;-&#x20;5056:&#x20;A&#x20;cryptographic&#x20;self&#x20;test&#x20;was&#x20;performed.&#x20;-&#x20;5057:&#x20;A&#x20;cryptographic&#x20;primitive&#x20;operation&#x20;failed.&#x20;-&#x20;5060:&#x20;Verification&#x20;operation&#x20;failed.&#x20;-&#x20;5061:&#x20;Cryptographic&#x20;operation.&#x20;-&#x20;5062:&#x20;A&#x20;kernel-mode&#x20;cryptographic&#x20;self&#x20;test&#x20;was&#x20;performed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;System&#x20;Integrity','[{\"cis\": [\"17.9.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26172,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Disables&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;toggle&#x20;switch&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;camera&#x20;from&#x20;being&#x20;invoked&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;camera&#x20;features.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26173,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Disables&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;settings&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;slide&#x20;show&#x20;from&#x20;playing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;slide&#x20;show&#x20;contents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26174,'Ensure&#x20;&#039;Allow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;enables&#x20;the&#x20;automatic&#x20;learning&#x20;component&#x20;of&#x20;input&#x20;personalization&#x20;that&#x20;includes&#x20;speech,&#x20;inking,&#x20;and&#x20;typing.&#x20;Automatic&#x20;learning&#x20;enables&#x20;the&#x20;collection&#x20;of&#x20;speech&#x20;and&#x20;handwriting&#x20;patterns,&#x20;typing&#x20;history,&#x20;contacts,&#x20;and&#x20;recent&#x20;calendar&#x20;information.&#x20;It&#x20;is&#x20;required&#x20;for&#x20;the&#x20;use&#x20;of&#x20;Cortana.&#x20;Some&#x20;of&#x20;this&#x20;collected&#x20;information&#x20;may&#x20;be&#x20;stored&#x20;on&#x20;the&#x20;user&#039;s&#x20;OneDrive,&#x20;in&#x20;the&#x20;case&#x20;of&#x20;inking&#x20;and&#x20;typing;&#x20;some&#x20;of&#x20;the&#x20;information&#x20;will&#x20;be&#x20;uploaded&#x20;to&#x20;Microsoft&#x20;to&#x20;personalize&#x20;speech.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;Enabled&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;stored&#x20;in&#x20;the&#x20;cloud&#x20;or&#x20;sent&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelRegional&#x20;and&#x20;Language&#x20;OptionsAllow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;input&#x20;personalization,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;R1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.1.2.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26175,'Ensure&#x20;&#039;Allow&#x20;Online&#x20;Tips&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;the&#x20;retrieval&#x20;of&#x20;online&#x20;tips&#x20;and&#x20;help&#x20;for&#x20;the&#x20;Settings&#x20;app.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelAllow&#x20;Online&#x20;Tips.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanel.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.3\"]}, {\"pci_dss\": [\"1.3.4\"]}, {\"tsc\": [\"CC6.6\"]}]'),(26176,'Ensure&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;is&#x20;installed.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','In&#x20;order&#x20;to&#x20;utilize&#x20;LAPS,&#x20;a&#x20;minor&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;is&#x20;required,&#x20;and&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;each&#x20;managed&#x20;computer.&#x20;When&#x20;LAPS&#x20;is&#x20;installed,&#x20;the&#x20;file&#x20;AdmPwd.dll&#x20;must&#x20;be&#x20;present&#x20;in&#x20;the&#x20;following&#x20;location&#x20;and&#x20;registered&#x20;in&#x20;Windows&#x20;&#40;the&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;installation&#x20;does&#x20;this&#x20;for&#x20;you&#41;:&#x20;C:Program&#x20;FilesLAPSCSEAdmPwd.dll','[{\"cis\": [\"18.2.1\"]}, {\"cis_csc\": [\"5.2\", \"5.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26177,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSDo&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.2\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26178,'Ensure&#x20;&#039;Enable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSEnable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.3\"]}, {\"cis_csc\": [\"5.2\", \"5.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26179,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Complexity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Complexity&#x20;option&#x20;to&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.4\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26180,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;or&#x20;more&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;or&#x20;more.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Length&#x20;option&#x20;to&#x20;15&#x20;or&#x20;more:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.5\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26181,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;30&#x20;or&#x20;fewer&#039;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;30&#x20;or&#x20;fewer.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#x20;option&#x20;to&#x20;30&#x20;or&#x20;fewer:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.6\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26182,'Ensure&#x20;&#039;Apply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;accounts&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;administration&#x20;via&#x20;network&#x20;logon&#x20;&#40;e.g.,&#x20;NET&#x20;USE,&#x20;connecting&#x20;to&#x20;C$,&#x20;etc.&#41;.&#x20;Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Enabling&#x20;this&#x20;policy&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.&#x20;Enabled:&#x20;Applies&#x20;UAC&#x20;token-filtering&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Membership&#x20;in&#x20;powerful&#x20;group&#x20;such&#x20;as&#x20;Administrators&#x20;is&#x20;disabled&#x20;and&#x20;powerful&#x20;privileges&#x20;are&#x20;removed&#x20;from&#x20;the&#x20;resulting&#x20;access&#x20;token.&#x20;This&#x20;configures&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;0.&#x20;This&#x20;is&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Windows.&#x20;Disabled:&#x20;Allows&#x20;local&#x20;accounts&#x20;to&#x20;have&#x20;full&#x20;administrative&#x20;rights&#x20;when&#x20;authenticating&#x20;via&#x20;network&#x20;logon,&#x20;by&#x20;configuring&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;1.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;LocalAccountTokenFilterPolicy,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;951016:&#x20;Description&#x20;of&#x20;User&#x20;Account&#x20;Control&#x20;and&#x20;remote&#x20;restrictions&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Ensuring&#x20;this&#x20;policy&#x20;is&#x20;Enabled&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideApply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.1\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26183,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;driver&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;start&#x20;type&#x20;for&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;client&#x20;driver&#x20;service&#x20;&#40;MRxSmb10&#41;,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;disabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;.&#x20;Note:&#x20;Do&#x20;not,&#x20;under&#x20;any&#x20;circumstances,&#x20;configure&#x20;this&#x20;overall&#x20;setting&#x20;as&#x20;Disabled,&#x20;as&#x20;doing&#x20;so&#x20;will&#x20;delete&#x20;the&#x20;underlying&#x20;registry&#x20;entry&#x20;altogether,&#x20;which&#x20;will&#x20;cause&#x20;serious&#x20;problems.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;client&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26184,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;server-side&#x20;processing&#x20;of&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;protocol.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;server.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26185,'Ensure&#x20;&#039;Enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Windows&#x20;includes&#x20;support&#x20;for&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;We&#x20;recommend&#x20;enabling&#x20;this&#x20;feature&#x20;to&#x20;improve&#x20;the&#x20;security&#x20;profile&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;block&#x20;exploits&#x20;that&#x20;use&#x20;the&#x20;Structured&#x20;Exception&#x20;Handler&#x20;&#40;SEH&#41;&#x20;overwrite&#x20;technique.&#x20;This&#x20;protection&#x20;mechanism&#x20;is&#x20;provided&#x20;at&#x20;run-time.&#x20;Therefore,&#x20;it&#x20;helps&#x20;protect&#x20;applications&#x20;regardless&#x20;of&#x20;whether&#x20;they&#x20;have&#x20;been&#x20;compiled&#x20;with&#x20;the&#x20;latest&#x20;improvements,&#x20;such&#x20;as&#x20;the&#x20;/SAFESEH&#x20;option.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideEnable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.4\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(26186,'Ensure&#x20;&#039;Limits&#x20;print&#x20;driver&#x20;installation&#x20;to&#x20;Administrators&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;that&#x20;aren&#039;t&#x20;Administrators&#x20;can&#x20;install&#x20;print&#x20;drivers&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.','Restricting&#x20;the&#x20;installation&#x20;of&#x20;print&#x20;drives&#x20;to&#x20;Administrators&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideLimits&#x20;print&#x20;driver&#x20;installation&#x20;to&#x20;Administrators.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;SecGuide.admx/adml&#x20;is&#x20;required.','[{\"cis\": [\"18.3.5\"]}]'),(26187,'Ensure&#x20;&#039;NetBT&#x20;NodeType&#x20;configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;P-node&#039;.','This&#x20;setting&#x20;determines&#x20;which&#x20;method&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;NetBT&#41;&#x20;uses&#x20;to&#x20;register&#x20;and&#x20;resolve&#x20;names.&#x20;The&#x20;available&#x20;methods&#x20;are:&#x20;The&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;method&#x20;only&#x20;uses&#x20;broadcasts.&#x20;The&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;method&#x20;only&#x20;uses&#x20;name&#x20;queries&#x20;to&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;.&#x20;The&#x20;M-node&#x20;&#40;mixed&#41;&#x20;method&#x20;broadcasts&#x20;first,&#x20;then&#x20;queries&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;if&#x20;broadcast&#x20;failed.&#x20;The&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;method&#x20;queries&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;first,&#x20;then&#x20;broadcasts&#x20;if&#x20;the&#x20;query&#x20;failed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;P-node&#x20;&#40;recommended&#41;&#x20;&#40;point-to-&#x20;point&#41;.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Note:&#x20;Resolution&#x20;through&#x20;LMHOSTS&#x20;or&#x20;DNS&#x20;follows&#x20;these&#x20;methods.&#x20;If&#x20;the&#x20;NodeType&#x20;registry&#x20;value&#x20;is&#x20;present,&#x20;it&#x20;overrides&#x20;any&#x20;DhcpNodeType&#x20;registry&#x20;value.&#x20;If&#x20;neither&#x20;NodeType&#x20;nor&#x20;DhcpNodeType&#x20;is&#x20;present,&#x20;the&#x20;computer&#x20;uses&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;if&#x20;there&#x20;are&#x20;no&#x20;WINS&#x20;servers&#x20;configured&#x20;for&#x20;the&#x20;network,&#x20;or&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;if&#x20;there&#x20;is&#x20;at&#x20;least&#x20;one&#x20;WINS&#x20;server&#x20;configured.','In&#x20;order&#x20;to&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;NetBIOS&#x20;Name&#x20;Service&#x20;&#40;NBT-NS&#41;&#x20;poisoning&#x20;attacks,&#x20;setting&#x20;the&#x20;node&#x20;type&#x20;to&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;will&#x20;prevent&#x20;the&#x20;system&#x20;from&#x20;sending&#x20;out&#x20;NetBIOS&#x20;broadcasts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;P-node&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideNetBT&#x20;NodeType&#x20;configuration.&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.6\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26188,'Ensure&#x20;&#039;WDigest&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','When&#x20;WDigest&#x20;authentication&#x20;is&#x20;enabled,&#x20;Lsass.exe&#x20;retains&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;user&#039;s&#x20;plaintext&#x20;password&#x20;in&#x20;memory,&#x20;where&#x20;it&#x20;can&#x20;be&#x20;at&#x20;risk&#x20;of&#x20;theft.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured,&#x20;WDigest&#x20;authentication&#x20;is&#x20;disabled&#x20;in&#x20;Windows&#x20;8.1&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;R2;&#x20;it&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;in&#x20;earlier&#x20;versions&#x20;of&#x20;Windows&#x20;and&#x20;Windows&#x20;Server.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&#039;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&#039;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;UseLogonCredential,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;2871997:&#x20;Microsoft&#x20;Security&#x20;Advisory&#x20;Update&#x20;to&#x20;improve&#x20;credentials&#x20;protection&#x20;and&#x20;management&#x20;May&#x20;13,&#x20;2014.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideWDigest&#x20;Authentication&#x20;&#40;disabling&#x20;may&#x20;require&#x20;KB2871997&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.7\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26189,'Ensure&#x20;&#039;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;is&#x20;separate&#x20;from&#x20;the&#x20;Welcome&#x20;screen&#x20;feature&#x20;in&#x20;Windows&#x20;XP&#x20;and&#x20;Windows&#x20;Vista;&#x20;if&#x20;that&#x20;feature&#x20;is&#x20;disabled,&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;disabled.&#x20;If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;to&#x20;which&#x20;the&#x20;computer&#x20;is&#x20;connected.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext,&#x20;and&#x20;the&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;value&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;For&#x20;additional&#x20;information,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;324737:&#x20;How&#x20;to&#x20;turn&#x20;on&#x20;automatic&#x20;logon&#x20;in&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;that&#x20;the&#x20;computer&#x20;is&#x20;connected&#x20;to.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext.&#x20;The&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;setting&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;As&#x20;a&#x20;result,&#x20;this&#x20;entry&#x20;is&#x20;appropriate&#x20;only&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;physically&#x20;secured&#x20;and&#x20;if&#x20;you&#x20;ensure&#x20;that&#x20;untrusted&#x20;users&#x20;cannot&#x20;remotely&#x20;see&#x20;the&#x20;registry.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.1\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26190,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highe','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;follow&#x20;through&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26191,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highest&#x20;pr','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;take&#x20;through&#x20;the&#x20;network.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;Not&#x20;Defined&#x20;for&#x20;enterprise&#x20;environments&#x20;and&#x20;to&#x20;Highest&#x20;Protection&#x20;for&#x20;high&#x20;security&#x20;environments&#x20;to&#x20;completely&#x20;disable&#x20;source&#x20;routing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26192,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableSavePassword&#41;&#x20;Prevent&#x20;the&#x20;dial-up&#x20;password&#x20;from&#x20;being&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;you&#x20;dial&#x20;a&#x20;phonebook&#x20;or&#x20;VPN&#x20;entry&#x20;in&#x20;Dial-Up&#x20;Networking,&#x20;you&#x20;can&#x20;use&#x20;the&#x20;&quot;Save&#x20;Password&quot;&#x20;option&#x20;so&#x20;that&#x20;your&#x20;Dial-Up&#x20;Networking&#x20;password&#x20;is&#x20;cached&#x20;and&#x20;you&#x20;will&#x20;not&#x20;need&#x20;to&#x20;enter&#x20;it&#x20;on&#x20;successive&#x20;dial&#x20;attempts.&#x20;For&#x20;security,&#x20;administrators&#x20;may&#x20;want&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;caching&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;who&#x20;steals&#x20;a&#x20;mobile&#x20;user&#039;s&#x20;computer&#x20;could&#x20;automatically&#x20;connect&#x20;to&#x20;the&#x20;organization&#039;s&#x20;network&#x20;if&#x20;the&#x20;Save&#x20;This&#x20;Password&#x20;check&#x20;box&#x20;is&#x20;selected&#x20;for&#x20;the&#x20;dial-up&#x20;or&#x20;VPN&#x20;networking&#x20;entry&#x20;used&#x20;to&#x20;connect&#x20;to&#x20;your&#x20;organization&#039;s&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;DisableSavePassword&#41;&#x20;Prevent&#x20;the&#x20;dial-up&#x20;password&#x20;from&#x20;being&#x20;saved.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26193,'Ensure&#x20;&#039;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Internet&#x20;Control&#x20;Message&#x20;Protocol&#x20;&#40;ICMP&#41;&#x20;redirects&#x20;cause&#x20;the&#x20;IPv4&#x20;stack&#x20;to&#x20;plumb&#x20;host&#x20;routes.&#x20;These&#x20;routes&#x20;override&#x20;the&#x20;Open&#x20;Shortest&#x20;Path&#x20;First&#x20;&#40;OSPF&#41;&#x20;generated&#x20;routes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;behavior&#x20;is&#x20;expected.&#x20;The&#x20;problem&#x20;is&#x20;that&#x20;the&#x20;10&#x20;minute&#x20;time-out&#x20;period&#x20;for&#x20;the&#x20;ICMP&#x20;redirect-plumbed&#x20;routes&#x20;temporarily&#x20;creates&#x20;a&#x20;network&#x20;situation&#x20;in&#x20;which&#x20;traffic&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;routed&#x20;properly&#x20;for&#x20;the&#x20;affected&#x20;host.&#x20;Ignoring&#x20;such&#x20;ICMP&#x20;redirects&#x20;will&#x20;limit&#x20;the&#x20;system&#039;s&#x20;exposure&#x20;to&#x20;attacks&#x20;that&#x20;will&#x20;impact&#x20;its&#x20;ability&#x20;to&#x20;participate&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.5\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(26194,'Ensure&#x20;&#039;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recomme','This&#x20;value&#x20;controls&#x20;how&#x20;often&#x20;TCP&#x20;attempts&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;idle&#x20;connection&#x20;is&#x20;still&#x20;intact&#x20;by&#x20;sending&#x20;a&#x20;keep-alive&#x20;packet.&#x20;If&#x20;the&#x20;remote&#x20;computer&#x20;is&#x20;still&#x20;reachable,&#x20;it&#x20;acknowledges&#x20;the&#x20;keep-alive&#x20;packet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;.','An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;network&#x20;applications&#x20;could&#x20;establish&#x20;numerous&#x20;connections&#x20;to&#x20;cause&#x20;a&#x20;DoS&#x20;condition.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.6\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26195,'Ensure&#x20;&#039;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enab','NetBIOS&#x20;over&#x20;TCP/IP&#x20;is&#x20;a&#x20;network&#x20;protocol&#x20;that&#x20;among&#x20;other&#x20;things&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;easily&#x20;resolve&#x20;NetBIOS&#x20;names&#x20;that&#x20;are&#x20;registered&#x20;on&#x20;Windows-based&#x20;systems&#x20;to&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;configured&#x20;on&#x20;those&#x20;systems.&#x20;This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;computer&#x20;releases&#x20;its&#x20;NetBIOS&#x20;name&#x20;when&#x20;it&#x20;receives&#x20;a&#x20;name-release&#x20;request.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;NetBT&#x20;protocol&#x20;is&#x20;designed&#x20;not&#x20;to&#x20;use&#x20;authentication,&#x20;and&#x20;is&#x20;therefore&#x20;vulnerable&#x20;to&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;exploit&#x20;the&#x20;unauthenticated&#x20;nature&#x20;of&#x20;the&#x20;protocol&#x20;to&#x20;send&#x20;a&#x20;name-conflict&#x20;datagram&#x20;to&#x20;a&#x20;target&#x20;computer,&#x20;which&#x20;would&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;relinquish&#x20;its&#x20;name&#x20;and&#x20;not&#x20;respond&#x20;to&#x20;queries.&#x20;An&#x20;attacker&#x20;could&#x20;send&#x20;a&#x20;request&#x20;over&#x20;the&#x20;network&#x20;and&#x20;query&#x20;a&#x20;computer&#x20;to&#x20;release&#x20;its&#x20;NetBIOS&#x20;name.&#x20;As&#x20;with&#x20;any&#x20;change&#x20;that&#x20;could&#x20;affect&#x20;applications,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;test&#x20;this&#x20;change&#x20;in&#x20;a&#x20;non-production&#x20;environment&#x20;before&#x20;you&#x20;change&#x20;the&#x20;production&#x20;environment.&#x20;The&#x20;result&#x20;of&#x20;such&#x20;an&#x20;attack&#x20;could&#x20;be&#x20;to&#x20;cause&#x20;intermittent&#x20;connectivity&#x20;issues&#x20;on&#x20;the&#x20;target&#x20;computer,&#x20;or&#x20;even&#x20;to&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;Network&#x20;Neighborhood,&#x20;domain&#x20;logons,&#x20;the&#x20;NET&#x20;SEND&#x20;command,&#x20;or&#x20;additional&#x20;NetBIOS&#x20;name&#x20;resolution.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.7\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26196,'Ensure&#x20;&#039;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','This&#x20;setting&#x20;is&#x20;used&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;the&#x20;Internet&#x20;Router&#x20;Discovery&#x20;Protocol&#x20;&#40;IRDP&#41;,&#x20;which&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;default&#x20;gateway&#x20;addresses&#x20;automatically&#x20;as&#x20;described&#x20;in&#x20;RFC&#x20;1256&#x20;on&#x20;a&#x20;per-interface&#x20;basis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;control&#x20;of&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;network&#x20;segment&#x20;could&#x20;configure&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;network&#x20;to&#x20;impersonate&#x20;a&#x20;router.&#x20;Other&#x20;computers&#x20;with&#x20;IRDP&#x20;enabled&#x20;would&#x20;then&#x20;attempt&#x20;to&#x20;route&#x20;their&#x20;traffic&#x20;through&#x20;the&#x20;already&#x20;compromised&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.8\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26197,'Ensure&#x20;&#039;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;DLL&#x20;search&#x20;order&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;that&#x20;are&#x20;requested&#x20;by&#x20;running&#x20;processes&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;-&#x20;Search&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;-&#x20;Search&#x20;current&#x20;working&#x20;folder&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;When&#x20;enabled,&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;1.&#x20;With&#x20;a&#x20;setting&#x20;of&#x20;1,&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;When&#x20;disabled&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0&#x20;and&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;Applications&#x20;will&#x20;be&#x20;forced&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first.&#x20;For&#x20;applications&#x20;that&#x20;require&#x20;unique&#x20;versions&#x20;of&#x20;these&#x20;DLLs&#x20;that&#x20;are&#x20;included&#x20;with&#x20;the&#x20;application,&#x20;this&#x20;entry&#x20;could&#x20;cause&#x20;performance&#x20;or&#x20;stability&#x20;problems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;More&#x20;information&#x20;on&#x20;how&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;works&#x20;is&#x20;available&#x20;at&#x20;this&#x20;link:&#x20;Dynamic-Link&#x20;Library&#x20;Search&#x20;Order&#x20;-&#x20;Windows&#x20;applications&#x20;|&#x20;Microsoft&#x20;Docs','If&#x20;a&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;was&#x20;packaged&#x20;with&#x20;additional&#x20;files&#x20;that&#x20;include&#x20;modified&#x20;versions&#x20;of&#x20;system&#x20;DLLs,&#x20;the&#x20;hostile&#x20;code&#x20;could&#x20;load&#x20;its&#x20;own&#x20;versions&#x20;of&#x20;those&#x20;DLLs&#x20;and&#x20;potentially&#x20;increase&#x20;the&#x20;type&#x20;and&#x20;degree&#x20;of&#x20;damage&#x20;the&#x20;code&#x20;can&#x20;render.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.9\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26198,'Ensure&#x20;&#039;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','Windows&#x20;includes&#x20;a&#x20;grace&#x20;period&#x20;between&#x20;when&#x20;the&#x20;screen&#x20;saver&#x20;is&#x20;launched&#x20;and&#x20;when&#x20;the&#x20;console&#x20;is&#x20;actually&#x20;locked&#x20;automatically&#x20;when&#x20;screen&#x20;saver&#x20;locking&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds.','The&#x20;default&#x20;grace&#x20;period&#x20;that&#x20;is&#x20;allowed&#x20;for&#x20;user&#x20;movement&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;lock&#x20;takes&#x20;effect&#x20;is&#x20;five&#x20;seconds.&#x20;If&#x20;you&#x20;leave&#x20;the&#x20;default&#x20;grace&#x20;period&#x20;configuration,&#x20;your&#x20;computer&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;potential&#x20;attack&#x20;from&#x20;someone&#x20;who&#x20;could&#x20;approach&#x20;the&#x20;console&#x20;and&#x20;attempt&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;before&#x20;the&#x20;lock&#x20;takes&#x20;effect.&#x20;An&#x20;entry&#x20;to&#x20;the&#x20;registry&#x20;can&#x20;be&#x20;made&#x20;to&#x20;adjust&#x20;the&#x20;length&#x20;of&#x20;the&#x20;grace&#x20;period.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.10\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26199,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;.','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.11\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26200,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;.','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.12\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(26201,'Ensure&#x20;&#039;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#039;&#x20;is&#x20;set&#x20;to&#x20;&','This&#x20;setting&#x20;can&#x20;generate&#x20;a&#x20;security&#x20;audit&#x20;in&#x20;the&#x20;Security&#x20;event&#x20;log&#x20;when&#x20;the&#x20;log&#x20;reaches&#x20;a&#x20;user-defined&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;90%&#x20;or&#x20;less.&#x20;Note:&#x20;If&#x20;log&#x20;settings&#x20;are&#x20;configured&#x20;to&#x20;Overwrite&#x20;events&#x20;as&#x20;needed&#x20;or&#x20;Overwrite&#x20;events&#x20;older&#x20;than&#x20;x&#x20;days,&#x20;this&#x20;event&#x20;will&#x20;not&#x20;be&#x20;generated.','If&#x20;the&#x20;Security&#x20;log&#x20;reaches&#x20;90&#x20;percent&#x20;of&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;not&#x20;been&#x20;configured&#x20;to&#x20;overwrite&#x20;events&#x20;as&#x20;needed,&#x20;more&#x20;recent&#x20;events&#x20;will&#x20;not&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.&#x20;If&#x20;the&#x20;log&#x20;reaches&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;shut&#x20;down&#x20;when&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;the&#x20;computer&#x20;will&#x20;shut&#x20;down&#x20;and&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;available&#x20;to&#x20;provide&#x20;network&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;90%&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.4.13\"]}, {\"pci_dss\": [\"10.7\"]}]'),(26202,'Ensure&#x20;&#039;Configure&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Allow&#x20;DoH&#039;&#x20;or&#x20;higher.','This&#x20;setting&#x20;determines&#x20;if&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;is&#x20;used&#x20;by&#x20;the&#x20;system.&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;is&#x20;a&#x20;protocol&#x20;for&#x20;performing&#x20;remote&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;resolution&#x20;over&#x20;the&#x20;Hypertext&#x20;Transfer&#x20;Protocol&#x20;Secure&#x20;&#40;HTTPS&#41;.&#x20;For&#x20;additional&#x20;information&#x20;on&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;,&#x20;visit:&#x20;Secure&#x20;DNS&#x20;Client&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;on&#x20;Windows&#x20;Server&#x20;2022&#x20;|&#x20;Microsoft&#x20;Docs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Allow&#x20;DoH.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Enabled:&#x20;Require&#x20;DoH&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;helps&#x20;protect&#x20;against&#x20;DNS&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;It&#x20;can&#x20;also&#x20;help&#x20;prevent&#x20;man-in-the-middle&#x20;&#40;MitM&#41;&#x20;attacks&#x20;because&#x20;the&#x20;session&#x20;in-between&#x20;is&#x20;encrypted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Allow&#x20;DoH&#x20;&#40;configuring&#x20;to&#x20;Enabled:&#x20;Require&#x20;DoH&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientConfigure&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;name&#x20;resolution.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.1\"]}, {\"cis_csc\": [\"3.10\"]}]'),(26203,'Ensure&#x20;&#039;Turn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','LLMNR&#x20;is&#x20;a&#x20;secondary&#x20;name&#x20;resolution&#x20;protocol.&#x20;With&#x20;LLMNR,&#x20;queries&#x20;are&#x20;sent&#x20;using&#x20;multicast&#x20;over&#x20;a&#x20;local&#x20;network&#x20;link&#x20;on&#x20;a&#x20;single&#x20;subnet&#x20;from&#x20;a&#x20;client&#x20;computer&#x20;to&#x20;another&#x20;client&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;subnet&#x20;that&#x20;also&#x20;has&#x20;LLMNR&#x20;enabled.&#x20;LLMNR&#x20;does&#x20;not&#x20;require&#x20;a&#x20;DNS&#x20;server&#x20;or&#x20;DNS&#x20;client&#x20;configuration,&#x20;and&#x20;provides&#x20;name&#x20;resolution&#x20;in&#x20;scenarios&#x20;in&#x20;which&#x20;conventional&#x20;DNS&#x20;name&#x20;resolution&#x20;is&#x20;not&#x20;possible.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;can&#x20;listen&#x20;on&#x20;a&#x20;network&#x20;for&#x20;these&#x20;LLMNR&#x20;&#40;UDP/5355&#41;&#x20;or&#x20;NBT-NS&#x20;&#40;UDP/137&#41;&#x20;broadcasts&#x20;and&#x20;respond&#x20;to&#x20;them,&#x20;tricking&#x20;the&#x20;host&#x20;into&#x20;thinking&#x20;that&#x20;it&#x20;knows&#x20;the&#x20;location&#x20;of&#x20;the&#x20;requested&#x20;system.&#x20;Note:&#x20;To&#x20;completely&#x20;mitigate&#x20;local&#x20;name&#x20;resolution&#x20;poisoning,&#x20;in&#x20;addition&#x20;to&#x20;this&#x20;setting,&#x20;the&#x20;properties&#x20;of&#x20;each&#x20;installed&#x20;NIC&#x20;should&#x20;also&#x20;be&#x20;set&#x20;to&#x20;Disable&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;on&#x20;the&#x20;WINS&#x20;tab&#x20;in&#x20;the&#x20;NIC&#x20;properties&#41;.&#x20;Unfortunately,&#x20;there&#x20;is&#x20;no&#x20;global&#x20;setting&#x20;to&#x20;achieve&#x20;this&#x20;that&#x20;automatically&#x20;applies&#x20;to&#x20;all&#x20;NICs&#x20;-&#x20;it&#x20;is&#x20;a&#x20;per-NIC&#x20;setting&#x20;that&#x20;varies&#x20;with&#x20;different&#x20;NIC&#x20;hardware&#x20;installations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientTurn&#x20;off&#x20;multicast&#x20;name&#x20;resolution.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26204,'Ensure&#x20;&#039;Enable&#x20;Font&#x20;Providers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;is&#x20;allowed&#x20;to&#x20;download&#x20;fonts&#x20;and&#x20;font&#x20;catalog&#x20;data&#x20;from&#x20;an&#x20;online&#x20;font&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;configuration,&#x20;to&#x20;ensure&#x20;all&#x20;changes&#x20;are&#x20;tested&#x20;and&#x20;approved.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkFontsEnable&#x20;Font&#x20;Providers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.5.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(26205,'Ensure&#x20;&#039;Enable&#x20;insecure&#x20;guest&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;if&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;allow&#x20;insecure&#x20;guest&#x20;logons&#x20;to&#x20;an&#x20;SMB&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Insecure&#x20;guest&#x20;logons&#x20;are&#x20;used&#x20;by&#x20;file&#x20;servers&#x20;to&#x20;allow&#x20;unauthenticated&#x20;access&#x20;to&#x20;shared&#x20;folders.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLanman&#x20;WorkstationEnable&#x20;insecure&#x20;guest&#x20;logons.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LanmanWorkstation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.8.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26206,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Mapper&#x20;I/O&#x20;network&#x20;protocol&#x20;driver.&#x20;LLTDIO&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;discover&#x20;the&#x20;topology&#x20;of&#x20;a&#x20;network&#x20;it&#039;s&#x20;connected&#x20;to.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;initiate&#x20;Quality-of-Service&#x20;requests&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26207,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Responder&#x20;network&#x20;protocol&#x20;driver.&#x20;The&#x20;Responder&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Link&#x20;Layer&#x20;Topology&#x20;Discovery&#x20;requests&#x20;so&#x20;that&#x20;it&#x20;can&#x20;be&#x20;discovered&#x20;and&#x20;located&#x20;on&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Quality-of-Service&#x20;activities&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.2\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26208,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;allows&#x20;for&#x20;distributed&#x20;resolution&#x20;of&#x20;a&#x20;name&#x20;to&#x20;an&#x20;IPv6&#x20;address&#x20;and&#x20;port&#x20;number.&#x20;The&#x20;protocol&#x20;operates&#x20;in&#x20;the&#x20;context&#x20;of&#x20;clouds.&#x20;A&#x20;cloud&#x20;is&#x20;a&#x20;set&#x20;of&#x20;peer&#x20;computers&#x20;that&#x20;can&#x20;communicate&#x20;with&#x20;each&#x20;other&#x20;by&#x20;using&#x20;the&#x20;same&#x20;IPv6&#x20;scope.&#x20;Peer-to-Peer&#x20;protocols&#x20;allow&#x20;for&#x20;applications&#x20;in&#x20;the&#x20;areas&#x20;of&#x20;RTC,&#x20;collaboration,&#x20;content&#x20;distribution&#x20;and&#x20;distributed&#x20;processing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;peer-to-peer&#x20;networking.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkMicrosoft&#x20;Peer-to-Peer&#x20;Networking&#x20;ServicesTurn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;P2P-pnrp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.10.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26209,'Ensure&#x20;&#039;Prohibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','You&#x20;can&#x20;use&#x20;this&#x20;procedure&#x20;to&#x20;control&#x20;a&#x20;user&#039;s&#x20;ability&#x20;to&#x20;install&#x20;and&#x20;configure&#x20;a&#x20;Network&#x20;Bridge.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Network&#x20;Bridge&#x20;setting,&#x20;if&#x20;enabled,&#x20;allows&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Layer&#x20;2&#x20;Media&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;bridge,&#x20;enabling&#x20;them&#x20;to&#x20;connect&#x20;two&#x20;or&#x20;more&#x20;physical&#x20;network&#x20;segments&#x20;together.&#x20;A&#x20;Network&#x20;Bridge&#x20;thus&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;has&#x20;connections&#x20;to&#x20;two&#x20;different&#x20;networks&#x20;to&#x20;share&#x20;data&#x20;between&#x20;those&#x20;networks.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;where&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;control&#x20;network&#x20;traffic&#x20;to&#x20;only&#x20;authorized&#x20;paths,&#x20;allowing&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Network&#x20;Bridge&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface&#x20;from&#x20;the&#x20;bridged&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.2\"]}, {\"cis_csc\": [\"12.2\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(26210,'Ensure&#x20;&#039;Prohibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Although&#x20;this&#x20;&#039;legacy&#039;&#x20;setting&#x20;traditionally&#x20;applied&#x20;to&#x20;the&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;in&#x20;Windows&#x20;2000,&#x20;Windows&#x20;XP&#x20;&amp;&#x20;Server&#x20;2003,&#x20;this&#x20;setting&#x20;now&#x20;freshly&#x20;applies&#x20;to&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;in&#x20;Windows&#x20;10&#x20;&amp;&#x20;Server&#x20;2016.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Non-administrators&#x20;should&#x20;not&#x20;be&#x20;able&#x20;to&#x20;turn&#x20;on&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;and&#x20;open&#x20;their&#x20;Internet&#x20;connectivity&#x20;up&#x20;to&#x20;nearby&#x20;mobile&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(26211,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.4\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(26212,'Ensure&#x20;&#039;Hardened&#x20;UNC&#x20;Paths&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&','This&#x20;policy&#x20;setting&#x20;configures&#x20;secure&#x20;access&#x20;to&#x20;UNC&#x20;paths.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled,&#x20;with&#x20;Require&#x20;Mutual&#x20;Authentication&#x20;and&#x20;Require&#x20;Integrity&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&#x20;and&#x20;SYSVOL&#x20;shares.&#x20;Note:&#x20;If&#x20;the&#x20;environment&#x20;exclusively&#x20;contains&#x20;Windows&#x20;8.0&#x20;/&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;systems,&#x20;then&#x20;the&#x20;&quot;Privacy&quot;&#x20;setting&#x20;may&#x20;&#40;optionally&#41;&#x20;also&#x20;be&#x20;set&#x20;to&#x20;enable&#x20;SMB&#x20;encryption.&#x20;However,&#x20;using&#x20;SMB&#x20;encryption&#x20;will&#x20;render&#x20;the&#x20;targeted&#x20;share&#x20;paths&#x20;completely&#x20;inaccessible&#x20;by&#x20;older&#x20;OSes,&#x20;so&#x20;only&#x20;use&#x20;this&#x20;additional&#x20;option&#x20;with&#x20;caution&#x20;and&#x20;thorough&#x20;testing.','In&#x20;February&#x20;2015,&#x20;Microsoft&#x20;released&#x20;a&#x20;new&#x20;control&#x20;mechanism&#x20;to&#x20;mitigate&#x20;a&#x20;security&#x20;risk&#x20;in&#x20;Group&#x20;Policy&#x20;as&#x20;part&#x20;of&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update.&#x20;This&#x20;mechanism&#x20;requires&#x20;both&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;new&#x20;security&#x20;update&#x20;and&#x20;also&#x20;the&#x20;deployment&#x20;of&#x20;specific&#x20;group&#x20;policy&#x20;settings&#x20;to&#x20;all&#x20;computers&#x20;on&#x20;the&#x20;domain&#x20;from&#x20;Windows&#x20;Vista&#x20;/&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;&#40;the&#x20;associated&#x20;security&#x20;patch&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;was&#x20;not&#x20;released&#x20;for&#x20;Server&#x20;2003&#41;.&#x20;A&#x20;new&#x20;group&#x20;policy&#x20;template&#x20;&#40;NetworkProvider.admx/adml&#41;&#x20;was&#x20;also&#x20;provided&#x20;with&#x20;the&#x20;security&#x20;update.&#x20;Once&#x20;the&#x20;new&#x20;GPO&#x20;template&#x20;is&#x20;in&#x20;place,&#x20;the&#x20;following&#x20;are&#x20;the&#x20;minimum&#x20;requirements&#x20;to&#x20;remediate&#x20;the&#x20;Group&#x20;Policy&#x20;security&#x20;risk:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Note:&#x20;A&#x20;reboot&#x20;may&#x20;be&#x20;required&#x20;after&#x20;the&#x20;setting&#x20;is&#x20;applied&#x20;to&#x20;a&#x20;client&#x20;machine&#x20;to&#x20;access&#x20;the&#x20;above&#x20;paths.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;the&#x20;following&#x20;paths&#x20;configured,&#x20;at&#x20;a&#x20;minimum:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ProviderHardened&#x20;UNC&#x20;Paths.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;NetworkProvider.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.5.14.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26213,'Disable&#x20;IPv6&#x20;&#40;Ensure&#x20;TCPIP6&#x20;Parameter&#x20;&#039;DisabledComponents&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0xff&#x20;&#40;255&#41;&#039;&#41;.','Internet&#x20;Protocol&#x20;version&#x20;6&#x20;&#40;IPv6&#41;&#x20;is&#x20;a&#x20;set&#x20;of&#x20;protocols&#x20;that&#x20;computers&#x20;use&#x20;to&#x20;exchange&#x20;information&#x20;over&#x20;the&#x20;Internet&#x20;and&#x20;over&#x20;home&#x20;and&#x20;business&#x20;networks.&#x20;IPv6&#x20;allows&#x20;for&#x20;many&#x20;more&#x20;IP&#x20;addresses&#x20;to&#x20;be&#x20;assigned&#x20;than&#x20;IPv4&#x20;did.&#x20;Older&#x20;networking,&#x20;hosts&#x20;and&#x20;operating&#x20;systems&#x20;may&#x20;not&#x20;support&#x20;IPv6&#x20;natively.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;DisabledComponents&#x20;-&#x20;0xff&#x20;&#40;255&#41;','Since&#x20;the&#x20;vast&#x20;majority&#x20;of&#x20;private&#x20;enterprise&#x20;managed&#x20;networks&#x20;have&#x20;no&#x20;need&#x20;to&#x20;utilize&#x20;IPv6&#x20;&#40;because&#x20;they&#x20;have&#x20;access&#x20;to&#x20;private&#x20;IPv4&#x20;addressing&#41;,&#x20;disabling&#x20;IPv6&#x20;components&#x20;removes&#x20;a&#x20;possible&#x20;attack&#x20;surface&#x20;that&#x20;is&#x20;also&#x20;harder&#x20;to&#x20;monitor&#x20;the&#x20;traffic&#x20;on.&#x20;As&#x20;a&#x20;result,&#x20;we&#x20;recommend&#x20;configuring&#x20;IPv6&#x20;to&#x20;a&#x20;Disabled&#x20;state&#x20;when&#x20;it&#x20;is&#x20;not&#x20;needed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0xff&#x20;&#40;255&#41;&#x20;&#40;DWORD&#41;:&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTCPIP6Parameters:DisabledComponents.&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;Although&#x20;Microsoft&#x20;does&#x20;not&#x20;provide&#x20;an&#x20;ADMX&#x20;template&#x20;to&#x20;configure&#x20;this&#x20;registry&#x20;value,&#x20;a&#x20;custom&#x20;.ADM&#x20;template&#x20;&#40;Disable-IPv6-Components-KB929852.adm&#41;&#x20;is&#x20;provided&#x20;in&#x20;the&#x20;CIS&#x20;Benchmark&#x20;Remediation&#x20;Kit&#x20;to&#x20;facilitate&#x20;its&#x20;configuration.&#x20;Be&#x20;aware&#x20;though&#x20;that&#x20;simply&#x20;turning&#x20;off&#x20;the&#x20;group&#x20;policy&#x20;setting&#x20;in&#x20;the&#x20;.ADM&#x20;template&#x20;will&#x20;not&#x20;&quot;undo&quot;&#x20;the&#x20;change&#x20;once&#x20;applied.&#x20;Instead,&#x20;the&#x20;opposite&#x20;setting&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;change&#x20;the&#x20;registry&#x20;value&#x20;to&#x20;the&#x20;opposite&#x20;state.','[{\"cis\": [\"18.5.19.2.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26214,'Ensure&#x20;&#039;Configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;the&#x20;configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;.&#x20;The&#x20;WCN&#x20;Registrar&#x20;enables&#x20;the&#x20;discovery&#x20;and&#x20;configuration&#x20;of&#x20;devices&#x20;over&#x20;Ethernet&#x20;&#40;UPnP&#41;&#x20;over&#x20;in-band&#x20;802.11&#x20;Wi-Fi&#x20;through&#x20;the&#x20;Windows&#x20;Portable&#x20;Device&#x20;API&#x20;&#40;WPD&#41;&#x20;and&#x20;via&#x20;USB&#x20;Flash&#x20;drives.&#x20;Additional&#x20;options&#x20;are&#x20;available&#x20;to&#x20;allow&#x20;discovery&#x20;and&#x20;configuration&#x20;over&#x20;a&#x20;specific&#x20;medium.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;user&#x20;configuration&#x20;of&#x20;wireless&#x20;settings.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowConfiguration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.20.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26215,'Ensure&#x20;&#039;Prohibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prohibits&#x20;access&#x20;to&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;standard&#x20;users&#x20;to&#x20;access&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizard&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowProhibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.20.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26216,'Ensure&#x20;&#039;Minimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;establishing&#x20;multiple&#x20;simultaneous&#x20;connections&#x20;to&#x20;either&#x20;the&#x20;Internet&#x20;or&#x20;to&#x20;a&#x20;Windows&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20;when&#x20;on&#x20;Ethernet.','Preventing&#x20;bridged&#x20;network&#x20;connections&#x20;can&#x20;help&#x20;prevent&#x20;a&#x20;user&#x20;unknowingly&#x20;allowing&#x20;traffic&#x20;to&#x20;route&#x20;between&#x20;internal&#x20;and&#x20;external&#x20;networks,&#x20;which&#x20;risks&#x20;exposure&#x20;to&#x20;sensitive&#x20;internal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20;when&#x20;on&#x20;Ethernet:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerMinimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;updated&#x20;with&#x20;a&#x20;new&#x20;Minimize&#x20;Policy&#x20;Options&#x20;sub-setting&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.21.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26217,'Ensure&#x20;&#039;Prohibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;potential&#x20;concern&#x20;is&#x20;that&#x20;a&#x20;user&#x20;would&#x20;unknowingly&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;insecure&#x20;public&#x20;network&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerProhibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.21.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26218,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots,&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;contacts,&#x20;and&#x20;to&#x20;hotspots&#x20;offering&#x20;paid&#x20;services&#039','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;enable&#x20;the&#x20;following&#x20;WLAN&#x20;settings:&#x20;Connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots,&#x20;Connect&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;my&#x20;contacts,&#x20;and&#x20;Enable&#x20;paid&#x20;services.&#x20;-&#x20;Connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots&#x20;enables&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;users&#x20;to&#x20;open&#x20;hotspots&#x20;it&#x20;knows&#x20;about&#x20;by&#x20;crowdsourcing&#x20;networks&#x20;that&#x20;other&#x20;people&#x20;using&#x20;Windows&#x20;have&#x20;connected&#x20;to.&#x20;-&#x20;Connect&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;my&#x20;contacts&#x20;enables&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;to&#x20;networks&#x20;that&#x20;the&#x20;user&#039;s&#x20;contacts&#x20;have&#x20;shared&#x20;with&#x20;them,&#x20;and&#x20;enables&#x20;users&#x20;on&#x20;this&#x20;device&#x20;to&#x20;share&#x20;networks&#x20;with&#x20;their&#x20;contacts.&#x20;-&#x20;Enable&#x20;paid&#x20;services&#x20;enables&#x20;Windows&#x20;to&#x20;temporarily&#x20;connect&#x20;to&#x20;open&#x20;hotspots&#x20;to&#x20;determine&#x20;if&#x20;paid&#x20;services&#x20;are&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;These&#x20;features&#x20;are&#x20;also&#x20;known&#x20;by&#x20;the&#x20;name&#x20;&quot;Wi-Fi&#x20;Sense&quot;.','Automatically&#x20;connecting&#x20;to&#x20;an&#x20;open&#x20;hotspot&#x20;or&#x20;network&#x20;can&#x20;introduce&#x20;the&#x20;system&#x20;to&#x20;a&#x20;rogue&#x20;network&#x20;with&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWLAN&#x20;ServiceWLAN&#x20;SettingsAllow&#x20;Windows&#x20;to&#x20;automatically&#x20;connect&#x20;to&#x20;suggested&#x20;open&#x20;hotspots,&#x20;to&#x20;networks&#x20;shared&#x20;by&#x20;contacts,&#x20;and&#x20;to&#x20;hotspots&#x20;offering&#x20;paid&#x20;services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;wlansvc.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.23.2.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26219,'Ensure&#x20;&#039;Allow&#x20;Print&#x20;Spooler&#x20;to&#x20;accept&#x20;client&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Print&#x20;Spooler&#x20;service&#x20;will&#x20;accept&#x20;client&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Print&#x20;Spooler&#x20;service&#x20;must&#x20;be&#x20;restarted&#x20;for&#x20;changes&#x20;to&#x20;this&#x20;policy&#x20;to&#x20;take&#x20;effect.','Disabling&#x20;the&#x20;ability&#x20;for&#x20;the&#x20;Print&#x20;Spooler&#x20;service&#x20;to&#x20;accept&#x20;client&#x20;connections&#x20;mitigates&#x20;remote&#x20;attacks&#x20;against&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;remote&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;However,&#x20;this&#x20;recommendation&#x20;does&#x20;not&#x20;mitigate&#x20;against&#x20;local&#x20;attacks&#x20;on&#x20;the&#x20;Print&#x20;Spooler&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersAllow&#x20;Print&#x20;Spooler&#x20;to&#x20;accept&#x20;client&#x20;connections.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;printing2.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.1\"]}]'),(26220,'Ensure&#x20;&#039;Point&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;installing&#x20;drivers&#x20;for&#x20;a&#x20;new&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt&#0','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;computers&#x20;will&#x20;show&#x20;a&#x20;warning&#x20;and&#x20;a&#x20;security&#x20;elevation&#x20;prompt&#x20;when&#x20;users&#x20;create&#x20;a&#x20;new&#x20;printer&#x20;connection&#x20;using&#x20;Point&#x20;and&#x20;Print.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.&#x20;This&#x20;change&#x20;overrides&#x20;all&#x20;Point&#x20;and&#x20;Print&#x20;Group&#x20;Policy&#x20;settings&#x20;and&#x20;ensures&#x20;that&#x20;only&#x20;Administrators&#x20;can&#x20;install&#x20;printer&#x20;drivers&#x20;from&#x20;a&#x20;print&#x20;server&#x20;using&#x20;Point&#x20;and&#x20;Print.','Enabling&#x20;Windows&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;for&#x20;the&#x20;installation&#x20;of&#x20;new&#x20;print&#x20;drivers&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;Although&#x20;the&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;overrides&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;configure&#x20;this&#x20;as&#x20;a&#x20;backstop&#x20;in&#x20;the&#x20;event&#x20;that&#x20;behavior&#x20;is&#x20;reversed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersPoint&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;installing&#x20;drivers&#x20;for&#x20;a&#x20;new&#x20;connection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.2\"]}]'),(26221,'Ensure&#x20;&#039;Point&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;promp','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;computers&#x20;will&#x20;show&#x20;a&#x20;warning&#x20;and&#x20;a&#x20;security&#x20;elevation&#x20;prompt&#x20;when&#x20;users&#x20;are&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#x20;using&#x20;Point&#x20;and&#x20;Print.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.&#x20;This&#x20;change&#x20;overrides&#x20;all&#x20;Point&#x20;and&#x20;Print&#x20;Group&#x20;Policy&#x20;settings&#x20;and&#x20;ensures&#x20;that&#x20;only&#x20;Administrators&#x20;can&#x20;install&#x20;printer&#x20;drivers&#x20;from&#x20;a&#x20;print&#x20;server&#x20;using&#x20;Point&#x20;and&#x20;Print.','Enabling&#x20;Windows&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;for&#x20;updating&#x20;existing&#x20;print&#x20;drivers&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;Although&#x20;the&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;overrides&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;configure&#x20;this&#x20;as&#x20;a&#x20;backstop&#x20;in&#x20;the&#x20;event&#x20;that&#x20;behavior&#x20;is&#x20;reversed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersPoint&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.3\"]}]'),(26222,'Ensure&#x20;&#039;Turn&#x20;off&#x20;notifications&#x20;network&#x20;usage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;blocks&#x20;applications&#x20;from&#x20;using&#x20;the&#x20;network&#x20;to&#x20;send&#x20;notifications&#x20;to&#x20;update&#x20;tiles,&#x20;tile&#x20;badges,&#x20;toast,&#x20;or&#x20;raw&#x20;notifications.&#x20;This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;connection&#x20;between&#x20;Windows&#x20;and&#x20;the&#x20;Windows&#x20;Push&#x20;Notification&#x20;Service&#x20;&#40;WNS&#41;.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;stops&#x20;applications&#x20;from&#x20;being&#x20;able&#x20;to&#x20;poll&#x20;application&#x20;services&#x20;to&#x20;update&#x20;tiles.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Windows&#x20;Push&#x20;Notification&#x20;Services&#x20;&#40;WNS&#41;&#x20;is&#x20;a&#x20;mechanism&#x20;to&#x20;receive&#x20;3rd-party&#x20;notifications&#x20;and&#x20;updates&#x20;from&#x20;the&#x20;cloud/Internet.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;external&#x20;systems,&#x20;especially&#x20;those&#x20;hosted&#x20;outside&#x20;the&#x20;organization,&#x20;should&#x20;be&#x20;prevented&#x20;from&#x20;having&#x20;an&#x20;impact&#x20;on&#x20;the&#x20;secure&#x20;workstations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesStart&#x20;Menu&#x20;and&#x20;TaskbarTurn&#x20;off&#x20;notifications&#x20;network&#x20;usage.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WPN.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.7.1.1\"]}]'),(26223,'Ensure&#x20;&#039;Include&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;process&#x20;creation&#x20;command&#x20;line&#x20;text&#x20;is&#x20;logged&#x20;in&#x20;security&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;feature&#x20;that&#x20;this&#x20;setting&#x20;controls&#x20;was&#x20;not&#x20;originally&#x20;supported&#x20;in&#x20;workstation&#x20;OSes&#x20;older&#x20;than&#x20;Windows&#x20;8.1.&#x20;However,&#x20;in&#x20;February&#x20;2015&#x20;Microsoft&#x20;added&#x20;support&#x20;for&#x20;the&#x20;feature&#x20;to&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;8.0&#x20;via&#x20;an&#x20;update&#x20;-&#x20;KB3004375.&#x20;Therefore,&#x20;this&#x20;setting&#x20;is&#x20;also&#x20;important&#x20;to&#x20;set&#x20;on&#x20;those&#x20;older&#x20;OSes.','Capturing&#x20;process&#x20;command&#x20;line&#x20;information&#x20;in&#x20;event&#x20;logs&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;when&#x20;performing&#x20;forensic&#x20;investigations&#x20;of&#x20;attack&#x20;incidents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemAudit&#x20;Process&#x20;CreationInclude&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AuditSettings.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.3.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26224,'Ensure&#x20;&#039;Encryption&#x20;Oracle&#x20;Remediation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Force&#x20;Updated&#x20;Clients&#039;.','Some&#x20;versions&#x20;of&#x20;the&#x20;CredSSP&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;by&#x20;some&#x20;applications&#x20;&#40;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Connection&#41;&#x20;are&#x20;vulnerable&#x20;to&#x20;an&#x20;encryption&#x20;oracle&#x20;attack&#x20;against&#x20;the&#x20;client.&#x20;This&#x20;policy&#x20;controls&#x20;compatibility&#x20;with&#x20;vulnerable&#x20;clients&#x20;and&#x20;servers&#x20;and&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;level&#x20;of&#x20;protection&#x20;desired&#x20;for&#x20;the&#x20;encryption&#x20;oracle&#x20;vulnerability.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients.','This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;mitigate&#x20;the&#x20;CredSSP&#x20;encryption&#x20;oracle&#x20;vulnerability,&#x20;for&#x20;which&#x20;information&#x20;was&#x20;published&#x20;by&#x20;Microsoft&#x20;on&#x20;03/13/2018&#x20;in&#x20;CVE-2018-0886&#x20;|&#x20;CredSSP&#x20;Remote&#x20;Code&#x20;Execution&#x20;Vulnerability.&#x20;All&#x20;versions&#x20;of&#x20;Windows&#x20;from&#x20;Windows&#x20;Vista&#x20;onwards&#x20;are&#x20;affected&#x20;by&#x20;this&#x20;vulnerability,&#x20;and&#x20;will&#x20;be&#x20;compatible&#x20;with&#x20;this&#x20;recommendation&#x20;provided&#x20;that&#x20;they&#x20;have&#x20;been&#x20;patched&#x20;at&#x20;least&#x20;through&#x20;May&#x20;2018&#x20;&#40;or&#x20;later&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationEncryption&#x20;Oracle&#x20;Remediation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.1\"]}, {\"cis_csc\": [\"7.3\"]}]'),(26225,'Ensure&#x20;&#039;Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;When&#x20;using&#x20;credential&#x20;delegation,&#x20;devices&#x20;provide&#x20;an&#x20;exportable&#x20;version&#x20;of&#x20;credentials&#x20;to&#x20;the&#x20;remote&#x20;host.&#x20;This&#x20;exposes&#x20;users&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;credential&#x20;theft&#x20;from&#x20;attackers&#x20;on&#x20;the&#x20;remote&#x20;host.&#x20;The&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;and&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;features&#x20;are&#x20;two&#x20;options&#x20;to&#x20;help&#x20;protect&#x20;against&#x20;this&#x20;risk.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;More&#x20;detailed&#x20;information&#x20;on&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;and&#x20;how&#x20;it&#x20;compares&#x20;to&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;can&#x20;be&#x20;found&#x20;at&#x20;this&#x20;link:&#x20;Protect&#x20;Remote&#x20;Desktop&#x20;credentials&#x20;with&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs','Restricted&#x20;Admin&#x20;Mode&#x20;was&#x20;designed&#x20;to&#x20;help&#x20;protect&#x20;administrator&#x20;accounts&#x20;by&#x20;ensuring&#x20;that&#x20;reusable&#x20;credentials&#x20;are&#x20;not&#x20;stored&#x20;in&#x20;memory&#x20;on&#x20;remote&#x20;devices&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;compromised.&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;helps&#x20;you&#x20;protect&#x20;your&#x20;credentials&#x20;over&#x20;a&#x20;Remote&#x20;Desktop&#x20;connection&#x20;by&#x20;redirecting&#x20;Kerberos&#x20;requests&#x20;back&#x20;to&#x20;the&#x20;device&#x20;that&#x20;is&#x20;requesting&#x20;the&#x20;connection.&#x20;Both&#x20;features&#x20;should&#x20;be&#x20;enabled&#x20;and&#x20;supported,&#x20;as&#x20;they&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationRemote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26226,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Virtualization&#x20;Based&#x20;Security&#x20;is&#x20;enabled.&#x20;Virtualization&#x20;Based&#x20;Security&#x20;uses&#x20;the&#x20;Windows&#x20;Hypervisor&#x20;to&#x20;provide&#x20;support&#x20;for&#x20;security&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Kerberos,&#x20;NTLM,&#x20;and&#x20;Credential&#x20;manager&#x20;isolate&#x20;secrets&#x20;by&#x20;using&#x20;virtualization-based&#x20;security.&#x20;Previous&#x20;versions&#x20;of&#x20;Windows&#x20;stored&#x20;secrets&#x20;in&#x20;the&#x20;Local&#x20;Security&#x20;Authority&#x20;&#40;LSA&#41;.&#x20;Prior&#x20;to&#x20;Windows&#x20;10,&#x20;the&#x20;LSA&#x20;stored&#x20;secrets&#x20;used&#x20;by&#x20;the&#x20;operating&#x20;system&#x20;in&#x20;its&#x20;process&#x20;memory.&#x20;With&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;enabled,&#x20;the&#x20;LSA&#x20;process&#x20;in&#x20;the&#x20;operating&#x20;system&#x20;talks&#x20;to&#x20;a&#x20;new&#x20;component&#x20;called&#x20;the&#x20;isolated&#x20;LSA&#x20;process&#x20;that&#x20;stores&#x20;and&#x20;protects&#x20;those&#x20;secrets.&#x20;Data&#x20;stored&#x20;by&#x20;the&#x20;isolated&#x20;LSA&#x20;process&#x20;is&#x20;protected&#x20;using&#x20;virtualization-based&#x20;security&#x20;and&#x20;is&#x20;not&#x20;accessible&#x20;to&#x20;the&#x20;rest&#x20;of&#x20;the&#x20;operating&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.1\"]}, {\"cis_csc\": [\"10.5\"]}]'),(26227,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Select&#x20;Platform&#x20;Security&#x20;Level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Virtualization&#x20;Based&#x20;Security&#x20;is&#x20;enabled.&#x20;Virtualization&#x20;Based&#x20;Security&#x20;uses&#x20;the&#x20;Windows&#x20;Hypervisor&#x20;to&#x20;provide&#x20;support&#x20;for&#x20;security&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Secure&#x20;Boot&#x20;can&#x20;help&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;bootloader&#x20;attacks&#x20;and&#x20;in&#x20;conjunction&#x20;with&#x20;DMA&#x20;protections&#x20;to&#x20;help&#x20;protect&#x20;data&#x20;from&#x20;being&#x20;scraped&#x20;from&#x20;memory.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Select&#x20;Platform&#x20;Security&#x20;Level.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.2\"]}, {\"cis_csc\": [\"10.5\"]}]'),(26228,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#x20;with&#x20;UEFI&#x20;lock&#039;.','This&#x20;setting&#x20;enables&#x20;virtualization&#x20;based&#x20;protection&#x20;of&#x20;Kernel&#x20;Mode&#x20;Code&#x20;Integrity.&#x20;When&#x20;this&#x20;is&#x20;enabled,&#x20;kernel&#x20;mode&#x20;memory&#x20;protections&#x20;are&#x20;enforced&#x20;and&#x20;the&#x20;Code&#x20;Integrity&#x20;validation&#x20;path&#x20;is&#x20;protected&#x20;by&#x20;the&#x20;Virtualization&#x20;Based&#x20;Security&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','The&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;option&#x20;ensures&#x20;that&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.3\"]}, {\"cis_csc\": [\"10.5\"]}]'),(26229,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Require&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;True&#x20;&#40;checked&#41;&#039;.','This&#x20;option&#x20;will&#x20;only&#x20;enable&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;on&#x20;devices&#x20;with&#x20;UEFI&#x20;firmware&#x20;support&#x20;for&#x20;the&#x20;Memory&#x20;Attributes&#x20;Table.&#x20;Devices&#x20;without&#x20;the&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#x20;may&#x20;have&#x20;firmware&#x20;that&#x20;is&#x20;incompatible&#x20;with&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;which&#x20;in&#x20;some&#x20;cases&#x20;can&#x20;lead&#x20;to&#x20;crashes&#x20;or&#x20;data&#x20;loss&#x20;or&#x20;incompatibility&#x20;with&#x20;certain&#x20;plug-in&#x20;cards.&#x20;If&#x20;not&#x20;setting&#x20;this&#x20;option&#x20;the&#x20;targeted&#x20;devices&#x20;should&#x20;be&#x20;tested&#x20;to&#x20;ensure&#x20;compatibility.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;True&#x20;&#40;checked&#41;.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','This&#x20;setting&#x20;will&#x20;help&#x20;protect&#x20;this&#x20;control&#x20;from&#x20;being&#x20;enabled&#x20;on&#x20;a&#x20;system&#x20;that&#x20;is&#x20;not&#x20;compatible&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;a&#x20;crash&#x20;or&#x20;data&#x20;loss.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;TRUE:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Require&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.4\"]}, {\"cis_csc\": [\"10.5\"]}]'),(26230,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#x20;with&#x20;UEFI&#x20;lock&#039;.','This&#x20;setting&#x20;lets&#x20;users&#x20;turn&#x20;on&#x20;Credential&#x20;Guard&#x20;with&#x20;virtualization-based&#x20;security&#x20;to&#x20;help&#x20;protect&#x20;credentials.&#x20;The&#x20;&quot;Enabled&#x20;with&#x20;UEFI&#x20;lock&quot;&#x20;option&#x20;ensures&#x20;that&#x20;Credential&#x20;Guard&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.&#x20;In&#x20;order&#x20;to&#x20;disable&#x20;the&#x20;feature,&#x20;you&#x20;must&#x20;set&#x20;the&#x20;Group&#x20;Policy&#x20;to&#x20;&quot;Disabled&quot;&#x20;as&#x20;well&#x20;as&#x20;remove&#x20;the&#x20;security&#x20;functionality&#x20;from&#x20;each&#x20;computer,&#x20;with&#x20;a&#x20;physically&#x20;present&#x20;user,&#x20;in&#x20;order&#x20;to&#x20;clear&#x20;configuration&#x20;persisted&#x20;in&#x20;UEFI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','The&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;option&#x20;ensures&#x20;that&#x20;Credential&#x20;Guard&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.5\"]}, {\"cis_csc\": [\"10.5\"]}]'),(26231,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Secure&#x20;Launch&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Secure&#x20;Launch&#x20;protects&#x20;the&#x20;Virtualization&#x20;Based&#x20;Security&#x20;environment&#x20;from&#x20;exploited&#x20;vulnerabilities&#x20;in&#x20;device&#x20;firmware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Secure&#x20;Launch&#x20;changes&#x20;the&#x20;way&#x20;Windows&#x20;boots&#x20;to&#x20;use&#x20;Intel&#x20;Trusted&#x20;Execution&#x20;Technology&#x20;&#40;TXT&#41;&#x20;and&#x20;Runtime&#x20;BIOS&#x20;Resilience&#x20;features&#x20;to&#x20;prevent&#x20;firmware&#x20;exploits&#x20;from&#x20;being&#x20;able&#x20;to&#x20;impact&#x20;the&#x20;security&#x20;of&#x20;the&#x20;Windows&#x20;Virtualization&#x20;Based&#x20;Security&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Secure&#x20;Launch&#x20;Configuration.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.6\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26232,'Ensure&#x20;&#039;Prevent&#x20;device&#x20;metadata&#x20;retrieval&#x20;from&#x20;the&#x20;Internet&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;Windows&#x20;from&#x20;retrieving&#x20;device&#x20;metadata&#x20;from&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;will&#x20;not&#x20;prevent&#x20;the&#x20;installation&#x20;of&#x20;basic&#x20;hardware&#x20;drivers,&#x20;but&#x20;does&#x20;prevent&#x20;associated&#x20;3rd-party&#x20;utility&#x20;software&#x20;from&#x20;automatically&#x20;being&#x20;installed&#x20;under&#x20;the&#x20;context&#x20;of&#x20;the&#x20;SYSTEM&#x20;account.','Installation&#x20;of&#x20;software&#x20;should&#x20;be&#x20;conducted&#x20;by&#x20;an&#x20;authorized&#x20;system&#x20;administrator&#x20;and&#x20;not&#x20;a&#x20;standard&#x20;user.&#x20;Allowing&#x20;automatic&#x20;3rd-party&#x20;software&#x20;installations&#x20;under&#x20;the&#x20;context&#x20;of&#x20;the&#x20;SYSTEM&#x20;account&#x20;has&#x20;potential&#x20;for&#x20;allowing&#x20;unauthorized&#x20;access&#x20;via&#x20;backdoors&#x20;or&#x20;installation&#x20;software&#x20;bugs.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;InstallationPrevent&#x20;device&#x20;metadata&#x20;retrieval&#x20;from&#x20;the&#x20;Internet.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceInstallation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;with&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceSetup.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.7.2\"]}]'),(26233,'Ensure&#x20;&#039;Boot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;which&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized&#x20;based&#x20;on&#x20;a&#x20;classification&#x20;determined&#x20;by&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;The&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;can&#x20;return&#x20;the&#x20;following&#x20;classifications&#x20;for&#x20;each&#x20;boot-start&#x20;driver:&#x20;-&#x20;Good:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;signed&#x20;and&#x20;has&#x20;not&#x20;been&#x20;tampered&#x20;with.&#x20;-&#x20;Bad:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;allow&#x20;known&#x20;bad&#x20;drivers&#x20;to&#x20;be&#x20;initialized.&#x20;-&#x20;Bad,&#x20;but&#x20;required&#x20;for&#x20;boot:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware,&#x20;but&#x20;the&#x20;computer&#x20;cannot&#x20;successfully&#x20;boot&#x20;without&#x20;loading&#x20;this&#x20;driver.&#x20;-&#x20;Unknown:&#x20;This&#x20;driver&#x20;has&#x20;not&#x20;been&#x20;attested&#x20;to&#x20;by&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;and&#x20;has&#x20;not&#x20;been&#x20;classified&#x20;by&#x20;the&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;choose&#x20;which&#x20;boot-start&#x20;drivers&#x20;to&#x20;initialize&#x20;the&#x20;next&#x20;time&#x20;the&#x20;computer&#x20;is&#x20;started.&#x20;If&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;does&#x20;not&#x20;include&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;bootstart&#x20;driver&#x20;or&#x20;if&#x20;your&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;has&#x20;been&#x20;disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;and&#x20;all&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical.','This&#x20;policy&#x20;setting&#x20;helps&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;malware&#x20;that&#x20;has&#x20;already&#x20;infected&#x20;your&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemEarly&#x20;Launch&#x20;AntimalwareBoot-Start&#x20;Driver&#x20;Initialization&#x20;Policy.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EarlyLaunchAM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.14.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"5.1.1\"]}, {\"nist_800_53\": [\"SI.3\"]}, {\"tsc\": [\"CC6.8\"]}]'),(26234,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;FALSE&#039;.','The&#x20;&quot;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&quot;&#x20;option&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;updating&#x20;affected&#x20;policies&#x20;in&#x20;the&#x20;background&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;When&#x20;background&#x20;updates&#x20;are&#x20;disabled,&#x20;policy&#x20;changes&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;FALSE&#x20;&#40;unchecked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;false&#x20;&#40;unchecked&#41;&#x20;will&#x20;ensure&#x20;that&#x20;domain&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#x20;option&#x20;to&#x20;FALSE&#x20;&#40;unchecked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26235,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;TRUE&#039;.','The&#x20;&quot;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&quot;&#x20;option&#x20;updates&#x20;and&#x20;reapplies&#x20;policies&#x20;even&#x20;if&#x20;the&#x20;policies&#x20;have&#x20;not&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;TRUE&#x20;&#40;checked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;true&#x20;&#40;checked&#41;&#x20;will&#x20;ensure&#x20;unauthorized&#x20;changes&#x20;that&#x20;might&#x20;have&#x20;been&#x20;configured&#x20;locally&#x20;are&#x20;forced&#x20;to&#x20;match&#x20;the&#x20;domain-based&#x20;Group&#x20;Policy&#x20;settings&#x20;again.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#x20;option&#x20;to&#x20;TRUE&#x20;&#40;checked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.3\"]}, {\"pci_dss\": [\"11.5.1\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(26236,'Ensure&#x20;&#039;Continue&#x20;experiences&#x20;on&#x20;this&#x20;device&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Windows&#x20;device&#x20;is&#x20;allowed&#x20;to&#x20;participate&#x20;in&#x20;cross-device&#x20;experiences&#x20;&#40;continue&#x20;experiences&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;cross-device&#x20;experience&#x20;is&#x20;when&#x20;a&#x20;system&#x20;can&#x20;access&#x20;app&#x20;and&#x20;send&#x20;messages&#x20;to&#x20;other&#x20;devices.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;only&#x20;trusted&#x20;systems&#x20;should&#x20;be&#x20;communicating&#x20;within&#x20;the&#x20;network.&#x20;Access&#x20;to&#x20;any&#x20;other&#x20;system&#x20;should&#x20;be&#x20;prohibited.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyContinue&#x20;experiences&#x20;on&#x20;this&#x20;device.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26237,'Ensure&#x20;&#039;Turn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;Group&#x20;Policy&#x20;from&#x20;being&#x20;updated&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;to&#x20;Group&#x20;Policy&#x20;for&#x20;computers,&#x20;users&#x20;and&#x20;Domain&#x20;Controllers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;group&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyTurn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.21.5\"]}]'),(26238,'Ensure&#x20;&#039;Turn&#x20;off&#x20;access&#x20;to&#x20;the&#x20;Store&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;use&#x20;the&#x20;Store&#x20;service&#x20;for&#x20;finding&#x20;an&#x20;application&#x20;to&#x20;open&#x20;a&#x20;file&#x20;with&#x20;an&#x20;unhandled&#x20;file&#x20;type&#x20;or&#x20;protocol&#x20;association.&#x20;When&#x20;a&#x20;user&#x20;opens&#x20;a&#x20;file&#x20;type&#x20;or&#x20;protocol&#x20;that&#x20;is&#x20;not&#x20;associated&#x20;with&#x20;any&#x20;applications&#x20;on&#x20;the&#x20;computer,&#x20;the&#x20;user&#x20;is&#x20;given&#x20;the&#x20;choice&#x20;to&#x20;select&#x20;a&#x20;local&#x20;application&#x20;or&#x20;use&#x20;the&#x20;Store&#x20;service&#x20;to&#x20;find&#x20;an&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Store&#x20;service&#x20;is&#x20;a&#x20;retail&#x20;outlet&#x20;built&#x20;into&#x20;Windows,&#x20;primarily&#x20;for&#x20;consumer&#x20;use.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;installation&#x20;of&#x20;all&#x20;applications&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;installation&#x20;of&#x20;vulnerable&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;access&#x20;to&#x20;the&#x20;Store.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26239,'Ensure&#x20;&#039;Turn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;computer&#x20;can&#x20;download&#x20;print&#x20;driver&#x20;packages&#x20;over&#x20;HTTP.&#x20;To&#x20;set&#x20;up&#x20;HTTP&#x20;printing,&#x20;printer&#x20;drivers&#x20;that&#x20;are&#x20;not&#x20;available&#x20;in&#x20;the&#x20;standard&#x20;operating&#x20;system&#x20;installation&#x20;might&#x20;need&#x20;to&#x20;be&#x20;downloaded&#x20;over&#x20;HTTP.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;might&#x20;download&#x20;drivers&#x20;that&#x20;include&#x20;malicious&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.2\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26240,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;turns&#x20;off&#x20;data&#x20;sharing&#x20;from&#x20;the&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool&#x20;enables&#x20;Tablet&#x20;PC&#x20;users&#x20;to&#x20;adapt&#x20;handwriting&#x20;recognition&#x20;to&#x20;their&#x20;own&#x20;writing&#x20;style&#x20;by&#x20;providing&#x20;writing&#x20;samples.&#x20;The&#x20;tool&#x20;can&#x20;optionally&#x20;share&#x20;user&#x20;writing&#x20;samples&#x20;with&#x20;Microsoft&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;tool&#x20;generates&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ShapeCollector.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.3\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26241,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Turns&#x20;off&#x20;the&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool&#x20;enables&#x20;users&#x20;to&#x20;report&#x20;errors&#x20;encountered&#x20;in&#x20;Tablet&#x20;PC&#x20;Input&#x20;Panel.&#x20;The&#x20;tool&#x20;generates&#x20;error&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;Microsoft&#x20;uses&#x20;these&#x20;error&#x20;reports&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InkWatson.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26242,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;can&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;Internet&#x20;Service&#x20;Providers&#x20;&#40;ISPs&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26243,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;will&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;for&#x20;the&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Although&#x20;the&#x20;risk&#x20;is&#x20;minimal,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;downloading&#x20;malicious&#x20;content&#x20;through&#x20;this&#x20;feature.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.6\"]}]'),(26244,'Ensure&#x20;&#039;Turn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;disable&#x20;the&#x20;client&#x20;computer&#039;s&#x20;ability&#x20;to&#x20;print&#x20;over&#x20;HTTP,&#x20;which&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;printers&#x20;on&#x20;the&#x20;intranet&#x20;as&#x20;well&#x20;as&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;control&#x20;affects&#x20;printing&#x20;over&#x20;both&#x20;HTTP&#x20;and&#x20;HTTPS.','Information&#x20;that&#x20;is&#x20;transmitted&#x20;over&#x20;HTTP&#x20;through&#x20;this&#x20;capability&#x20;is&#x20;not&#x20;protected&#x20;and&#x20;can&#x20;be&#x20;intercepted&#x20;by&#x20;malicious&#x20;users.&#x20;For&#x20;this&#x20;reason,&#x20;it&#x20;is&#x20;not&#x20;often&#x20;used&#x20;in&#x20;enterprise&#x20;managed&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;printing&#x20;over&#x20;HTTP.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.7\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26245,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Registration&#x20;Wizard&#x20;connects&#x20;to&#x20;Microsoft.com&#x20;for&#x20;online&#x20;registration.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;should&#x20;not&#x20;be&#x20;registering&#x20;their&#x20;own&#x20;copies&#x20;of&#x20;Windows,&#x20;providing&#x20;their&#x20;own&#x20;PII&#x20;in&#x20;the&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26246,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Search&#x20;Companion&#x20;should&#x20;automatically&#x20;download&#x20;content&#x20;updates&#x20;during&#x20;local&#x20;and&#x20;Internet&#x20;searches.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;users&#x20;will&#x20;unknowingly&#x20;reveal&#x20;sensitive&#x20;information&#x20;because&#x20;of&#x20;the&#x20;topics&#x20;they&#x20;are&#x20;searching&#x20;for.&#x20;This&#x20;risk&#x20;is&#x20;very&#x20;low&#x20;because&#x20;even&#x20;if&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;users&#x20;still&#x20;must&#x20;submit&#x20;search&#x20;queries&#x20;to&#x20;the&#x20;desired&#x20;search&#x20;engine&#x20;in&#x20;order&#x20;to&#x20;perform&#x20;searches.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.9\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26247,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;&quot;Order&#x20;Prints&#x20;Online&quot;&#x20;task&#x20;is&#x20;available&#x20;from&#x20;Picture&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Order&#x20;Prints&#x20;Online&#x20;Wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;order&#x20;prints&#x20;online.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.10\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26248,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;tasks&#x20;Publish&#x20;this&#x20;file&#x20;to&#x20;the&#x20;Web,&#x20;Publish&#x20;this&#x20;folder&#x20;to&#x20;the&#x20;Web,&#x20;and&#x20;Publish&#x20;the&#x20;selected&#x20;items&#x20;to&#x20;the&#x20;Web&#x20;are&#x20;available&#x20;from&#x20;File&#x20;and&#x20;Folder&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Web&#x20;Publishing&#x20;wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;publish&#x20;content&#x20;to&#x20;the&#x20;Web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;may&#x20;publish&#x20;confidential&#x20;or&#x20;sensitive&#x20;information&#x20;to&#x20;a&#x20;public&#x20;service&#x20;outside&#x20;of&#x20;the&#x20;control&#x20;of&#x20;the&#x20;organization.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.11\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26249,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;Windows&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;improve&#x20;features&#x20;that&#x20;are&#x20;most&#x20;used&#x20;and&#x20;to&#x20;detect&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly.&#x20;Enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.12\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26250,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.13\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26251,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;errors&#x20;are&#x20;reported&#x20;to&#x20;Microsoft.&#x20;Error&#x20;Reporting&#x20;is&#x20;used&#x20;to&#x20;report&#x20;information&#x20;about&#x20;a&#x20;system&#x20;or&#x20;application&#x20;that&#x20;has&#x20;failed&#x20;or&#x20;has&#x20;stopped&#x20;responding&#x20;and&#x20;is&#x20;used&#x20;to&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;the&#x20;product.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.14\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26252,'Ensure&#x20;&#039;Support&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Automatic&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;support&#x20;for&#x20;Kerberos&#x20;to&#x20;attempt&#x20;authentication&#x20;using&#x20;the&#x20;certificate&#x20;for&#x20;the&#x20;device&#x20;to&#x20;the&#x20;domain.&#x20;Support&#x20;for&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;will&#x20;require&#x20;connectivity&#x20;to&#x20;a&#x20;DC&#x20;in&#x20;the&#x20;device&#x20;account&#x20;domain&#x20;which&#x20;supports&#x20;certificate&#x20;authentication&#x20;for&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Automatic.','Having&#x20;stronger&#x20;device&#x20;authentication&#x20;with&#x20;the&#x20;use&#x20;of&#x20;certificates&#x20;is&#x20;strongly&#x20;encouraged&#x20;over&#x20;standard&#x20;username&#x20;and&#x20;password&#x20;authentication.&#x20;Having&#x20;this&#x20;set&#x20;to&#x20;Automatic&#x20;will&#x20;allow&#x20;certificate&#x20;based&#x20;authentication&#x20;to&#x20;be&#x20;used&#x20;whenever&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Automatic:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKerberosSupport&#x20;device&#x20;authentication&#x20;using&#x20;certificate.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Kerberos.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.25.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26253,'Ensure&#x20;&#039;Enumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#x20;All&#039;.','This&#x20;policy&#x20;is&#x20;intended&#x20;to&#x20;provide&#x20;additional&#x20;security&#x20;against&#x20;external&#x20;DMA-capable&#x20;devices.&#x20;It&#x20;allows&#x20;for&#x20;more&#x20;control&#x20;over&#x20;the&#x20;enumeration&#x20;of&#x20;external&#x20;DMA-capable&#x20;devices&#x20;that&#x20;are&#x20;not&#x20;compatible&#x20;with&#x20;DMA&#x20;Remapping/device&#x20;memory&#x20;isolation&#x20;and&#x20;sandboxing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;All.&#x20;Note:&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;1394,&#x20;PCMCIA&#x20;or&#x20;ExpressCard&#x20;devices.&#x20;The&#x20;protection&#x20;also&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;R1803&#x20;or&#x20;higher,&#x20;and&#x20;also&#x20;requires&#x20;a&#x20;UEFI&#x20;BIOS&#x20;to&#x20;function.&#x20;Note&#x20;#2:&#x20;More&#x20;information&#x20;on&#x20;this&#x20;feature&#x20;is&#x20;available&#x20;at&#x20;this&#x20;link:&#x20;Kernel&#x20;DMA&#x20;Protection&#x20;for&#x20;Thunderbolt&trade;&#x20;3&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs.','Device&#x20;memory&#x20;sandboxing&#x20;allows&#x20;the&#x20;OS&#x20;to&#x20;leverage&#x20;the&#x20;I/O&#x20;Memory&#x20;Management&#x20;Unit&#x20;&#40;IOMMU&#41;&#x20;of&#x20;a&#x20;device&#x20;to&#x20;block&#x20;unpermitted&#x20;I/O,&#x20;or&#x20;memory&#x20;access,&#x20;by&#x20;the&#x20;peripheral.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;All:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKernel&#x20;DMA&#x20;ProtectionEnumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DmaGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26254,'Ensure&#x20;&#039;Disallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;prevents&#x20;automatic&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;use&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;user&#x20;is&#x20;restricted&#x20;to&#x20;the&#x20;set&#x20;of&#x20;input&#x20;methods&#x20;that&#x20;are&#x20;enabled&#x20;in&#x20;the&#x20;system&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;way&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLocale&#x20;ServicesDisallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26255,'Ensure&#x20;&#039;Block&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;&#40;email&#x20;address&#x20;or&#x20;user&#x20;name&#41;&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;workstation&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonBlock&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26256,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;anyone&#x20;can&#x20;interact&#x20;with&#x20;available&#x20;networks&#x20;UI&#x20;on&#x20;the&#x20;logon&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;disconnect&#x20;the&#x20;PC&#x20;from&#x20;the&#x20;network&#x20;or&#x20;can&#x20;connect&#x20;the&#x20;PC&#x20;to&#x20;other&#x20;available&#x20;networks&#x20;without&#x20;signing&#x20;into&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26257,'Ensure&#x20;&#039;Do&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;connected&#x20;users&#x20;from&#x20;being&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.3\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26258,'Ensure&#x20;&#039;Enumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;local&#x20;users&#x20;to&#x20;be&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonEnumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26259,'Ensure&#x20;&#039;Turn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;app&#x20;notifications&#x20;from&#x20;appearing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','App&#x20;notifications&#x20;might&#x20;display&#x20;sensitive&#x20;business&#x20;or&#x20;personal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26260,'Ensure&#x20;&#039;Turn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;picture&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;the&#x20;picture&#x20;password&#x20;feature&#x20;is&#x20;permitted,&#x20;the&#x20;user&#039;s&#x20;domain&#x20;password&#x20;is&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;it.','Picture&#x20;passwords&#x20;bypass&#x20;the&#x20;requirement&#x20;for&#x20;a&#x20;typed&#x20;complex&#x20;password.&#x20;In&#x20;a&#x20;shared&#x20;work&#x20;environment,&#x20;a&#x20;simple&#x20;shoulder&#x20;surf&#x20;where&#x20;someone&#x20;observed&#x20;the&#x20;on-screen&#x20;gestures&#x20;would&#x20;allow&#x20;that&#x20;person&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;the&#x20;need&#x20;to&#x20;know&#x20;the&#x20;complex&#x20;password.&#x20;Vertical&#x20;monitor&#x20;screens&#x20;with&#x20;an&#x20;image&#x20;are&#x20;much&#x20;more&#x20;visible&#x20;at&#x20;a&#x20;distance&#x20;than&#x20;horizontal&#x20;key&#x20;strokes,&#x20;increasing&#x20;the&#x20;likelihood&#x20;of&#x20;a&#x20;successful&#x20;observation&#x20;of&#x20;the&#x20;mouse&#x20;gestures.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;picture&#x20;password&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26261,'Ensure&#x20;&#039;Turn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;convenience&#x20;PIN.&#x20;In&#x20;Windows&#x20;10,&#x20;convenience&#x20;PIN&#x20;was&#x20;replaced&#x20;with&#x20;Passport,&#x20;which&#x20;has&#x20;stronger&#x20;security&#x20;properties.&#x20;To&#x20;configure&#x20;Passport&#x20;for&#x20;domain&#x20;users,&#x20;use&#x20;the&#x20;policies&#x20;under&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Passport&#x20;for&#x20;Work.&#x20;Note:&#x20;The&#x20;user&#039;s&#x20;domain&#x20;password&#x20;will&#x20;be&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;this&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;PIN&#x20;is&#x20;created&#x20;from&#x20;a&#x20;much&#x20;smaller&#x20;selection&#x20;of&#x20;characters&#x20;than&#x20;a&#x20;password,&#x20;so&#x20;in&#x20;most&#x20;cases&#x20;a&#x20;PIN&#x20;will&#x20;be&#x20;much&#x20;less&#x20;robust&#x20;than&#x20;a&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;on&#x20;PIN&#x20;sign-in,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.28.7\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26262,'Ensure&#x20;&#039;Allow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;Clipboard&#x20;contents&#x20;can&#x20;be&#x20;synchronized&#x20;across&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;high&#x20;security&#x20;environments,&#x20;clipboard&#x20;data&#x20;should&#x20;stay&#x20;local&#x20;to&#x20;the&#x20;system&#x20;and&#x20;not&#x20;synced&#x20;across&#x20;devices,&#x20;as&#x20;it&#x20;may&#x20;contain&#x20;very&#x20;sensitive&#x20;information&#x20;that&#x20;must&#x20;be&#x20;contained&#x20;locally.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;OSPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.31.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26263,'Ensure&#x20;&#039;Allow&#x20;upload&#x20;of&#x20;User&#x20;Activities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;published&#x20;User&#x20;Activities&#x20;can&#x20;be&#x20;uploaded&#x20;to&#x20;the&#x20;cloud.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;upload&#x20;of&#x20;User&#x20;Activities.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;OSPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.31.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26264,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;on&#x20;battery&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26265,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;plugged&#x20;in&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.2\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26266,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.5\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26267,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.6\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26268,'Ensure&#x20;&#039;Configure&#x20;Offer&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Offer&#x20;&#40;Unsolicited&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;Help&#x20;desk&#x20;and&#x20;support&#x20;personnel&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;proactively&#x20;offer&#x20;assistance,&#x20;although&#x20;they&#x20;can&#x20;still&#x20;respond&#x20;to&#x20;user&#x20;assistance&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;user&#x20;might&#x20;be&#x20;tricked&#x20;and&#x20;accept&#x20;an&#x20;unsolicited&#x20;Remote&#x20;Assistance&#x20;offer&#x20;from&#x20;a&#x20;malicious&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Offer&#x20;Remote&#x20;Assistance.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26269,'Ensure&#x20;&#039;Configure&#x20;Solicited&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Solicited&#x20;&#40;Ask&#x20;for&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','There&#x20;is&#x20;slight&#x20;risk&#x20;that&#x20;a&#x20;rogue&#x20;administrator&#x20;will&#x20;gain&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;desktop&#x20;session,&#x20;however,&#x20;they&#x20;cannot&#x20;connect&#x20;to&#x20;a&#x20;user&#039;s&#x20;computer&#x20;unannounced&#x20;or&#x20;control&#x20;it&#x20;without&#x20;permission&#x20;from&#x20;the&#x20;user.&#x20;When&#x20;an&#x20;expert&#x20;tries&#x20;to&#x20;connect,&#x20;the&#x20;user&#x20;can&#x20;still&#x20;choose&#x20;to&#x20;deny&#x20;the&#x20;connection&#x20;or&#x20;give&#x20;the&#x20;expert&#x20;view-only&#x20;privileges.&#x20;The&#x20;user&#x20;must&#x20;explicitly&#x20;click&#x20;the&#x20;Yes&#x20;button&#x20;to&#x20;allow&#x20;the&#x20;expert&#x20;to&#x20;remotely&#x20;control&#x20;the&#x20;workstation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Solicited&#x20;Remote&#x20;Assistance.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26270,'Ensure&#x20;&#039;Enable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;RPC&#x20;clients&#x20;authenticate&#x20;with&#x20;the&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;when&#x20;the&#x20;call&#x20;they&#x20;are&#x20;making&#x20;contains&#x20;authentication&#x20;information.&#x20;The&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;on&#x20;computers&#x20;running&#x20;Windows&#x20;NT4&#x20;&#40;all&#x20;service&#x20;packs&#41;&#x20;cannot&#x20;process&#x20;authentication&#x20;information&#x20;supplied&#x20;in&#x20;this&#x20;manner.&#x20;This&#x20;policy&#x20;setting&#x20;can&#x20;cause&#x20;a&#x20;specific&#x20;issue&#x20;with&#x20;1-way&#x20;forest&#x20;trusts&#x20;if&#x20;it&#x20;is&#x20;applied&#x20;to&#x20;the&#x20;trusting&#x20;domain&#x20;DCs&#x20;&#40;see&#x20;Microsoft&#x20;KB3073942&#41;,&#x20;so&#x20;we&#x20;do&#x20;not&#x20;recommend&#x20;applying&#x20;it&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;This&#x20;policy&#x20;will&#x20;not&#x20;in&#x20;effect&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Anonymous&#x20;access&#x20;to&#x20;RPC&#x20;services&#x20;could&#x20;result&#x20;in&#x20;accidental&#x20;disclosure&#x20;of&#x20;information&#x20;to&#x20;unauthenticated&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallEnable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.1\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26271,'Ensure&#x20;&#039;Restrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Authenticated&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;how&#x20;the&#x20;RPC&#x20;server&#x20;runtime&#x20;handles&#x20;unauthenticated&#x20;RPC&#x20;clients&#x20;connecting&#x20;to&#x20;RPC&#x20;servers.&#x20;This&#x20;policy&#x20;setting&#x20;impacts&#x20;all&#x20;RPC&#x20;applications.&#x20;In&#x20;a&#x20;domain&#x20;environment&#x20;this&#x20;policy&#x20;setting&#x20;should&#x20;be&#x20;used&#x20;with&#x20;caution&#x20;as&#x20;it&#x20;can&#x20;impact&#x20;a&#x20;wide&#x20;range&#x20;of&#x20;functionality&#x20;including&#x20;group&#x20;policy&#x20;processing&#x20;itself.&#x20;Reverting&#x20;a&#x20;change&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;can&#x20;require&#x20;manual&#x20;intervention&#x20;on&#x20;each&#x20;affected&#x20;machine.&#x20;This&#x20;policy&#x20;setting&#x20;should&#x20;never&#x20;be&#x20;applied&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;A&#x20;client&#x20;will&#x20;be&#x20;considered&#x20;an&#x20;authenticated&#x20;client&#x20;if&#x20;it&#x20;uses&#x20;a&#x20;named&#x20;pipe&#x20;to&#x20;communicate&#x20;with&#x20;the&#x20;server&#x20;or&#x20;if&#x20;it&#x20;uses&#x20;RPC&#x20;Security.&#x20;RPC&#x20;Interfaces&#x20;that&#x20;have&#x20;specifically&#x20;requested&#x20;to&#x20;be&#x20;accessible&#x20;by&#x20;unauthenticated&#x20;clients&#x20;may&#x20;be&#x20;exempt&#x20;from&#x20;this&#x20;restriction,&#x20;depending&#x20;on&#x20;the&#x20;selected&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting.&#x20;--&#x20;&quot;None&quot;&#x20;allows&#x20;all&#x20;RPC&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;--&#x20;&quot;Authenticated&quot;&#x20;allows&#x20;only&#x20;authenticated&#x20;RPC&#x20;Clients&#x20;&#40;per&#x20;the&#x20;definition&#x20;above&#41;&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;Exemptions&#x20;are&#x20;granted&#x20;to&#x20;interfaces&#x20;that&#x20;have&#x20;requested&#x20;them.&#x20;--&#x20;&quot;Authenticated&#x20;without&#x20;exceptions&quot;&#x20;allows&#x20;only&#x20;authenticated&#x20;RPC&#x20;Clients&#x20;&#40;per&#x20;the&#x20;definition&#x20;above&#41;&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;No&#x20;exceptions&#x20;are&#x20;allowed.&#x20;This&#x20;value&#x20;has&#x20;the&#x20;potential&#x20;to&#x20;cause&#x20;serious&#x20;problems&#x20;and&#x20;is&#x20;not&#x20;recommended.&#039;&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;will&#x20;not&#x20;be&#x20;applied&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Authenticated.','Unauthenticated&#x20;RPC&#x20;communication&#x20;can&#x20;create&#x20;a&#x20;security&#x20;vulnerability.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Authenticated:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallRestrict&#x20;Unauthenticated&#x20;RPC&#x20;clients.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26272,'Ensure&#x20;&#039;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool&#x20;&#40;MSDT&#41;&#x20;interactive&#x20;communication&#x20;with&#x20;the&#x20;support&#x20;provider.&#x20;MSDT&#x20;gathers&#x20;diagnostic&#x20;data&#x20;for&#x20;analysis&#x20;by&#x20;support&#x20;professionals.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsMicrosoft&#x20;Support&#x20;Diagnostic&#x20;ToolMicrosoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSDT.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.48.5.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26273,'Ensure&#x20;&#039;Enable/Disable&#x20;PerfTrack&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;tracking&#x20;of&#x20;responsiveness&#x20;events.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;enabled&#x20;the&#x20;aggregated&#x20;data&#x20;of&#x20;a&#x20;given&#x20;event&#x20;will&#x20;be&#x20;transmitted&#x20;to&#x20;Microsoft.&#x20;The&#x20;option&#x20;exists&#x20;to&#x20;restrict&#x20;this&#x20;feature&#x20;for&#x20;a&#x20;specific&#x20;user,&#x20;set&#x20;the&#x20;consent&#x20;level,&#x20;and&#x20;designate&#x20;specific&#x20;programs&#x20;for&#x20;which&#x20;error&#x20;reports&#x20;could&#x20;be&#x20;sent.&#x20;However,&#x20;centrally&#x20;restricting&#x20;the&#x20;ability&#x20;to&#x20;execute&#x20;PerfTrack&#x20;to&#x20;limit&#x20;the&#x20;potential&#x20;for&#x20;unauthorized&#x20;or&#x20;undesired&#x20;usage,&#x20;data&#x20;leakage,&#x20;or&#x20;unintentional&#x20;communications&#x20;is&#x20;highly&#x20;recommended.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsWindows&#x20;Performance&#x20;PerfTrackEnable/Disable&#x20;PerfTrack.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PerformancePerftrack.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.48.11.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26274,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;advertising&#x20;ID,&#x20;preventing&#x20;apps&#x20;from&#x20;using&#x20;the&#x20;ID&#x20;for&#x20;experiences&#x20;across&#x20;apps.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Tracking&#x20;user&#x20;activity&#x20;for&#x20;advertising&#x20;purposes,&#x20;even&#x20;anonymously,&#x20;may&#x20;be&#x20;a&#x20;privacy&#x20;concern.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;applications&#x20;should&#x20;not&#x20;need&#x20;or&#x20;require&#x20;tracking&#x20;for&#x20;targeted&#x20;advertising.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemUser&#x20;ProfilesTurn&#x20;off&#x20;the&#x20;advertising&#x20;ID.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;UserProfiles.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.50.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26275,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Client&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;is&#x20;enabled.&#x20;Enabling&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;allows&#x20;your&#x20;computer&#x20;to&#x20;synchronize&#x20;its&#x20;computer&#x20;clock&#x20;with&#x20;other&#x20;NTP&#x20;servers.&#x20;You&#x20;might&#x20;want&#x20;to&#x20;disable&#x20;this&#x20;service&#x20;if&#x20;you&#x20;decide&#x20;to&#x20;use&#x20;a&#x20;third-party&#x20;time&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;reliable&#x20;and&#x20;accurate&#x20;account&#x20;of&#x20;time&#x20;is&#x20;important&#x20;for&#x20;a&#x20;number&#x20;of&#x20;services&#x20;and&#x20;security&#x20;requirements,&#x20;including&#x20;but&#x20;not&#x20;limited&#x20;to&#x20;distributed&#x20;applications,&#x20;authentication&#x20;services,&#x20;multi-user&#x20;databases&#x20;and&#x20;logging&#x20;services.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;NTP&#x20;client&#x20;&#40;with&#x20;secure&#x20;operation&#41;&#x20;establishes&#x20;functional&#x20;accuracy&#x20;and&#x20;is&#x20;a&#x20;focal&#x20;point&#x20;when&#x20;reviewing&#x20;security&#x20;relevant&#x20;events.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Client.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.53.1.1\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(26276,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;configuration&#x20;of&#x20;proper&#x20;time&#x20;synchronization&#x20;is&#x20;critically&#x20;important&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;both&#x20;due&#x20;to&#x20;the&#x20;sensitivity&#x20;of&#x20;Kerberos&#x20;authentication&#x20;timestamps&#x20;and&#x20;also&#x20;to&#x20;ensure&#x20;accurate&#x20;security&#x20;logging.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Server.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.53.1.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(26277,'Ensure&#x20;&#039;Allow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Manages&#x20;a&#x20;Windows&#x20;app&#039;s&#x20;ability&#x20;to&#x20;share&#x20;data&#x20;between&#x20;users&#x20;who&#x20;have&#x20;installed&#x20;the&#x20;app.&#x20;Data&#x20;is&#x20;shared&#x20;through&#x20;the&#x20;SharedLocal&#x20;folder.&#x20;This&#x20;folder&#x20;is&#x20;available&#x20;through&#x20;the&#x20;Windows.Storage&#x20;API.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;of&#x20;a&#x20;system&#x20;could&#x20;accidentally&#x20;share&#x20;sensitive&#x20;data&#x20;with&#x20;other&#x20;users&#x20;on&#x20;the&#x20;same&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentAllow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.1\"]}, {\"cis_csc\": [\"3.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26278,'Ensure&#x20;&#039;Prevent&#x20;non-admin&#x20;users&#x20;from&#x20;installing&#x20;packaged&#x20;Windows&#x20;apps&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;manages&#x20;non-Administrator&#x20;users&#039;&#x20;ability&#x20;to&#x20;install&#x20;Windows&#x20;app&#x20;packages.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;corporate&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentPrevent&#x20;non-admin&#x20;users&#x20;from&#x20;installing&#x20;packaged&#x20;Windows&#x20;apps.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.2\"]}, {\"cis_csc\": [\"2.5\"]}]'),(26279,'Ensure&#x20;&#039;Let&#x20;Windows&#x20;apps&#x20;activate&#x20;with&#x20;voice&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Force&#x20;Deny&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;apps&#x20;can&#x20;be&#x20;activated&#x20;by&#x20;voice&#x20;&#40;apps&#x20;and&#x20;Cortana&#41;&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Force&#x20;Deny.','Access&#x20;to&#x20;any&#x20;computer&#x20;resource&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;when&#x20;the&#x20;device&#x20;is&#x20;locked.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Force&#x20;Deny:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;PrivacyLet&#x20;Windows&#x20;apps&#x20;activate&#x20;with&#x20;voice&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppPrivacy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.5.1\"]}]'),(26280,'Ensure&#x20;&#039;Allow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;control&#x20;whether&#x20;Microsoft&#x20;accounts&#x20;are&#x20;optional&#x20;for&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;require&#x20;an&#x20;account&#x20;to&#x20;sign&#x20;in.&#x20;This&#x20;policy&#x20;only&#x20;affects&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;use&#x20;their&#x20;enterprise&#x20;user&#x20;accounts&#x20;instead&#x20;of&#x20;using&#x20;their&#x20;Microsoft&#x20;accounts&#x20;when&#x20;accessing&#x20;Windows&#x20;store&#x20;apps.&#x20;This&#x20;provides&#x20;the&#x20;organization&#x20;with&#x20;greater&#x20;control&#x20;over&#x20;relevant&#x20;credentials.&#x20;Microsoft&#x20;accounts&#x20;cannot&#x20;be&#x20;centrally&#x20;managed&#x20;and&#x20;as&#x20;such&#x20;enterprise&#x20;credential&#x20;security&#x20;policies&#x20;cannot&#x20;be&#x20;applied&#x20;to&#x20;them,&#x20;which&#x20;could&#x20;put&#x20;any&#x20;information&#x20;accessed&#x20;by&#x20;using&#x20;Microsoft&#x20;accounts&#x20;at&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeAllow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.6.1\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26281,'Ensure&#x20;&#039;Block&#x20;launching&#x20;Universal&#x20;Windows&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;from&#x20;hosted&#x20;content.&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Microsoft&#x20;Store&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;directly&#x20;from&#x20;web&#x20;content&#x20;can&#x20;be&#x20;launched.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blocking&#x20;apps&#x20;from&#x20;the&#x20;web&#x20;with&#x20;direct&#x20;access&#x20;to&#x20;the&#x20;Windows&#x20;API&#x20;can&#x20;prevent&#x20;malicious&#x20;apps&#x20;from&#x20;being&#x20;run&#x20;on&#x20;a&#x20;system.&#x20;Only&#x20;system&#x20;administrators&#x20;should&#x20;be&#x20;installing&#x20;approved&#x20;applications.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeBlock&#x20;launching&#x20;Universal&#x20;Windows&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;from&#x20;hosted&#x20;content.&#x20;Note:&#x20;A&#x20;reboot&#x20;may&#x20;be&#x20;required&#x20;after&#x20;the&#x20;setting&#x20;is&#x20;applied.&#x20;Note&#x20;#2:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#3:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Block&#x20;launching&#x20;Windows&#x20;Store&#x20;apps&#x20;with&#x20;Windows&#x20;Runtime&#x20;API&#x20;access&#x20;from&#x20;hosted&#x20;content.,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates','[{\"cis\": [\"18.9.6.2\"]}, {\"cis_csc\": [\"2.5\"]}]'),(26282,'Ensure&#x20;&#039;Disallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;disallows&#x20;AutoPlay&#x20;for&#x20;MTP&#x20;devices&#x20;like&#x20;cameras&#x20;or&#x20;phones.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesDisallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.1\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26283,'Ensure&#x20;&#039;Set&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands&#039;.','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Autorun&#x20;commands.&#x20;Autorun&#x20;commands&#x20;are&#x20;generally&#x20;stored&#x20;in&#x20;autorun.inf&#x20;files.&#x20;They&#x20;often&#x20;launch&#x20;the&#x20;installation&#x20;program&#x20;or&#x20;other&#x20;routines.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands.','Prior&#x20;to&#x20;Windows&#x20;Vista,&#x20;when&#x20;media&#x20;containing&#x20;an&#x20;autorun&#x20;command&#x20;is&#x20;inserted,&#x20;the&#x20;system&#x20;will&#x20;automatically&#x20;execute&#x20;the&#x20;program&#x20;without&#x20;user&#x20;intervention.&#x20;This&#x20;creates&#x20;a&#x20;major&#x20;security&#x20;concern&#x20;as&#x20;code&#x20;may&#x20;be&#x20;executed&#x20;without&#x20;user&#039;s&#x20;knowledge.&#x20;The&#x20;default&#x20;behavior&#x20;starting&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;to&#x20;prompt&#x20;the&#x20;user&#x20;whether&#x20;autorun&#x20;command&#x20;is&#x20;to&#x20;be&#x20;run.&#x20;The&#x20;autorun&#x20;command&#x20;is&#x20;represented&#x20;as&#x20;a&#x20;handler&#x20;in&#x20;the&#x20;Autoplay&#x20;dialog.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesSet&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.2\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26284,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Autoplay&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;All&#x20;drives&#039;.','Autoplay&#x20;starts&#x20;to&#x20;read&#x20;from&#x20;a&#x20;drive&#x20;as&#x20;soon&#x20;as&#x20;you&#x20;insert&#x20;media&#x20;in&#x20;the&#x20;drive,&#x20;which&#x20;causes&#x20;the&#x20;setup&#x20;file&#x20;for&#x20;programs&#x20;or&#x20;audio&#x20;media&#x20;to&#x20;start&#x20;immediately.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;the&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.&#x20;Autoplay&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;on&#x20;some&#x20;removable&#x20;drive&#x20;types,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives,&#x20;but&#x20;not&#x20;on&#x20;CD-ROM&#x20;drives.&#x20;Note:&#x20;You&#x20;cannot&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enable&#x20;Autoplay&#x20;on&#x20;computer&#x20;drives&#x20;in&#x20;which&#x20;it&#x20;is&#x20;disabled&#x20;by&#x20;default,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;All&#x20;drives.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;All&#x20;drives:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesTurn&#x20;off&#x20;Autoplay.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.8.3\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26285,'Ensure&#x20;&#039;Configure&#x20;enhanced&#x20;anti-spoofing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;enhanced&#x20;anti-spoofing&#x20;is&#x20;configured&#x20;for&#x20;devices&#x20;which&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enterprise&#x20;managed&#x20;environments&#x20;are&#x20;now&#x20;supporting&#x20;a&#x20;wider&#x20;range&#x20;of&#x20;mobile&#x20;devices,&#x20;increasing&#x20;the&#x20;security&#x20;on&#x20;these&#x20;devices&#x20;will&#x20;help&#x20;protect&#x20;against&#x20;unauthorized&#x20;access&#x20;on&#x20;your&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsBiometricsFacial&#x20;FeaturesConfigure&#x20;enhanced&#x20;anti-spoofing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Biometrics.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;and&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Use&#x20;enhanced&#x20;anti-spoofing&#x20;when&#x20;available.&#x20;It&#x20;was&#x20;renamed&#x20;to&#x20;Configure&#x20;enhanced&#x20;anti-spoofing&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.10.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26286,'Ensure&#x20;&#039;Allow&#x20;Use&#x20;of&#x20;Camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;use&#x20;of&#x20;Camera&#x20;devices&#x20;on&#x20;the&#x20;machine&#x20;are&#x20;permitted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Cameras&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment&#x20;can&#x20;pose&#x20;serious&#x20;privacy&#x20;and&#x20;data&#x20;exfiltration&#x20;risks&#x20;-&#x20;they&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;help&#x20;mitigate&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCameraAllow&#x20;Use&#x20;of&#x20;Camera.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Camera.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.12.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26287,'Ensure&#x20;&#039;Turn&#x20;off&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#x20;is&#x20;allowed&#x20;in&#x20;all&#x20;Windows&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;use&#x20;of&#x20;consumer&#x20;accounts&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;as&#x20;it&#x20;could&#x20;lead&#x20;to&#x20;possible&#x20;data&#x20;leakage.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.1\"]}]'),(26288,'Ensure&#x20;&#039;Turn&#x20;off&#x20;cloud&#x20;optimized&#x20;content&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;cloud&#x20;optimized&#x20;content&#x20;in&#x20;all&#x20;Windows&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;cloud&#x20;optimized&#x20;content.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;20H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.2\"]}]'),(26289,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;experiences&#x20;that&#x20;help&#x20;consumers&#x20;make&#x20;the&#x20;most&#x20;of&#x20;their&#x20;devices&#x20;and&#x20;Microsoft&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet,&#x20;this&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.','Having&#x20;apps&#x20;silently&#x20;install&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;-&#x20;especially&#x20;if&#x20;the&#x20;apps&#x20;send&#x20;data&#x20;back&#x20;to&#x20;a&#x20;3rd&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26290,'Ensure&#x20;&#039;Require&#x20;pin&#x20;for&#x20;pairing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;First&#x20;Time&#039;&#x20;OR&#x20;&#039;Enabled:&#x20;Always&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;PIN&#x20;is&#x20;required&#x20;for&#x20;pairing&#x20;to&#x20;a&#x20;wireless&#x20;display&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;First&#x20;Time&#x20;OR&#x20;Enabled:&#x20;Always.','If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured&#x20;or&#x20;disabled&#x20;then&#x20;a&#x20;PIN&#x20;would&#x20;not&#x20;be&#x20;required&#x20;when&#x20;pairing&#x20;wireless&#x20;display&#x20;devices&#x20;to&#x20;the&#x20;system,&#x20;increasing&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;First&#x20;Time&#x20;OR&#x20;Enabled:&#x20;Always:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsConnectRequire&#x20;pin&#x20;for&#x20;pairing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WirelessDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;The&#x20;new&#x20;Choose&#x20;one&#x20;of&#x20;the&#x20;following&#x20;actions&#x20;sub-option&#x20;was&#x20;later&#x20;added&#x20;as&#x20;of&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;Administrative&#x20;Templates.&#x20;Choosing&#x20;Enabled&#x20;in&#x20;the&#x20;older&#x20;templates&#x20;is&#x20;the&#x20;equivalent&#x20;of&#x20;choosing&#x20;Enabled:&#x20;First&#x20;Time&#x20;in&#x20;the&#x20;newer&#x20;templates.','[{\"cis\": [\"18.9.15.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26291,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;display&#x20;of&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;in&#x20;password&#x20;entry&#x20;user&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;useful&#x20;feature&#x20;when&#x20;entering&#x20;a&#x20;long&#x20;and&#x20;complex&#x20;password,&#x20;especially&#x20;when&#x20;using&#x20;a&#x20;touchscreen.&#x20;The&#x20;potential&#x20;risk&#x20;is&#x20;that&#x20;someone&#x20;else&#x20;may&#x20;see&#x20;your&#x20;password&#x20;while&#x20;surreptitiously&#x20;observing&#x20;your&#x20;screen.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceDo&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26292,'Ensure&#x20;&#039;Enumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;administrator&#x20;accounts&#x20;are&#x20;displayed&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;elevate&#x20;a&#x20;running&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;could&#x20;see&#x20;the&#x20;list&#x20;of&#x20;administrator&#x20;accounts,&#x20;making&#x20;it&#x20;slightly&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;user&#x20;who&#x20;has&#x20;logged&#x20;onto&#x20;a&#x20;console&#x20;session&#x20;to&#x20;try&#x20;to&#x20;crack&#x20;the&#x20;passwords&#x20;of&#x20;those&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceEnumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.16.2\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26293,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;use&#x20;of&#x20;security&#x20;questions&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;security&#x20;questions&#x20;can&#x20;be&#x20;used&#x20;to&#x20;reset&#x20;local&#x20;account&#x20;passwords.&#x20;The&#x20;security&#x20;question&#x20;feature&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;domain&#x20;accounts,&#x20;only&#x20;local&#x20;accounts&#x20;on&#x20;the&#x20;workstation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;could&#x20;establish&#x20;security&#x20;questions&#x20;that&#x20;are&#x20;easily&#x20;guessed&#x20;or&#x20;sleuthed&#x20;by&#x20;observing&#x20;the&#x20;user&rsquo;s&#x20;social&#x20;media&#x20;accounts,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;actor&#x20;to&#x20;change&#x20;the&#x20;local&#x20;user&#x20;account&#x20;password&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;as&#x20;that&#x20;user&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfacePrevent&#x20;the&#x20;use&#x20;of&#x20;security&#x20;questions&#x20;for&#x20;local&#x20;accounts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.3\"]}]'),(26294,'Ensure&#x20;&#039;Allow&#x20;Diagnostic&#x20;Data&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;or&#x20;&#039;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;reported&#x20;to&#x20;Microsoft:&#x20;-&#x20;A&#x20;value&#x20;of&#x20;&#40;0&#41;&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;.&#x20;Using&#x20;this&#x20;value,&#x20;no&#x20;diagnostic&#x20;data&#x20;is&#x20;sent&#x20;from&#x20;the&#x20;device.&#x20;This&#x20;value&#x20;is&#x20;only&#x20;supported&#x20;on&#x20;Enterprise,&#x20;Education,&#x20;and&#x20;Server&#x20;editions.&#x20;If&#x20;you&#x20;choose&#x20;this&#x20;setting,&#x20;devices&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;still&#x20;be&#x20;secure.&#x20;-&#x20;A&#x20;value&#x20;of&#x20;&#40;1&#41;&#x20;Send&#x20;required&#x20;diagnostic&#x20;data.&#x20;This&#x20;is&#x20;the&#x20;minimum&#x20;diagnostic&#x20;data&#x20;necessary&#x20;to&#x20;keep&#x20;Windows&#x20;secure,&#x20;up&#x20;to&#x20;date,&#x20;and&#x20;performing&#x20;as&#x20;expected.&#x20;Using&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;Optional&#x20;diagnostic&#x20;data&#x20;control&#x20;in&#x20;the&#x20;Settings&#x20;app.&#x20;-&#x20;A&#x20;value&#x20;of&#x20;&#40;3&#41;Send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Additional&#x20;diagnostic&#x20;data&#x20;is&#x20;collected&#x20;that&#x20;helps&#x20;us&#x20;to&#x20;detect,&#x20;diagnose&#x20;and&#x20;fix&#x20;issues,&#x20;as&#x20;well&#x20;as&#x20;make&#x20;product&#x20;improvements.&#x20;Required&#x20;diagnostic&#x20;data&#x20;will&#x20;always&#x20;be&#x20;included&#x20;when&#x20;you&#x20;choose&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Optional&#x20;diagnostic&#x20;data&#x20;can&#x20;also&#x20;include&#x20;diagnostic&#x20;log&#x20;files&#x20;and&#x20;crash&#x20;dumps.&#x20;Use&#x20;the&#x20;Limit&#x20;Dump&#x20;Collection&#x20;and&#x20;the&#x20;Limit&#x20;&#x20;Diagnostic&#x20;Log&#x20;Collection&#x20;policies&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;of&#x20;what&#x20;optional&#x20;diagnostic&#x20;data&#x20;is&#x20;sent.&#x20;Windows&#x20;telemetry&#x20;settings&#x20;apply&#x20;to&#x20;the&#x20;Windows&#x20;operating&#x20;system&#x20;and&#x20;some&#x20;first&#x20;party&#x20;apps.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;third&#x20;party&#x20;apps&#x20;running&#x20;on&#x20;Windows&#x20;10/11.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data.&#x20;Note:&#x20;If&#x20;your&#x20;organization&#x20;relies&#x20;on&#x20;Windows&#x20;Update,&#x20;the&#x20;minimum&#x20;recommended&#x20;setting&#x20;is&#x20;Required&#x20;diagnostic&#x20;data.&#x20;Because&#x20;no&#x20;Windows&#x20;Update&#x20;information&#x20;is&#x20;collected&#x20;when&#x20;diagnostic&#x20;data&#x20;is&#x20;off,&#x20;important&#x20;information&#x20;about&#x20;update&#x20;failures&#x20;is&#x20;not&#x20;sent.&#x20;Microsoft&#x20;uses&#x20;this&#x20;information&#x20;to&#x20;fix&#x20;the&#x20;causes&#x20;of&#x20;those&#x20;failures&#x20;and&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;updates.&#x20;Note&#x20;#2:&#x20;The&#x20;Configure&#x20;diagnostic&#x20;data&#x20;opt-in&#x20;settings&#x20;user&#x20;interface&#x20;group&#x20;policy&#x20;can&#x20;be&#x20;used&#x20;to&#x20;prevent&#x20;end&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;data&#x20;collection&#x20;settings.&#x20;Note&#x20;#3:&#x20;Enhanced&#x20;diagnostic&#x20;data&#x20;setting&#x20;is&#x20;not&#x20;available&#x20;on&#x20;Windows&#x20;11&#x20;and&#x20;Windows&#x20;Server&#x20;2022&#x20;and&#x20;has&#x20;been&#x20;replaced&#x20;with&#x20;policies&#x20;that&#x20;can&#x20;control&#x20;the&#x20;amount&#x20;of&#x20;optional&#x20;diagnostic&#x20;data&#x20;that&#x20;is&#x20;sent.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;these&#x20;settings&#x20;visit&#x20;Manage&#x20;diagnostic&#x20;data&#x20;using&#x20;Group&#x20;Policy&#x20;and&#x20;MDM','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsAllow&#x20;Diagnostic&#x20;Data.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;11&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;Telemetry,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;11&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.17.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26295,'Ensure&#x20;&#039;Configure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Pr','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;can&#x20;automatically&#x20;use&#x20;an&#x20;authenticated&#x20;proxy&#x20;to&#x20;send&#x20;data&#x20;back&#x20;to&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsConfigure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26296,'Ensure&#x20;&#039;Disable&#x20;OneSettings&#x20;Downloads&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;attempts&#x20;to&#x20;connect&#x20;with&#x20;the&#x20;OneSettings&#x20;service&#x20;to&#x20;download&#x20;configuration&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as-needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDisable&#x20;OneSettings&#x20;Downloads.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.3\"]}]'),(26297,'Ensure&#x20;&#039;Do&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;prevent&#x20;its&#x20;devices&#x20;from&#x20;showing&#x20;feedback&#x20;questions&#x20;from&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;should&#x20;not&#x20;be&#x20;sending&#x20;any&#x20;feedback&#x20;to&#x20;3rd&#x20;party&#x20;vendors&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDo&#x20;not&#x20;show&#x20;feedback&#x20;notifications.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;FeedbackNotifications.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26298,'Ensure&#x20;&#039;Enable&#x20;OneSettings&#x20;Auditing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;records&#x20;attempts&#x20;to&#x20;connect&#x20;with&#x20;the&#x20;OneSettings&#x20;service&#x20;to&#x20;the&#x20;Operational&#x20;EventLog.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsEnable&#x20;OneSettings&#x20;Auditing.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(26299,'Ensure&#x20;&#039;Limit&#x20;Diagnostic&#x20;Log&#x20;Collection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;additional&#x20;diagnostic&#x20;logs&#x20;are&#x20;collected&#x20;when&#x20;more&#x20;information&#x20;is&#x20;needed&#x20;to&#x20;troubleshoot&#x20;a&#x20;problem&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Diagnostic&#x20;logs&#x20;are&#x20;only&#x20;sent&#x20;when&#x20;the&#x20;device&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Diagnostic&#x20;data&#x20;is&#x20;limited&#x20;with&#x20;recommendation&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;is&#x20;set&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data&#x20;to&#x20;send&#x20;only&#x20;basic&#x20;information.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd-party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as-needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsLimit&#x20;Diagnostic&#x20;Log&#x20;Collection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.6\"]}]'),(26300,'Ensure&#x20;&#039;Limit&#x20;Dump&#x20;Collection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;limits&#x20;the&#x20;type&#x20;of&#x20;dumps&#x20;that&#x20;can&#x20;be&#x20;collected&#x20;when&#x20;more&#x20;information&#x20;is&#x20;needed&#x20;to&#x20;troubleshoot&#x20;a&#x20;problem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Dumps&#x20;are&#x20;only&#x20;sent&#x20;when&#x20;the&#x20;device&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Diagnostic&#x20;data&#x20;is&#x20;limited&#x20;with&#x20;recommendation&#x20;Ensure&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;is&#x20;set&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data&#x20;to&#x20;send&#x20;only&#x20;basic&#x20;information.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsLimit&#x20;Dump&#x20;Collection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.7\"]}]'),(26301,'Ensure&#x20;&#039;Toggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Insider&#x20;build&#x20;controls&#x20;in&#x20;the&#x20;Advanced&#x20;Options&#x20;for&#x20;Windows&#x20;Update.&#x20;These&#x20;controls&#x20;are&#x20;located&#x20;under&#x20;&quot;Get&#x20;Insider&#x20;builds,&quot;&#x20;and&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;Windows&#x20;preview&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;only&#x20;to&#x20;devices&#x20;running&#x20;Windows&#x20;10&#x20;Pro&#x20;or&#x20;Windows&#x20;10&#x20;Enterprise,&#x20;up&#x20;until&#x20;Release&#x20;1703.&#x20;For&#x20;Release&#x20;1709&#x20;or&#x20;newer,&#x20;Microsoft&#x20;encourages&#x20;using&#x20;the&#x20;Manage&#x20;preview&#x20;builds&#x20;setting&#x20;&#40;recommendation&#x20;title&#x20;&lsquo;Manage&#x20;preview&#x20;builds&rsquo;&#41;.&#x20;We&#x20;have&#x20;kept&#x20;this&#x20;setting&#x20;in&#x20;the&#x20;benchmark&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;older&#x20;builds&#x20;of&#x20;Windows&#x20;10&#x20;in&#x20;the&#x20;environment&#x20;are&#x20;still&#x20;enforced.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsToggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AllowBuildPreview.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.8\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26302,'Ensure&#x20;&#039;Download&#x20;Mode&#039;&#x20;is&#x20;NOT&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Internet&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;download&#x20;method&#x20;that&#x20;Delivery&#x20;Optimization&#x20;can&#x20;use&#x20;in&#x20;downloads&#x20;of&#x20;Windows&#x20;Updates,&#x20;Apps&#x20;and&#x20;App&#x20;updates.&#x20;The&#x20;following&#x20;methods&#x20;are&#x20;supported:&#x20;-&#x20;0&#x20;=&#x20;HTTP&#x20;only,&#x20;no&#x20;peering.&#x20;-&#x20;1&#x20;=&#x20;HTTP&#x20;blended&#x20;with&#x20;peering&#x20;behind&#x20;the&#x20;same&#x20;NAT.&#x20;-&#x20;2&#x20;=&#x20;HTTP&#x20;blended&#x20;with&#x20;peering&#x20;across&#x20;a&#x20;private&#x20;group.&#x20;Peering&#x20;occurs&#x20;on&#x20;devices&#x20;in&#x20;the&#x20;same&#x20;Active&#x20;Directory&#x20;Site&#x20;&#40;if&#x20;exist&#41;&#x20;or&#x20;the&#x20;same&#x20;domain&#x20;by&#x20;default.&#x20;When&#x20;this&#x20;option&#x20;is&#x20;selected,&#x20;peering&#x20;will&#x20;cross&#x20;NATs.&#x20;To&#x20;create&#x20;a&#x20;custom&#x20;group&#x20;use&#x20;Group&#x20;ID&#x20;in&#x20;combination&#x20;with&#x20;Mode&#x20;2.&#x20;-&#x20;3&#x20;=&#x20;HTTP&#x20;blended&#x20;with&#x20;Internet&#x20;Peering.&#x20;-&#x20;99&#x20;=&#x20;Simple&#x20;download&#x20;mode&#x20;with&#x20;no&#x20;peering.&#x20;Delivery&#x20;Optimization&#x20;downloads&#x20;using&#x20;HTTP&#x20;only&#x20;and&#x20;does&#x20;not&#x20;attempt&#x20;to&#x20;contact&#x20;the&#x20;Delivery&#x20;Optimization&#x20;cloud&#x20;services.&#x20;-&#x20;100&#x20;=&#x20;Bypass&#x20;mode.&#x20;Do&#x20;not&#x20;use&#x20;Delivery&#x20;Optimization&#x20;and&#x20;use&#x20;BITS&#x20;instead.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;any&#x20;value&#x20;EXCEPT:&#x20;Enabled:&#x20;Internet&#x20;&#40;3&#41;.&#x20;Note:&#x20;The&#x20;default&#x20;on&#x20;all&#x20;SKUs&#x20;other&#x20;than&#x20;Enterprise,&#x20;Enterprise&#x20;LTSB&#x20;or&#x20;Education&#x20;is&#x20;Enabled:&#x20;Internet&#x20;&#40;3&#41;,&#x20;so&#x20;on&#x20;other&#x20;SKUs,&#x20;be&#x20;sure&#x20;to&#x20;set&#x20;this&#x20;to&#x20;a&#x20;different&#x20;value.','Due&#x20;to&#x20;privacy&#x20;concerns&#x20;and&#x20;security&#x20;risks,&#x20;updates&#x20;should&#x20;only&#x20;be&#x20;downloaded&#x20;directly&#x20;from&#x20;Microsoft,&#x20;or&#x20;from&#x20;a&#x20;trusted&#x20;machine&#x20;on&#x20;the&#x20;internal&#x20;network&#x20;that&#x20;received&#x20;its&#x20;updates&#x20;from&#x20;a&#x20;trusted&#x20;source&#x20;and&#x20;approved&#x20;by&#x20;the&#x20;network&#x20;administrator.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;any&#x20;value&#x20;other&#x20;than&#x20;Enabled:&#x20;Internet&#x20;&#40;3&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsDelivery&#x20;OptimizationDownload&#x20;Mode.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeliveryOptimization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.18.1\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(26303,'Ensure&#x20;&#039;Application:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.1.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26304,'Ensure&#x20;&#039;Application:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.1.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26305,'Ensure&#x20;&#039;Security:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecurityControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.2.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26306,'Ensure&#x20;&#039;Security:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;196,608&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecuritySpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.2.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26307,'Ensure&#x20;&#039;Setup:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.3.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26308,'Ensure&#x20;&#039;Setup:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.3.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26309,'Ensure&#x20;&#039;System:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.4.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26310,'Ensure&#x20;&#039;System:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.4.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26311,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Disabling&#x20;Data&#x20;Execution&#x20;Prevention&#x20;can&#x20;allow&#x20;certain&#x20;legacy&#x20;plug-in&#x20;applications&#x20;to&#x20;function&#x20;without&#x20;terminating&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;legacy&#x20;plug-in&#x20;applications&#x20;and&#x20;other&#x20;software&#x20;may&#x20;not&#x20;function&#x20;with&#x20;Data&#x20;Execution&#x20;Prevention&#x20;and&#x20;will&#x20;require&#x20;an&#x20;exception&#x20;to&#x20;be&#x20;defined&#x20;for&#x20;that&#x20;specific&#x20;plug-&#x20;in/software.','Data&#x20;Execution&#x20;Prevention&#x20;is&#x20;an&#x20;important&#x20;security&#x20;feature&#x20;supported&#x20;by&#x20;Explorer&#x20;that&#x20;helps&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;of&#x20;certain&#x20;types&#x20;of&#x20;malware.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.31.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(26312,'Ensure&#x20;&#039;Turn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Without&#x20;heap&#x20;termination&#x20;on&#x20;corruption,&#x20;legacy&#x20;plug-in&#x20;applications&#x20;may&#x20;continue&#x20;to&#x20;function&#x20;when&#x20;a&#x20;File&#x20;Explorer&#x20;session&#x20;has&#x20;become&#x20;corrupt.&#x20;Ensuring&#x20;that&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#x20;is&#x20;active&#x20;will&#x20;prevent&#x20;this.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Allowing&#x20;an&#x20;application&#x20;to&#x20;function&#x20;after&#x20;its&#x20;session&#x20;has&#x20;become&#x20;corrupt&#x20;increases&#x20;the&#x20;risk&#x20;posture&#x20;to&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.31.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26313,'Ensure&#x20;&#039;Turn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.31.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26314,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;computer&#x20;from&#x20;joining&#x20;a&#x20;homegroup&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','By&#x20;default,&#x20;users&#x20;can&#x20;add&#x20;their&#x20;computer&#x20;to&#x20;a&#x20;HomeGroup&#x20;on&#x20;a&#x20;home&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;HomeGroup&#x20;feature&#x20;is&#x20;available&#x20;in&#x20;all&#x20;workstation&#x20;releases&#x20;of&#x20;Windows&#x20;from&#x20;Windows&#x20;7&#x20;through&#x20;Windows&#x20;10&#x20;Release&#x20;1709.&#x20;Microsoft&#x20;removed&#x20;the&#x20;feature&#x20;completely&#x20;starting&#x20;with&#x20;Windows&#x20;10&#x20;Release&#x20;1803.&#x20;However,&#x20;if&#x20;your&#x20;environment&#x20;still&#x20;contains&#x20;any&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;&#40;or&#x20;older&#41;&#x20;workstations,&#x20;then&#x20;this&#x20;setting&#x20;remains&#x20;important&#x20;to&#x20;disable&#x20;HomeGroup&#x20;on&#x20;those&#x20;systems.','While&#x20;resources&#x20;on&#x20;a&#x20;domain-joined&#x20;computer&#x20;cannot&#x20;be&#x20;shared&#x20;with&#x20;a&#x20;HomeGroup,&#x20;information&#x20;from&#x20;the&#x20;domain-joined&#x20;computer&#x20;can&#x20;be&#x20;leaked&#x20;to&#x20;other&#x20;computers&#x20;in&#x20;the&#x20;HomeGroup.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsHomeGroupPrevent&#x20;the&#x20;computer&#x20;from&#x20;joining&#x20;a&#x20;homegroup.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sharing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.36.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26315,'Ensure&#x20;&#039;Turn&#x20;off&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;location&#x20;feature&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&#039;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsTurn&#x20;off&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sensors.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.41.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26316,'Ensure&#x20;&#039;Allow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;backup&#x20;and&#x20;restore&#x20;of&#x20;cellular&#x20;text&#x20;messages&#x20;to&#x20;Microsoft&#039;s&#x20;cloud&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMessagingAllow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Messaging.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.45.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26317,'Ensure&#x20;&#039;Block&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;applications&#x20;and&#x20;services&#x20;on&#x20;the&#x20;device&#x20;can&#x20;utilize&#x20;new&#x20;consumer&#x20;Microsoft&#x20;account&#x20;authentication&#x20;via&#x20;the&#x20;Windows&#x20;OnlineID&#x20;and&#x20;WebAccountManager&#x20;APIs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;on&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;accountsBlock&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSAPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.46.1\"]}, {\"cis_csc\": [\"5.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26318,'Ensure&#x20;&#039;Configure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;a&#x20;local&#x20;override&#x20;for&#x20;the&#x20;configuration&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;and&#x20;then&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service.&#x20;This&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;set&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;decision&#x20;on&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;participate&#x20;in&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;for&#x20;malicious&#x20;software&#x20;reporting&#x20;should&#x20;be&#x20;made&#x20;centrally&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;so&#x20;that&#x20;all&#x20;computers&#x20;within&#x20;it&#x20;behave&#x20;consistently&#x20;in&#x20;that&#x20;regard.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Disabled&#x20;ensures&#x20;that&#x20;the&#x20;decision&#x20;remains&#x20;centrally&#x20;managed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMAPSConfigure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.4.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26319,'Ensure&#x20;&#039;Join&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;and&#x20;then&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service.&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;is&#x20;the&#x20;online&#x20;community&#x20;that&#x20;helps&#x20;you&#x20;choose&#x20;how&#x20;to&#x20;respond&#x20;to&#x20;potential&#x20;threats.&#x20;The&#x20;community&#x20;also&#x20;helps&#x20;stop&#x20;the&#x20;spread&#x20;of&#x20;new&#x20;malicious&#x20;software&#x20;infections.&#x20;You&#x20;can&#x20;choose&#x20;to&#x20;send&#x20;basic&#x20;or&#x20;additional&#x20;information&#x20;about&#x20;detected&#x20;software.&#x20;Additional&#x20;information&#x20;helps&#x20;Microsoft&#x20;create&#x20;new&#x20;definitions&#x20;and&#x20;help&#x20;it&#x20;to&#x20;protect&#x20;your&#x20;computer.&#x20;Possible&#x20;options&#x20;are:&#x20;-&#x20;&#40;0x0&#41;&#x20;Disabled&#x20;&#40;default&#41;&#x20;-&#x20;&#40;0x1&#41;&#x20;Basic&#x20;membership&#x20;-&#x20;&#40;0x2&#41;&#x20;Advanced&#x20;membership&#x20;Basic&#x20;membership&#x20;will&#x20;send&#x20;basic&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;software&#x20;that&#x20;has&#x20;been&#x20;detected&#x20;including&#x20;where&#x20;the&#x20;software&#x20;came&#x20;from&#x20;the&#x20;actions&#x20;that&#x20;you&#x20;apply&#x20;or&#x20;that&#x20;are&#x20;applied&#x20;automatically&#x20;and&#x20;whether&#x20;the&#x20;actions&#x20;were&#x20;successful.&#x20;Advanced&#x20;membership&#x20;in&#x20;addition&#x20;to&#x20;basic&#x20;information&#x20;will&#x20;send&#x20;more&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;malicious&#x20;software&#x20;spyware&#x20;and&#x20;potentially&#x20;unwanted&#x20;software&#x20;including&#x20;the&#x20;location&#x20;of&#x20;the&#x20;software&#x20;file&#x20;names&#x20;how&#x20;the&#x20;software&#x20;operates&#x20;and&#x20;how&#x20;it&#x20;has&#x20;impacted&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;information&#x20;that&#x20;would&#x20;be&#x20;sent&#x20;can&#x20;include&#x20;things&#x20;like&#x20;location&#x20;of&#x20;detected&#x20;items&#x20;on&#x20;your&#x20;computer&#x20;if&#x20;harmful&#x20;software&#x20;was&#x20;removed.&#x20;The&#x20;information&#x20;would&#x20;be&#x20;automatically&#x20;collected&#x20;and&#x20;sent.&#x20;In&#x20;some&#x20;instances&#x20;personal&#x20;information&#x20;might&#x20;unintentionally&#x20;be&#x20;sent&#x20;to&#x20;Microsoft.&#x20;However,&#x20;Microsoft&#x20;states&#x20;that&#x20;it&#x20;will&#x20;not&#x20;use&#x20;this&#x20;information&#x20;to&#x20;identify&#x20;you&#x20;or&#x20;contact&#x20;you.&#x20;For&#x20;privacy&#x20;reasons&#x20;in&#x20;high&#x20;security&#x20;environments,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;prevent&#x20;these&#x20;data&#x20;submissions&#x20;altogether.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMAPSJoin&#x20;Microsoft&#x20;MAPS.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.4.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26320,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;state&#x20;for&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;&#40;ASR&#41;&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26321,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules:&#x20;Set&#x20;the&#x20;state&#x20;for&#x20;each&#x20;ASR&#x20;rule&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;26190899-1602-49e8-8b27-eb1d0a1ce869&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;communication&#x20;application&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;3b576869-a4ec-4529-8536-b80a7769e899&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;creating&#x20;executable&#x20;content&#41;&#x20;5beb7efe-fd9a-4556-801d-275e5ffc04cc&#x20;-&#x20;1&#x20;&#40;Block&#x20;execution&#x20;of&#x20;potentially&#x20;obfuscated&#x20;scripts&#41;&#x20;75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;injecting&#x20;code&#x20;into&#x20;other&#x20;processes&#41;&#x20;7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c&#x20;-&#x20;1&#x20;&#40;Block&#x20;Adobe&#x20;Reader&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b&#x20;-&#x20;1&#x20;&#40;Block&#x20;Win32&#x20;API&#x20;calls&#x20;from&#x20;Office&#x20;macro&#41;&#x20;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2&#x20;-&#x20;1&#x20;&#40;Block&#x20;credential&#x20;stealing&#x20;from&#x20;the&#x20;Windows&#x20;local&#x20;security&#x20;authority&#x20;subsystem&#x20;&#40;lsass.exe&#41;&#41;&#x20;b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4&#x20;-&#x20;1&#x20;&#40;Block&#x20;untrusted&#x20;and&#x20;unsigned&#x20;processes&#x20;that&#x20;run&#x20;from&#x20;USB&#41;&#x20;be9ba2d9-53ea-4cdc-84e5-9b1eeee46550&#x20;-&#x20;1&#x20;&#40;Block&#x20;executable&#x20;content&#x20;from&#x20;email&#x20;client&#x20;and&#x20;webmail&#41;&#x20;d3e037e1-3eb8-44c8-a917-57927947596d&#x20;-&#x20;1&#x20;&#40;Block&#x20;JavaScript&#x20;or&#x20;VBScript&#x20;from&#x20;launching&#x20;downloaded&#x20;executable&#x20;content&#41;&#x20;d4f940ab-401b-4efc-aadc-ad5f3c50688a&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;e6db77e5-3df2-4cf1-b95a-636979351e5b&#x20;-&#x20;1&#x20;&#40;Block&#x20;persistence&#x20;through&#x20;WMI&#x20;event&#x20;subscription&#41;&#x20;Note:&#x20;More&#x20;information&#x20;on&#x20;ASR&#x20;rules&#x20;can&#x20;be&#x20;found&#x20;at&#x20;the&#x20;following&#x20;link:&#x20;Use&#x20;Attack&#x20;surface&#x20;reduction&#x20;rules&#x20;to&#x20;prevent&#x20;malware&#x20;infection&#x20;|&#x20;Microsoft&#x20;Docs','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;so&#x20;that&#x20;26190899-1602-49e8-8b27-eb1d0a1ce869,&#x20;3b576869-a4ec-4529-8536-b80a7769e899,&#x20;5beb7efe-fd9a-4556-801d-275e5ffc04cc,&#x20;75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,&#x20;7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,&#x20;92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,&#x20;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,&#x20;b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,&#x20;be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,&#x20;d3e037e1-3eb8-44c8-a917-57927947596d,&#x20;d4f940ab-401b-4efc-aadc-ad5f3c50688a,&#x20;and&#x20;e6db77e5-3df2-4cf1-b95a-636979351e5b&#x20;are&#x20;each&#x20;set&#x20;to&#x20;a&#x20;value&#x20;of&#x20;1:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules:&#x20;Set&#x20;the&#x20;state&#x20;for&#x20;each&#x20;ASR&#x20;rule.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.1.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26322,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Microsoft&#x20;Defender&#x20;Exploit&#x20;Guard&#x20;network&#x20;protection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block.','This&#x20;setting&#x20;can&#x20;help&#x20;prevent&#x20;employees&#x20;from&#x20;using&#x20;any&#x20;application&#x20;to&#x20;access&#x20;dangerous&#x20;domains&#x20;that&#x20;may&#x20;host&#x20;phishing&#x20;scams,&#x20;exploit-hosting&#x20;sites,&#x20;and&#x20;other&#x20;malicious&#x20;content&#x20;on&#x20;the&#x20;Internet.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;AntivirusWindows&#x20;Defender&#x20;Exploit&#x20;GuardNetwork&#x20;ProtectionPrevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.3.1\"]}, {\"cis_csc\": [\"9.3\", \"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26323,'Ensure&#x20;&#039;Enable&#x20;file&#x20;hash&#x20;computation&#x20;feature&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;hash&#x20;values&#x20;are&#x20;computed&#x20;for&#x20;files&#x20;scanned&#x20;by&#x20;Microsoft&#x20;Defender.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;monitor&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.&#x20;File&#x20;hashes&#x20;are&#x20;a&#x20;reliable&#x20;way&#x20;of&#x20;detecting&#x20;changes&#x20;to&#x20;files,&#x20;and&#x20;can&#x20;speed&#x20;up&#x20;the&#x20;scan&#x20;process&#x20;by&#x20;skipping&#x20;files&#x20;that&#x20;have&#x20;not&#x20;changed&#x20;since&#x20;they&#x20;were&#x20;last&#x20;scanned&#x20;and&#x20;determined&#x20;to&#x20;be&#x20;safe.&#x20;A&#x20;changed&#x20;file&#x20;hash&#x20;can&#x20;also&#x20;be&#x20;cause&#x20;for&#x20;additional&#x20;scrutiny.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMpEngineEnable&#x20;file&#x20;hash&#x20;computation&#x20;feature.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.6.1\"]}, {\"cis_csc\": [\"10.1\"]}]'),(26324,'Ensure&#x20;&#039;Scan&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;scanning&#x20;for&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionScan&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.1\"]}]'),(26325,'Ensure&#x20;&#039;Turn&#x20;off&#x20;real-time&#x20;protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;real-time&#x20;protection&#x20;prompts&#x20;for&#x20;known&#x20;malware&#x20;detection.&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;alerts&#x20;you&#x20;when&#x20;malware&#x20;or&#x20;potentially&#x20;unwanted&#x20;software&#x20;attempts&#x20;to&#x20;install&#x20;itself&#x20;or&#x20;to&#x20;run&#x20;on&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;off&#x20;real-time&#x20;protection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.2\"]}]'),(26326,'Ensure&#x20;&#039;Turn&#x20;on&#x20;behavior&#x20;monitoring&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;behavior&#x20;monitoring&#x20;for&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;behavior&#x20;monitoring.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.3\"]}, {\"cis_csc\": [\"10.7\"]}]'),(26327,'Ensure&#x20;&#039;Turn&#x20;on&#x20;script&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;script&#x20;scanning&#x20;to&#x20;be&#x20;turned&#x20;on/off.&#x20;Script&#x20;scanning&#x20;intercepts&#x20;scripts&#x20;then&#x20;scans&#x20;them&#x20;before&#x20;they&#x20;are&#x20;executed&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;script&#x20;scanning.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.4\"]}, {\"cis_csc\": [\"10.7\"]}]'),(26328,'Ensure&#x20;&#039;Configure&#x20;Watson&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;whether&#x20;or&#x20;not&#x20;Watson&#x20;events&#x20;are&#x20;sent.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Watson&#x20;events&#x20;are&#x20;the&#x20;reports&#x20;that&#x20;get&#x20;sent&#x20;to&#x20;Microsoft&#x20;when&#x20;a&#x20;program&#x20;or&#x20;service&#x20;crashes&#x20;or&#x20;fails,&#x20;including&#x20;the&#x20;possibility&#x20;of&#x20;automatic&#x20;submission.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReportingConfigure&#x20;Watson&#x20;events.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.11.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26329,'Ensure&#x20;&#039;Scan&#x20;removable&#x20;drives&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;scan&#x20;for&#x20;malicious&#x20;software&#x20;and&#x20;unwanted&#x20;software&#x20;in&#x20;the&#x20;contents&#x20;of&#x20;removable&#x20;drives,&#x20;such&#x20;as&#x20;USB&#x20;flash&#x20;drives,&#x20;when&#x20;running&#x20;a&#x20;full&#x20;scan.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;present&#x20;removable&#x20;drives&#x20;are&#x20;always&#x20;included&#x20;in&#x20;any&#x20;type&#x20;of&#x20;scan,&#x20;as&#x20;removable&#x20;drives&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;contain&#x20;malicious&#x20;software&#x20;brought&#x20;in&#x20;to&#x20;the&#x20;enterprise&#x20;managed&#x20;environment&#x20;from&#x20;an&#x20;external,&#x20;unmanaged&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusScanScan&#x20;removable&#x20;drives.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.12.1\"]}, {\"cis_csc\": [\"10.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26330,'Ensure&#x20;&#039;Turn&#x20;on&#x20;e-mail&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;e-mail&#x20;scanning.&#x20;When&#x20;e-mail&#x20;scanning&#x20;is&#x20;enabled,&#x20;the&#x20;engine&#x20;will&#x20;parse&#x20;the&#x20;mailbox&#x20;and&#x20;mail&#x20;files,&#x20;according&#x20;to&#x20;their&#x20;specific&#x20;format,&#x20;in&#x20;order&#x20;to&#x20;analyze&#x20;the&#x20;mail&#x20;bodies&#x20;and&#x20;attachments.&#x20;Several&#x20;e-mail&#x20;formats&#x20;are&#x20;currently&#x20;supported,&#x20;for&#x20;example:&#x20;pst&#x20;&#40;Outlook&#41;,&#x20;dbx,&#x20;mbx,&#x20;mime&#x20;&#40;Outlook&#x20;Express&#41;,&#x20;binhex&#x20;&#40;Mac&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Incoming&#x20;e-mails&#x20;should&#x20;be&#x20;scanned&#x20;by&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;as&#x20;email&#x20;attachments&#x20;are&#x20;a&#x20;commonly&#x20;used&#x20;attack&#x20;vector&#x20;to&#x20;infiltrate&#x20;computers&#x20;with&#x20;malicious&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusScanTurn&#x20;on&#x20;e-mail&#x20;scanning.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.12.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26331,'Ensure&#x20;&#039;Configure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;detection&#x20;and&#x20;action&#x20;for&#x20;Potentially&#x20;Unwanted&#x20;Applications&#x20;&#40;PUA&#41;,&#x20;which&#x20;are&#x20;sneaky&#x20;unwanted&#x20;application&#x20;bundlers&#x20;or&#x20;their&#x20;bundled&#x20;applications,&#x20;that&#x20;can&#x20;deliver&#x20;adware&#x20;or&#x20;malware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block.&#x20;For&#x20;more&#x20;information,&#x20;see&#x20;this&#x20;link:&#x20;Block&#x20;potentially&#x20;unwanted&#x20;applications&#x20;with&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;|&#x20;Microsoft&#x20;Docs','Potentially&#x20;unwanted&#x20;applications&#x20;can&#x20;increase&#x20;the&#x20;risk&#x20;of&#x20;your&#x20;network&#x20;being&#x20;infected&#x20;with&#x20;malware,&#x20;cause&#x20;malware&#x20;infections&#x20;to&#x20;be&#x20;harder&#x20;to&#x20;identify,&#x20;and&#x20;can&#x20;waste&#x20;IT&#x20;resources&#x20;in&#x20;cleaning&#x20;up&#x20;the&#x20;applications.&#x20;They&#x20;should&#x20;be&#x20;blocked&#x20;from&#x20;installation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusConfigure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.15\"]}, {\"cis_csc\": [\"2.5\", \"10.6\"]}]'),(26332,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;AntiVirus&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;If&#x20;the&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;Disabled,&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;runs&#x20;and&#x20;computers&#x20;are&#x20;scanned&#x20;for&#x20;malware&#x20;and&#x20;other&#x20;potentially&#x20;unwanted&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;current,&#x20;updated&#x20;antivirus&#x20;product&#x20;is&#x20;scanning&#x20;each&#x20;computer&#x20;for&#x20;malicious&#x20;file&#x20;activity.&#x20;Microsoft&#x20;provides&#x20;a&#x20;competent&#x20;solution&#x20;out&#x20;of&#x20;the&#x20;box&#x20;in&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;Organizations&#x20;that&#x20;choose&#x20;to&#x20;purchase&#x20;a&#x20;reputable&#x20;3rd-party&#x20;antivirus&#x20;solution&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;in&#x20;lieu&#x20;of&#x20;the&#x20;commercial&#x20;alternative.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusTurn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;AntiVirus.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;off&#x20;Windows&#x20;Defender,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;again&#x20;renamed&#x20;to&#x20;Turn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.47.16\"]}, {\"cis_csc\": [\"10.6\"]}]'),(26333,'Ensure&#x20;&#039;Enable&#x20;news&#x20;and&#x20;interests&#x20;on&#x20;the&#x20;taskbar&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;news&#x20;and&#x20;interests&#x20;feature&#x20;is&#x20;allowed&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;apps&#x20;and&#x20;features&#x20;such&#x20;as&#x20;news&#x20;and&#x20;interests&#x20;on&#x20;the&#x20;Windows&#x20;taskbar&#x20;should&#x20;be&#x20;treated&#x20;as&#x20;a&#x20;possible&#x20;security&#x20;risk&#x20;due&#x20;to&#x20;the&#x20;potential&#x20;of&#x20;data&#x20;being&#x20;sent&#x20;back&#x20;to&#x20;3rd&#x20;parties,&#x20;such&#x20;as&#x20;Microsoft.&#x20;In&#x20;addition,&#x20;the&#x20;app&#x20;may&#x20;display&#x20;inappropriate&#x20;news&#x20;and&#x20;interests&#x20;within&#x20;the&#x20;feed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsNews&#x20;and&#x20;interestsEnable&#x20;news&#x20;and&#x20;interests&#x20;on&#x20;the&#x20;taskbar.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Feeds.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H1&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.57.1\"]}]'),(26334,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;&#40;or&#x20;intentionally&#41;&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;cloud-based&#x20;file&#x20;storage&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;workstation,&#x20;not&#x20;just&#x20;the&#x20;one&#x20;supplied&#x20;with&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;However,&#x20;we&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;the&#x20;version&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Prevent&#x20;the&#x20;usage&#x20;of&#x20;SkyDrive&#x20;for&#x20;file&#x20;storage,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26335,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Push&#x20;To&#x20;Install&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;can&#x20;push&#x20;Apps&#x20;to&#x20;the&#x20;device&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;App&#x20;running&#x20;on&#x20;other&#x20;devices&#x20;or&#x20;the&#x20;web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;high&#x20;security&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsPush&#x20;to&#x20;InstallTurn&#x20;off&#x20;Push&#x20;To&#x20;Install&#x20;service.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PushToInstall.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.64.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26336,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;helps&#x20;prevent&#x20;Remote&#x20;Desktop&#x20;clients&#x20;from&#x20;saving&#x20;passwords&#x20;on&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;was&#x20;previously&#x20;configured&#x20;as&#x20;Disabled&#x20;or&#x20;Not&#x20;configured,&#x20;any&#x20;previously&#x20;saved&#x20;passwords&#x20;will&#x20;be&#x20;deleted&#x20;the&#x20;first&#x20;time&#x20;a&#x20;Remote&#x20;Desktop&#x20;client&#x20;disconnects&#x20;from&#x20;any&#x20;server.','An&#x20;attacker&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;may&#x20;be&#x20;able&#x20;to&#x20;break&#x20;the&#x20;protection&#x20;guarding&#x20;saved&#x20;passwords.&#x20;An&#x20;attacker&#x20;who&#x20;compromises&#x20;a&#x20;user&#039;s&#x20;account&#x20;and&#x20;connects&#x20;to&#x20;their&#x20;computer&#x20;could&#x20;use&#x20;saved&#x20;passwords&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;additional&#x20;hosts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Connection&#x20;ClientDo&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.2.2\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(26337,'Ensure&#x20;&#039;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;remote&#x20;access&#x20;to&#x20;computers&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;account&#x20;with&#x20;the&#x20;Allow&#x20;log&#x20;on&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#x20;user&#x20;right&#x20;can&#x20;log&#x20;on&#x20;to&#x20;the&#x20;remote&#x20;console&#x20;of&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;restrict&#x20;access&#x20;to&#x20;legitimate&#x20;users&#x20;who&#x20;need&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;console&#x20;of&#x20;the&#x20;computer,&#x20;unauthorized&#x20;users&#x20;could&#x20;download&#x20;and&#x20;execute&#x20;malicious&#x20;code&#x20;to&#x20;elevate&#x20;their&#x20;privileges.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostConnectionsAllow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;using&#x20;Terminal&#x20;Services,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services&#x20;in&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;finally&#x20;renamed&#x20;&#40;again&#41;&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;connect&#x20;remotely&#x20;by&#x20;using&#x20;Remote&#x20;Desktop&#x20;Services&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.2.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26338,'Ensure&#x20;&#039;Allow&#x20;UI&#x20;Automation&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;User&#x20;Interface&#x20;&#40;UI&#41;&#x20;Automation&#x20;client&#x20;applications&#x20;running&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;can&#x20;access&#x20;UI&#x20;elements&#x20;on&#x20;the&#x20;server.&#x20;UI&#x20;Automation&#x20;gives&#x20;programs&#x20;access&#x20;to&#x20;most&#x20;UI&#x20;elements,&#x20;which&#x20;allows&#x20;use&#x20;of&#x20;assistive&#x20;technology&#x20;products&#x20;like&#x20;Magnifier&#x20;and&#x20;Narrator&#x20;that&#x20;need&#x20;to&#x20;interact&#x20;with&#x20;the&#x20;UI&#x20;in&#x20;order&#x20;to&#x20;work&#x20;properly.&#x20;UI&#x20;information&#x20;also&#x20;allows&#x20;automated&#x20;test&#x20;scripts&#x20;to&#x20;interact&#x20;with&#x20;the&#x20;UI.&#x20;For&#x20;example,&#x20;the&#x20;local&#x20;computer&#039;s&#x20;Narrator&#x20;and&#x20;Magnifier&#x20;clients&#x20;can&#x20;be&#x20;used&#x20;to&#x20;interact&#x20;with&#x20;UI&#x20;on&#x20;a&#x20;web&#x20;page&#x20;opened&#x20;in&#x20;a&#x20;remote&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;don&#039;t&#x20;currently&#x20;support&#x20;UI&#x20;Automation&#x20;redirection.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;UI&#x20;Automation&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;rare,&#x20;and&#x20;not&#x20;supported&#x20;at&#x20;this&#x20;time,&#x20;but&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;malicious&#x20;activity&#x20;to&#x20;occur.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionAllow&#x20;UI&#x20;Automation&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.3.3.1\"]}]');
INSERT INTO `tsca` VALUES (26339,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;COM&#x20;ports&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;COM&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26340,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;sharing&#x20;the&#x20;local&#x20;drives&#x20;on&#x20;their&#x20;client&#x20;computers&#x20;to&#x20;Remote&#x20;Desktop&#x20;Servers&#x20;that&#x20;they&#x20;access.&#x20;Mapped&#x20;drives&#x20;appear&#x20;in&#x20;the&#x20;session&#x20;folder&#x20;tree&#x20;in&#x20;Windows&#x20;Explorer&#x20;in&#x20;the&#x20;following&#x20;format:&#x20;&#92;TSClient&lt;driveletter&gt;$&#x20;If&#x20;local&#x20;drives&#x20;are&#x20;shared&#x20;they&#x20;are&#x20;left&#x20;vulnerable&#x20;to&#x20;intruders&#x20;who&#x20;want&#x20;to&#x20;exploit&#x20;the&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Data&#x20;could&#x20;be&#x20;forwarded&#x20;from&#x20;the&#x20;user&#039;s&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;without&#x20;any&#x20;direct&#x20;user&#x20;interaction.&#x20;Malicious&#x20;software&#x20;already&#x20;present&#x20;on&#x20;a&#x20;compromised&#x20;server&#x20;would&#x20;have&#x20;direct&#x20;and&#x20;stealthy&#x20;disk&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;drive&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26341,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;location&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;redirection&#x20;of&#x20;location&#x20;data&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;location&#x20;data&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;rare,&#x20;so&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;malicious&#x20;activity&#x20;to&#x20;occur.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;location&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.3.3.4\"]}]'),(26342,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;LPT&#x20;ports&#x20;during&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;LPT&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26343,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;redirection&#x20;of&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;devices,&#x20;such&#x20;as&#x20;Windows&#x20;Portable&#x20;Devices,&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.6\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26344,'Ensure&#x20;&#039;Always&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;always&#x20;prompts&#x20;the&#x20;client&#x20;computer&#x20;for&#x20;a&#x20;password&#x20;upon&#x20;connection.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enforce&#x20;a&#x20;password&#x20;prompt&#x20;for&#x20;users&#x20;who&#x20;log&#x20;on&#x20;to&#x20;Remote&#x20;Desktop&#x20;Services,&#x20;even&#x20;if&#x20;they&#x20;already&#x20;provided&#x20;the&#x20;password&#x20;in&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;have&#x20;the&#x20;option&#x20;to&#x20;store&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;when&#x20;they&#x20;create&#x20;a&#x20;new&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut.&#x20;If&#x20;the&#x20;server&#x20;that&#x20;runs&#x20;Remote&#x20;Desktop&#x20;Services&#x20;allows&#x20;users&#x20;who&#x20;have&#x20;used&#x20;this&#x20;feature&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;server&#x20;but&#x20;not&#x20;enter&#x20;their&#x20;password,&#x20;then&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer&#x20;could&#x20;connect&#x20;to&#x20;a&#x20;Remote&#x20;Desktop&#x20;Server&#x20;through&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut,&#x20;even&#x20;though&#x20;they&#x20;may&#x20;not&#x20;know&#x20;the&#x20;user&#039;s&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityAlways&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Always&#x20;prompt&#x20;client&#x20;for&#x20;password&#x20;upon&#x20;connection,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26345,'Ensure&#x20;&#039;Require&#x20;secure&#x20;RPC&#x20;communication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;requires&#x20;secure&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;communication&#x20;with&#x20;all&#x20;clients&#x20;or&#x20;allows&#x20;unsecured&#x20;communication.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;strengthen&#x20;the&#x20;security&#x20;of&#x20;RPC&#x20;communication&#x20;with&#x20;clients&#x20;by&#x20;allowing&#x20;only&#x20;authenticated&#x20;and&#x20;encrypted&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;unsecure&#x20;RPC&#x20;communication&#x20;can&#x20;exposes&#x20;the&#x20;server&#x20;to&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks&#x20;and&#x20;data&#x20;disclosure&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;secure&#x20;RPC&#x20;communication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.2\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26346,'Ensure&#x20;&#039;Require&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;SSL&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;security&#x20;layer&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;SSL.&#x20;Note:&#x20;In&#x20;spite&#x20;of&#x20;this&#x20;setting&#x20;being&#x20;labeled&#x20;SSL,&#x20;it&#x20;is&#x20;actually&#x20;enforcing&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;version&#x20;1.0,&#x20;not&#x20;the&#x20;older&#x20;&#40;and&#x20;less&#x20;secure&#41;&#x20;SSL&#x20;protocol.','The&#x20;native&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;encryption&#x20;is&#x20;now&#x20;considered&#x20;a&#x20;weak&#x20;protocol,&#x20;so&#x20;enforcing&#x20;the&#x20;use&#x20;of&#x20;stronger&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;encryption&#x20;for&#x20;all&#x20;RDP&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;is&#x20;preferred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;SSL:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.3\"]}, {\"cis_csc\": [\"3.10\"]}]'),(26347,'Ensure&#x20;&#039;Require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;to&#x20;require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;to&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Requiring&#x20;that&#x20;user&#x20;authentication&#x20;occur&#x20;earlier&#x20;in&#x20;the&#x20;remote&#x20;connection&#x20;process&#x20;enhances&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Require&#x20;user&#x20;authentication&#x20;using&#x20;RDP&#x20;6.0&#x20;for&#x20;remote&#x20;connections,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.4\"]}, {\"cis_csc\": [\"3.10\"]}]'),(26348,'Ensure&#x20;&#039;Set&#x20;client&#x20;connection&#x20;encryption&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;High&#x20;Level&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;encryption&#x20;level&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;client&#x20;computers&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;This&#x20;policy&#x20;only&#x20;applies&#x20;when&#x20;you&#x20;are&#x20;using&#x20;native&#x20;RDP&#x20;encryption.&#x20;However,&#x20;native&#x20;RDP&#x20;encryption&#x20;&#40;as&#x20;opposed&#x20;to&#x20;SSL&#x20;encryption&#41;&#x20;is&#x20;not&#x20;recommended.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;SSL&#x20;encryption.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;High&#x20;Level.','If&#x20;Remote&#x20;Desktop&#x20;client&#x20;connections&#x20;that&#x20;use&#x20;low&#x20;level&#x20;encryption&#x20;are&#x20;allowed,&#x20;it&#x20;is&#x20;more&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;any&#x20;captured&#x20;Remote&#x20;Desktop&#x20;Services&#x20;network&#x20;traffic.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.5\"]}, {\"cis_csc\": [\"3.10\"]}]'),(26349,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;time&#x20;that&#x20;an&#x20;active&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;can&#x20;be&#x20;idle&#x20;&#40;without&#x20;user&#x20;input&#41;&#x20;before&#x20;it&#x20;is&#x20;automatically&#x20;disconnected.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never&#x20;&#40;0&#41;.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;inactive&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never&#x20;&#40;0&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Terminal&#x20;Services&#x20;sessions,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.10.1\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26350,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;1&#x20;minute&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;a&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;1&#x20;minute.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;disconnected&#x20;but&#x20;still&#x20;active&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.&#x20;This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;disconnected&#x20;session&#x20;is&#x20;properly&#x20;terminated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;1&#x20;minute:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.10.2\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26351,'Ensure&#x20;&#039;Do&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;retains&#x20;a&#x20;user&#039;s&#x20;per-session&#x20;temporary&#x20;folders&#x20;at&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;inside&#x20;the&#x20;temporary&#x20;folders&#x20;and&#x20;visible&#x20;to&#x20;other&#x20;administrators&#x20;that&#x20;log&#x20;into&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Do&#x20;not&#x20;delete&#x20;temp&#x20;folder&#x20;upon&#x20;exit,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.11.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26352,'Ensure&#x20;&#039;Prevent&#x20;downloading&#x20;of&#x20;enclosures&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;having&#x20;enclosures&#x20;&#40;file&#x20;attachments&#41;&#x20;downloaded&#x20;from&#x20;an&#x20;RSS&#x20;feed&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;attachments&#x20;to&#x20;be&#x20;downloaded&#x20;through&#x20;the&#x20;RSS&#x20;feed&#x20;can&#x20;introduce&#x20;files&#x20;that&#x20;could&#x20;have&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRSS&#x20;FeedsPrevent&#x20;downloading&#x20;of&#x20;enclosures.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InetRes.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Turn&#x20;off&#x20;downloading&#x20;of&#x20;enclosures,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.66.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26353,'Ensure&#x20;&#039;Allow&#x20;Cloud&#x20;Search&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;search&#x20;cloud&#x20;sources&#x20;like&#x20;OneDrive&#x20;and&#x20;SharePoint.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cloud&#x20;Search.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26354,'Ensure&#x20;&#039;Allow&#x20;Cortana&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Cortana&#x20;is&#x20;allowed&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;Cortana&#x20;is&#x20;enabled,&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;in&#x20;search&#x20;history&#x20;and&#x20;sent&#x20;out&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cortana.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.3\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26355,'Ensure&#x20;&#039;Allow&#x20;Cortana&#x20;above&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;can&#x20;interact&#x20;with&#x20;Cortana&#x20;using&#x20;speech&#x20;while&#x20;the&#x20;system&#x20;is&#x20;locked.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Access&#x20;to&#x20;any&#x20;computer&#x20;resource&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;when&#x20;the&#x20;device&#x20;is&#x20;locked.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cortana&#x20;above&#x20;lock&#x20;screen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26356,'Ensure&#x20;&#039;Allow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;encrypted&#x20;items&#x20;are&#x20;allowed&#x20;to&#x20;be&#x20;indexed.&#x20;When&#x20;this&#x20;setting&#x20;is&#x20;changed,&#x20;the&#x20;index&#x20;is&#x20;rebuilt&#x20;completely.&#x20;Full&#x20;volume&#x20;encryption&#x20;&#40;such&#x20;as&#x20;BitLocker&#x20;Drive&#x20;Encryption&#x20;or&#x20;a&#x20;non-Microsoft&#x20;solution&#41;&#x20;must&#x20;be&#x20;used&#x20;for&#x20;the&#x20;location&#x20;of&#x20;the&#x20;index&#x20;to&#x20;maintain&#x20;security&#x20;for&#x20;encrypted&#x20;files.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Indexing&#x20;and&#x20;allowing&#x20;users&#x20;to&#x20;search&#x20;encrypted&#x20;files&#x20;could&#x20;potentially&#x20;reveal&#x20;confidential&#x20;data&#x20;stored&#x20;within&#x20;the&#x20;encrypted&#x20;files.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.67.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26357,'Ensure&#x20;&#039;Allow&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;use&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;search&#x20;and&#x20;Cortana&#x20;can&#x20;provide&#x20;location&#x20;aware&#x20;search&#x20;and&#x20;Cortana&#x20;results.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;allowing&#x20;Cortana&#x20;and&#x20;Search&#x20;to&#x20;have&#x20;access&#x20;to&#x20;location&#x20;data&#x20;is&#x20;unnecessary.&#x20;Organizations&#x20;likely&#x20;do&#x20;not&#x20;want&#x20;this&#x20;information&#x20;shared&#x20;out.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;use&#x20;location.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26358,'Ensure&#x20;&#039;Turn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;Key&#x20;Management&#x20;Service&#x20;&#40;KMS&#41;&#x20;is&#x20;a&#x20;Microsoft&#x20;license&#x20;activation&#x20;method&#x20;that&#x20;entails&#x20;setting&#x20;up&#x20;a&#x20;local&#x20;server&#x20;to&#x20;store&#x20;the&#x20;software&#x20;licenses.&#x20;The&#x20;KMS&#x20;server&#x20;itself&#x20;needs&#x20;to&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;activate&#x20;the&#x20;KMS&#x20;service,&#x20;but&#x20;subsequent&#x20;on-network&#x20;clients&#x20;can&#x20;activate&#x20;Microsoft&#x20;Windows&#x20;OS&#x20;and/or&#x20;their&#x20;Microsoft&#x20;Office&#x20;via&#x20;the&#x20;KMS&#x20;server&#x20;instead&#x20;of&#x20;connecting&#x20;directly&#x20;to&#x20;Microsoft.&#x20;This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;opt-out&#x20;of&#x20;sending&#x20;KMS&#x20;client&#x20;activation&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Even&#x20;though&#x20;the&#x20;KMS&#x20;licensing&#x20;method&#x20;does&#x20;not&#x20;require&#x20;KMS&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;Microsoft,&#x20;they&#x20;still&#x20;send&#x20;KMS&#x20;client&#x20;activation&#x20;state&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSoftware&#x20;Protection&#x20;PlatformTurn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AVSValidationGP.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.72.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26359,'Ensure&#x20;&#039;Disable&#x20;all&#x20;apps&#x20;from&#x20;Microsoft&#x20;Store&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;launch&#x20;of&#x20;all&#x20;apps&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;that&#x20;came&#x20;pre-installed&#x20;or&#x20;were&#x20;downloaded.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.&#x20;Note&#x20;#2:&#x20;The&#x20;name&#x20;of&#x20;this&#x20;setting&#x20;and&#x20;the&#x20;Enabled/Disabled&#x20;values&#x20;are&#x20;incorrectly&#x20;worded&#x20;-&#x20;logically,&#x20;the&#x20;title&#x20;implies&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;disable&#x20;all&#x20;apps&#x20;from&#x20;the&#x20;Microsoft&#x20;Store,&#x20;and&#x20;configuring&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;enable&#x20;all&#x20;apps&#x20;from&#x20;the&#x20;Microsoft&#x20;Store.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;GPME&#x20;help&#x20;text&#41;.&#x20;This&#x20;is&#x20;a&#x20;logical&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','The&#x20;Store&#x20;service&#x20;is&#x20;a&#x20;retail&#x20;outlet&#x20;built&#x20;into&#x20;Windows,&#x20;primarily&#x20;for&#x20;consumer&#x20;use.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;installation&#x20;of&#x20;all&#x20;applications&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;installation&#x20;of&#x20;vulnerable&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreDisable&#x20;all&#x20;apps&#x20;from&#x20;Microsoft&#x20;Store.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;all&#x20;apps&#x20;from&#x20;Windows&#x20;Store,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.75.1\"]}, {\"cis_csc\": [\"2.5\"]}]'),(26360,'Ensure&#x20;&#039;Only&#x20;display&#x20;the&#x20;private&#x20;store&#x20;within&#x20;the&#x20;Microsoft&#x20;Store&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;denies&#x20;access&#x20;to&#x20;the&#x20;retail&#x20;catalog&#x20;in&#x20;the&#x20;Microsoft&#x20;Store,&#x20;but&#x20;displays&#x20;the&#x20;private&#x20;store.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;the&#x20;private&#x20;store&#x20;will&#x20;allow&#x20;an&#x20;organization&#x20;to&#x20;control&#x20;the&#x20;apps&#x20;that&#x20;users&#x20;have&#x20;access&#x20;to&#x20;add&#x20;to&#x20;a&#x20;system.&#x20;This&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;unapproved&#x20;malicious&#x20;apps&#x20;are&#x20;not&#x20;running&#x20;on&#x20;a&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreOnly&#x20;display&#x20;the&#x20;private&#x20;store&#x20;within&#x20;the&#x20;Microsoft&#x20;Store.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Only&#x20;display&#x20;the&#x20;private&#x20;store&#x20;within&#x20;the&#x20;Windows&#x20;Store&#x20;app,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.75.2\"]}, {\"cis_csc\": [\"2.5\"]}]'),(26361,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Automatic&#x20;Download&#x20;and&#x20;Install&#x20;of&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;automatic&#x20;download&#x20;and&#x20;installation&#x20;of&#x20;Microsoft&#x20;Store&#x20;app&#x20;updates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Keeping&#x20;your&#x20;system&#x20;properly&#x20;patched&#x20;can&#x20;help&#x20;protect&#x20;against&#x20;0&#x20;day&#x20;vulnerabilities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreTurn&#x20;off&#x20;Automatic&#x20;Download&#x20;and&#x20;Install&#x20;of&#x20;updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinStoreUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.75.3\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26362,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;offer&#x20;to&#x20;update&#x20;to&#x20;the&#x20;latest&#x20;version&#x20;of&#x20;Windows&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Enables&#x20;or&#x20;disables&#x20;the&#x20;Microsoft&#x20;Store&#x20;offer&#x20;to&#x20;update&#x20;to&#x20;the&#x20;latest&#x20;version&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Unplanned&#x20;OS&#x20;upgrades&#x20;can&#x20;lead&#x20;to&#x20;more&#x20;preventable&#x20;support&#x20;calls.&#x20;The&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;and&#x20;approving&#x20;all&#x20;upgrades&#x20;and&#x20;updates.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreTurn&#x20;off&#x20;the&#x20;offer&#x20;to&#x20;update&#x20;to&#x20;the&#x20;latest&#x20;version&#x20;of&#x20;Windows.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinStoreUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.75.4\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26363,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Store&#x20;application&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;denies&#x20;or&#x20;allows&#x20;access&#x20;to&#x20;the&#x20;Store&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet&#x20;and&#x20;MSKB&#x20;3135657,&#x20;this&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;any&#x20;Windows&#x20;10&#x20;editions&#x20;other&#x20;than&#x20;Enterprise&#x20;and&#x20;Education.','Only&#x20;applications&#x20;approved&#x20;by&#x20;an&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;installed.&#x20;Allowing&#x20;users&#x20;to&#x20;install&#x20;3rd&#x20;party&#x20;applications&#x20;can&#x20;lead&#x20;to&#x20;missed&#x20;patches&#x20;and&#x20;potential&#x20;zero&#x20;day&#x20;vulnerabilities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsStoreTurn&#x20;off&#x20;the&#x20;Store&#x20;application.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinStoreUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates,&#x20;or&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsStore.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.75.5\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26364,'Ensure&#x20;&#039;Allow&#x20;widgets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;widgets&#x20;feature&#x20;is&#x20;allowed&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;widgets&#x20;feature&#x20;provides&#x20;information&#x20;such&#x20;as,&#x20;weather,&#x20;news,&#x20;sports,&#x20;stocks,&#x20;traffic,&#x20;and&#x20;entertainment&#x20;&#40;not&#x20;an&#x20;inclusive&#x20;list&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;apps&#x20;and&#x20;features&#x20;such&#x20;as&#x20;widgets&#x20;on&#x20;the&#x20;Windows&#x20;taskbar&#x20;should&#x20;be&#x20;treated&#x20;as&#x20;a&#x20;possible&#x20;security&#x20;risk&#x20;due&#x20;to&#x20;the&#x20;potential&#x20;of&#x20;data&#x20;being&#x20;sent&#x20;back&#x20;to&#x20;3rd&#x20;parties,&#x20;such&#x20;as&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWidgetsAllow&#x20;Widgets.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NewsAndInterests.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.81.1\"]}]'),(26365,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;the&#x20;behavior&#x20;of&#x20;Windows&#x20;Defender&#x20;SmartScreen.&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;Some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;with&#x20;this&#x20;feature&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass.','Windows&#x20;Defender&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;However,&#x20;due&#x20;to&#x20;the&#x20;fact&#x20;that&#x20;some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;disable&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenExplorerConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Configure&#x20;Windows&#x20;SmartScreen,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26366,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;lets&#x20;you&#x20;decide&#x20;whether&#x20;to&#x20;turn&#x20;on&#x20;SmartScreen&#x20;Filter.&#x20;SmartScreen&#x20;Filter&#x20;provides&#x20;warning&#x20;messages&#x20;to&#x20;help&#x20;protect&#x20;your&#x20;employees&#x20;from&#x20;potential&#x20;phishing&#x20;scams&#x20;and&#x20;malicious&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','SmartScreen&#x20;serves&#x20;an&#x20;important&#x20;purpose&#x20;as&#x20;it&#x20;helps&#x20;to&#x20;warn&#x20;users&#x20;of&#x20;possible&#x20;malicious&#x20;sites&#x20;and&#x20;files.&#x20;Allowing&#x20;users&#x20;to&#x20;turn&#x20;off&#x20;this&#x20;setting&#x20;can&#x20;make&#x20;the&#x20;browser&#x20;become&#x20;more&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenMicrosoft&#x20;EdgeConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MicrosoftEdge.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allows&#x20;you&#x20;to&#x20;configure&#x20;SmartScreen.&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates,&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Turn&#x20;off&#x20;the&#x20;SmartScreen&#x20;Filter.&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;it&#x20;was&#x20;renamed&#x20;&#40;again&#41;&#x20;to&#x20;Configure&#x20;SmartScreen&#x20;Filter.&#x20;Finally,&#x20;it&#x20;was&#x20;given&#x20;its&#x20;current&#x20;name&#x20;of&#x20;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26367,'Ensure&#x20;&#039;Prevent&#x20;bypassing&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;lets&#x20;you&#x20;decide&#x20;whether&#x20;employees&#x20;can&#x20;override&#x20;the&#x20;SmartScreen&#x20;Filter&#x20;warnings&#x20;about&#x20;potentially&#x20;malicious&#x20;websites.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','SmartScreen&#x20;will&#x20;warn&#x20;an&#x20;employee&#x20;if&#x20;a&#x20;website&#x20;is&#x20;potentially&#x20;malicious.&#x20;Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;these&#x20;warnings&#x20;from&#x20;being&#x20;bypassed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenMicrosoft&#x20;EdgePrevent&#x20;bypassing&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MicrosoftEdge.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Don&#039;t&#x20;allow&#x20;SmartScreen&#x20;Filter&#x20;warning&#x20;overrides.&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;renamed&#x20;to&#x20;Prevent&#x20;bypassing&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites.&#x20;Finally,&#x20;it&#x20;was&#x20;given&#x20;its&#x20;current&#x20;name&#x20;of&#x20;Prevent&#x20;bypassing&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;prompts&#x20;for&#x20;sites&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.2.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(26368,'Ensure&#x20;&#039;Enables&#x20;or&#x20;disables&#x20;Windows&#x20;Game&#x20;Recording&#x20;and&#x20;Broadcasting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;Windows&#x20;Game&#x20;Recording&#x20;and&#x20;Broadcasting&#x20;features.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;allowed,&#x20;users&#x20;could&#x20;record&#x20;and&#x20;broadcast&#x20;session&#x20;info&#x20;to&#x20;external&#x20;sites,&#x20;which&#x20;is&#x20;both&#x20;a&#x20;risk&#x20;of&#x20;accidentally&#x20;exposing&#x20;sensitive&#x20;company&#x20;data&#x20;&#40;on-screen&#41;&#x20;outside&#x20;the&#x20;company&#x20;as&#x20;well&#x20;as&#x20;a&#x20;privacy&#x20;concern.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Game&#x20;Recording&#x20;and&#x20;BroadcastingEnables&#x20;or&#x20;disables&#x20;Windows&#x20;Game&#x20;Recording&#x20;and&#x20;Broadcasting.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GameDVR.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.87.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26369,'Ensure&#x20;&#039;Allow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;are&#x20;allowed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;Microsoft&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;collect&#x20;data&#x20;and&#x20;suggest&#x20;apps&#x20;based&#x20;on&#x20;that&#x20;data&#x20;collected.&#x20;Disabling&#x20;this&#x20;setting&#x20;will&#x20;help&#x20;ensure&#x20;your&#x20;data&#x20;is&#x20;not&#x20;shared&#x20;with&#x20;any&#x20;third&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.89.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26370,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#039;&#x20;OR&#x20;&#039;Disabled&#039;&#x20;but&#x20;not&#x20;&#039;Enabled:&','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;Ink&#x20;items&#x20;are&#x20;allowed&#x20;above&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled.','Allowing&#x20;any&#x20;apps&#x20;to&#x20;be&#x20;accessed&#x20;while&#x20;system&#x20;is&#x20;locked&#x20;is&#x20;not&#x20;recommended.&#x20;If&#x20;this&#x20;feature&#x20;is&#x20;permitted,&#x20;it&#x20;should&#x20;only&#x20;be&#x20;accessible&#x20;once&#x20;a&#x20;user&#x20;authenticates&#x20;with&#x20;the&#x20;proper&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;Windows&#x20;Ink&#x20;Workspace.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.89.2\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26371,'Ensure&#x20;&#039;Allow&#x20;user&#x20;control&#x20;over&#x20;installs&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;are&#x20;permitted&#x20;to&#x20;change&#x20;installation&#x20;options&#x20;that&#x20;typically&#x20;are&#x20;available&#x20;only&#x20;to&#x20;system&#x20;administrators.&#x20;The&#x20;security&#x20;features&#x20;of&#x20;Windows&#x20;Installer&#x20;normally&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;installation&#x20;options&#x20;that&#x20;are&#x20;typically&#x20;reserved&#x20;for&#x20;system&#x20;administrators,&#x20;such&#x20;as&#x20;specifying&#x20;the&#x20;directory&#x20;to&#x20;which&#x20;files&#x20;are&#x20;installed.&#x20;If&#x20;Windows&#x20;Installer&#x20;detects&#x20;that&#x20;an&#x20;installation&#x20;package&#x20;has&#x20;permitted&#x20;the&#x20;user&#x20;to&#x20;change&#x20;a&#x20;protected&#x20;option,&#x20;it&#x20;stops&#x20;the&#x20;installation&#x20;and&#x20;displays&#x20;a&#x20;message.&#x20;These&#x20;security&#x20;features&#x20;operate&#x20;only&#x20;when&#x20;the&#x20;installation&#x20;program&#x20;is&#x20;running&#x20;in&#x20;a&#x20;privileged&#x20;security&#x20;context&#x20;in&#x20;which&#x20;it&#x20;has&#x20;access&#x20;to&#x20;directories&#x20;denied&#x20;to&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;only&#x20;IT&#x20;staff&#x20;with&#x20;administrative&#x20;rights&#x20;should&#x20;be&#x20;installing&#x20;or&#x20;changing&#x20;software&#x20;on&#x20;a&#x20;system.&#x20;Allowing&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;have&#x20;any&#x20;control&#x20;over&#x20;installs&#x20;can&#x20;risk&#x20;unapproved&#x20;software&#x20;from&#x20;being&#x20;installed&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;system,&#x20;which&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;become&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAllow&#x20;user&#x20;control&#x20;over&#x20;installs.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Enable&#x20;user&#x20;control&#x20;over&#x20;installs,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26372,'Ensure&#x20;&#039;Always&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;Windows&#x20;Installer&#x20;should&#x20;use&#x20;system&#x20;permissions&#x20;when&#x20;it&#x20;installs&#x20;any&#x20;program&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;This&#x20;setting&#x20;appears&#x20;both&#x20;in&#x20;the&#x20;Computer&#x20;Configuration&#x20;and&#x20;User&#x20;Configuration&#x20;folders.&#x20;To&#x20;make&#x20;this&#x20;setting&#x20;effective,&#x20;you&#x20;must&#x20;enable&#x20;the&#x20;setting&#x20;in&#x20;both&#x20;folders.&#x20;Caution:&#x20;If&#x20;enabled,&#x20;skilled&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;permissions&#x20;this&#x20;setting&#x20;grants&#x20;to&#x20;change&#x20;their&#x20;privileges&#x20;and&#x20;gain&#x20;permanent&#x20;access&#x20;to&#x20;restricted&#x20;files&#x20;and&#x20;folders.&#x20;Note&#x20;that&#x20;the&#x20;User&#x20;Configuration&#x20;version&#x20;of&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;guaranteed&#x20;to&#x20;be&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;with&#x20;limited&#x20;privileges&#x20;can&#x20;exploit&#x20;this&#x20;feature&#x20;by&#x20;creating&#x20;a&#x20;Windows&#x20;Installer&#x20;installation&#x20;package&#x20;that&#x20;creates&#x20;a&#x20;new&#x20;local&#x20;account&#x20;that&#x20;belongs&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;adds&#x20;their&#x20;current&#x20;account&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;installs&#x20;malicious&#x20;software,&#x20;or&#x20;performs&#x20;other&#x20;unauthorized&#x20;activities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAlways&#x20;install&#x20;with&#x20;elevated&#x20;privileges.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.2\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26373,'Ensure&#x20;&#039;Prevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Web-based&#x20;programs&#x20;are&#x20;allowed&#x20;to&#x20;install&#x20;software&#x20;on&#x20;the&#x20;computer&#x20;without&#x20;notifying&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Suppressing&#x20;the&#x20;system&#x20;warning&#x20;can&#x20;pose&#x20;a&#x20;security&#x20;risk&#x20;and&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerPrevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;IE&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.3\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(26374,'Ensure&#x20;&#039;Sign-in&#x20;and&#x20;lock&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;restart&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;a&#x20;device&#x20;will&#x20;automatically&#x20;sign-in&#x20;the&#x20;last&#x20;interactive&#x20;user&#x20;after&#x20;Windows&#x20;Update&#x20;restarts&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;feature&#x20;will&#x20;prevent&#x20;the&#x20;caching&#x20;of&#x20;user&#039;s&#x20;credentials&#x20;and&#x20;unauthorized&#x20;use&#x20;of&#x20;the&#x20;device,&#x20;and&#x20;also&#x20;ensure&#x20;the&#x20;user&#x20;is&#x20;aware&#x20;of&#x20;the&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Logon&#x20;OptionsSign-in&#x20;and&#x20;lock&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;restart.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinLogon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Sign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.91.1\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(26375,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;logging&#x20;of&#x20;all&#x20;PowerShell&#x20;script&#x20;input&#x20;to&#x20;the&#x20;Applications&#x20;and&#x20;Services&#x20;LogsMicrosoftWindowsPowerShellOperational&#x20;Event&#x20;Log&#x20;channel.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;logging&#x20;of&#x20;Script&#x20;Block&#x20;Invocation&#x20;Start/Stop&#x20;Events&#x20;is&#x20;enabled&#x20;&#40;option&#x20;box&#x20;checked&#41;,&#x20;PowerShell&#x20;will&#x20;log&#x20;additional&#x20;events&#x20;when&#x20;invocation&#x20;of&#x20;a&#x20;command,&#x20;script&#x20;block,&#x20;function,&#x20;or&#x20;script&#x20;starts&#x20;or&#x20;stops.&#x20;Enabling&#x20;this&#x20;option&#x20;generates&#x20;a&#x20;high&#x20;volume&#x20;of&#x20;event&#x20;logs.&#x20;CIS&#x20;has&#x20;intentionally&#x20;chosen&#x20;not&#x20;to&#x20;make&#x20;a&#x20;recommendation&#x20;for&#x20;this&#x20;option,&#x20;since&#x20;it&#x20;generates&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;events.&#x20;If&#x20;an&#x20;organization&#x20;chooses&#x20;to&#x20;enable&#x20;the&#x20;optional&#x20;setting&#x20;&#40;checked&#41;,&#x20;this&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Logs&#x20;of&#x20;PowerShell&#x20;script&#x20;input&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;when&#x20;performing&#x20;forensic&#x20;investigations&#x20;of&#x20;PowerShell&#x20;attack&#x20;incidents&#x20;to&#x20;determine&#x20;what&#x20;occurred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.100.1\"]}, {\"cis_csc\": [\"8.8\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(26376,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Transcription&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;Policy&#x20;setting&#x20;lets&#x20;you&#x20;capture&#x20;the&#x20;input&#x20;and&#x20;output&#x20;of&#x20;Windows&#x20;PowerShell&#x20;commands&#x20;into&#x20;text-based&#x20;transcripts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;that&#x20;passwords&#x20;could&#x20;get&#x20;stored&#x20;in&#x20;plain&#x20;text&#x20;in&#x20;the&#x20;PowerShell_transcript&#x20;output&#x20;file.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Transcription.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.100.2\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(26377,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;uses&#x20;Basic&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Clients&#x20;that&#x20;use&#x20;Microsoft&#039;s&#x20;Exchange&#x20;Online&#x20;service&#x20;&#40;Office&#x20;365&#41;&#x20;will&#x20;require&#x20;an&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;instead&#x20;have&#x20;this&#x20;setting&#x20;set&#x20;to&#x20;Enabled.&#x20;Exchange&#x20;Online&#x20;uses&#x20;Basic&#x20;authentication&#x20;over&#x20;HTTPS,&#x20;and&#x20;so&#x20;the&#x20;Exchange&#x20;Online&#x20;authentication&#x20;traffic&#x20;will&#x20;still&#x20;be&#x20;safely&#x20;encrypted.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;Basic&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26378,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;unencrypted&#x20;traffic.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.2\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26379,'Ensure&#x20;&#039;Disallow&#x20;Digest&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;will&#x20;not&#x20;use&#x20;Digest&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Digest&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM,&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientDisallow&#x20;Digest&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26380,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;accepts&#x20;Basic&#x20;authentication&#x20;from&#x20;a&#x20;remote&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;Basic&#x20;authentication.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26381,'Ensure&#x20;&#039;Allow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;automatically&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;requests&#x20;on&#x20;the&#x20;HTTP&#x20;transport&#x20;over&#x20;the&#x20;default&#x20;HTTP&#x20;port.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;automatic&#x20;configuration&#x20;of&#x20;listeners,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26382,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;unencrypted&#x20;traffic.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26383,'Ensure&#x20;&#039;Disallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;will&#x20;allow&#x20;RunAs&#x20;credentials&#x20;to&#x20;be&#x20;stored&#x20;for&#x20;any&#x20;plug-ins.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;you&#x20;enable&#x20;and&#x20;then&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;any&#x20;values&#x20;that&#x20;were&#x20;previously&#x20;configured&#x20;for&#x20;RunAsPassword&#x20;will&#x20;need&#x20;to&#x20;be&#x20;reset.','Although&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;RunAs&#x20;credentials&#x20;is&#x20;a&#x20;convenient&#x20;feature&#x20;it&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;account&#x20;compromise&#x20;slightly.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;forget&#x20;to&#x20;lock&#x20;your&#x20;desktop&#x20;before&#x20;leaving&#x20;it&#x20;unattended&#x20;for&#x20;a&#x20;few&#x20;minutes&#x20;another&#x20;person&#x20;could&#x20;access&#x20;not&#x20;only&#x20;the&#x20;desktop&#x20;of&#x20;your&#x20;computer&#x20;but&#x20;also&#x20;any&#x20;hosts&#x20;you&#x20;manage&#x20;via&#x20;WinRM&#x20;with&#x20;cached&#x20;RunAs&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceDisallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.102.2.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(26384,'Ensure&#x20;&#039;Allow&#x20;Remote&#x20;Shell&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;configuration&#x20;of&#x20;remote&#x20;access&#x20;to&#x20;all&#x20;supported&#x20;shells&#x20;to&#x20;execute&#x20;scripts&#x20;and&#x20;commands.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;GPME&#x20;help&#x20;text&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded,&#x20;implying&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;reject&#x20;new&#x20;Remote&#x20;Shell&#x20;connections,&#x20;and&#x20;setting&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;allow&#x20;Remote&#x20;Shell&#x20;connections.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;title&#x20;of&#x20;the&#x20;setting&#41;.&#x20;This&#x20;is&#x20;a&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Shell&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;ShellAllow&#x20;Remote&#x20;Shell&#x20;Access.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteShell.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.103.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26385,'Ensure&#x20;&#039;Allow&#x20;clipboard&#x20;sharing&#x20;with&#x20;Windows&#x20;Sandbox&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;clipboard&#x20;sharing&#x20;with&#x20;the&#x20;Windows&#x20;sandbox.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Windows&#x20;Sandbox&#x20;feature&#x20;was&#x20;first&#x20;introduced&#x20;in&#x20;Windows&#x20;10&#x20;R1903,&#x20;and&#x20;allows&#x20;a&#x20;temporary&#x20;&quot;clean&#x20;install&quot;&#x20;virtual&#x20;instance&#x20;of&#x20;Windows&#x20;to&#x20;be&#x20;run&#x20;inside&#x20;the&#x20;host,&#x20;for&#x20;the&#x20;ostensible&#x20;purpose&#x20;of&#x20;testing&#x20;applications&#x20;without&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;host.','Disabling&#x20;copy&#x20;and&#x20;paste&#x20;decreases&#x20;the&#x20;attack&#x20;surface&#x20;exposed&#x20;by&#x20;the&#x20;Windows&#x20;Sandbox&#x20;and&#x20;possible&#x20;exposure&#x20;of&#x20;untrusted&#x20;applications&#x20;to&#x20;the&#x20;internal&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SandboxAllow&#x20;clipboard&#x20;sharing&#x20;with&#x20;Windows&#x20;Sandbox.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsSandbox.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.104.1\"]}]'),(26386,'Ensure&#x20;&#039;Allow&#x20;networking&#x20;in&#x20;Windows&#x20;Sandbox&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;networking&#x20;in&#x20;the&#x20;Windows&#x20;Sandbox.&#x20;Networking&#x20;is&#x20;achieved&#x20;by&#x20;creating&#x20;a&#x20;virtual&#x20;switch&#x20;on&#x20;the&#x20;host,&#x20;and&#x20;connecting&#x20;the&#x20;Windows&#x20;Sandbox&#x20;to&#x20;it&#x20;via&#x20;a&#x20;virtual&#x20;Network&#x20;Interface&#x20;Card&#x20;&#40;NIC&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Windows&#x20;Sandbox&#x20;feature&#x20;was&#x20;first&#x20;introduced&#x20;in&#x20;Windows&#x20;10&#x20;R1903,&#x20;and&#x20;allows&#x20;a&#x20;temporary&#x20;&quot;clean&#x20;install&quot;&#x20;virtual&#x20;instance&#x20;of&#x20;Windows&#x20;to&#x20;be&#x20;run&#x20;inside&#x20;the&#x20;host,&#x20;for&#x20;the&#x20;ostensible&#x20;purpose&#x20;of&#x20;testing&#x20;applications&#x20;without&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;host.','Disabling&#x20;network&#x20;access&#x20;decreases&#x20;the&#x20;attack&#x20;surface&#x20;exposed&#x20;by&#x20;the&#x20;Windows&#x20;Sandbox&#x20;and&#x20;exposure&#x20;of&#x20;untrusted&#x20;applications&#x20;to&#x20;the&#x20;internal&#x20;network.&#x20;Note:&#x20;Per&#x20;Microsoft,&#x20;enabling&#x20;networking&#x20;in&#x20;the&#x20;Windows&#x20;Sandbox&#x20;can&#x20;expose&#x20;untrusted&#x20;applications&#x20;to&#x20;the&#x20;internal&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SandboxAllow&#x20;networking&#x20;in&#x20;Windows&#x20;Sandbox.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsSandbox.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.104.2\"]}]'),(26387,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevent&#x20;users&#x20;from&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;Exploit&#x20;protection&#x20;settings&#x20;area&#x20;in&#x20;the&#x20;Windows&#x20;Security&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Only&#x20;authorized&#x20;IT&#x20;staff&#x20;should&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;to&#x20;the&#x20;exploit&#x20;protection&#x20;settings&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;the&#x20;organizations&#x20;specific&#x20;configuration&#x20;is&#x20;not&#x20;modified.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SecurityApp&#x20;and&#x20;browser&#x20;protectionPrevent&#x20;users&#x20;from&#x20;modifying&#x20;settings.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefenderSecurityCenter.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.105.2.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(26388,'Ensure&#x20;&#039;No&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;that&#x20;Automatic&#x20;Updates&#x20;will&#x20;wait&#x20;for&#x20;computers&#x20;to&#x20;be&#x20;restarted&#x20;by&#x20;the&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;on&#x20;to&#x20;them&#x20;to&#x20;complete&#x20;a&#x20;scheduled&#x20;installation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;applies&#x20;only&#x20;when&#x20;you&#x20;configure&#x20;Automatic&#x20;Updates&#x20;to&#x20;perform&#x20;scheduled&#x20;update&#x20;installations.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;to&#x20;Disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect.','Some&#x20;security&#x20;updates&#x20;require&#x20;that&#x20;the&#x20;computer&#x20;be&#x20;restarted&#x20;to&#x20;complete&#x20;an&#x20;installation.&#x20;If&#x20;the&#x20;computer&#x20;cannot&#x20;restart&#x20;automatically,&#x20;then&#x20;the&#x20;most&#x20;recent&#x20;update&#x20;will&#x20;not&#x20;completely&#x20;install&#x20;and&#x20;no&#x20;new&#x20;updates&#x20;will&#x20;download&#x20;to&#x20;the&#x20;computer&#x20;until&#x20;it&#x20;is&#x20;restarted.&#x20;Without&#x20;the&#x20;auto-restart&#x20;functionality,&#x20;users&#x20;who&#x20;are&#x20;not&#x20;security-conscious&#x20;may&#x20;choose&#x20;to&#x20;indefinitely&#x20;delay&#x20;the&#x20;restart,&#x20;therefore&#x20;keeping&#x20;the&#x20;computer&#x20;in&#x20;a&#x20;less&#x20;secure&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateLegacy&#x20;PoliciesNo&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;No&#x20;auto-restart&#x20;for&#x20;scheduled&#x20;Automatic&#x20;Updates&#x20;installations,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.1.1\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(26389,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;recognize&#x20;when&#x20;a&#x20;network&#x20;connection&#x20;is&#x20;available&#x20;and&#x20;then&#x20;use&#x20;the&#x20;network&#x20;connection&#x20;to&#x20;search&#x20;Windows&#x20;Update&#x20;or&#x20;your&#x20;designated&#x20;intranet&#x20;site&#x20;for&#x20;updates&#x20;that&#x20;apply&#x20;to&#x20;them.&#x20;After&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;select&#x20;one&#x20;of&#x20;the&#x20;following&#x20;three&#x20;options&#x20;in&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;Properties&#x20;dialog&#x20;box&#x20;to&#x20;specify&#x20;how&#x20;the&#x20;service&#x20;will&#x20;work:&#x20;2&#x20;-&#x20;Notify&#x20;for&#x20;download&#x20;and&#x20;auto&#x20;install&#x20;&#40;Notify&#x20;before&#x20;downloading&#x20;any&#x20;updates&#41;&#x20;3&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;notify&#x20;for&#x20;install&#x20;&#40;Download&#x20;the&#x20;updates&#x20;automatically&#x20;and&#x20;notify&#x20;when&#x20;they&#x20;are&#x20;ready&#x20;to&#x20;be&#x20;installed.&#41;&#x20;&#40;Default&#x20;setting&#41;&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;&#40;Automatically&#x20;download&#x20;updates&#x20;and&#x20;install&#x20;them&#x20;on&#x20;the&#x20;schedule&#x20;specified&#x20;below.&#41;&#41;&#x20;5&#x20;-&#x20;Allow&#x20;local&#x20;admin&#x20;to&#x20;choose&#x20;setting&#x20;&#40;Leave&#x20;decision&#x20;on&#x20;above&#x20;choices&#x20;up&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;&#40;Not&#x20;Recommended&#41;&#41;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;sub-setting&#x20;&quot;Configure&#x20;automatic&#x20;updating:&quot;&#x20;has&#x20;4&#x20;possible&#x20;values&#x20;-&#x20;all&#x20;of&#x20;them&#x20;are&#x20;valid&#x20;depending&#x20;on&#x20;specific&#x20;organizational&#x20;needs,&#x20;however&#x20;if&#x20;feasible&#x20;we&#x20;suggest&#x20;using&#x20;a&#x20;value&#x20;of&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install.&#x20;This&#x20;suggestion&#x20;is&#x20;not&#x20;a&#x20;scored&#x20;requirement.&#x20;Note&#x20;#2:&#x20;Organizations&#x20;that&#x20;utilize&#x20;a&#x20;3rd-party&#x20;solution&#x20;for&#x20;patching&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation,&#x20;and&#x20;instead&#x20;configure&#x20;it&#x20;to&#x20;Disabled&#x20;so&#x20;that&#x20;the&#x20;native&#x20;Windows&#x20;Update&#x20;mechanism&#x20;does&#x20;not&#x20;interfere&#x20;with&#x20;the&#x20;3rd-party&#x20;patching&#x20;process.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceConfigure&#x20;Automatic&#x20;Updates.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.2.1\"]}, {\"cis_csc\": [\"7.3\"]}]'),(26390,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#x20;-&#x20;Every&#x20;day&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;when&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;0&#x20;-&#x20;Every&#x20;day.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;applicable&#x20;if&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;is&#x20;selected&#x20;in&#x20;recommendation&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;.&#x20;It&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;if&#x20;any&#x20;other&#x20;option&#x20;is&#x20;selected.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;0&#x20;-&#x20;Every&#x20;day:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceConfigure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.2.2\"]}, {\"cis_csc\": [\"7.3\"]}]'),(26391,'Ensure&#x20;&#039;Remove&#x20;access&#x20;to&#x20;&quot;Pause&#x20;updates&quot;&#x20;feature&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;removes&#x20;access&#x20;to&#x20;&quot;Pause&#x20;updates&quot;&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;order&#x20;to&#x20;ensure&#x20;security&#x20;and&#x20;system&#x20;updates&#x20;are&#x20;applied,&#x20;system&#x20;administrators&#x20;should&#x20;control&#x20;when&#x20;updates&#x20;are&#x20;applied&#x20;to&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceRemove&#x20;access&#x20;to&#x20;&quot;Pause&#x20;updates&quot;&#x20;feature.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.2.3\"]}, {\"cis_csc\": [\"7.3\"]}]'),(26392,'Ensure&#x20;&#039;Manage&#x20;preview&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;manage&#x20;which&#x20;updates&#x20;that&#x20;are&#x20;receive&#x20;prior&#x20;to&#x20;the&#x20;update&#x20;being&#x20;released.&#x20;Dev&#x20;Channel:&#x20;Ideal&#x20;for&#x20;highly&#x20;technical&#x20;users.&#x20;Insiders&#x20;in&#x20;the&#x20;Dev&#x20;Channel&#x20;will&#x20;receive&#x20;builds&#x20;from&#x20;our&#x20;active&#x20;development&#x20;branch&#x20;that&#x20;is&#x20;earliest&#x20;in&#x20;a&#x20;development&#x20;cycle.&#x20;These&#x20;builds&#x20;are&#x20;not&#x20;matched&#x20;to&#x20;a&#x20;specific&#x20;Windows&#x20;10&#x20;release.&#x20;Beta&#x20;Channel:&#x20;Ideal&#x20;for&#x20;feature&#x20;explorers&#x20;who&#x20;want&#x20;to&#x20;see&#x20;upcoming&#x20;Windows&#x20;10&#x20;features.&#x20;Your&#x20;feedback&#x20;will&#x20;be&#x20;especially&#x20;important&#x20;here&#x20;as&#x20;it&#x20;will&#x20;help&#x20;our&#x20;engineers&#x20;ensure&#x20;key&#x20;issues&#x20;are&#x20;fixed&#x20;before&#x20;a&#x20;major&#x20;release.&#x20;Release&#x20;Preview&#x20;Channel&#x20;&#40;default&#41;:&#x20;Insiders&#x20;in&#x20;the&#x20;Release&#x20;Preview&#x20;Channel&#x20;will&#x20;have&#x20;access&#x20;to&#x20;the&#x20;upcoming&#x20;release&#x20;of&#x20;Windows&#x20;10&#x20;prior&#x20;to&#x20;it&#x20;being&#x20;released&#x20;to&#x20;the&#x20;world.&#x20;These&#x20;builds&#x20;are&#x20;supported&#x20;by&#x20;Microsoft.&#x20;The&#x20;Release&#x20;Preview&#x20;Channel&#x20;is&#x20;where&#x20;we&#x20;recommend&#x20;companies&#x20;preview&#x20;and&#x20;validate&#x20;upcoming&#x20;Windows&#x20;10&#x20;releases&#x20;before&#x20;broad&#x20;deployment&#x20;within&#x20;their&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Preview&#x20;Build&#x20;enrollment&#x20;requires&#x20;a&#x20;telemetry&#x20;level&#x20;setting&#x20;of&#x20;2&#x20;or&#x20;higher&#x20;and&#x20;your&#x20;domain&#x20;registered&#x20;on&#x20;insider.windows.com.&#x20;For&#x20;additional&#x20;information&#x20;on&#x20;Preview&#x20;Builds,&#x20;see:&#x20;https://aka.ms/wipforbiz','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;updates&#x20;offered&#x20;from&#x20;Windows&#x20;UpdateManage&#x20;preview&#x20;builds.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.4.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26393,'Ensure&#x20;&#039;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;180&#x20;or&#x20;more&#x20;days&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;when&#x20;Preview&#x20;Build&#x20;or&#x20;Feature&#x20;Updates&#x20;are&#x20;received.&#x20;Defer&#x20;Updates&#x20;This&#x20;enables&#x20;devices&#x20;to&#x20;defer&#x20;taking&#x20;the&#x20;next&#x20;Feature&#x20;Update&#x20;available&#x20;to&#x20;your&#x20;channel&#x20;for&#x20;up&#x20;to&#x20;14&#x20;days&#x20;for&#x20;all&#x20;the&#x20;pre-release&#x20;channels&#x20;and&#x20;up&#x20;to&#x20;365&#x20;days&#x20;for&#x20;the&#x20;Semi-Annual&#x20;Channel.&#x20;Or,&#x20;if&#x20;the&#x20;device&#x20;is&#x20;updating&#x20;from&#x20;the&#x20;Semi-Annual&#x20;Channel,&#x20;a&#x20;version&#x20;for&#x20;the&#x20;device&#x20;to&#x20;move&#x20;to&#x20;and/or&#x20;stay&#x20;on&#x20;until&#x20;the&#x20;policy&#x20;is&#x20;updated&#x20;or&#x20;the&#x20;device&#x20;reaches&#x20;end&#x20;of&#x20;service&#x20;can&#x20;be&#x20;specified.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;both&#x20;policies,&#x20;the&#x20;version&#x20;specified&#x20;will&#x20;take&#x20;precedence&#x20;and&#x20;the&#x20;deferrals&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect.&#x20;Please&#x20;see&#x20;the&#x20;Windows&#x20;Release&#x20;Information&#x20;page&#x20;for&#x20;OS&#x20;version&#x20;information.&#x20;Pause&#x20;Updates&#x20;To&#x20;prevent&#x20;Feature&#x20;Updates&#x20;from&#x20;being&#x20;received&#x20;on&#x20;their&#x20;scheduled&#x20;time,&#x20;you&#x20;can&#x20;temporarily&#x20;pause&#x20;Feature&#x20;Updates.&#x20;The&#x20;pause&#x20;will&#x20;remain&#x20;in&#x20;effect&#x20;for&#x20;35&#x20;days&#x20;from&#x20;the&#x20;specified&#x20;start&#x20;date&#x20;or&#x20;until&#x20;the&#x20;field&#x20;is&#x20;cleared&#x20;&#40;Quality&#x20;Updates&#x20;will&#x20;still&#x20;be&#x20;offered&#41;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Diagnostic&#x20;Data&quot;&#x20;&#40;formerly&#x20;&quot;Allow&#x20;Telemetry&quot;&#41;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;More&#x20;information&#x20;on&#x20;Dual&#x20;Scan&#x20;is&#x20;available&#x20;at&#x20;these&#x20;links:&#x20;-&#x20;Demystifying&#x20;&quot;Dual&#x20;Scan&quot;&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog&#x20;-&#x20;Improving&#x20;Dual&#x20;Scan&#x20;on&#x20;1607&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog&#x20;Note&#x20;#3:&#x20;Prior&#x20;to&#x20;Windows&#x20;10&#x20;R1703,&#x20;values&#x20;above&#x20;180&#x20;days&#x20;are&#x20;not&#x20;recognized&#x20;by&#x20;the&#x20;OS.&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1703,&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;days&#x20;you&#x20;can&#x20;defer&#x20;is&#x20;365&#x20;days.','In&#x20;a&#x20;production&#x20;environment,&#x20;it&#x20;is&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;software&#x20;and&#x20;features&#x20;that&#x20;are&#x20;publicly&#x20;available,&#x20;after&#x20;they&#x20;have&#x20;gone&#x20;through&#x20;rigorous&#x20;testing&#x20;in&#x20;beta.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;180&#x20;or&#x20;more&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;updates&#x20;offered&#x20;from&#x20;Windows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received.&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Select&#x20;when&#x20;Feature&#x20;Updates&#x20;are&#x20;received,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.4.2\"]}, {\"cis_csc\": [\"2.5\", \"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(26394,'Ensure&#x20;&#039;Select&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;days&#039;.','This&#x20;settings&#x20;controls&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;days.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Diagnostic&#x20;Data&quot;&#x20;&#40;formerly&#x20;&quot;Allow&#x20;Telemetry&quot;&#41;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;More&#x20;information&#x20;on&#x20;Dual&#x20;Scan&#x20;is&#x20;available&#x20;at&#x20;these&#x20;links:&#x20;-&#x20;Demystifying&#x20;&quot;Dual&#x20;Scan&quot;&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog&#x20;-&#x20;Improving&#x20;Dual&#x20;Scan&#x20;on&#x20;1607&#x20;-&#x20;WSUS&#x20;Product&#x20;Team&#x20;Blog','Quality&#x20;Updates&#x20;can&#x20;contain&#x20;important&#x20;bug&#x20;fixes&#x20;and/or&#x20;security&#x20;patches,&#x20;and&#x20;should&#x20;be&#x20;installed&#x20;as&#x20;soon&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:0&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;updated&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;WindowsUpdate.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.4.3\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(27000,'Ensure&#x20;&#039;Enforce&#x20;password&#x20;history&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;24&#x20;or&#x20;more&#x20;password&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;renewed,&#x20;unique&#x20;passwords&#x20;that&#x20;have&#x20;to&#x20;be&#x20;associated&#x20;with&#x20;a&#x20;user&#x20;account&#x20;before&#x20;you&#x20;can&#x20;reuse&#x20;an&#x20;old&#x20;password.&#x20;The&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;must&#x20;be&#x20;between&#x20;0&#x20;and&#x20;24&#x20;passwords.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;Windows&#x20;Vista&#x20;is&#x20;0&#x20;passwords,&#x20;but&#x20;the&#x20;default&#x20;setting&#x20;in&#x20;a&#x20;domain&#x20;is&#x20;24&#x20;passwords.&#x20;To&#x20;maintain&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;policy&#x20;setting,&#x20;use&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;24&#x20;or&#x20;more&#x20;password&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.&#x20;Note&#x20;#2:&#x20;As&#x20;of&#x20;the&#x20;publication&#x20;of&#x20;this&#x20;benchmark,&#x20;Microsoft&#x20;currently&#x20;has&#x20;a&#x20;maximum&#x20;limit&#x20;of&#x20;24&#x20;saved&#x20;passwords.&#x20;For&#x20;more&#x20;information,&#x20;please&#x20;visit&#x20;Enforce&#x20;password&#x20;history&#x20;&#40;Windows&#x20;10&#41;&#x20;-&#x20;Windows&#x20;security&#x20;|&#x20;Microsoft&#x20;Docs','The&#x20;longer&#x20;a&#x20;user&#x20;uses&#x20;the&#x20;same&#x20;password,&#x20;the&#x20;greater&#x20;the&#x20;chance&#x20;that&#x20;an&#x20;attacker&#x20;can&#x20;determine&#x20;the&#x20;password&#x20;through&#x20;brute&#x20;force&#x20;attacks.&#x20;Also,&#x20;any&#x20;accounts&#x20;that&#x20;may&#x20;have&#x20;been&#x20;compromised&#x20;will&#x20;remain&#x20;exploitable&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;password&#x20;is&#x20;left&#x20;unchanged.&#x20;If&#x20;password&#x20;changes&#x20;are&#x20;required&#x20;but&#x20;password&#x20;reuse&#x20;is&#x20;not&#x20;prevented,&#x20;or&#x20;if&#x20;users&#x20;continually&#x20;reuse&#x20;a&#x20;small&#x20;number&#x20;of&#x20;passwords,&#x20;the&#x20;effectiveness&#x20;of&#x20;a&#x20;good&#x20;password&#x20;policy&#x20;is&#x20;greatly&#x20;reduced.&#x20;If&#x20;you&#x20;specify&#x20;a&#x20;low&#x20;number&#x20;for&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;use&#x20;the&#x20;same&#x20;small&#x20;number&#x20;of&#x20;passwords&#x20;repeatedly.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;also&#x20;configure&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting,&#x20;users&#x20;might&#x20;repeatedly&#x20;change&#x20;their&#x20;passwords&#x20;until&#x20;they&#x20;can&#x20;reuse&#x20;their&#x20;original&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;24&#x20;or&#x20;more&#x20;password&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyEnforce&#x20;password&#x20;history','[{\"cis\": [\"1.1.1\"]}, {\"cis_csc\": [\"5.2\"]}]'),(27001,'Ensure&#x20;&#039;Maximum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;defines&#x20;how&#x20;long&#x20;a&#x20;user&#x20;can&#x20;use&#x20;their&#x20;password&#x20;before&#x20;it&#x20;expires.&#x20;Values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;range&#x20;from&#x20;0&#x20;to&#x20;999&#x20;days.&#x20;If&#x20;you&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0,&#x20;the&#x20;password&#x20;will&#x20;never&#x20;expire.&#x20;Because&#x20;attackers&#x20;can&#x20;crack&#x20;passwords,&#x20;the&#x20;more&#x20;frequently&#x20;you&#x20;change&#x20;the&#x20;password&#x20;the&#x20;less&#x20;opportunity&#x20;an&#x20;attacker&#x20;has&#x20;to&#x20;use&#x20;a&#x20;cracked&#x20;password.&#x20;However,&#x20;the&#x20;lower&#x20;this&#x20;value&#x20;is&#x20;set,&#x20;the&#x20;higher&#x20;the&#x20;potential&#x20;for&#x20;an&#x20;increase&#x20;in&#x20;calls&#x20;to&#x20;help&#x20;desk&#x20;support&#x20;due&#x20;to&#x20;users&#x20;having&#x20;to&#x20;change&#x20;their&#x20;password&#x20;or&#x20;forgetting&#x20;which&#x20;password&#x20;is&#x20;current.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','The&#x20;longer&#x20;a&#x20;password&#x20;exists&#x20;the&#x20;higher&#x20;the&#x20;likelihood&#x20;that&#x20;it&#x20;will&#x20;be&#x20;compromised&#x20;by&#x20;a&#x20;brute&#x20;force&#x20;attack,&#x20;by&#x20;an&#x20;attacker&#x20;gaining&#x20;general&#x20;knowledge&#x20;about&#x20;the&#x20;user,&#x20;or&#x20;by&#x20;the&#x20;user&#x20;sharing&#x20;the&#x20;password.&#x20;Configuring&#x20;the&#x20;Maximum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;0&#x20;so&#x20;that&#x20;users&#x20;are&#x20;never&#x20;required&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;is&#x20;a&#x20;major&#x20;security&#x20;risk&#x20;because&#x20;that&#x20;allows&#x20;a&#x20;compromised&#x20;password&#x20;to&#x20;be&#x20;used&#x20;by&#x20;the&#x20;malicious&#x20;user&#x20;for&#x20;as&#x20;long&#x20;as&#x20;the&#x20;valid&#x20;user&#x20;has&#x20;authorized&#x20;access.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;365&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMaximum&#x20;password&#x20;age','[{\"cis\": [\"1.1.2\"]}, {\"cis_csc\": [\"5.2\"]}]'),(27002,'Ensure&#x20;&#039;Minimum&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;1&#x20;or&#x20;more&#x20;day&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;days&#x20;that&#x20;you&#x20;must&#x20;use&#x20;a&#x20;password&#x20;before&#x20;you&#x20;can&#x20;change&#x20;it.&#x20;The&#x20;range&#x20;of&#x20;values&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;between&#x20;1&#x20;and&#x20;999&#x20;days.&#x20;&#40;You&#x20;may&#x20;also&#x20;set&#x20;the&#x20;value&#x20;to&#x20;0&#x20;to&#x20;allow&#x20;immediate&#x20;password&#x20;changes.&#41;&#x20;The&#x20;default&#x20;value&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;0&#x20;days.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;1&#x20;or&#x20;more&#x20;day&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Users&#x20;may&#x20;have&#x20;favorite&#x20;passwords&#x20;that&#x20;they&#x20;like&#x20;to&#x20;use&#x20;because&#x20;they&#x20;are&#x20;easy&#x20;to&#x20;remember&#x20;and&#x20;they&#x20;believe&#x20;that&#x20;their&#x20;password&#x20;choice&#x20;is&#x20;secure&#x20;from&#x20;compromise.&#x20;Unfortunately,&#x20;passwords&#x20;are&#x20;compromised&#x20;and&#x20;if&#x20;an&#x20;attacker&#x20;is&#x20;targeting&#x20;a&#x20;specific&#x20;individual&#x20;user&#x20;account,&#x20;with&#x20;foreknowledge&#x20;of&#x20;data&#x20;about&#x20;that&#x20;user,&#x20;reuse&#x20;of&#x20;old&#x20;passwords&#x20;can&#x20;cause&#x20;a&#x20;security&#x20;breach.&#x20;To&#x20;address&#x20;password&#x20;reuse&#x20;a&#x20;combination&#x20;of&#x20;security&#x20;settings&#x20;is&#x20;required.&#x20;Using&#x20;this&#x20;policy&#x20;setting&#x20;with&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;prevents&#x20;the&#x20;easy&#x20;reuse&#x20;of&#x20;old&#x20;passwords.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;configure&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;reuse&#x20;any&#x20;of&#x20;their&#x20;last&#x20;12&#x20;passwords,&#x20;they&#x20;could&#x20;change&#x20;their&#x20;password&#x20;13&#x20;times&#x20;in&#x20;a&#x20;few&#x20;minutes&#x20;and&#x20;reuse&#x20;the&#x20;password&#x20;they&#x20;started&#x20;with,&#x20;unless&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Minimum&#x20;password&#x20;age&#x20;setting&#x20;to&#x20;a&#x20;number&#x20;that&#x20;is&#x20;greater&#x20;than&#x20;0.&#x20;You&#x20;must&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;a&#x20;number&#x20;that&#x20;is&#x20;greater&#x20;than&#x20;0&#x20;for&#x20;the&#x20;Enforce&#x20;password&#x20;history&#x20;setting&#x20;to&#x20;be&#x20;effective.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;1&#x20;or&#x20;more&#x20;day&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMinimum&#x20;password&#x20;age','[{\"cis\": [\"1.1.3\"]}, {\"cis_csc\": [\"5.2\"]}]'),(27003,'Ensure&#x20;&#039;Minimum&#x20;password&#x20;length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;14&#x20;or&#x20;more&#x20;character&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;least&#x20;number&#x20;of&#x20;characters&#x20;that&#x20;make&#x20;up&#x20;a&#x20;password&#x20;for&#x20;a&#x20;user&#x20;account.&#x20;There&#x20;are&#x20;many&#x20;different&#x20;theories&#x20;about&#x20;how&#x20;to&#x20;determine&#x20;the&#x20;best&#x20;password&#x20;length&#x20;for&#x20;an&#x20;organization,&#x20;but&#x20;perhaps&#x20;&quot;passphrase&quot;&#x20;is&#x20;a&#x20;better&#x20;term&#x20;than&#x20;&quot;password.&quot;&#x20;In&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;and&#x20;newer,&#x20;passphrases&#x20;can&#x20;be&#x20;quite&#x20;long&#x20;and&#x20;can&#x20;include&#x20;spaces.&#x20;Therefore,&#x20;a&#x20;phrase&#x20;such&#x20;as&#x20;&quot;I&#x20;want&#x20;to&#x20;drink&#x20;a&#x20;$5&#x20;milkshake&quot;&#x20;is&#x20;a&#x20;valid&#x20;passphrase;&#x20;it&#x20;is&#x20;a&#x20;considerably&#x20;stronger&#x20;password&#x20;than&#x20;an&#x20;8&#x20;or&#x20;10&#x20;character&#x20;string&#x20;of&#x20;random&#x20;numbers&#x20;and&#x20;letters,&#x20;and&#x20;yet&#x20;is&#x20;easier&#x20;to&#x20;remember.&#x20;Users&#x20;must&#x20;be&#x20;educated&#x20;about&#x20;the&#x20;proper&#x20;selection&#x20;and&#x20;maintenance&#x20;of&#x20;passwords,&#x20;especially&#x20;with&#x20;regard&#x20;to&#x20;password&#x20;length.&#x20;In&#x20;enterprise&#x20;environments,&#x20;the&#x20;ideal&#x20;value&#x20;for&#x20;the&#x20;Minimum&#x20;password&#x20;length&#x20;setting&#x20;is&#x20;14&#x20;characters,&#x20;however&#x20;you&#x20;should&#x20;adjust&#x20;this&#x20;value&#x20;to&#x20;meet&#x20;your&#x20;organization&#039;s&#x20;business&#x20;requirements.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;14&#x20;or&#x20;more&#x20;character&#40;s&#41;.&#x20;Note:&#x20;In&#x20;Windows&#x20;Server&#x20;2016&#x20;and&#x20;older&#x20;versions&#x20;of&#x20;Windows&#x20;Server,&#x20;the&#x20;GUI&#x20;of&#x20;the&#x20;Local&#x20;Security&#x20;Policy&#x20;&#40;LSP&#41;,&#x20;Local&#x20;Group&#x20;Policy&#x20;Editor&#x20;&#40;LGPE&#41;&#x20;and&#x20;Group&#x20;Policy&#x20;Management&#x20;Editor&#x20;&#40;GPME&#41;&#x20;would&#x20;not&#x20;let&#x20;you&#x20;set&#x20;this&#x20;value&#x20;higher&#x20;than&#x20;14&#x20;characters.&#x20;However,&#x20;starting&#x20;with&#x20;Windows&#x20;Server&#x20;2019,&#x20;Microsoft&#x20;changed&#x20;the&#x20;GUI&#x20;to&#x20;allow&#x20;up&#x20;to&#x20;a&#x20;20&#x20;character&#x20;minimum&#x20;password&#x20;length.&#x20;Note&#x20;#2:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Types&#x20;of&#x20;password&#x20;attacks&#x20;include&#x20;dictionary&#x20;attacks&#x20;&#40;which&#x20;attempt&#x20;to&#x20;use&#x20;common&#x20;words&#x20;and&#x20;phrases&#41;&#x20;and&#x20;brute&#x20;force&#x20;attacks&#x20;&#40;which&#x20;try&#x20;every&#x20;possible&#x20;combination&#x20;of&#x20;characters&#41;.&#x20;Also,&#x20;attackers&#x20;sometimes&#x20;try&#x20;to&#x20;obtain&#x20;the&#x20;account&#x20;database&#x20;so&#x20;they&#x20;can&#x20;use&#x20;tools&#x20;to&#x20;discover&#x20;the&#x20;accounts&#x20;and&#x20;passwords.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;14&#x20;or&#x20;more&#x20;character&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyMinimum&#x20;password&#x20;length','[{\"cis\": [\"1.1.4\"]}, {\"cis_csc\": [\"5.2\"]}]'),(27004,'Ensure&#x20;&#039;Password&#x20;must&#x20;meet&#x20;complexity&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;checks&#x20;all&#x20;new&#x20;passwords&#x20;to&#x20;ensure&#x20;that&#x20;they&#x20;meet&#x20;basic&#x20;requirements&#x20;for&#x20;strong&#x20;passwords.&#x20;When&#x20;this&#x20;policy&#x20;is&#x20;enabled,&#x20;passwords&#x20;must&#x20;meet&#x20;the&#x20;following&#x20;minimum&#x20;requirements:&#x20;&#x20;-&#x20;&#x20;Not&#x20;contain&#x20;the&#x20;user&#039;s&#x20;account&#x20;name&#x20;or&#x20;parts&#x20;of&#x20;the&#x20;user&#039;s&#x20;full&#x20;name&#x20;that&#x20;exceed&#x20;two&#x20;&#x20;consecutive&#x20;characters&#x20;&#x20;-&#x20;&#x20;Be&#x20;at&#x20;least&#x20;six&#x20;characters&#x20;in&#x20;length&#x20;&#x20;-&#x20;&#x20;Contain&#x20;characters&#x20;from&#x20;three&#x20;of&#x20;the&#x20;following&#x20;categories:&#x20;&#x20;&#x20;o&#x20;English&#x20;uppercase&#x20;characters&#x20;&#40;A&#x20;through&#x20;Z&#41;&#x20;&#x20;&#x20;o&#x20;English&#x20;lowercase&#x20;characters&#x20;&#40;a&#x20;through&#x20;z&#41;&#x20;&#x20;&#x20;o&#x20;Base&#x20;10&#x20;digits&#x20;&#40;0&#x20;through&#x20;9&#41;&#x20;&#x20;&#x20;o&#x20;Non-alphabetic&#x20;characters&#x20;&#40;for&#x20;example,&#x20;!,&#x20;$,&#x20;#,&#x20;%&#41;&#x20;&#x20;&#x20;o&#x20;A&#x20;catch-all&#x20;category&#x20;of&#x20;any&#x20;Unicode&#x20;character&#x20;that&#x20;does&#x20;not&#x20;fall&#x20;under&#x20;the&#x20;&#x20;&#x20;&#x20;previous&#x20;four&#x20;categories.&#x20;This&#x20;fifth&#x20;category&#x20;can&#x20;be&#x20;regionally&#x20;specific.&#x20;Each&#x20;additional&#x20;character&#x20;in&#x20;a&#x20;password&#x20;increases&#x20;its&#x20;complexity&#x20;exponentially.&#x20;For&#x20;instance,&#x20;a&#x20;seven-character,&#x20;all&#x20;lower-case&#x20;alphabetic&#x20;password&#x20;would&#x20;have&#x20;267&#x20;&#40;approximately&#x20;8&#x20;x&#x20;109&#x20;or&#x20;8&#x20;billion&#41;&#x20;possible&#x20;combinations.&#x20;At&#x20;1,000,000&#x20;attempts&#x20;per&#x20;second&#x20;&#40;a&#x20;capability&#x20;of&#x20;many&#x20;password-cracking&#x20;utilities&#41;,&#x20;it&#x20;would&#x20;only&#x20;take&#x20;133&#x20;minutes&#x20;to&#x20;crack.&#x20;A&#x20;seven-character&#x20;alphabetic&#x20;password&#x20;with&#x20;case&#x20;sensitivity&#x20;has&#x20;527&#x20;combinations.&#x20;A&#x20;seven-character&#x20;case-sensitive&#x20;alphanumeric&#x20;password&#x20;without&#x20;punctuation&#x20;has&#x20;627&#x20;combinations.&#x20;An&#x20;eight-character&#x20;password&#x20;has&#x20;268&#x20;&#40;or&#x20;2&#x20;x&#x20;1011&#41;&#x20;possible&#x20;combinations.&#x20;Although&#x20;this&#x20;might&#x20;seem&#x20;to&#x20;be&#x20;a&#x20;large&#x20;number,&#x20;at&#x20;1,000,000&#x20;attempts&#x20;per&#x20;second&#x20;it&#x20;would&#x20;take&#x20;only&#x20;59&#x20;hours&#x20;to&#x20;try&#x20;all&#x20;possible&#x20;passwords.&#x20;Remember,&#x20;these&#x20;times&#x20;will&#x20;significantly&#x20;increase&#x20;for&#x20;passwords&#x20;that&#x20;use&#x20;ALT&#x20;characters&#x20;and&#x20;other&#x20;special&#x20;keyboard&#x20;characters&#x20;such&#x20;as&#x20;&quot;!&quot;&#x20;or&#x20;&quot;@&quot;.&#x20;Proper&#x20;use&#x20;of&#x20;the&#x20;password&#x20;settings&#x20;can&#x20;help&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;mount&#x20;a&#x20;brute&#x20;force&#x20;attack.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Passwords&#x20;that&#x20;contain&#x20;only&#x20;alphanumeric&#x20;characters&#x20;are&#x20;extremely&#x20;easy&#x20;to&#x20;discover&#x20;with&#x20;several&#x20;publicly&#x20;available&#x20;tools.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyPassword&#x20;must&#x20;meet&#x20;complexity&#x20;requirements','[{\"cis\": [\"1.1.5\"]}, {\"cis_csc\": [\"5.2\"]}]'),(27005,'Ensure&#x20;&#039;Relax&#x20;minimum&#x20;password&#x20;length&#x20;limits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;minimum&#x20;password&#x20;length&#x20;setting&#x20;can&#x20;be&#x20;increased&#x20;beyond&#x20;the&#x20;legacy&#x20;limit&#x20;of&#x20;14&#x20;characters.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;only&#x20;affects&#x20;local&#x20;accounts&#x20;on&#x20;the&#x20;computer.&#x20;Domain&#x20;accounts&#x20;are&#x20;only&#x20;affected&#x20;by&#x20;settings&#x20;on&#x20;the&#x20;Domain&#x20;Controllers,&#x20;because&#x20;that&#x20;is&#x20;where&#x20;domain&#x20;accounts&#x20;are&#x20;stored.','This&#x20;setting&#x20;will&#x20;enable&#x20;the&#x20;enforcement&#x20;of&#x20;longer&#x20;and&#x20;generally&#x20;stronger&#x20;passwords&#x20;or&#x20;passphrases&#x20;where&#x20;MFA&#x20;is&#x20;not&#x20;in&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesPassword&#x20;PolicyRelax&#x20;minimum&#x20;password&#x20;length&#x20;limits&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;available&#x20;within&#x20;the&#x20;built-in&#x20;OS&#x20;security&#x20;template&#x20;of&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;and&#x20;Server&#x20;2022&#x20;&#40;or&#x20;newer&#41;,&#x20;and&#x20;is&#x20;not&#x20;available&#x20;via&#x20;older&#x20;versions&#x20;of&#x20;the&#x20;OS,&#x20;or&#x20;via&#x20;downloadable&#x20;Administrative&#x20;Templates&#x20;&#40;ADMX/ADML&#41;.&#x20;Therefore,&#x20;you&#x20;must&#x20;use&#x20;a&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;or&#x20;Server&#x20;2022&#x20;system&#x20;&#40;or&#x20;newer&#41;&#x20;to&#x20;view&#x20;or&#x20;edit&#x20;this&#x20;setting&#x20;with&#x20;the&#x20;Group&#x20;Policy&#x20;Management&#x20;Console&#x20;&#40;GPMC&#41;&#x20;or&#x20;Group&#x20;Policy&#x20;Management&#x20;Editor&#x20;&#40;GPME&#41;.','[{\"cis\": [\"1.1.6\"]}, {\"cis_csc\": [\"5.2\"]}]'),(27006,'Ensure&#x20;&#039;Account&#x20;lockout&#x20;duration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;length&#x20;of&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;before&#x20;a&#x20;locked&#x20;account&#x20;is&#x20;unlocked&#x20;and&#x20;a&#x20;user&#x20;can&#x20;try&#x20;to&#x20;log&#x20;on&#x20;again.&#x20;The&#x20;setting&#x20;does&#x20;this&#x20;by&#x20;specifying&#x20;the&#x20;number&#x20;of&#x20;minutes&#x20;a&#x20;locked&#x20;out&#x20;account&#x20;will&#x20;remain&#x20;unavailable.&#x20;If&#x20;the&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;0,&#x20;locked&#x20;out&#x20;accounts&#x20;will&#x20;remain&#x20;locked&#x20;out&#x20;until&#x20;an&#x20;administrator&#x20;manually&#x20;unlocks&#x20;them.&#x20;Although&#x20;it&#x20;might&#x20;seem&#x20;like&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;configure&#x20;the&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;a&#x20;high&#x20;value,&#x20;such&#x20;a&#x20;configuration&#x20;will&#x20;likely&#x20;increase&#x20;the&#x20;number&#x20;of&#x20;calls&#x20;that&#x20;the&#x20;help&#x20;desk&#x20;receives&#x20;to&#x20;unlock&#x20;accounts&#x20;locked&#x20;by&#x20;mistake.&#x20;Users&#x20;should&#x20;be&#x20;aware&#x20;of&#x20;the&#x20;length&#x20;of&#x20;time&#x20;a&#x20;lock&#x20;remains&#x20;in&#x20;place,&#x20;so&#x20;that&#x20;they&#x20;realize&#x20;they&#x20;only&#x20;need&#x20;to&#x20;call&#x20;the&#x20;help&#x20;desk&#x20;if&#x20;they&#x20;have&#x20;an&#x20;extremely&#x20;urgent&#x20;need&#x20;to&#x20;regain&#x20;access&#x20;to&#x20;their&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','A&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;condition&#x20;can&#x20;be&#x20;created&#x20;if&#x20;an&#x20;attacker&#x20;abuses&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;and&#x20;repeatedly&#x20;attempts&#x20;to&#x20;log&#x20;on&#x20;with&#x20;a&#x20;specific&#x20;account.&#x20;Once&#x20;you&#x20;configure&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;setting,&#x20;the&#x20;account&#x20;will&#x20;be&#x20;locked&#x20;out&#x20;after&#x20;the&#x20;specified&#x20;number&#x20;of&#x20;failed&#x20;attempts.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Account&#x20;lockout&#x20;duration&#x20;setting&#x20;to&#x20;0,&#x20;then&#x20;the&#x20;account&#x20;will&#x20;remain&#x20;locked&#x20;out&#x20;until&#x20;an&#x20;administrator&#x20;unlocks&#x20;it&#x20;manually.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyAccount&#x20;lockout&#x20;duration','[{\"cis\": [\"1.2.1\"]}, {\"cis_csc\": [\"4.10\"]}]'),(27007,'Ensure&#x20;&#039;Account&#x20;lockout&#x20;threshold&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;5&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;Setting&#x20;this&#x20;policy&#x20;to&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;doing&#x20;so&#x20;disables&#x20;the&#x20;account&#x20;lockout&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;5&#x20;or&#x20;fewer&#x20;invalid&#x20;logon&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Setting&#x20;an&#x20;account&#x20;lockout&#x20;threshold&#x20;reduces&#x20;the&#x20;likelihood&#x20;that&#x20;an&#x20;online&#x20;password&#x20;brute&#x20;force&#x20;attack&#x20;will&#x20;be&#x20;successful.&#x20;Setting&#x20;the&#x20;account&#x20;lockout&#x20;threshold&#x20;too&#x20;low&#x20;introduces&#x20;risk&#x20;of&#x20;increased&#x20;accidental&#x20;lockouts&#x20;and/or&#x20;a&#x20;malicious&#x20;actor&#x20;intentionally&#x20;locking&#x20;out&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;5&#x20;or&#x20;fewer&#x20;invalid&#x20;login&#x20;attempt&#40;s&#41;,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyAccount&#x20;lockout&#x20;threshold','[{\"cis\": [\"1.2.2\"]}, {\"cis_csc\": [\"4.10\"]}]'),(27008,'Ensure&#x20;&#039;Reset&#x20;account&#x20;lockout&#x20;counter&#x20;after&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;length&#x20;of&#x20;time&#x20;before&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;resets&#x20;to&#x20;zero.&#x20;The&#x20;default&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;Not&#x20;Defined.&#x20;If&#x20;the&#x20;Account&#x20;lockout&#x20;threshold&#x20;is&#x20;defined,&#x20;this&#x20;reset&#x20;time&#x20;must&#x20;be&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;the&#x20;value&#x20;for&#x20;the&#x20;Account&#x20;lockout&#x20;duration&#x20;setting.&#x20;If&#x20;you&#x20;leave&#x20;this&#x20;policy&#x20;setting&#x20;at&#x20;its&#x20;default&#x20;value&#x20;or&#x20;configure&#x20;the&#x20;value&#x20;to&#x20;an&#x20;interval&#x20;that&#x20;is&#x20;too&#x20;long,&#x20;your&#x20;environment&#x20;could&#x20;be&#x20;vulnerable&#x20;to&#x20;a&#x20;DoS&#x20;attack.&#x20;An&#x20;attacker&#x20;could&#x20;maliciously&#x20;perform&#x20;a&#x20;number&#x20;of&#x20;failed&#x20;logon&#x20;attempts&#x20;on&#x20;all&#x20;users&#x20;in&#x20;the&#x20;organization,&#x20;which&#x20;will&#x20;lock&#x20;out&#x20;their&#x20;accounts.&#x20;If&#x20;no&#x20;policy&#x20;were&#x20;determined&#x20;to&#x20;reset&#x20;the&#x20;account&#x20;lockout,&#x20;it&#x20;would&#x20;be&#x20;a&#x20;manual&#x20;task&#x20;for&#x20;administrators.&#x20;Conversely,&#x20;if&#x20;a&#x20;reasonable&#x20;time&#x20;value&#x20;is&#x20;configured&#x20;for&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;would&#x20;be&#x20;locked&#x20;out&#x20;for&#x20;a&#x20;set&#x20;period&#x20;until&#x20;all&#x20;of&#x20;the&#x20;accounts&#x20;are&#x20;unlocked&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;.&#x20;Note:&#x20;Password&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.1&#41;&#x20;and&#x20;Account&#x20;Lockout&#x20;Policy&#x20;settings&#x20;&#40;section&#x20;1.2&#41;&#x20;must&#x20;be&#x20;applied&#x20;via&#x20;the&#x20;Default&#x20;Domain&#x20;Policy&#x20;GPO&#x20;in&#x20;order&#x20;to&#x20;be&#x20;globally&#x20;in&#x20;effect&#x20;on&#x20;domain&#x20;user&#x20;accounts&#x20;as&#x20;their&#x20;default&#x20;behavior.&#x20;If&#x20;these&#x20;settings&#x20;are&#x20;configured&#x20;in&#x20;another&#x20;GPO,&#x20;they&#x20;will&#x20;only&#x20;affect&#x20;local&#x20;user&#x20;accounts&#x20;on&#x20;the&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO.&#x20;However,&#x20;custom&#x20;exceptions&#x20;to&#x20;the&#x20;default&#x20;password&#x20;policy&#x20;and&#x20;account&#x20;lockout&#x20;policy&#x20;rules&#x20;for&#x20;specific&#x20;domain&#x20;users&#x20;and/or&#x20;groups&#x20;can&#x20;be&#x20;defined&#x20;using&#x20;Password&#x20;Settings&#x20;Objects&#x20;&#40;PSOs&#41;,&#x20;which&#x20;are&#x20;completely&#x20;separate&#x20;from&#x20;Group&#x20;Policy&#x20;and&#x20;most&#x20;easily&#x20;configured&#x20;using&#x20;Active&#x20;Directory&#x20;Administrative&#x20;Center.','Users&#x20;can&#x20;accidentally&#x20;lock&#x20;themselves&#x20;out&#x20;of&#x20;their&#x20;accounts&#x20;if&#x20;they&#x20;mistype&#x20;their&#x20;password&#x20;multiple&#x20;times.&#x20;To&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;such&#x20;accidental&#x20;lockouts,&#x20;the&#x20;Reset&#x20;account&#x20;lockout&#x20;counter&#x20;after&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;minutes&#x20;that&#x20;must&#x20;elapse&#x20;before&#x20;the&#x20;counter&#x20;that&#x20;tracks&#x20;failed&#x20;logon&#x20;attempts&#x20;and&#x20;triggers&#x20;lockouts&#x20;is&#x20;reset&#x20;to&#x20;0.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;more&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAccount&#x20;PoliciesAccount&#x20;Lockout&#x20;PolicyReset&#x20;account&#x20;lockout&#x20;counter&#x20;after','[{\"cis\": [\"1.2.3\"]}, {\"cis_csc\": [\"4.10\"]}]'),(27009,'Ensure&#x20;&#039;Accounts:&#x20;Administrator&#x20;account&#x20;status&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;or&#x20;disables&#x20;the&#x20;Administrator&#x20;account&#x20;during&#x20;normal&#x20;operation.&#x20;When&#x20;a&#x20;computer&#x20;is&#x20;booted&#x20;into&#x20;safe&#x20;mode,&#x20;the&#x20;Administrator&#x20;account&#x20;is&#x20;always&#x20;enabled,&#x20;regardless&#x20;of&#x20;how&#x20;this&#x20;setting&#x20;is&#x20;configured.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;when&#x20;applied&#x20;to&#x20;the&#x20;Domain&#x20;Controllers&#x20;organizational&#x20;unit&#x20;via&#x20;group&#x20;policy&#x20;because&#x20;Domain&#x20;Controllers&#x20;have&#x20;no&#x20;local&#x20;account&#x20;database.&#x20;It&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;domain&#x20;level&#x20;via&#x20;group&#x20;policy,&#x20;similar&#x20;to&#x20;account&#x20;lockout&#x20;and&#x20;password&#x20;policy&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;some&#x20;organizations,&#x20;it&#x20;can&#x20;be&#x20;a&#x20;daunting&#x20;management&#x20;challenge&#x20;to&#x20;maintain&#x20;a&#x20;regular&#x20;schedule&#x20;for&#x20;periodic&#x20;password&#x20;changes&#x20;for&#x20;local&#x20;accounts.&#x20;Therefore,&#x20;you&#x20;may&#x20;want&#x20;to&#x20;disable&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;instead&#x20;of&#x20;relying&#x20;on&#x20;regular&#x20;password&#x20;changes&#x20;to&#x20;protect&#x20;it&#x20;from&#x20;attack.&#x20;Another&#x20;reason&#x20;to&#x20;disable&#x20;this&#x20;built-in&#x20;account&#x20;is&#x20;that&#x20;it&#x20;cannot&#x20;be&#x20;locked&#x20;out&#x20;no&#x20;matter&#x20;how&#x20;many&#x20;failed&#x20;logons&#x20;it&#x20;accrues,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;prime&#x20;target&#x20;for&#x20;brute&#x20;force&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;guess&#x20;passwords.&#x20;Also,&#x20;this&#x20;account&#x20;has&#x20;a&#x20;well-known&#x20;security&#x20;identifier&#x20;&#40;SID&#41;&#x20;and&#x20;there&#x20;are&#x20;third-party&#x20;tools&#x20;that&#x20;allow&#x20;authentication&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;rather&#x20;than&#x20;the&#x20;account&#x20;name.&#x20;This&#x20;capability&#x20;means&#x20;that&#x20;even&#x20;if&#x20;you&#x20;rename&#x20;the&#x20;Administrator&#x20;account,&#x20;an&#x20;attacker&#x20;could&#x20;launch&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Administrator&#x20;account&#x20;status','[{\"cis\": [\"2.3.1.1\"]}, {\"cis_csc\": [\"4.7\"]}]'),(27010,'Ensure&#x20;&#039;Accounts:&#x20;Block&#x20;Microsoft&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;adding&#x20;new&#x20;Microsoft&#x20;accounts&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;onto&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Users&#x20;can&#039;t&#x20;add&#x20;or&#x20;log&#x20;on&#x20;with&#x20;Microsoft&#x20;accounts:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Block&#x20;Microsoft&#x20;accounts','[{\"cis\": [\"2.3.1.2\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27011,'Ensure&#x20;&#039;Accounts:&#x20;Guest&#x20;account&#x20;status&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;enabled&#x20;or&#x20;disabled.&#x20;The&#x20;Guest&#x20;account&#x20;allows&#x20;unauthenticated&#x20;network&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;when&#x20;applied&#x20;to&#x20;the&#x20;Domain&#x20;Controllers&#x20;organizational&#x20;unit&#x20;via&#x20;group&#x20;policy&#x20;because&#x20;Domain&#x20;Controllers&#x20;have&#x20;no&#x20;local&#x20;account&#x20;database.&#x20;It&#x20;can&#x20;be&#x20;configured&#x20;at&#x20;the&#x20;domain&#x20;level&#x20;via&#x20;group&#x20;policy,&#x20;similar&#x20;to&#x20;account&#x20;lockout&#x20;and&#x20;password&#x20;policy&#x20;settings.','The&#x20;default&#x20;Guest&#x20;account&#x20;allows&#x20;unauthenticated&#x20;network&#x20;users&#x20;to&#x20;log&#x20;on&#x20;as&#x20;Guest&#x20;with&#x20;no&#x20;password.&#x20;These&#x20;unauthorized&#x20;users&#x20;could&#x20;access&#x20;any&#x20;resources&#x20;that&#x20;are&#x20;accessible&#x20;to&#x20;the&#x20;Guest&#x20;account&#x20;over&#x20;the&#x20;network.&#x20;This&#x20;capability&#x20;means&#x20;that&#x20;any&#x20;network&#x20;shares&#x20;with&#x20;permissions&#x20;that&#x20;allow&#x20;access&#x20;to&#x20;the&#x20;Guest&#x20;account,&#x20;the&#x20;Guests&#x20;group,&#x20;or&#x20;the&#x20;Everyone&#x20;group&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Guest&#x20;account&#x20;status','[{\"cis\": [\"2.3.1.3\"]}, {\"cis_csc\": [\"4.7\"]}]'),(27012,'Ensure&#x20;&#039;Accounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;local&#x20;accounts&#x20;that&#x20;are&#x20;not&#x20;password&#x20;protected&#x20;can&#x20;be&#x20;used&#x20;to&#x20;log&#x20;on&#x20;from&#x20;locations&#x20;other&#x20;than&#x20;the&#x20;physical&#x20;computer&#x20;console.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;local&#x20;accounts&#x20;that&#x20;have&#x20;blank&#x20;passwords&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;network&#x20;from&#x20;remote&#x20;client&#x20;computers.&#x20;Such&#x20;accounts&#x20;will&#x20;only&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;at&#x20;the&#x20;keyboard&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Blank&#x20;passwords&#x20;are&#x20;a&#x20;serious&#x20;threat&#x20;to&#x20;computer&#x20;security&#x20;and&#x20;should&#x20;be&#x20;forbidden&#x20;through&#x20;both&#x20;organizational&#x20;policy&#x20;and&#x20;suitable&#x20;technical&#x20;measures.&#x20;In&#x20;fact,&#x20;the&#x20;default&#x20;settings&#x20;for&#x20;Active&#x20;Directory&#x20;domains&#x20;require&#x20;complex&#x20;passwords&#x20;of&#x20;at&#x20;least&#x20;seven&#x20;characters.&#x20;However,&#x20;if&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;create&#x20;new&#x20;accounts&#x20;bypass&#x20;your&#x20;domain-&#x20;based&#x20;password&#x20;policies,&#x20;they&#x20;could&#x20;create&#x20;accounts&#x20;with&#x20;blank&#x20;passwords.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;could&#x20;build&#x20;a&#x20;stand-alone&#x20;computer,&#x20;create&#x20;one&#x20;or&#x20;more&#x20;accounts&#x20;with&#x20;blank&#x20;passwords,&#x20;and&#x20;then&#x20;join&#x20;the&#x20;computer&#x20;to&#x20;the&#x20;domain.&#x20;The&#x20;local&#x20;accounts&#x20;with&#x20;blank&#x20;passwords&#x20;would&#x20;still&#x20;function.&#x20;Anyone&#x20;who&#x20;knows&#x20;the&#x20;name&#x20;of&#x20;one&#x20;of&#x20;these&#x20;unprotected&#x20;accounts&#x20;could&#x20;then&#x20;use&#x20;it&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Limit&#x20;local&#x20;account&#x20;use&#x20;of&#x20;blank&#x20;passwords&#x20;to&#x20;console&#x20;logon&#x20;only','[{\"cis\": [\"2.3.1.4\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27013,'Configure&#x20;&#039;Accounts:&#x20;Rename&#x20;administrator&#x20;account&#039;.','The&#x20;built-in&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;a&#x20;well-known&#x20;account&#x20;name&#x20;that&#x20;attackers&#x20;will&#x20;target.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;choose&#x20;another&#x20;name&#x20;for&#x20;this&#x20;account,&#x20;and&#x20;to&#x20;avoid&#x20;names&#x20;that&#x20;denote&#x20;administrative&#x20;or&#x20;elevated&#x20;access&#x20;accounts.&#x20;Be&#x20;sure&#x20;to&#x20;also&#x20;change&#x20;the&#x20;default&#x20;description&#x20;for&#x20;the&#x20;local&#x20;administrator&#x20;&#40;through&#x20;the&#x20;Computer&#x20;Management&#x20;console&#41;.&#x20;On&#x20;Domain&#x20;Controllers,&#x20;since&#x20;they&#x20;do&#x20;not&#x20;have&#x20;their&#x20;own&#x20;local&#x20;accounts,&#x20;this&#x20;rule&#x20;refers&#x20;to&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;that&#x20;was&#x20;established&#x20;when&#x20;the&#x20;domain&#x20;was&#x20;first&#x20;created.','The&#x20;Administrator&#x20;account&#x20;exists&#x20;on&#x20;all&#x20;computers&#x20;that&#x20;run&#x20;the&#x20;Windows&#x20;2000&#x20;or&#x20;newer&#x20;operating&#x20;systems.&#x20;If&#x20;you&#x20;rename&#x20;this&#x20;account,&#x20;it&#x20;is&#x20;slightly&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;guess&#x20;this&#x20;privileged&#x20;user&#x20;name&#x20;and&#x20;password&#x20;combination.&#x20;The&#x20;built-in&#x20;Administrator&#x20;account&#x20;cannot&#x20;be&#x20;locked&#x20;out,&#x20;regardless&#x20;of&#x20;how&#x20;many&#x20;times&#x20;an&#x20;attacker&#x20;might&#x20;use&#x20;a&#x20;bad&#x20;password.&#x20;This&#x20;capability&#x20;makes&#x20;the&#x20;Administrator&#x20;account&#x20;a&#x20;popular&#x20;target&#x20;for&#x20;brute&#x20;force&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;guess&#x20;passwords.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;lessened&#x20;because&#x20;this&#x20;account&#x20;has&#x20;a&#x20;well-known&#x20;SID,&#x20;and&#x20;there&#x20;are&#x20;third-party&#x20;tools&#x20;that&#x20;allow&#x20;authentication&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;rather&#x20;than&#x20;the&#x20;account&#x20;name.&#x20;Therefore,&#x20;even&#x20;if&#x20;you&#x20;rename&#x20;the&#x20;Administrator&#x20;account,&#x20;an&#x20;attacker&#x20;could&#x20;launch&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;by&#x20;using&#x20;the&#x20;SID&#x20;to&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Rename&#x20;administrator&#x20;account','[{\"cis\": [\"2.3.1.5\"]}, {\"cis_csc\": [\"4.7\"]}]'),(27014,'Configure&#x20;&#039;Accounts:&#x20;Rename&#x20;guest&#x20;account&#039;.','The&#x20;built-in&#x20;local&#x20;guest&#x20;account&#x20;is&#x20;another&#x20;well-known&#x20;name&#x20;to&#x20;attackers.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;rename&#x20;this&#x20;account&#x20;to&#x20;something&#x20;that&#x20;does&#x20;not&#x20;indicate&#x20;its&#x20;purpose.&#x20;Even&#x20;if&#x20;you&#x20;disable&#x20;this&#x20;account,&#x20;which&#x20;is&#x20;recommended,&#x20;ensure&#x20;that&#x20;you&#x20;rename&#x20;it&#x20;for&#x20;added&#x20;security.&#x20;On&#x20;Domain&#x20;Controllers,&#x20;since&#x20;they&#x20;do&#x20;not&#x20;have&#x20;their&#x20;own&#x20;local&#x20;accounts,&#x20;this&#x20;rule&#x20;refers&#x20;to&#x20;the&#x20;built-in&#x20;Guest&#x20;account&#x20;that&#x20;was&#x20;established&#x20;when&#x20;the&#x20;domain&#x20;was&#x20;first&#x20;created.','The&#x20;Guest&#x20;account&#x20;exists&#x20;on&#x20;all&#x20;computers&#x20;that&#x20;run&#x20;the&#x20;Windows&#x20;2000&#x20;or&#x20;newer&#x20;operating&#x20;systems.&#x20;If&#x20;you&#x20;rename&#x20;this&#x20;account,&#x20;it&#x20;is&#x20;slightly&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;guess&#x20;this&#x20;privileged&#x20;user&#x20;name&#x20;and&#x20;password&#x20;combination.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAccounts:&#x20;Rename&#x20;guest&#x20;account','[{\"cis\": [\"2.3.1.6\"]}, {\"cis_csc\": [\"4.7\"]}]'),(27015,'Ensure&#x20;&#039;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#0','This&#x20;policy&#x20;setting&#x20;allows&#x20;administrators&#x20;to&#x20;enable&#x20;the&#x20;more&#x20;precise&#x20;auditing&#x20;capabilities&#x20;present&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;Audit&#x20;Policy&#x20;settings&#x20;available&#x20;in&#x20;Windows&#x20;Server&#x20;2003&#x20;Active&#x20;Directory&#x20;do&#x20;not&#x20;yet&#x20;contain&#x20;settings&#x20;for&#x20;managing&#x20;the&#x20;new&#x20;auditing&#x20;subcategories.&#x20;To&#x20;properly&#x20;apply&#x20;the&#x20;auditing&#x20;policies&#x20;prescribed&#x20;in&#x20;this&#x20;baseline,&#x20;the&#x20;Audit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings&#x20;setting&#x20;needs&#x20;to&#x20;be&#x20;configured&#x20;to&#x20;Enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Important:&#x20;Be&#x20;very&#x20;cautious&#x20;about&#x20;audit&#x20;settings&#x20;that&#x20;can&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;traffic.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;enable&#x20;either&#x20;success&#x20;or&#x20;failure&#x20;auditing&#x20;for&#x20;all&#x20;of&#x20;the&#x20;Privilege&#x20;Use&#x20;subcategories,&#x20;the&#x20;high&#x20;volume&#x20;of&#x20;audit&#x20;events&#x20;generated&#x20;can&#x20;make&#x20;it&#x20;difficult&#x20;to&#x20;find&#x20;other&#x20;types&#x20;of&#x20;entries&#x20;in&#x20;the&#x20;Security&#x20;log.&#x20;Such&#x20;a&#x20;configuration&#x20;could&#x20;also&#x20;have&#x20;a&#x20;significant&#x20;impact&#x20;on&#x20;system&#x20;performance.','Prior&#x20;to&#x20;the&#x20;introduction&#x20;of&#x20;auditing&#x20;subcategories&#x20;in&#x20;Windows&#x20;Vista,&#x20;it&#x20;was&#x20;difficult&#x20;to&#x20;track&#x20;events&#x20;at&#x20;a&#x20;per-system&#x20;or&#x20;per-user&#x20;level.&#x20;The&#x20;larger&#x20;event&#x20;categories&#x20;created&#x20;too&#x20;many&#x20;events&#x20;and&#x20;the&#x20;key&#x20;information&#x20;that&#x20;needed&#x20;to&#x20;be&#x20;audited&#x20;was&#x20;difficult&#x20;to&#x20;find.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Force&#x20;audit&#x20;policy&#x20;subcategory&#x20;settings&#x20;&#40;Windows&#x20;Vista&#x20;or&#x20;later&#41;&#x20;to&#x20;override&#x20;audit&#x20;policy&#x20;category&#x20;settings','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc\": [\"8.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27016,'Ensure&#x20;&#039;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;system&#x20;shuts&#x20;down&#x20;if&#x20;it&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;Security&#x20;events.&#x20;It&#x20;is&#x20;a&#x20;requirement&#x20;for&#x20;Trusted&#x20;Computer&#x20;System&#x20;Evaluation&#x20;Criteria&#x20;&#40;TCSEC&#41;-C2&#x20;and&#x20;Common&#x20;Criteria&#x20;certification&#x20;to&#x20;prevent&#x20;auditable&#x20;events&#x20;from&#x20;occurring&#x20;if&#x20;the&#x20;audit&#x20;system&#x20;is&#x20;unable&#x20;to&#x20;log&#x20;them.&#x20;Microsoft&#x20;has&#x20;chosen&#x20;to&#x20;meet&#x20;this&#x20;requirement&#x20;by&#x20;halting&#x20;the&#x20;system&#x20;and&#x20;displaying&#x20;a&#x20;stop&#x20;message&#x20;if&#x20;the&#x20;auditing&#x20;system&#x20;experiences&#x20;a&#x20;failure.&#x20;When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;system&#x20;will&#x20;be&#x20;shut&#x20;down&#x20;if&#x20;a&#x20;security&#x20;audit&#x20;cannot&#x20;be&#x20;logged&#x20;for&#x20;any&#x20;reason.&#x20;If&#x20;the&#x20;Audit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits&#x20;setting&#x20;is&#x20;enabled,&#x20;unplanned&#x20;system&#x20;failures&#x20;can&#x20;occur.&#x20;The&#x20;administrative&#x20;burden&#x20;can&#x20;be&#x20;significant,&#x20;especially&#x20;if&#x20;you&#x20;also&#x20;configure&#x20;the&#x20;Retention&#x20;method&#x20;for&#x20;the&#x20;Security&#x20;log&#x20;to&#x20;Do&#x20;not&#x20;overwrite&#x20;events&#x20;&#40;clear&#x20;log&#x20;manually&#41;.&#x20;This&#x20;configuration&#x20;causes&#x20;a&#x20;repudiation&#x20;threat&#x20;&#40;a&#x20;backup&#x20;operator&#x20;could&#x20;deny&#x20;that&#x20;they&#x20;backed&#x20;up&#x20;or&#x20;restored&#x20;data&#41;&#x20;to&#x20;become&#x20;a&#x20;denial&#x20;of&#x20;service&#x20;&#40;DoS&#41;&#x20;vulnerability,&#x20;because&#x20;a&#x20;server&#x20;could&#x20;be&#x20;forced&#x20;to&#x20;shut&#x20;down&#x20;if&#x20;it&#x20;is&#x20;overwhelmed&#x20;with&#x20;logon&#x20;events&#x20;and&#x20;other&#x20;security&#x20;events&#x20;that&#x20;are&#x20;written&#x20;to&#x20;the&#x20;Security&#x20;log.&#x20;Also,&#x20;because&#x20;the&#x20;shutdown&#x20;is&#x20;not&#x20;graceful,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;irreparable&#x20;damage&#x20;to&#x20;the&#x20;operating&#x20;system,&#x20;applications,&#x20;or&#x20;data&#x20;could&#x20;result.&#x20;Although&#x20;the&#x20;NTFS&#x20;file&#x20;system&#x20;guarantees&#x20;its&#x20;integrity&#x20;when&#x20;an&#x20;ungraceful&#x20;computer&#x20;shutdown&#x20;occurs,&#x20;it&#x20;cannot&#x20;guarantee&#x20;that&#x20;every&#x20;data&#x20;file&#x20;for&#x20;every&#x20;application&#x20;will&#x20;still&#x20;be&#x20;in&#x20;a&#x20;usable&#x20;form&#x20;when&#x20;the&#x20;computer&#x20;restarts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;the&#x20;computer&#x20;is&#x20;unable&#x20;to&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;critical&#x20;evidence&#x20;or&#x20;important&#x20;troubleshooting&#x20;information&#x20;may&#x20;not&#x20;be&#x20;available&#x20;for&#x20;review&#x20;after&#x20;a&#x20;security&#x20;incident.&#x20;Also,&#x20;an&#x20;attacker&#x20;could&#x20;potentially&#x20;generate&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;Security&#x20;log&#x20;events&#x20;to&#x20;purposely&#x20;force&#x20;a&#x20;computer&#x20;shutdown.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsAudit:&#x20;Shut&#x20;down&#x20;system&#x20;immediately&#x20;if&#x20;unable&#x20;to&#x20;log&#x20;security&#x20;audits','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(27017,'Ensure&#x20;&#039;Devices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;NTFS&#x20;media.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;unauthorized&#x20;users&#x20;from&#x20;removing&#x20;data&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;access&#x20;it&#x20;on&#x20;another&#x20;computer&#x20;on&#x20;which&#x20;they&#x20;have&#x20;local&#x20;administrator&#x20;privileges.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators.','Users&#x20;may&#x20;be&#x20;able&#x20;to&#x20;move&#x20;data&#x20;on&#x20;removable&#x20;disks&#x20;to&#x20;a&#x20;different&#x20;computer&#x20;where&#x20;they&#x20;have&#x20;administrative&#x20;privileges.&#x20;The&#x20;user&#x20;could&#x20;then&#x20;take&#x20;ownership&#x20;of&#x20;any&#x20;file,&#x20;grant&#x20;themselves&#x20;full&#x20;control,&#x20;and&#x20;view&#x20;or&#x20;modify&#x20;any&#x20;file.&#x20;The&#x20;fact&#x20;that&#x20;most&#x20;removable&#x20;storage&#x20;devices&#x20;will&#x20;eject&#x20;media&#x20;by&#x20;pressing&#x20;a&#x20;mechanical&#x20;button&#x20;diminishes&#x20;the&#x20;advantage&#x20;of&#x20;this&#x20;policy&#x20;setting.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Allowed&#x20;to&#x20;format&#x20;and&#x20;eject&#x20;removable&#x20;media','[{\"cis\": [\"2.3.4.1\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27018,'Ensure&#x20;&#039;Devices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','For&#x20;a&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;a&#x20;shared&#x20;printer,&#x20;the&#x20;driver&#x20;for&#x20;that&#x20;shared&#x20;printer&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;local&#x20;computer.&#x20;This&#x20;security&#x20;setting&#x20;determines&#x20;who&#x20;is&#x20;allowed&#x20;to&#x20;install&#x20;a&#x20;printer&#x20;driver&#x20;as&#x20;part&#x20;of&#x20;connecting&#x20;to&#x20;a&#x20;shared&#x20;printer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;the&#x20;ability&#x20;to&#x20;add&#x20;a&#x20;local&#x20;printer.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;Administrators.','It&#x20;may&#x20;be&#x20;appropriate&#x20;in&#x20;some&#x20;organizations&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;install&#x20;printer&#x20;drivers&#x20;on&#x20;their&#x20;own&#x20;workstations.&#x20;However,&#x20;you&#x20;should&#x20;allow&#x20;only&#x20;Administrators,&#x20;not&#x20;users,&#x20;to&#x20;do&#x20;so&#x20;on&#x20;servers,&#x20;because&#x20;printer&#x20;driver&#x20;installation&#x20;on&#x20;a&#x20;server&#x20;may&#x20;unintentionally&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;become&#x20;less&#x20;stable.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;install&#x20;inappropriate&#x20;printer&#x20;drivers&#x20;in&#x20;a&#x20;deliberate&#x20;attempt&#x20;to&#x20;damage&#x20;the&#x20;computer,&#x20;or&#x20;a&#x20;user&#x20;might&#x20;accidentally&#x20;install&#x20;malicious&#x20;software&#x20;that&#x20;masquerades&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;It&#x20;is&#x20;feasible&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;disguise&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;as&#x20;a&#x20;printer&#x20;driver.&#x20;The&#x20;program&#x20;may&#x20;appear&#x20;to&#x20;users&#x20;as&#x20;if&#x20;they&#x20;must&#x20;use&#x20;it&#x20;to&#x20;print,&#x20;but&#x20;such&#x20;a&#x20;program&#x20;could&#x20;unleash&#x20;malicious&#x20;code&#x20;on&#x20;your&#x20;computer&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDevices:&#x20;Prevent&#x20;users&#x20;from&#x20;installing&#x20;printer&#x20;drivers','[{\"cis\": [\"2.3.4.2\"]}, {\"pci_dss\": [\"2.2.4\", \"2.2.5\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC6.3\", \"CC5.2\"]}]'),(27019,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;members&#x20;of&#x20;the&#x20;Server&#x20;Operators&#x20;group&#x20;are&#x20;allowed&#x20;to&#x20;submit&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;schedule&#x20;facility.&#x20;The&#x20;impact&#x20;of&#x20;this&#x20;policy&#x20;setting&#x20;configuration&#x20;should&#x20;be&#x20;small&#x20;for&#x20;most&#x20;organizations.&#x20;Users,&#x20;including&#x20;those&#x20;in&#x20;the&#x20;Server&#x20;Operators&#x20;group,&#x20;will&#x20;still&#x20;be&#x20;able&#x20;to&#x20;create&#x20;jobs&#x20;by&#x20;means&#x20;of&#x20;the&#x20;Task&#x20;Scheduler&#x20;Wizard,&#x20;but&#x20;those&#x20;jobs&#x20;will&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;with&#x20;which&#x20;the&#x20;user&#x20;authenticates&#x20;when&#x20;they&#x20;set&#x20;up&#x20;the&#x20;job.&#x20;Note:&#x20;An&#x20;AT&#x20;Service&#x20;Account&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;select&#x20;a&#x20;different&#x20;account&#x20;rather&#x20;than&#x20;the&#x20;LOCAL&#x20;SYSTEM&#x20;account.&#x20;To&#x20;change&#x20;the&#x20;account,&#x20;open&#x20;System&#x20;Tools,&#x20;click&#x20;Scheduled&#x20;Tasks,&#x20;and&#x20;then&#x20;click&#x20;Accessories&#x20;folder.&#x20;Then&#x20;click&#x20;AT&#x20;Service&#x20;Account&#x20;on&#x20;the&#x20;Advanced&#x20;menu.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;jobs&#x20;that&#x20;are&#x20;created&#x20;by&#x20;server&#x20;operators&#x20;by&#x20;means&#x20;of&#x20;the&#x20;AT&#x20;service&#x20;will&#x20;execute&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;account&#x20;that&#x20;runs&#x20;that&#x20;service.&#x20;By&#x20;default,&#x20;that&#x20;is&#x20;the&#x20;local&#x20;SYSTEM&#x20;account.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;server&#x20;operators&#x20;could&#x20;perform&#x20;tasks&#x20;that&#x20;SYSTEM&#x20;is&#x20;able&#x20;to&#x20;do&#x20;but&#x20;that&#x20;they&#x20;would&#x20;typically&#x20;not&#x20;be&#x20;able&#x20;to&#x20;do,&#x20;such&#x20;as&#x20;add&#x20;their&#x20;account&#x20;to&#x20;the&#x20;local&#x20;Administrators&#x20;group.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Allow&#x20;server&#x20;operators&#x20;to&#x20;schedule&#x20;tasks','[{\"cis\": [\"2.3.5.1\"]}]'),(27020,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Allow&#x20;vulnerable&#x20;Netlogon&#x20;secure&#x20;channel&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Not&#x20;Configured&#039;&#x20;&#40;DC&#x20;Only&#41;.','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;domain&#x20;controller&#x20;bypasses&#x20;secure&#x20;RPC&#x20;for&#x20;Netlogon&#x20;secure&#x20;channel&#x20;connections&#x20;for&#x20;specified&#x20;machine&#x20;accounts.&#x20;When&#x20;deployed,&#x20;this&#x20;policy&#x20;should&#x20;be&#x20;applied&#x20;to&#x20;all&#x20;domain&#x20;controllers&#x20;in&#x20;a&#x20;forest&#x20;by&#x20;enabling&#x20;the&#x20;policy&#x20;on&#x20;the&#x20;domain&#x20;controllers&#x20;OU.&#x20;When&#x20;the&#x20;Create&#x20;Vulnerable&#x20;Connections&#x20;list&#x20;&#40;allow&#x20;list&#41;&#x20;is&#x20;configured:&#x20;&#x20;-&#x20;&#x20;Given&#x20;allow&#x20;permission,&#x20;the&#x20;domain&#x20;controller&#x20;will&#x20;allow&#x20;accounts&#x20;to&#x20;use&#x20;a&#x20;Netlogon&#x20;&#x20;secure&#x20;channel&#x20;without&#x20;secure&#x20;RPC.&#x20;&#x20;-&#x20;&#x20;Given&#x20;deny&#x20;permission,&#x20;the&#x20;domain&#x20;controller&#x20;will&#x20;require&#x20;accounts&#x20;to&#x20;use&#x20;a&#x20;&#x20;Netlogon&#x20;secure&#x20;channel&#x20;with&#x20;secure&#x20;RPC&#x20;which&#x20;is&#x20;the&#x20;same&#x20;as&#x20;the&#x20;default&#x20;&#40;not&#x20;&#x20;necessary&#41;.&#x20;Note:&#x20;Warning&#x20;from&#x20;Microsoft&#x20;-&#x20;enabling&#x20;this&#x20;policy&#x20;will&#x20;expose&#x20;your&#x20;domain-joined&#x20;devices&#x20;and&#x20;can&#x20;expose&#x20;your&#x20;Active&#x20;Directory&#x20;forest&#x20;to&#x20;risk.&#x20;This&#x20;policy&#x20;should&#x20;be&#x20;used&#x20;as&#x20;a&#x20;temporary&#x20;measure&#x20;for&#x20;3rd-party&#x20;devices&#x20;as&#x20;you&#x20;deploy&#x20;updates.&#x20;Once&#x20;a&#x20;3rd-party&#x20;device&#x20;is&#x20;updated&#x20;to&#x20;support&#x20;using&#x20;secure&#x20;RPC&#x20;with&#x20;Netlogon&#x20;secure&#x20;channels,&#x20;the&#x20;account&#x20;should&#x20;be&#x20;removed&#x20;from&#x20;the&#x20;Create&#x20;Vulnerable&#x20;Connections&#x20;list.&#x20;To&#x20;better&#x20;understand&#x20;the&#x20;risk&#x20;of&#x20;configuring&#x20;accounts&#x20;to&#x20;be&#x20;allowed&#x20;to&#x20;use&#x20;vulnerable&#x20;Netlogon&#x20;secure&#x20;channel&#x20;connections,&#x20;please&#x20;visit&#x20;How&#x20;to&#x20;manage&#x20;the&#x20;changes&#x20;in&#x20;Netlogon&#x20;secure&#x20;channel&#x20;connections&#x20;associated&#x20;with&#x20;CVE-2020-1472.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Not&#x20;Configured.','Enabling&#x20;this&#x20;policy&#x20;will&#x20;expose&#x20;your&#x20;domain-joined&#x20;devices&#x20;and&#x20;can&#x20;expose&#x20;your&#x20;Active&#x20;Directory&#x20;forest&#x20;to&#x20;security&#x20;risks.&#x20;It&#x20;is&#x20;highly&#x20;recommended&#x20;that&#x20;this&#x20;setting&#x20;not&#x20;be&#x20;used&#x20;&#40;i.e.&#x20;be&#x20;left&#x20;completely&#x20;unconfigured&#41;&#x20;so&#x20;as&#x20;not&#x20;to&#x20;add&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Not&#x20;Configured:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Allow&#x20;vulnerable&#x20;Netlogon&#x20;secure&#x20;channel&#x20;connections','[{\"cis\": [\"2.3.5.2\"]}]'),(27021,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;LDAP&#x20;server&#x20;channel&#x20;binding&#x20;token&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Always&#039;&#x20;&#40;DC&#x20;Only&#41;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LDAP&#x20;server&#x20;&#40;Domain&#x20;Controller&#41;&#x20;enforces&#x20;validation&#x20;of&#x20;Channel&#x20;Binding&#x20;Tokens&#x20;&#40;CBT&#41;&#x20;received&#x20;in&#x20;LDAP&#x20;bind&#x20;requests&#x20;that&#x20;are&#x20;sent&#x20;over&#x20;SSL/TLS&#x20;&#40;i.e.&#x20;LDAPS&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Always.&#x20;Note:&#x20;All&#x20;LDAP&#x20;clients&#x20;must&#x20;have&#x20;the&#x20;CVC-2017-8563&#x20;security&#x20;update&#x20;to&#x20;be&#x20;compatible&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;have&#x20;this&#x20;setting&#x20;enabled.&#x20;More&#x20;information&#x20;on&#x20;this&#x20;setting&#x20;is&#x20;available&#x20;at:&#x20;MSKB&#x20;4520412:&#x20;2020&#x20;LDAP&#x20;channel&#x20;binding&#x20;and&#x20;LDAP&#x20;signing&#x20;requirements&#x20;for&#x20;Windows','Requiring&#x20;Channel&#x20;Binding&#x20;Tokens&#x20;&#40;CBT&#41;&#x20;can&#x20;prevent&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;users&#039;&#x20;authentication&#x20;credentials&#x20;&#40;e.g.&#x20;OAuth&#x20;tokens,&#x20;session&#x20;identifiers,&#x20;etc.&#41;&#x20;from&#x20;reusing&#x20;those&#x20;credentials&#x20;in&#x20;another&#x20;TLS&#x20;session.&#x20;This&#x20;also&#x20;helps&#x20;to&#x20;increase&#x20;protection&#x20;against&#x20;&quot;man-in-the-middle&quot;&#x20;attacks&#x20;using&#x20;LDAP&#x20;authentication&#x20;over&#x20;SSL/TLS&#x20;&#40;LDAPS&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Always:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;LDAP&#x20;server&#x20;channel&#x20;binding&#x20;token&#x20;requirements&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;requires&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;March&#x20;2020&#x20;&#40;or&#x20;later&#41;&#x20;Windows&#x20;security&#x20;update.&#x20;With&#x20;that&#x20;update,&#x20;Microsoft&#x20;added&#x20;this&#x20;setting&#x20;to&#x20;the&#x20;built-in&#x20;OS&#x20;security&#x20;template.','[{\"cis\": [\"2.3.5.3\"]}, {\"cis_csc\": [\"3.10\"]}]'),(27022,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;signing&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;server&#x20;requires&#x20;LDAP&#x20;clients&#x20;to&#x20;negotiate&#x20;data&#x20;signing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;signing.&#x20;Note:&#x20;Domain&#x20;member&#x20;computers&#x20;must&#x20;have&#x20;Network&#x20;security:&#x20;LDAP&#x20;signing&#x20;requirements&#x20;&#40;Rule&#x20;2.3.11.8&#41;&#x20;set&#x20;to&#x20;Negotiate&#x20;signing&#x20;or&#x20;higher.&#x20;If&#x20;not,&#x20;they&#x20;will&#x20;fail&#x20;to&#x20;authenticate&#x20;once&#x20;the&#x20;above&#x20;Require&#x20;signing&#x20;value&#x20;is&#x20;configured&#x20;on&#x20;the&#x20;Domain&#x20;Controllers.&#x20;Fortunately,&#x20;Negotiate&#x20;signing&#x20;is&#x20;the&#x20;default&#x20;in&#x20;the&#x20;client&#x20;configuration.&#x20;Note&#x20;#2:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;shipped&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;LDAP&#x20;simple&#x20;bind&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;to&#x20;talk&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;Note&#x20;#3:&#x20;Before&#x20;enabling&#x20;this&#x20;setting,&#x20;you&#x20;should&#x20;first&#x20;ensure&#x20;that&#x20;there&#x20;are&#x20;no&#x20;clients&#x20;&#40;including&#x20;server-based&#x20;applications&#41;&#x20;that&#x20;are&#x20;configured&#x20;to&#x20;authenticate&#x20;with&#x20;Active&#x20;Directory&#x20;via&#x20;unsigned&#x20;LDAP,&#x20;because&#x20;changing&#x20;this&#x20;setting&#x20;will&#x20;break&#x20;those&#x20;applications.&#x20;Such&#x20;applications&#x20;should&#x20;first&#x20;be&#x20;reconfigured&#x20;to&#x20;use&#x20;signed&#x20;LDAP,&#x20;Secure&#x20;LDAP&#x20;&#40;LDAPS&#41;,&#x20;or&#x20;IPsec-protected&#x20;connections.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;In&#x20;such&#x20;attacks,&#x20;an&#x20;intruder&#x20;captures&#x20;packets&#x20;between&#x20;the&#x20;server&#x20;and&#x20;the&#x20;client,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;client.&#x20;Where&#x20;LDAP&#x20;servers&#x20;are&#x20;concerned,&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;client&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;records&#x20;from&#x20;the&#x20;LDAP&#x20;directory.&#x20;To&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;intrusion&#x20;in&#x20;an&#x20;organization&#039;s&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;could&#x20;implement&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;authentication&#x20;header&#x20;mode&#x20;&#40;AH&#41;,&#x20;which&#x20;performs&#x20;mutual&#x20;authentication&#x20;and&#x20;packet&#x20;integrity&#x20;for&#x20;IP&#x20;traffic&#x20;to&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-&#x20;in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult.&#x20;Additionally,&#x20;allowing&#x20;the&#x20;use&#x20;of&#x20;regular,&#x20;unsigned&#x20;LDAP&#x20;permits&#x20;credentials&#x20;to&#x20;be&#x20;received&#x20;over&#x20;the&#x20;network&#x20;in&#x20;clear&#x20;text,&#x20;which&#x20;could&#x20;very&#x20;easily&#x20;result&#x20;in&#x20;the&#x20;interception&#x20;of&#x20;account&#x20;passwords&#x20;by&#x20;other&#x20;systems&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;signing:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;LDAP&#x20;server&#x20;signing&#x20;requirements','[{\"cis\": [\"2.3.5.4\"]}, {\"cis_csc\": [\"3.10\"]}]'),(27023,'Ensure&#x20;&#039;Domain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;Domain&#x20;Controllers&#x20;will&#x20;refuse&#x20;requests&#x20;from&#x20;member&#x20;computers&#x20;to&#x20;change&#x20;computer&#x20;account&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;a&#x20;domain,&#x20;domain&#x20;members&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;change&#x20;their&#x20;computer&#x20;account&#x20;passwords,&#x20;and&#x20;those&#x20;passwords&#x20;will&#x20;be&#x20;more&#x20;susceptible&#x20;to&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;controller:&#x20;Refuse&#x20;machine&#x20;account&#x20;password&#x20;changes','[{\"cis\": [\"2.3.5.5\"]}]'),(27024,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;is&#x20;initiated&#x20;by&#x20;the&#x20;domain&#x20;member&#x20;must&#x20;be&#x20;signed&#x20;or&#x20;encrypted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated&mdash;and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted&mdash;but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;or&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.6.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27025,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;encryption&#x20;for&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated&mdash;and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted&mdash;but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;','[{\"cis\": [\"2.3.6.2\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27026,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;should&#x20;attempt&#x20;to&#x20;negotiate&#x20;whether&#x20;all&#x20;secure&#x20;channel&#x20;traffic&#x20;that&#x20;it&#x20;initiates&#x20;must&#x20;be&#x20;digitally&#x20;signed.&#x20;Digital&#x20;signatures&#x20;protect&#x20;the&#x20;traffic&#x20;from&#x20;being&#x20;modified&#x20;by&#x20;anyone&#x20;who&#x20;captures&#x20;the&#x20;data&#x20;as&#x20;it&#x20;traverses&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;a&#x20;computer&#x20;joins&#x20;a&#x20;domain,&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created.&#x20;After&#x20;it&#x20;joins&#x20;the&#x20;domain,&#x20;the&#x20;computer&#x20;uses&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account&#x20;to&#x20;create&#x20;a&#x20;secure&#x20;channel&#x20;with&#x20;the&#x20;Domain&#x20;Controller&#x20;for&#x20;its&#x20;domain&#x20;every&#x20;time&#x20;that&#x20;it&#x20;restarts.&#x20;Requests&#x20;that&#x20;are&#x20;sent&#x20;on&#x20;the&#x20;secure&#x20;channel&#x20;are&#x20;authenticated&mdash;and&#x20;sensitive&#x20;information&#x20;such&#x20;as&#x20;passwords&#x20;are&#x20;encrypted&mdash;but&#x20;the&#x20;channel&#x20;is&#x20;not&#x20;integrity-checked,&#x20;and&#x20;not&#x20;all&#x20;information&#x20;is&#x20;encrypted.&#x20;Digital&#x20;encryption&#x20;and&#x20;signing&#x20;of&#x20;the&#x20;secure&#x20;channel&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;where&#x20;it&#x20;is&#x20;supported.&#x20;The&#x20;secure&#x20;channel&#x20;protects&#x20;domain&#x20;credentials&#x20;as&#x20;they&#x20;are&#x20;sent&#x20;to&#x20;the&#x20;Domain&#x20;Controller.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Digitally&#x20;sign&#x20;secure&#x20;channel&#x20;data&#x20;&#40;when&#x20;possible&#41;','[{\"cis\": [\"2.3.6.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27027,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;domain&#x20;member&#x20;can&#x20;periodically&#x20;change&#x20;its&#x20;computer&#x20;account&#x20;password.&#x20;Computers&#x20;that&#x20;cannot&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;passwords&#x20;are&#x20;potentially&#x20;vulnerable,&#x20;because&#x20;an&#x20;attacker&#x20;might&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;system&#039;s&#x20;domain&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','The&#x20;default&#x20;configuration&#x20;for&#x20;Windows&#x20;Server&#x20;2003-based&#x20;computers&#x20;that&#x20;belong&#x20;to&#x20;a&#x20;domain&#x20;is&#x20;that&#x20;they&#x20;are&#x20;automatically&#x20;required&#x20;to&#x20;change&#x20;the&#x20;passwords&#x20;for&#x20;their&#x20;accounts&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;computers&#x20;that&#x20;run&#x20;Windows&#x20;Server&#x20;2003&#x20;will&#x20;retain&#x20;the&#x20;same&#x20;passwords&#x20;as&#x20;their&#x20;computer&#x20;accounts.&#x20;Computers&#x20;that&#x20;are&#x20;no&#x20;longer&#x20;able&#x20;to&#x20;automatically&#x20;change&#x20;their&#x20;account&#x20;password&#x20;are&#x20;at&#x20;risk&#x20;from&#x20;an&#x20;attacker&#x20;who&#x20;could&#x20;determine&#x20;the&#x20;password&#x20;for&#x20;the&#x20;computer&#039;s&#x20;domain&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Disable&#x20;machine&#x20;account&#x20;password&#x20;changes','[{\"cis\": [\"2.3.6.4\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27028,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Maximum&#x20;machine&#x20;account&#x20;password&#x20;age&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;maximum&#x20;allowable&#x20;age&#x20;for&#x20;a&#x20;computer&#x20;account&#x20;password.&#x20;By&#x20;default,&#x20;domain&#x20;members&#x20;automatically&#x20;change&#x20;their&#x20;domain&#x20;passwords&#x20;every&#x20;30&#x20;days.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;maximum&#x20;password&#x20;age.&#x20;Note&#x20;#2:&#x20;Some&#x20;problems&#x20;can&#x20;occur&#x20;as&#x20;a&#x20;result&#x20;of&#x20;machine&#x20;account&#x20;password&#x20;expiration,&#x20;particularly&#x20;if&#x20;a&#x20;machine&#x20;is&#x20;reverted&#x20;to&#x20;a&#x20;previous&#x20;point-in-time&#x20;state,&#x20;as&#x20;is&#x20;common&#x20;with&#x20;virtual&#x20;machines.&#x20;Depending&#x20;on&#x20;how&#x20;far&#x20;back&#x20;the&#x20;reversion&#x20;is,&#x20;the&#x20;older&#x20;machine&#x20;account&#x20;password&#x20;stored&#x20;on&#x20;the&#x20;machine&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;recognized&#x20;by&#x20;the&#x20;domain&#x20;controllers,&#x20;and&#x20;therefore&#x20;the&#x20;computer&#x20;loses&#x20;its&#x20;domain&#x20;trust.&#x20;This&#x20;can&#x20;also&#x20;disrupt&#x20;non-persistent&#x20;VDI&#x20;implementations,&#x20;and&#x20;devices&#x20;with&#x20;write&#x20;filters&#x20;that&#x20;disallow&#x20;permanent&#x20;changes&#x20;to&#x20;the&#x20;OS&#x20;volume.&#x20;Some&#x20;organizations&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;and&#x20;disable&#x20;machine&#x20;account&#x20;password&#x20;expiration&#x20;for&#x20;these&#x20;situations.','In&#x20;Active&#x20;Directory-based&#x20;domains,&#x20;each&#x20;computer&#x20;has&#x20;an&#x20;account&#x20;and&#x20;password&#x20;just&#x20;like&#x20;every&#x20;user.&#x20;By&#x20;default,&#x20;the&#x20;domain&#x20;members&#x20;automatically&#x20;change&#x20;their&#x20;domain&#x20;password&#x20;every&#x20;30&#x20;days.&#x20;If&#x20;you&#x20;increase&#x20;this&#x20;interval&#x20;significantly,&#x20;or&#x20;set&#x20;it&#x20;to&#x20;0&#x20;so&#x20;that&#x20;the&#x20;computers&#x20;no&#x20;longer&#x20;change&#x20;their&#x20;passwords,&#x20;an&#x20;attacker&#x20;will&#x20;have&#x20;more&#x20;time&#x20;to&#x20;undertake&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;guess&#x20;the&#x20;passwords&#x20;of&#x20;computer&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;30&#x20;or&#x20;fewer&#x20;days,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Maximum&#x20;machine&#x20;account&#x20;password&#x20;age','[{\"cis\": [\"2.3.6.5\"]}]'),(27029,'Ensure&#x20;&#039;Domain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;secure&#x20;channel&#x20;can&#x20;only&#x20;be&#x20;established&#x20;with&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;encrypting&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;&#40;128-bit&#41;&#x20;session&#x20;key.&#x20;To&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;all&#x20;Domain&#x20;Controllers&#x20;in&#x20;the&#x20;domain&#x20;must&#x20;be&#x20;able&#x20;to&#x20;encrypt&#x20;secure&#x20;channel&#x20;data&#x20;with&#x20;a&#x20;strong&#x20;key,&#x20;which&#x20;means&#x20;all&#x20;Domain&#x20;Controllers&#x20;must&#x20;be&#x20;running&#x20;Microsoft&#x20;Windows&#x20;2000&#x20;or&#x20;newer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;keys&#x20;that&#x20;are&#x20;used&#x20;to&#x20;establish&#x20;secure&#x20;channel&#x20;communications&#x20;between&#x20;Domain&#x20;Controllers&#x20;and&#x20;member&#x20;computers&#x20;are&#x20;much&#x20;stronger&#x20;in&#x20;Windows&#x20;2000&#x20;than&#x20;they&#x20;were&#x20;in&#x20;previous&#x20;Microsoft&#x20;operating&#x20;systems.&#x20;Whenever&#x20;possible,&#x20;you&#x20;should&#x20;take&#x20;advantage&#x20;of&#x20;these&#x20;stronger&#x20;session&#x20;keys&#x20;to&#x20;help&#x20;protect&#x20;secure&#x20;channel&#x20;communications&#x20;from&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;hijack&#x20;network&#x20;sessions&#x20;and&#x20;eavesdropping.&#x20;&#40;Eavesdropping&#x20;is&#x20;a&#x20;form&#x20;of&#x20;hacking&#x20;in&#x20;which&#x20;network&#x20;data&#x20;is&#x20;read&#x20;or&#x20;altered&#x20;in&#x20;transit.&#x20;The&#x20;data&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;hide&#x20;or&#x20;change&#x20;the&#x20;sender,&#x20;or&#x20;be&#x20;redirected.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsDomain&#x20;member:&#x20;Require&#x20;strong&#x20;&#40;Windows&#x20;2000&#x20;or&#x20;later&#41;&#x20;session&#x20;key','[{\"cis\": [\"2.3.6.6\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27030,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;must&#x20;press&#x20;CTRL+ALT+DEL&#x20;before&#x20;they&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Microsoft&#x20;developed&#x20;this&#x20;feature&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;users&#x20;with&#x20;certain&#x20;types&#x20;of&#x20;physical&#x20;impairments&#x20;to&#x20;log&#x20;on&#x20;to&#x20;computers&#x20;that&#x20;run&#x20;Windows.&#x20;If&#x20;users&#x20;are&#x20;not&#x20;required&#x20;to&#x20;press&#x20;CTRL+ALT+DEL,&#x20;they&#x20;are&#x20;susceptible&#x20;to&#x20;attacks&#x20;that&#x20;attempt&#x20;to&#x20;intercept&#x20;their&#x20;passwords.&#x20;If&#x20;CTRL+ALT+DEL&#x20;is&#x20;required&#x20;before&#x20;logon,&#x20;user&#x20;passwords&#x20;are&#x20;communicated&#x20;by&#x20;means&#x20;of&#x20;a&#x20;trusted&#x20;path.&#x20;An&#x20;attacker&#x20;could&#x20;install&#x20;a&#x20;Trojan&#x20;horse&#x20;program&#x20;that&#x20;looks&#x20;like&#x20;the&#x20;standard&#x20;Windows&#x20;logon&#x20;dialog&#x20;box&#x20;and&#x20;capture&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;attacker&#x20;would&#x20;then&#x20;be&#x20;able&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;compromised&#x20;account&#x20;with&#x20;whatever&#x20;level&#x20;of&#x20;privilege&#x20;that&#x20;user&#x20;has.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Do&#x20;not&#x20;require&#x20;CTRL+ALT+DEL','[{\"cis\": [\"2.3.7.1\"]}]'),(27031,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;account&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;client&#x20;computers&#x20;in&#x20;your&#x20;organization&#x20;will&#x20;be&#x20;displayed&#x20;in&#x20;each&#x20;computer&#039;s&#x20;respective&#x20;Windows&#x20;logon&#x20;screen.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;prevent&#x20;intruders&#x20;from&#x20;collecting&#x20;account&#x20;names&#x20;visually&#x20;from&#x20;the&#x20;screens&#x20;of&#x20;desktop&#x20;or&#x20;laptop&#x20;computers&#x20;in&#x20;your&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Don&#039;t&#x20;display&#x20;last&#x20;signed-in&#x20;Note:&#x20;In&#x20;older&#x20;versions&#x20;of&#x20;Microsoft&#x20;Windows,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Interactive&#x20;logon:&#x20;Do&#x20;not&#x20;display&#x20;last&#x20;user&#x20;name,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;Windows&#x20;Server&#x20;2019.','[{\"cis\": [\"2.3.7.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27032,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0&#039;.','Windows&#x20;notices&#x20;inactivity&#x20;of&#x20;a&#x20;logon&#x20;session,&#x20;and&#x20;if&#x20;the&#x20;amount&#x20;of&#x20;inactive&#x20;time&#x20;exceeds&#x20;the&#x20;inactivity&#x20;limit,&#x20;then&#x20;the&#x20;screen&#x20;saver&#x20;will&#x20;run,&#x20;locking&#x20;the&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;900&#x20;or&#x20;fewer&#x20;second&#40;s&#41;,&#x20;but&#x20;not&#x20;0.&#x20;Note:&#x20;A&#x20;value&#x20;of&#x20;0&#x20;does&#x20;not&#x20;conform&#x20;to&#x20;the&#x20;benchmark&#x20;as&#x20;it&#x20;disables&#x20;the&#x20;machine&#x20;inactivity&#x20;limit.','If&#x20;a&#x20;user&#x20;forgets&#x20;to&#x20;lock&#x20;their&#x20;computer&#x20;when&#x20;they&#x20;walk&#x20;away&#x20;it&#039;s&#x20;possible&#x20;that&#x20;a&#x20;passerby&#x20;will&#x20;hijack&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;900&#x20;or&#x20;fewer&#x20;seconds,&#x20;but&#x20;not&#x20;0:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Machine&#x20;inactivity&#x20;limit','[{\"cis\": [\"2.3.7.3\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27033,'Configure&#x20;&#039;Interactive&#x20;logon:&#x20;Message&#x20;text&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;a&#x20;text&#x20;message&#x20;that&#x20;displays&#x20;to&#x20;users&#x20;when&#x20;they&#x20;log&#x20;on.&#x20;Configure&#x20;this&#x20;setting&#x20;in&#x20;a&#x20;manner&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization.','Displaying&#x20;a&#x20;warning&#x20;message&#x20;before&#x20;logon&#x20;may&#x20;help&#x20;prevent&#x20;an&#x20;attack&#x20;by&#x20;warning&#x20;the&#x20;attacker&#x20;about&#x20;the&#x20;consequences&#x20;of&#x20;their&#x20;misconduct&#x20;before&#x20;it&#x20;happens.&#x20;It&#x20;may&#x20;also&#x20;help&#x20;to&#x20;reinforce&#x20;corporate&#x20;policy&#x20;by&#x20;notifying&#x20;employees&#x20;of&#x20;the&#x20;appropriate&#x20;policy&#x20;during&#x20;the&#x20;logon&#x20;process.&#x20;This&#x20;text&#x20;is&#x20;often&#x20;used&#x20;for&#x20;legal&#x20;reasons&mdash;for&#x20;example,&#x20;to&#x20;warn&#x20;users&#x20;about&#x20;the&#x20;ramifications&#x20;of&#x20;misusing&#x20;company&#x20;information&#x20;or&#x20;to&#x20;warn&#x20;them&#x20;that&#x20;their&#x20;actions&#x20;may&#x20;be&#x20;audited.&#x20;Note:&#x20;Any&#x20;warning&#x20;that&#x20;you&#x20;display&#x20;should&#x20;first&#x20;be&#x20;approved&#x20;by&#x20;your&#x20;organization&#039;s&#x20;legal&#x20;and&#x20;human&#x20;resources&#x20;representatives.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Message&#x20;text&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.7.4\"]}]'),(27034,'Configure&#x20;&#039;Interactive&#x20;logon:&#x20;Message&#x20;title&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;text&#x20;displayed&#x20;in&#x20;the&#x20;title&#x20;bar&#x20;of&#x20;the&#x20;window&#x20;that&#x20;users&#x20;see&#x20;when&#x20;they&#x20;log&#x20;on&#x20;to&#x20;the&#x20;system.&#x20;Configure&#x20;this&#x20;setting&#x20;in&#x20;a&#x20;manner&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization.','Displaying&#x20;a&#x20;warning&#x20;message&#x20;before&#x20;logon&#x20;may&#x20;help&#x20;prevent&#x20;an&#x20;attack&#x20;by&#x20;warning&#x20;the&#x20;attacker&#x20;about&#x20;the&#x20;consequences&#x20;of&#x20;their&#x20;misconduct&#x20;before&#x20;it&#x20;happens.&#x20;It&#x20;may&#x20;also&#x20;help&#x20;to&#x20;reinforce&#x20;corporate&#x20;policy&#x20;by&#x20;notifying&#x20;employees&#x20;of&#x20;the&#x20;appropriate&#x20;policy&#x20;during&#x20;the&#x20;logon&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;that&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;security&#x20;and&#x20;operational&#x20;requirements&#x20;of&#x20;your&#x20;organization:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Message&#x20;title&#x20;for&#x20;users&#x20;attempting&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.7.5\"]}]'),(27035,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;4&#x20;or&#x20;few','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;user&#x20;can&#x20;log&#x20;on&#x20;to&#x20;a&#x20;Windows&#x20;domain&#x20;using&#x20;cached&#x20;account&#x20;information.&#x20;Logon&#x20;information&#x20;for&#x20;domain&#x20;accounts&#x20;can&#x20;be&#x20;cached&#x20;locally&#x20;to&#x20;allow&#x20;users&#x20;to&#x20;log&#x20;on&#x20;even&#x20;if&#x20;a&#x20;Domain&#x20;Controller&#x20;cannot&#x20;be&#x20;contacted.&#x20;This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;number&#x20;of&#x20;unique&#x20;users&#x20;for&#x20;whom&#x20;logon&#x20;information&#x20;is&#x20;cached&#x20;locally.&#x20;If&#x20;this&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;the&#x20;logon&#x20;cache&#x20;feature&#x20;is&#x20;disabled.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;server&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;.','The&#x20;number&#x20;that&#x20;is&#x20;assigned&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;indicates&#x20;the&#x20;number&#x20;of&#x20;users&#x20;whose&#x20;logon&#x20;information&#x20;the&#x20;computer&#x20;will&#x20;cache&#x20;locally.&#x20;If&#x20;the&#x20;number&#x20;is&#x20;set&#x20;to&#x20;4,&#x20;then&#x20;the&#x20;computer&#x20;caches&#x20;logon&#x20;information&#x20;for&#x20;4&#x20;users.&#x20;When&#x20;a&#x20;5th&#x20;user&#x20;logs&#x20;on&#x20;to&#x20;the&#x20;computer,&#x20;the&#x20;server&#x20;overwrites&#x20;the&#x20;oldest&#x20;cached&#x20;logon&#x20;session.&#x20;Users&#x20;who&#x20;access&#x20;the&#x20;computer&#x20;console&#x20;will&#x20;have&#x20;their&#x20;logon&#x20;credentials&#x20;cached&#x20;on&#x20;that&#x20;computer.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;access&#x20;the&#x20;file&#x20;system&#x20;of&#x20;the&#x20;computer&#x20;could&#x20;locate&#x20;this&#x20;cached&#x20;information&#x20;and&#x20;use&#x20;a&#x20;brute&#x20;force&#x20;attack&#x20;to&#x20;attempt&#x20;to&#x20;determine&#x20;user&#x20;passwords.&#x20;To&#x20;mitigate&#x20;this&#x20;type&#x20;of&#x20;attack,&#x20;Windows&#x20;encrypts&#x20;the&#x20;information&#x20;and&#x20;obscures&#x20;its&#x20;physical&#x20;location.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;4&#x20;or&#x20;fewer&#x20;logon&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Number&#x20;of&#x20;previous&#x20;logons&#x20;to&#x20;cache&#x20;&#40;in&#x20;case&#x20;domain&#x20;controller&#x20;is&#x20;not&#x20;available&#41;','[{\"cis\": [\"2.3.7.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27036,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;between&#x20;5&#x20;and&#x20;14&#x20;days&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;far&#x20;in&#x20;advance&#x20;users&#x20;are&#x20;warned&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;at&#x20;least&#x20;5&#x20;days&#x20;but&#x20;no&#x20;more&#x20;than&#x20;14&#x20;days&#x20;to&#x20;sufficiently&#x20;warn&#x20;users&#x20;when&#x20;their&#x20;passwords&#x20;will&#x20;expire.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days.','It&#x20;is&#x20;recommended&#x20;that&#x20;user&#x20;passwords&#x20;be&#x20;configured&#x20;to&#x20;expire&#x20;periodically.&#x20;Users&#x20;will&#x20;need&#x20;to&#x20;be&#x20;warned&#x20;that&#x20;their&#x20;passwords&#x20;are&#x20;going&#x20;to&#x20;expire,&#x20;or&#x20;they&#x20;may&#x20;inadvertently&#x20;be&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;computer&#x20;when&#x20;their&#x20;passwords&#x20;expire.&#x20;This&#x20;condition&#x20;could&#x20;lead&#x20;to&#x20;confusion&#x20;for&#x20;users&#x20;who&#x20;access&#x20;the&#x20;network&#x20;locally,&#x20;or&#x20;make&#x20;it&#x20;impossible&#x20;for&#x20;users&#x20;to&#x20;access&#x20;your&#x20;organization&#039;s&#x20;network&#x20;through&#x20;dial-up&#x20;or&#x20;virtual&#x20;private&#x20;network&#x20;&#40;VPN&#41;&#x20;connections.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;a&#x20;value&#x20;between&#x20;5&#x20;and&#x20;14&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Prompt&#x20;user&#x20;to&#x20;change&#x20;password&#x20;before&#x20;expiration','[{\"cis\": [\"2.3.7.7\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27037,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','Logon&#x20;information&#x20;is&#x20;required&#x20;to&#x20;unlock&#x20;a&#x20;locked&#x20;computer.&#x20;For&#x20;domain&#x20;accounts,&#x20;this&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;it&#x20;is&#x20;necessary&#x20;to&#x20;contact&#x20;a&#x20;Domain&#x20;Controller&#x20;to&#x20;unlock&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','By&#x20;default,&#x20;the&#x20;computer&#x20;caches&#x20;in&#x20;memory&#x20;the&#x20;credentials&#x20;of&#x20;any&#x20;users&#x20;who&#x20;are&#x20;authenticated&#x20;locally.&#x20;The&#x20;computer&#x20;uses&#x20;these&#x20;cached&#x20;credentials&#x20;to&#x20;authenticate&#x20;anyone&#x20;who&#x20;attempts&#x20;to&#x20;unlock&#x20;the&#x20;console.&#x20;When&#x20;cached&#x20;credentials&#x20;are&#x20;used,&#x20;any&#x20;changes&#x20;that&#x20;have&#x20;recently&#x20;been&#x20;made&#x20;to&#x20;the&#x20;account&#x20;&mdash;&#x20;such&#x20;as&#x20;user&#x20;rights&#x20;assignments,&#x20;account&#x20;lockout,&#x20;or&#x20;the&#x20;account&#x20;being&#x20;disabled&#x20;&mdash;&#x20;are&#x20;not&#x20;considered&#x20;or&#x20;applied&#x20;after&#x20;the&#x20;account&#x20;is&#x20;authenticated.&#x20;User&#x20;privileges&#x20;are&#x20;not&#x20;updated,&#x20;and&#x20;&#40;more&#x20;importantly&#41;&#x20;disabled&#x20;accounts&#x20;are&#x20;still&#x20;able&#x20;to&#x20;unlock&#x20;the&#x20;console&#x20;of&#x20;the&#x20;computer.','','To&#x20;implement&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Require&#x20;Domain&#x20;Controller&#x20;Authentication&#x20;to&#x20;unlock&#x20;workstation','[{\"cis\": [\"2.3.7.8\"]}, {\"cis_csc\": [\"4.3\", \"16.11\"]}]'),(27038,'Ensure&#x20;&#039;Interactive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Lock&#x20;Workstation&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;happens&#x20;when&#x20;the&#x20;smart&#x20;card&#x20;for&#x20;a&#x20;logged-on&#x20;user&#x20;is&#x20;removed&#x20;from&#x20;the&#x20;smart&#x20;card&#x20;reader.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Lock&#x20;Workstation.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Users&#x20;sometimes&#x20;forget&#x20;to&#x20;lock&#x20;their&#x20;workstations&#x20;when&#x20;they&#x20;are&#x20;away&#x20;from&#x20;them,&#x20;allowing&#x20;the&#x20;possibility&#x20;for&#x20;malicious&#x20;users&#x20;to&#x20;access&#x20;their&#x20;computers.&#x20;If&#x20;smart&#x20;cards&#x20;are&#x20;used&#x20;for&#x20;authentication,&#x20;the&#x20;computer&#x20;should&#x20;automatically&#x20;lock&#x20;itself&#x20;when&#x20;the&#x20;card&#x20;is&#x20;removed&#x20;to&#x20;ensure&#x20;that&#x20;only&#x20;the&#x20;user&#x20;with&#x20;the&#x20;smart&#x20;card&#x20;is&#x20;accessing&#x20;resources&#x20;using&#x20;those&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Lock&#x20;Workstation&#x20;&#40;or,&#x20;if&#x20;applicable&#x20;for&#x20;your&#x20;environment,&#x20;Force&#x20;Logoff&#x20;or&#x20;Disconnect&#x20;if&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsInteractive&#x20;logon:&#x20;Smart&#x20;card&#x20;removal&#x20;behavior','[{\"cis\": [\"2.3.7.9\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27039,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;client&#x20;component.&#x20;Note:&#x20;When&#x20;Windows&#x20;Vista-based&#x20;computers&#x20;have&#x20;this&#x20;policy&#x20;setting&#x20;enabled&#x20;and&#x20;they&#x20;connect&#x20;to&#x20;file&#x20;or&#x20;print&#x20;shares&#x20;on&#x20;remote&#x20;servers,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;setting&#x20;is&#x20;synchronized&#x20;with&#x20;its&#x20;companion&#x20;setting,&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;,&#x20;on&#x20;those&#x20;servers.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;these&#x20;settings,&#x20;see&#x20;the&#x20;&quot;Microsoft&#x20;network&#x20;client&#x20;and&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;four&#x20;related&#x20;settings&#41;&quot;&#x20;section&#x20;in&#x20;Chapter&#x20;5&#x20;of&#x20;the&#x20;Threats&#x20;and&#x20;Countermeasures&#x20;guide.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.8.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27040,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;attempt&#x20;to&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing.&#x20;Note:&#x20;Enabling&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;makes&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;server&#x20;agrees&#41;','[{\"cis\": [\"2.3.8.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27041,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;redirector&#x20;will&#x20;send&#x20;plaintext&#x20;passwords&#x20;during&#x20;authentication&#x20;to&#x20;third-party&#x20;SMB&#x20;servers&#x20;that&#x20;do&#x20;not&#x20;support&#x20;password&#x20;encryption.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;strong&#x20;business&#x20;case&#x20;to&#x20;enable&#x20;it.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;unencrypted&#x20;passwords&#x20;will&#x20;be&#x20;allowed&#x20;across&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;the&#x20;server&#x20;can&#x20;transmit&#x20;passwords&#x20;in&#x20;plaintext&#x20;across&#x20;the&#x20;network&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;offer&#x20;SMB&#x20;services,&#x20;which&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;risk.&#x20;These&#x20;other&#x20;computers&#x20;may&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;SMB&#x20;security&#x20;mechanisms&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;Server&#x20;2003.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;client:&#x20;Send&#x20;unencrypted&#x20;password&#x20;to&#x20;third-party&#x20;SMB&#x20;servers','[{\"cis\": [\"2.3.8.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27042,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;amount&#x20;of&#x20;continuous&#x20;idle&#x20;time&#x20;that&#x20;must&#x20;pass&#x20;in&#x20;an&#x20;SMB&#x20;session&#x20;before&#x20;the&#x20;session&#x20;is&#x20;suspended&#x20;because&#x20;of&#x20;inactivity.&#x20;Administrators&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;control&#x20;when&#x20;a&#x20;computer&#x20;suspends&#x20;an&#x20;inactive&#x20;SMB&#x20;session.&#x20;If&#x20;client&#x20;activity&#x20;resumes,&#x20;the&#x20;session&#x20;is&#x20;automatically&#x20;reestablished.&#x20;The&#x20;maximum&#x20;value&#x20;is&#x20;99999,&#x20;which&#x20;is&#x20;over&#x20;69&#x20;days;&#x20;in&#x20;effect,&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;.','Each&#x20;SMB&#x20;session&#x20;consumes&#x20;server&#x20;resources,&#x20;and&#x20;numerous&#x20;null&#x20;sessions&#x20;will&#x20;slow&#x20;the&#x20;server&#x20;or&#x20;possibly&#x20;cause&#x20;it&#x20;to&#x20;fail.&#x20;An&#x20;attacker&#x20;could&#x20;repeatedly&#x20;establish&#x20;SMB&#x20;sessions&#x20;until&#x20;the&#x20;server&#039;s&#x20;SMB&#x20;services&#x20;become&#x20;slow&#x20;or&#x20;unresponsive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;15&#x20;or&#x20;fewer&#x20;minute&#40;s&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Amount&#x20;of&#x20;idle&#x20;time&#x20;required&#x20;before&#x20;suspending&#x20;session','[{\"cis\": [\"2.3.9.1\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27043,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;packet&#x20;signing&#x20;is&#x20;required&#x20;by&#x20;the&#x20;SMB&#x20;server&#x20;component.&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;in&#x20;a&#x20;mixed&#x20;environment&#x20;to&#x20;prevent&#x20;downstream&#x20;clients&#x20;from&#x20;using&#x20;the&#x20;workstation&#x20;as&#x20;a&#x20;network&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;','[{\"cis\": [\"2.3.9.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27044,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;SMB&#x20;server&#x20;will&#x20;negotiate&#x20;SMB&#x20;packet&#x20;signing&#x20;with&#x20;clients&#x20;that&#x20;request&#x20;it.&#x20;If&#x20;no&#x20;signing&#x20;request&#x20;comes&#x20;from&#x20;the&#x20;client,&#x20;a&#x20;connection&#x20;will&#x20;be&#x20;allowed&#x20;without&#x20;a&#x20;signature&#x20;if&#x20;the&#x20;Microsoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;always&#41;&#x20;setting&#x20;is&#x20;not&#x20;enabled.&#x20;Note:&#x20;Enable&#x20;this&#x20;policy&#x20;setting&#x20;on&#x20;SMB&#x20;clients&#x20;on&#x20;your&#x20;network&#x20;to&#x20;make&#x20;them&#x20;fully&#x20;effective&#x20;for&#x20;packet&#x20;signing&#x20;with&#x20;all&#x20;clients&#x20;and&#x20;servers&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Session&#x20;hijacking&#x20;uses&#x20;tools&#x20;that&#x20;allow&#x20;attackers&#x20;who&#x20;have&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network&#x20;as&#x20;the&#x20;client&#x20;or&#x20;server&#x20;to&#x20;interrupt,&#x20;end,&#x20;or&#x20;steal&#x20;a&#x20;session&#x20;in&#x20;progress.&#x20;Attackers&#x20;can&#x20;potentially&#x20;intercept&#x20;and&#x20;modify&#x20;unsigned&#x20;SMB&#x20;packets&#x20;and&#x20;then&#x20;modify&#x20;the&#x20;traffic&#x20;and&#x20;forward&#x20;it&#x20;so&#x20;that&#x20;the&#x20;server&#x20;might&#x20;perform&#x20;undesirable&#x20;actions.&#x20;Alternatively,&#x20;the&#x20;attacker&#x20;could&#x20;pose&#x20;as&#x20;the&#x20;server&#x20;or&#x20;client&#x20;after&#x20;legitimate&#x20;authentication&#x20;and&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;data.&#x20;SMB&#x20;is&#x20;the&#x20;resource&#x20;sharing&#x20;protocol&#x20;that&#x20;is&#x20;supported&#x20;by&#x20;many&#x20;Windows&#x20;operating&#x20;systems.&#x20;It&#x20;is&#x20;the&#x20;basis&#x20;of&#x20;NetBIOS&#x20;and&#x20;many&#x20;other&#x20;protocols.&#x20;SMB&#x20;signatures&#x20;authenticate&#x20;both&#x20;users&#x20;and&#x20;the&#x20;servers&#x20;that&#x20;host&#x20;the&#x20;data.&#x20;If&#x20;either&#x20;side&#x20;fails&#x20;the&#x20;authentication&#x20;process,&#x20;data&#x20;transmission&#x20;will&#x20;not&#x20;take&#x20;place.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Digitally&#x20;sign&#x20;communications&#x20;&#40;if&#x20;client&#x20;agrees&#41;','[{\"cis\": [\"2.3.9.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27045,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;security&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;disconnect&#x20;users&#x20;who&#x20;are&#x20;connected&#x20;to&#x20;the&#x20;local&#x20;computer&#x20;outside&#x20;their&#x20;user&#x20;account&#039;s&#x20;valid&#x20;logon&#x20;hours.&#x20;This&#x20;setting&#x20;affects&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;component.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;should&#x20;also&#x20;enable&#x20;Network&#x20;security:&#x20;Force&#x20;logoff&#x20;when&#x20;logon&#x20;hours&#x20;expire&#x20;&#40;Rule&#x20;2.3.11.6&#41;.&#x20;If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;necessary&#x20;to&#x20;ensure&#x20;they&#x20;are&#x20;effective.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;your&#x20;organization&#x20;configures&#x20;logon&#x20;hours&#x20;for&#x20;users,&#x20;then&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting.&#x20;Otherwise,&#x20;users&#x20;who&#x20;should&#x20;not&#x20;have&#x20;access&#x20;to&#x20;network&#x20;resources&#x20;outside&#x20;of&#x20;their&#x20;logon&#x20;hours&#x20;may&#x20;actually&#x20;be&#x20;able&#x20;to&#x20;continue&#x20;to&#x20;use&#x20;those&#x20;resources&#x20;with&#x20;sessions&#x20;that&#x20;were&#x20;established&#x20;during&#x20;allowed&#x20;hours.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Disconnect&#x20;clients&#x20;when&#x20;logon&#x20;hours&#x20;expire','[{\"cis\": [\"2.3.9.4\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27046,'Ensure&#x20;&#039;Microsoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#039;&#x20;or&#x20;higher&#x20;&#40;MS&#','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;level&#x20;of&#x20;validation&#x20;a&#x20;computer&#x20;with&#x20;shared&#x20;folders&#x20;or&#x20;printers&#x20;&#40;the&#x20;server&#41;&#x20;performs&#x20;on&#x20;the&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;that&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;client&#x20;computer&#x20;when&#x20;it&#x20;establishes&#x20;a&#x20;session&#x20;using&#x20;the&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;The&#x20;server&#x20;message&#x20;block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;provides&#x20;the&#x20;basis&#x20;for&#x20;file&#x20;and&#x20;print&#x20;sharing&#x20;and&#x20;other&#x20;networking&#x20;operations,&#x20;such&#x20;as&#x20;remote&#x20;Windows&#x20;administration.&#x20;The&#x20;SMB&#x20;protocol&#x20;supports&#x20;validating&#x20;the&#x20;SMB&#x20;server&#x20;service&#x20;principal&#x20;name&#x20;&#40;SPN&#41;&#x20;within&#x20;the&#x20;authentication&#x20;blob&#x20;provided&#x20;by&#x20;a&#x20;SMB&#x20;client&#x20;to&#x20;prevent&#x20;a&#x20;class&#x20;of&#x20;attacks&#x20;against&#x20;SMB&#x20;servers&#x20;referred&#x20;to&#x20;as&#x20;SMB&#x20;relay&#x20;attacks.&#x20;This&#x20;setting&#x20;will&#x20;affect&#x20;both&#x20;SMB1&#x20;and&#x20;SMB2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.&#x20;Note:&#x20;Since&#x20;the&#x20;release&#x20;of&#x20;the&#x20;MS&#x20;KB3161561&#x20;security&#x20;patch,&#x20;this&#x20;setting&#x20;can&#x20;cause&#x20;significant&#x20;issues&#x20;&#40;such&#x20;as&#x20;replication&#x20;problems,&#x20;group&#x20;policy&#x20;editing&#x20;issues&#x20;and&#x20;blue&#x20;screen&#x20;crashes&#41;&#x20;on&#x20;Domain&#x20;Controllers&#x20;when&#x20;used&#x20;simultaneously&#x20;with&#x20;UNC&#x20;path&#x20;hardening&#x20;&#40;i.e.&#x20;Rule&#x20;18.5.14.1&#41;.&#x20;CIS&#x20;therefore&#x20;recommends&#x20;against&#x20;deploying&#x20;this&#x20;setting&#x20;on&#x20;Domain&#x20;Controllers.','The&#x20;identity&#x20;of&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;spoofed&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;network&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Accept&#x20;if&#x20;provided&#x20;by&#x20;client&#x20;&#40;configuring&#x20;to&#x20;Required&#x20;from&#x20;client&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsMicrosoft&#x20;network&#x20;server:&#x20;Server&#x20;SPN&#x20;target&#x20;name&#x20;validation&#x20;level','[{\"cis\": [\"2.3.9.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27047,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Allow&#x20;anonymous&#x20;SID/Name&#x20;translation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;an&#x20;anonymous&#x20;user&#x20;can&#x20;request&#x20;security&#x20;identifier&#x20;&#40;SID&#41;&#x20;attributes&#x20;for&#x20;another&#x20;user,&#x20;or&#x20;use&#x20;a&#x20;SID&#x20;to&#x20;obtain&#x20;its&#x20;corresponding&#x20;user&#x20;name.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;a&#x20;user&#x20;with&#x20;local&#x20;access&#x20;could&#x20;use&#x20;the&#x20;well-known&#x20;Administrator&#039;s&#x20;SID&#x20;to&#x20;learn&#x20;the&#x20;real&#x20;name&#x20;of&#x20;the&#x20;built-in&#x20;Administrator&#x20;account,&#x20;even&#x20;if&#x20;it&#x20;has&#x20;been&#x20;renamed.&#x20;That&#x20;person&#x20;could&#x20;then&#x20;use&#x20;the&#x20;account&#x20;name&#x20;to&#x20;initiate&#x20;a&#x20;password&#x20;guessing&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Allow&#x20;anonymous&#x20;SID/Name&#x20;translation','[{\"cis\": [\"2.3.10.1\"]}]'),(27048,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;the&#x20;accounts&#x20;in&#x20;the&#x20;Security&#x20;Accounts&#x20;Manager&#x20;&#40;SAM&#41;.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;users&#x20;with&#x20;anonymous&#x20;connections&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;allows&#x20;additional&#x20;restrictions&#x20;on&#x20;anonymous&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts','[{\"cis\": [\"2.3.10.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27049,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;ability&#x20;of&#x20;anonymous&#x20;users&#x20;to&#x20;enumerate&#x20;SAM&#x20;accounts&#x20;as&#x20;well&#x20;as&#x20;shares.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;anonymous&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;enumerate&#x20;domain&#x20;account&#x20;user&#x20;names&#x20;and&#x20;network&#x20;share&#x20;names&#x20;on&#x20;the&#x20;systems&#x20;in&#x20;your&#x20;environment.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;policy&#x20;has&#x20;no&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;anonymous&#x20;enumeration&#x20;of&#x20;SAM&#x20;accounts&#x20;and&#x20;shares','[{\"cis\": [\"2.3.10.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27050,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Credential&#x20;Manager&#x20;&#40;formerly&#x20;called&#x20;Stored&#x20;User&#x20;Names&#x20;and&#x20;Passwords&#41;&#x20;saves&#x20;passwords&#x20;or&#x20;credentials&#x20;for&#x20;later&#x20;use&#x20;when&#x20;it&#x20;gains&#x20;domain&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Changes&#x20;to&#x20;this&#x20;setting&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;Windows&#x20;is&#x20;restarted.','Passwords&#x20;that&#x20;are&#x20;cached&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;the&#x20;user&#x20;when&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;computer.&#x20;Although&#x20;this&#x20;information&#x20;may&#x20;sound&#x20;obvious,&#x20;a&#x20;problem&#x20;can&#x20;arise&#x20;if&#x20;the&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;reads&#x20;the&#x20;passwords&#x20;and&#x20;forwards&#x20;them&#x20;to&#x20;another,&#x20;unauthorized&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Do&#x20;not&#x20;allow&#x20;storage&#x20;of&#x20;passwords&#x20;and&#x20;credentials&#x20;for&#x20;network&#x20;authentication','[{\"cis\": [\"2.3.10.4\"]}, {\"pci_dss\": [\"3.1\"]}]'),(27051,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;what&#x20;additional&#x20;permissions&#x20;are&#x20;assigned&#x20;for&#x20;anonymous&#x20;connections&#x20;to&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;anonymously&#x20;list&#x20;account&#x20;names&#x20;and&#x20;shared&#x20;resources&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords,&#x20;perform&#x20;social&#x20;engineering&#x20;attacks,&#x20;or&#x20;launch&#x20;DoS&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Let&#x20;Everyone&#x20;permissions&#x20;apply&#x20;to&#x20;anonymous&#x20;users','[{\"cis\": [\"2.3.10.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27052,'Configure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;LSARPC,&#x20;NETLOGON,&#x20;SAMR&#x20;and&#x20;&#40;when&#x20;the&#x20;legacy&#x20;Computer&#x20;Browser&#x20;service&#x20;is&#x20;enabled&#41;&#x20;BROWSER.&#x20;Note:&#x20;A&#x20;Member&#x20;Server&#x20;that&#x20;holds&#x20;the&#x20;Remote&#x20;Desktop&#x20;Services&#x20;Role&#x20;with&#x20;Remote&#x20;Desktop&#x20;Licensing&#x20;Role&#x20;Service&#x20;will&#x20;require&#x20;a&#x20;special&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;allow&#x20;the&#x20;HydraLSPipe&#x20;and&#x20;TermServLicensing&#x20;Named&#x20;Pipes&#x20;to&#x20;be&#x20;accessed&#x20;anonymously.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.6\"]}, {\"cis_csc\": [\"14.1\", \"14.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27053,'Configure&#x20;&#039;Network&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;communication&#x20;sessions,&#x20;or&#x20;pipes,&#x20;will&#x20;have&#x20;attributes&#x20;and&#x20;permissions&#x20;that&#x20;allow&#x20;anonymous&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;,&#x20;or&#x20;&#40;when&#x20;the&#x20;legacy&#x20;Computer&#x20;Browser&#x20;service&#x20;is&#x20;enabled&#41;&#x20;BROWSER.&#x20;Note:&#x20;A&#x20;Member&#x20;Server&#x20;that&#x20;holds&#x20;the&#x20;Remote&#x20;Desktop&#x20;Services&#x20;Role&#x20;with&#x20;Remote&#x20;Desktop&#x20;Licensing&#x20;Role&#x20;Service&#x20;will&#x20;require&#x20;a&#x20;special&#x20;exception&#x20;to&#x20;this&#x20;recommendation,&#x20;to&#x20;allow&#x20;the&#x20;HydraLSPipe&#x20;and&#x20;TermServLicensing&#x20;Named&#x20;Pipes&#x20;to&#x20;be&#x20;accessed&#x20;anonymously.','Limiting&#x20;named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;will&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;configure&#x20;the&#x20;following&#x20;UI&#x20;path:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Named&#x20;Pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.7\"]}, {\"cis_csc\": [\"14.1\", \"14.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27054,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;There&#x20;was&#x20;a&#x20;setting&#x20;with&#x20;that&#x20;name&#x20;in&#x20;Windows&#x20;XP,&#x20;but&#x20;it&#x20;is&#x20;called&#x20;&quot;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-&#x20;paths&quot;&#x20;in&#x20;Windows&#x20;Server&#x20;2003,&#x20;Windows&#x20;Vista,&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;SystemCurrentControlSetControlProductOptions&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion','The&#x20;registry&#x20;is&#x20;a&#x20;database&#x20;that&#x20;contains&#x20;computer&#x20;configuration&#x20;information,&#x20;and&#x20;much&#x20;of&#x20;the&#x20;information&#x20;is&#x20;sensitive.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;information&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack,&#x20;suitable&#x20;ACLs&#x20;are&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;to&#x20;help&#x20;protect&#x20;it&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlProductOptions&#x20;SystemCurrentControlSetControlServer&#x20;Applications&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersion&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths','[{\"cis\": [\"2.3.10.8\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27055,'Configure&#x20;&#039;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;will&#x20;be&#x20;accessible&#x20;over&#x20;the&#x20;network,&#x20;regardless&#x20;of&#x20;the&#x20;users&#x20;or&#x20;groups&#x20;listed&#x20;in&#x20;the&#x20;access&#x20;control&#x20;list&#x20;&#40;ACL&#41;&#x20;of&#x20;the&#x20;winreg&#x20;registry&#x20;key.&#x20;Note:&#x20;In&#x20;Windows&#x20;XP&#x20;this&#x20;setting&#x20;is&#x20;called&#x20;&quot;Network&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths,&quot;&#x20;the&#x20;setting&#x20;with&#x20;that&#x20;same&#x20;name&#x20;in&#x20;Windows&#x20;Vista,&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;and&#x20;Windows&#x20;Server&#x20;2003&#x20;does&#x20;not&#x20;exist&#x20;in&#x20;Windows&#x20;XP.&#x20;Note&#x20;#2:&#x20;When&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;you&#x20;specify&#x20;a&#x20;list&#x20;of&#x20;one&#x20;or&#x20;more&#x20;objects.&#x20;The&#x20;delimiter&#x20;used&#x20;when&#x20;entering&#x20;the&#x20;list&#x20;is&#x20;a&#x20;line&#x20;feed&#x20;or&#x20;carriage&#x20;return,&#x20;that&#x20;is,&#x20;type&#x20;the&#x20;first&#x20;object&#x20;on&#x20;the&#x20;list,&#x20;press&#x20;the&#x20;Enter&#x20;button,&#x20;type&#x20;the&#x20;next&#x20;object,&#x20;press&#x20;Enter&#x20;again,&#x20;etc.&#x20;The&#x20;setting&#x20;value&#x20;is&#x20;stored&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;group&#x20;policy&#x20;security&#x20;templates.&#x20;It&#x20;is&#x20;also&#x20;rendered&#x20;as&#x20;a&#x20;comma-delimited&#x20;list&#x20;in&#x20;Group&#x20;Policy&#x20;Editor&#039;s&#x20;display&#x20;pane&#x20;and&#x20;the&#x20;Resultant&#x20;Set&#x20;of&#x20;Policy&#x20;console.&#x20;It&#x20;is&#x20;recorded&#x20;in&#x20;the&#x20;registry&#x20;as&#x20;a&#x20;line-feed&#x20;delimited&#x20;list&#x20;in&#x20;a&#x20;REG_MULTI_SZ&#x20;value.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;SystemCurrentControlSetServicesSysmonLog&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;servers&#x20;that&#x20;hold&#x20;the&#x20;Active&#x20;Directory&#x20;Certificate&#x20;Services&#x20;Role&#x20;with&#x20;Certification&#x20;Authority&#x20;Role&#x20;Service&#x20;includes&#x20;the&#x20;above&#x20;list&#x20;and:&#x20;SystemCurrentControlSetServicesCertSvc&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;servers&#x20;that&#x20;have&#x20;the&#x20;WINS&#x20;Server&#x20;Feature&#x20;installed&#x20;includes&#x20;the&#x20;above&#x20;list&#x20;and:&#x20;SystemCurrentControlSetServicesWINS','The&#x20;registry&#x20;contains&#x20;sensitive&#x20;computer&#x20;configuration&#x20;information&#x20;that&#x20;could&#x20;be&#x20;used&#x20;by&#x20;an&#x20;attacker&#x20;to&#x20;facilitate&#x20;unauthorized&#x20;activities.&#x20;The&#x20;fact&#x20;that&#x20;the&#x20;default&#x20;ACLs&#x20;assigned&#x20;throughout&#x20;the&#x20;registry&#x20;are&#x20;fairly&#x20;restrictive&#x20;and&#x20;help&#x20;to&#x20;protect&#x20;the&#x20;registry&#x20;from&#x20;access&#x20;by&#x20;unauthorized&#x20;users&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;such&#x20;an&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;SystemCurrentControlSetControlPrintPrinters&#x20;SystemCurrentControlSetServicesEventlog&#x20;SoftwareMicrosoftOLAP&#x20;Server&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPrint&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionWindows&#x20;SystemCurrentControlSetControlContentIndex&#x20;SystemCurrentControlSetControlTerminal&#x20;Server&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerUserConfig&#x20;SystemCurrentControlSetControlTerminal&#x20;ServerDefaultUserConfiguration&#x20;SoftwareMicrosoftWindows&#x20;NTCurrentVersionPerflib&#x20;SystemCurrentControlSetServicesSysmonLog&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Remotely&#x20;accessible&#x20;registry&#x20;paths&#x20;and&#x20;sub-paths&#x20;When&#x20;a&#x20;server&#x20;holds&#x20;the&#x20;Active&#x20;Directory&#x20;Certificate&#x20;Services&#x20;Role&#x20;with&#x20;Certification&#x20;Authority&#x20;Role&#x20;Service,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesCertSvc.&#x20;When&#x20;a&#x20;server&#x20;has&#x20;the&#x20;WINS&#x20;Server&#x20;Feature&#x20;installed,&#x20;the&#x20;above&#x20;list&#x20;should&#x20;also&#x20;include:&#x20;SystemCurrentControlSetServicesWINS','[{\"cis\": [\"2.3.10.9\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27056,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','When&#x20;enabled,&#x20;this&#x20;policy&#x20;setting&#x20;restricts&#x20;anonymous&#x20;access&#x20;to&#x20;only&#x20;those&#x20;shares&#x20;and&#x20;pipes&#x20;that&#x20;are&#x20;named&#x20;in&#x20;the&#x20;Network&#x20;access:&#x20;Named&#x20;pipes&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;and&#x20;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#x20;settings.&#x20;This&#x20;policy&#x20;setting&#x20;controls&#x20;null&#x20;session&#x20;access&#x20;to&#x20;shares&#x20;on&#x20;your&#x20;computers&#x20;by&#x20;adding&#x20;RestrictNullSessAccess&#x20;with&#x20;the&#x20;value&#x20;1&#x20;in&#x20;the&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanManServerParameters&#x20;registry&#x20;key.&#x20;This&#x20;registry&#x20;value&#x20;toggles&#x20;null&#x20;session&#x20;shares&#x20;on&#x20;or&#x20;off&#x20;to&#x20;control&#x20;whether&#x20;the&#x20;server&#x20;service&#x20;restricts&#x20;unauthenticated&#x20;clients&#039;&#x20;access&#x20;to&#x20;named&#x20;resources.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Null&#x20;sessions&#x20;are&#x20;a&#x20;weakness&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;through&#x20;shares&#x20;&#40;including&#x20;the&#x20;default&#x20;shares&#41;&#x20;on&#x20;computers&#x20;in&#x20;your&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;anonymous&#x20;access&#x20;to&#x20;Named&#x20;Pipes&#x20;and&#x20;Shares','[{\"cis\": [\"2.3.10.10\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27057,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow&#039;&#x20;&#40;MS&#x20;','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;remote&#x20;RPC&#x20;connections&#x20;to&#x20;SAM.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow.&#x20;Note:&#x20;A&#x20;Windows&#x20;10&#x20;R1607,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.&#x20;Note&#x20;#2:&#x20;If&#x20;your&#x20;organization&#x20;is&#x20;using&#x20;Azure&#x20;Advanced&#x20;Threat&#x20;Protection&#x20;&#40;APT&#41;,&#x20;the&#x20;service&#x20;account,&#x20;&ldquo;AATP&#x20;Service&rdquo;&#x20;will&#x20;need&#x20;to&#x20;be&#x20;added&#x20;to&#x20;the&#x20;recommendation&#x20;configuration.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;adding&#x20;the&#x20;&ldquo;AATP&#x20;Service&rdquo;&#x20;account&#x20;please&#x20;see&#x20;Configure&#x20;SAM-R&#x20;to&#x20;enable&#x20;lateral&#x20;movement&#x20;path&#x20;detection&#x20;in&#x20;Microsoft&#x20;Defender&#x20;for&#x20;Identity&#x20;|&#x20;Microsoft&#x20;Docs.','To&#x20;ensure&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;cannot&#x20;anonymously&#x20;list&#x20;local&#x20;account&#x20;names&#x20;or&#x20;groups&#x20;and&#x20;use&#x20;the&#x20;information&#x20;to&#x20;attempt&#x20;to&#x20;guess&#x20;passwords&#x20;or&#x20;perform&#x20;social&#x20;engineering&#x20;attacks.&#x20;&#40;Social&#x20;engineering&#x20;attacks&#x20;try&#x20;to&#x20;deceive&#x20;users&#x20;in&#x20;some&#x20;way&#x20;to&#x20;obtain&#x20;passwords&#x20;or&#x20;some&#x20;form&#x20;of&#x20;security&#x20;information.&#41;','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Administrators:&#x20;Remote&#x20;Access:&#x20;Allow:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Restrict&#x20;clients&#x20;allowed&#x20;to&#x20;make&#x20;remote&#x20;calls&#x20;to&#x20;SAM','[{\"cis\": [\"2.3.10.11\"]}, {\"cis_csc\": [\"5.1\", \"9.1\", \"9.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27058,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;None&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;network&#x20;shares&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;anonymous&#x20;users.&#x20;The&#x20;default&#x20;configuration&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;has&#x20;little&#x20;effect&#x20;because&#x20;all&#x20;users&#x20;have&#x20;to&#x20;be&#x20;authenticated&#x20;before&#x20;they&#x20;can&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;the&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;.','It&#x20;is&#x20;very&#x20;dangerous&#x20;to&#x20;allow&#x20;any&#x20;values&#x20;in&#x20;this&#x20;setting.&#x20;Any&#x20;shares&#x20;that&#x20;are&#x20;listed&#x20;can&#x20;be&#x20;accessed&#x20;by&#x20;any&#x20;network&#x20;user,&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;exposure&#x20;or&#x20;corruption&#x20;of&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&lt;blank&gt;&#x20;&#40;i.e.&#x20;None&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Shares&#x20;that&#x20;can&#x20;be&#x20;accessed&#x20;anonymously','[{\"cis\": [\"2.3.10.12\"]}, {\"cis_csc\": [\"3.3\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27059,'Ensure&#x20;&#039;Network&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;how&#x20;network&#x20;logons&#x20;that&#x20;use&#x20;local&#x20;accounts&#x20;are&#x20;authenticated.&#x20;The&#x20;Classic&#x20;option&#x20;allows&#x20;precise&#x20;control&#x20;over&#x20;access&#x20;to&#x20;resources,&#x20;including&#x20;the&#x20;ability&#x20;to&#x20;assign&#x20;different&#x20;types&#x20;of&#x20;access&#x20;to&#x20;different&#x20;users&#x20;for&#x20;the&#x20;same&#x20;resource.&#x20;The&#x20;Guest&#x20;only&#x20;option&#x20;allows&#x20;you&#x20;to&#x20;treat&#x20;all&#x20;users&#x20;equally.&#x20;In&#x20;this&#x20;context,&#x20;all&#x20;users&#x20;authenticate&#x20;as&#x20;Guest&#x20;only&#x20;to&#x20;receive&#x20;the&#x20;same&#x20;access&#x20;level&#x20;to&#x20;a&#x20;given&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves.&#x20;Note:&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;affect&#x20;interactive&#x20;logons&#x20;that&#x20;are&#x20;performed&#x20;remotely&#x20;by&#x20;using&#x20;such&#x20;services&#x20;as&#x20;Telnet&#x20;or&#x20;Remote&#x20;Desktop&#x20;Services&#x20;&#40;formerly&#x20;called&#x20;Terminal&#x20;Services&#41;.','With&#x20;the&#x20;Guest&#x20;only&#x20;model,&#x20;any&#x20;user&#x20;who&#x20;can&#x20;authenticate&#x20;to&#x20;your&#x20;computer&#x20;over&#x20;the&#x20;network&#x20;does&#x20;so&#x20;with&#x20;guest&#x20;privileges,&#x20;which&#x20;probably&#x20;means&#x20;that&#x20;they&#x20;will&#x20;not&#x20;have&#x20;write&#x20;access&#x20;to&#x20;shared&#x20;resources&#x20;on&#x20;that&#x20;computer.&#x20;Although&#x20;this&#x20;restriction&#x20;does&#x20;increase&#x20;security,&#x20;it&#x20;makes&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;authorized&#x20;users&#x20;to&#x20;access&#x20;shared&#x20;resources&#x20;on&#x20;those&#x20;computers&#x20;because&#x20;ACLs&#x20;on&#x20;those&#x20;resources&#x20;must&#x20;include&#x20;access&#x20;control&#x20;entries&#x20;&#40;ACEs&#41;&#x20;for&#x20;the&#x20;Guest&#x20;account.&#x20;With&#x20;the&#x20;Classic&#x20;model,&#x20;local&#x20;accounts&#x20;should&#x20;be&#x20;password&#x20;protected.&#x20;Otherwise,&#x20;if&#x20;Guest&#x20;access&#x20;is&#x20;enabled,&#x20;anyone&#x20;can&#x20;use&#x20;those&#x20;user&#x20;accounts&#x20;to&#x20;access&#x20;shared&#x20;system&#x20;resources.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Classic&#x20;-&#x20;local&#x20;users&#x20;authenticate&#x20;as&#x20;themselves:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;access:&#x20;Sharing&#x20;and&#x20;security&#x20;model&#x20;for&#x20;local&#x20;accounts','[{\"cis\": [\"2.3.10.13\"]}, {\"cis_csc\": [\"14\", \"16\"]}, {\"pci_dss\": [\"7.1.3\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27060,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Local&#x20;System&#x20;services&#x20;that&#x20;use&#x20;Negotiate&#x20;when&#x20;reverting&#x20;to&#x20;NTLM&#x20;authentication&#x20;can&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;This&#x20;policy&#x20;is&#x20;supported&#x20;on&#x20;at&#x20;least&#x20;Windows&#x20;7&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;R2.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;connecting&#x20;to&#x20;computers&#x20;running&#x20;versions&#x20;of&#x20;Windows&#x20;earlier&#x20;than&#x20;Windows&#x20;Vista&#x20;or&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;,&#x20;services&#x20;running&#x20;as&#x20;Local&#x20;System&#x20;and&#x20;using&#x20;SPNEGO&#x20;&#40;Negotiate&#41;&#x20;that&#x20;revert&#x20;to&#x20;NTLM&#x20;use&#x20;the&#x20;computer&#x20;identity.&#x20;In&#x20;Windows&#x20;7,&#x20;if&#x20;you&#x20;are&#x20;connecting&#x20;to&#x20;a&#x20;computer&#x20;running&#x20;Windows&#x20;Server&#x20;2008&#x20;or&#x20;Windows&#x20;Vista,&#x20;then&#x20;a&#x20;system&#x20;service&#x20;uses&#x20;either&#x20;the&#x20;computer&#x20;identity&#x20;or&#x20;a&#x20;NULL&#x20;session.&#x20;When&#x20;connecting&#x20;with&#x20;a&#x20;NULL&#x20;session,&#x20;a&#x20;system-generated&#x20;session&#x20;key&#x20;is&#x20;created,&#x20;which&#x20;provides&#x20;no&#x20;protection&#x20;but&#x20;allows&#x20;applications&#x20;to&#x20;sign&#x20;and&#x20;encrypt&#x20;data&#x20;without&#x20;errors.&#x20;When&#x20;connecting&#x20;with&#x20;the&#x20;computer&#x20;identity,&#x20;both&#x20;signing&#x20;and&#x20;encryption&#x20;is&#x20;supported&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;data&#x20;protection.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;Local&#x20;System&#x20;to&#x20;use&#x20;computer&#x20;identity&#x20;for&#x20;NTLM','[{\"cis\": [\"2.3.11.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27061,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;NTLM&#x20;is&#x20;allowed&#x20;to&#x20;fall&#x20;back&#x20;to&#x20;a&#x20;NULL&#x20;session&#x20;when&#x20;used&#x20;with&#x20;LocalSystem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','NULL&#x20;sessions&#x20;are&#x20;less&#x20;secure&#x20;because&#x20;by&#x20;definition&#x20;they&#x20;are&#x20;unauthenticated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Allow&#x20;LocalSystem&#x20;NULL&#x20;session&#x20;fallback','[{\"cis\": [\"2.3.11.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27062,'Ensure&#x20;&#039;Network&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;determines&#x20;if&#x20;online&#x20;identities&#x20;are&#x20;able&#x20;to&#x20;authenticate&#x20;to&#x20;this&#x20;computer.&#x20;The&#x20;Public&#x20;Key&#x20;Cryptography&#x20;Based&#x20;User-to-User&#x20;&#40;PKU2U&#41;&#x20;protocol&#x20;introduced&#x20;in&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;Server&#x20;2008&#x20;R2&#x20;is&#x20;implemented&#x20;as&#x20;a&#x20;security&#x20;support&#x20;provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;enables&#x20;peer-to-peer&#x20;authentication,&#x20;particularly&#x20;through&#x20;the&#x20;Windows&#x20;7&#x20;media&#x20;and&#x20;file&#x20;sharing&#x20;feature&#x20;called&#x20;HomeGroup,&#x20;which&#x20;permits&#x20;sharing&#x20;between&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;members&#x20;of&#x20;a&#x20;domain.&#x20;With&#x20;PKU2U,&#x20;a&#x20;new&#x20;extension&#x20;was&#x20;introduced&#x20;to&#x20;the&#x20;Negotiate&#x20;authentication&#x20;package,&#x20;Spnego.dll.&#x20;In&#x20;previous&#x20;versions&#x20;of&#x20;Windows,&#x20;Negotiate&#x20;decided&#x20;whether&#x20;to&#x20;use&#x20;Kerberos&#x20;or&#x20;NTLM&#x20;for&#x20;authentication.&#x20;The&#x20;extension&#x20;SSP&#x20;for&#x20;Negotiate,&#x20;Negoexts.dll,&#x20;which&#x20;is&#x20;treated&#x20;as&#x20;an&#x20;authentication&#x20;protocol&#x20;by&#x20;Windows,&#x20;supports&#x20;Microsoft&#x20;SSPs&#x20;including&#x20;PKU2U.&#x20;When&#x20;computers&#x20;are&#x20;configured&#x20;to&#x20;accept&#x20;authentication&#x20;requests&#x20;by&#x20;using&#x20;online&#x20;IDs,&#x20;Negoexts.dll&#x20;calls&#x20;the&#x20;PKU2U&#x20;SSP&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;PKU2U&#x20;SSP&#x20;obtains&#x20;a&#x20;local&#x20;certificate&#x20;and&#x20;exchanges&#x20;the&#x20;policy&#x20;between&#x20;the&#x20;peer&#x20;computers.&#x20;When&#x20;validated&#x20;on&#x20;the&#x20;peer&#x20;computer,&#x20;the&#x20;certificate&#x20;within&#x20;the&#x20;metadata&#x20;is&#x20;sent&#x20;to&#x20;the&#x20;logon&#x20;peer&#x20;for&#x20;validation&#x20;and&#x20;associates&#x20;the&#x20;user&#039;s&#x20;certificate&#x20;to&#x20;a&#x20;security&#x20;token&#x20;and&#x20;the&#x20;logon&#x20;process&#x20;completes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;PKU2U&#x20;protocol&#x20;is&#x20;a&#x20;peer-to-peer&#x20;authentication&#x20;protocol&#x20;-&#x20;authentication&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;in&#x20;most&#x20;managed&#x20;networks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;Security:&#x20;Allow&#x20;PKU2U&#x20;authentication&#x20;requests&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;use&#x20;online&#x20;identities','[{\"cis\": [\"2.3.11.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27063,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;encryption&#x20;types&#x20;that&#x20;Kerberos&#x20;is&#x20;allowed&#x20;to&#x20;use.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types.&#x20;Note:&#x20;Some&#x20;legacy&#x20;applications&#x20;and&#x20;OSes&#x20;may&#x20;still&#x20;require&#x20;RC4_HMAC_MD5&#x20;-&#x20;we&#x20;recommend&#x20;you&#x20;test&#x20;in&#x20;your&#x20;environment&#x20;and&#x20;verify&#x20;whether&#x20;you&#x20;can&#x20;safely&#x20;remove&#x20;it.','The&#x20;strength&#x20;of&#x20;each&#x20;encryption&#x20;algorithm&#x20;varies&#x20;from&#x20;one&#x20;to&#x20;the&#x20;next,&#x20;choosing&#x20;stronger&#x20;algorithms&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;compromise&#x20;however&#x20;doing&#x20;so&#x20;may&#x20;cause&#x20;issues&#x20;when&#x20;the&#x20;computer&#x20;attempts&#x20;to&#x20;authenticate&#x20;with&#x20;systems&#x20;that&#x20;do&#x20;not&#x20;support&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;AES128_HMAC_SHA1,&#x20;AES256_HMAC_SHA1,&#x20;Future&#x20;encryption&#x20;types:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Configure&#x20;encryption&#x20;types&#x20;allowed&#x20;for&#x20;Kerberos','[{\"cis\": [\"2.3.11.4\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27064,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;hash&#x20;value&#x20;for&#x20;the&#x20;new&#x20;password&#x20;is&#x20;stored&#x20;when&#x20;the&#x20;password&#x20;is&#x20;changed.&#x20;The&#x20;LM&#x20;hash&#x20;is&#x20;relatively&#x20;weak&#x20;and&#x20;prone&#x20;to&#x20;attack&#x20;compared&#x20;to&#x20;the&#x20;cryptographically&#x20;stronger&#x20;Microsoft&#x20;Windows&#x20;NT&#x20;hash.&#x20;Since&#x20;LM&#x20;hashes&#x20;are&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;in&#x20;the&#x20;security&#x20;database,&#x20;passwords&#x20;can&#x20;then&#x20;be&#x20;easily&#x20;compromised&#x20;if&#x20;the&#x20;database&#x20;is&#x20;attacked.&#x20;Note:&#x20;Older&#x20;operating&#x20;systems&#x20;and&#x20;some&#x20;third-party&#x20;applications&#x20;may&#x20;fail&#x20;when&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled.&#x20;Also,&#x20;note&#x20;that&#x20;the&#x20;password&#x20;will&#x20;need&#x20;to&#x20;be&#x20;changed&#x20;on&#x20;all&#x20;accounts&#x20;after&#x20;you&#x20;enable&#x20;this&#x20;setting&#x20;to&#x20;gain&#x20;the&#x20;proper&#x20;benefit.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;SAM&#x20;file&#x20;can&#x20;be&#x20;targeted&#x20;by&#x20;attackers&#x20;who&#x20;seek&#x20;access&#x20;to&#x20;username&#x20;and&#x20;password&#x20;hashes.&#x20;Such&#x20;attacks&#x20;use&#x20;special&#x20;tools&#x20;to&#x20;crack&#x20;passwords,&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;impersonate&#x20;users&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;resources&#x20;on&#x20;your&#x20;network.&#x20;These&#x20;types&#x20;of&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;prevented&#x20;if&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting,&#x20;but&#x20;it&#x20;will&#x20;be&#x20;much&#x20;more&#x20;difficult&#x20;for&#x20;these&#x20;types&#x20;of&#x20;attacks&#x20;to&#x20;succeed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Do&#x20;not&#x20;store&#x20;LAN&#x20;Manager&#x20;hash&#x20;value&#x20;on&#x20;next&#x20;password&#x20;change','[{\"cis\": [\"2.3.11.5\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27065,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM&#039;.','LAN&#x20;Manager&#x20;&#40;LM&#41;&#x20;was&#x20;a&#x20;family&#x20;of&#x20;early&#x20;Microsoft&#x20;client/server&#x20;software&#x20;&#40;predating&#x20;Windows&#x20;NT&#41;&#x20;that&#x20;allowed&#x20;users&#x20;to&#x20;link&#x20;personal&#x20;computers&#x20;together&#x20;on&#x20;a&#x20;single&#x20;network.&#x20;LM&#x20;network&#x20;capabilities&#x20;included&#x20;transparent&#x20;file&#x20;and&#x20;print&#x20;sharing,&#x20;user&#x20;security&#x20;features,&#x20;and&#x20;network&#x20;administration&#x20;tools.&#x20;In&#x20;Active&#x20;Directory&#x20;domains,&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;the&#x20;default&#x20;authentication&#x20;protocol.&#x20;However,&#x20;if&#x20;the&#x20;Kerberos&#x20;protocol&#x20;is&#x20;not&#x20;negotiated&#x20;for&#x20;some&#x20;reason,&#x20;Active&#x20;Directory&#x20;will&#x20;use&#x20;LM,&#x20;NTLM,&#x20;or&#x20;NTLMv2.&#x20;LAN&#x20;Manager&#x20;authentication&#x20;includes&#x20;the&#x20;LM,&#x20;NTLM,&#x20;and&#x20;NTLM&#x20;version&#x20;2&#x20;&#40;NTLMv2&#41;&#x20;variants,&#x20;and&#x20;is&#x20;the&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;to&#x20;authenticate&#x20;all&#x20;Windows&#x20;clients&#x20;when&#x20;they&#x20;perform&#x20;the&#x20;following&#x20;operations:&#x20;&#x20;-&#x20;&#x20;Join&#x20;a&#x20;domain&#x20;&#x20;-&#x20;&#x20;Authenticate&#x20;between&#x20;Active&#x20;Directory&#x20;forests&#x20;&#x20;-&#x20;&#x20;Authenticate&#x20;to&#x20;down-level&#x20;domains&#x20;&#x20;-&#x20;&#x20;Authenticate&#x20;to&#x20;computers&#x20;that&#x20;do&#x20;not&#x20;run&#x20;Windows&#x20;2000,&#x20;Windows&#x20;Server&#x20;2003,&#x20;&#x20;or&#x20;Windows&#x20;XP&#x20;&#x20;-&#x20;&#x20;Authenticate&#x20;to&#x20;computers&#x20;that&#x20;are&#x20;not&#x20;in&#x20;the&#x20;domain&#x20;The&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level&#x20;setting&#x20;determines&#x20;which&#x20;challenge/response&#x20;authentication&#x20;protocol&#x20;is&#x20;used&#x20;for&#x20;network&#x20;logons.&#x20;This&#x20;choice&#x20;affects&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;protocol&#x20;used&#x20;by&#x20;clients,&#x20;the&#x20;level&#x20;of&#x20;session&#x20;security&#x20;negotiated,&#x20;and&#x20;the&#x20;level&#x20;of&#x20;authentication&#x20;accepted&#x20;by&#x20;servers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM.','Windows&#x20;2000&#x20;and&#x20;Windows&#x20;XP&#x20;clients&#x20;were&#x20;configured&#x20;by&#x20;default&#x20;to&#x20;send&#x20;LM&#x20;and&#x20;NTLM&#x20;authentication&#x20;responses&#x20;&#40;Windows&#x20;95-based&#x20;and&#x20;Windows&#x20;98-based&#x20;clients&#x20;only&#x20;send&#x20;LM&#41;.&#x20;The&#x20;default&#x20;settings&#x20;in&#x20;OSes&#x20;predating&#x20;Windows&#x20;Vista&#x20;/&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-&#x20;R2&#41;&#x20;allowed&#x20;all&#x20;clients&#x20;to&#x20;authenticate&#x20;with&#x20;servers&#x20;and&#x20;use&#x20;their&#x20;resources.&#x20;However,&#x20;this&#x20;meant&#x20;that&#x20;LM&#x20;responses&#x20;-&#x20;the&#x20;weakest&#x20;form&#x20;of&#x20;authentication&#x20;response&#x20;-&#x20;were&#x20;sent&#x20;over&#x20;the&#x20;network,&#x20;and&#x20;it&#x20;was&#x20;potentially&#x20;possible&#x20;for&#x20;attackers&#x20;to&#x20;sniff&#x20;that&#x20;traffic&#x20;to&#x20;more&#x20;easily&#x20;reproduce&#x20;the&#x20;user&#039;s&#x20;password.&#x20;The&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;operating&#x20;systems&#x20;cannot&#x20;use&#x20;the&#x20;Kerberos&#x20;version&#x20;5&#x20;protocol&#x20;for&#x20;authentication.&#x20;For&#x20;this&#x20;reason,&#x20;in&#x20;a&#x20;Windows&#x20;Server&#x20;2003&#x20;domain,&#x20;these&#x20;computers&#x20;authenticate&#x20;by&#x20;default&#x20;with&#x20;both&#x20;the&#x20;LM&#x20;and&#x20;NTLM&#x20;protocols&#x20;for&#x20;network&#x20;authentication.&#x20;You&#x20;can&#x20;enforce&#x20;a&#x20;more&#x20;secure&#x20;authentication&#x20;protocol&#x20;for&#x20;Windows&#x20;95,&#x20;Windows&#x20;98,&#x20;and&#x20;Windows&#x20;NT&#x20;by&#x20;using&#x20;NTLMv2.&#x20;For&#x20;the&#x20;logon&#x20;process,&#x20;NTLMv2&#x20;uses&#x20;a&#x20;secure&#x20;channel&#x20;to&#x20;protect&#x20;the&#x20;authentication&#x20;process.&#x20;Even&#x20;if&#x20;you&#x20;use&#x20;NTLMv2&#x20;for&#x20;older&#x20;clients&#x20;and&#x20;servers,&#x20;Windows-based&#x20;clients&#x20;and&#x20;servers&#x20;that&#x20;are&#x20;members&#x20;of&#x20;the&#x20;domain&#x20;will&#x20;use&#x20;the&#x20;Kerberos&#x20;authentication&#x20;protocol&#x20;to&#x20;authenticate&#x20;with&#x20;Windows&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;Domain&#x20;Controllers.&#x20;For&#x20;these&#x20;reasons,&#x20;it&#x20;is&#x20;strongly&#x20;preferred&#x20;to&#x20;restrict&#x20;the&#x20;use&#x20;of&#x20;LM&#x20;&amp;&#x20;NTLM&#x20;&#40;non-v2&#41;&#x20;as&#x20;much&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Send&#x20;NTLMv2&#x20;response&#x20;only.&#x20;Refuse&#x20;LM&#x20;&amp;&#x20;NTLM:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LAN&#x20;Manager&#x20;authentication&#x20;level','[{\"cis\": [\"2.3.11.7\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27066,'Ensure&#x20;&#039;Network&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Negotiate&#x20;signing&#039;&#x20;or&#x20;higher.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;level&#x20;of&#x20;data&#x20;signing&#x20;that&#x20;is&#x20;requested&#x20;on&#x20;behalf&#x20;of&#x20;clients&#x20;that&#x20;issue&#x20;LDAP&#x20;BIND&#x20;requests.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;does&#x20;not&#x20;have&#x20;any&#x20;impact&#x20;on&#x20;LDAP&#x20;simple&#x20;bind&#x20;&#40;ldap_simple_bind&#41;&#x20;or&#x20;LDAP&#x20;simple&#x20;bind&#x20;through&#x20;SSL&#x20;&#40;ldap_simple_bind_s&#41;.&#x20;No&#x20;Microsoft&#x20;LDAP&#x20;clients&#x20;that&#x20;are&#x20;included&#x20;with&#x20;Windows&#x20;XP&#x20;Professional&#x20;use&#x20;ldap_simple_bind&#x20;or&#x20;ldap_simple_bind_s&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;Domain&#x20;Controller.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Negotiate&#x20;signing.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Unsigned&#x20;network&#x20;traffic&#x20;is&#x20;susceptible&#x20;to&#x20;man-in-the-middle&#x20;attacks&#x20;in&#x20;which&#x20;an&#x20;intruder&#x20;captures&#x20;the&#x20;packets&#x20;between&#x20;the&#x20;client&#x20;and&#x20;server,&#x20;modifies&#x20;them,&#x20;and&#x20;then&#x20;forwards&#x20;them&#x20;to&#x20;the&#x20;server.&#x20;For&#x20;an&#x20;LDAP&#x20;server,&#x20;this&#x20;susceptibility&#x20;means&#x20;that&#x20;an&#x20;attacker&#x20;could&#x20;cause&#x20;a&#x20;server&#x20;to&#x20;make&#x20;decisions&#x20;that&#x20;are&#x20;based&#x20;on&#x20;false&#x20;or&#x20;altered&#x20;data&#x20;from&#x20;the&#x20;LDAP&#x20;queries.&#x20;To&#x20;lower&#x20;this&#x20;risk&#x20;in&#x20;your&#x20;network,&#x20;you&#x20;can&#x20;implement&#x20;strong&#x20;physical&#x20;security&#x20;measures&#x20;to&#x20;protect&#x20;the&#x20;network&#x20;infrastructure.&#x20;Also,&#x20;you&#x20;can&#x20;make&#x20;all&#x20;types&#x20;of&#x20;man-in-the-middle&#x20;attacks&#x20;extremely&#x20;difficult&#x20;if&#x20;you&#x20;require&#x20;digital&#x20;signatures&#x20;on&#x20;all&#x20;network&#x20;packets&#x20;by&#x20;means&#x20;of&#x20;IPsec&#x20;authentication&#x20;headers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Negotiate&#x20;signing&#x20;&#40;configuring&#x20;to&#x20;Require&#x20;signing&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;LDAP&#x20;client&#x20;signing&#x20;requirements','[{\"cis\": [\"2.3.11.8\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27067,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;clients&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;both&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;In&#x20;other&#x20;words,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;clients','[{\"cis\": [\"2.3.11.9\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27068,'Ensure&#x20;&#039;Network&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Require&#x20;NTLMv2&#x20;session&#','This&#x20;policy&#x20;setting&#x20;determines&#x20;which&#x20;behaviors&#x20;are&#x20;allowed&#x20;by&#x20;servers&#x20;for&#x20;applications&#x20;using&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;SSP&#41;.&#x20;The&#x20;SSP&#x20;Interface&#x20;&#40;SSPI&#41;&#x20;is&#x20;used&#x20;by&#x20;applications&#x20;that&#x20;need&#x20;authentication&#x20;services.&#x20;The&#x20;setting&#x20;does&#x20;not&#x20;modify&#x20;how&#x20;the&#x20;authentication&#x20;sequence&#x20;works&#x20;but&#x20;instead&#x20;require&#x20;certain&#x20;behaviors&#x20;in&#x20;applications&#x20;that&#x20;use&#x20;the&#x20;SSPI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption.&#x20;Note:&#x20;These&#x20;values&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;Network&#x20;security:&#x20;LAN&#x20;Manager&#x20;Authentication&#x20;Level&#x20;&#40;Rule&#x20;2.3.11.7&#41;&#x20;security&#x20;setting&#x20;value.','You&#x20;can&#x20;enable&#x20;all&#x20;of&#x20;the&#x20;options&#x20;for&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;help&#x20;protect&#x20;network&#x20;traffic&#x20;that&#x20;uses&#x20;the&#x20;NTLM&#x20;Security&#x20;Support&#x20;Provider&#x20;&#40;NTLM&#x20;SSP&#41;&#x20;from&#x20;being&#x20;exposed&#x20;or&#x20;tampered&#x20;with&#x20;by&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;access&#x20;to&#x20;the&#x20;same&#x20;network.&#x20;That&#x20;is,&#x20;these&#x20;options&#x20;help&#x20;protect&#x20;against&#x20;man-in-the-middle&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Require&#x20;NTLMv2&#x20;session&#x20;security,&#x20;Require&#x20;128-bit&#x20;encryption:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsNetwork&#x20;security:&#x20;Minimum&#x20;session&#x20;security&#x20;for&#x20;NTLM&#x20;SSP&#x20;based&#x20;&#40;including&#x20;secure&#x20;RPC&#41;&#x20;servers','[{\"cis\": [\"2.3.11.10\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27069,'Ensure&#x20;&#039;Shutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;a&#x20;computer&#x20;can&#x20;be&#x20;shut&#x20;down&#x20;when&#x20;a&#x20;user&#x20;is&#x20;not&#x20;logged&#x20;on.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;the&#x20;shutdown&#x20;command&#x20;is&#x20;available&#x20;on&#x20;the&#x20;Windows&#x20;logon&#x20;screen.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;disable&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;restrict&#x20;the&#x20;ability&#x20;to&#x20;shut&#x20;down&#x20;the&#x20;computer&#x20;to&#x20;users&#x20;with&#x20;credentials&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;Server&#x20;2008&#x20;R2&#x20;and&#x20;older&#x20;versions,&#x20;this&#x20;setting&#x20;had&#x20;no&#x20;impact&#x20;on&#x20;Remote&#x20;Desktop&#x20;&#40;RDP&#41;&#x20;/&#x20;Terminal&#x20;Services&#x20;sessions&#x20;-&#x20;it&#x20;only&#x20;affected&#x20;the&#x20;local&#x20;console.&#x20;However,&#x20;Microsoft&#x20;changed&#x20;the&#x20;behavior&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;where&#x20;if&#x20;set&#x20;to&#x20;Enabled,&#x20;RDP&#x20;sessions&#x20;are&#x20;also&#x20;allowed&#x20;to&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server.','Users&#x20;who&#x20;can&#x20;access&#x20;the&#x20;console&#x20;locally&#x20;could&#x20;shut&#x20;down&#x20;the&#x20;computer.&#x20;Attackers&#x20;could&#x20;also&#x20;walk&#x20;to&#x20;the&#x20;local&#x20;console&#x20;and&#x20;restart&#x20;the&#x20;server,&#x20;which&#x20;would&#x20;cause&#x20;a&#x20;temporary&#x20;DoS&#x20;condition.&#x20;Attackers&#x20;could&#x20;also&#x20;shut&#x20;down&#x20;the&#x20;server&#x20;and&#x20;leave&#x20;all&#x20;of&#x20;its&#x20;applications&#x20;and&#x20;services&#x20;unavailable.&#x20;As&#x20;noted&#x20;in&#x20;the&#x20;Description&#x20;above,&#x20;the&#x20;Denial&#x20;of&#x20;Service&#x20;&#40;DoS&#41;&#x20;risk&#x20;of&#x20;enabling&#x20;this&#x20;setting&#x20;dramatically&#x20;increases&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;and&#x20;above,&#x20;as&#x20;even&#x20;remote&#x20;users&#x20;could&#x20;then&#x20;shut&#x20;down&#x20;or&#x20;restart&#x20;the&#x20;server&#x20;from&#x20;the&#x20;logon&#x20;screen&#x20;of&#x20;an&#x20;RDP&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsShutdown:&#x20;Allow&#x20;system&#x20;to&#x20;be&#x20;shut&#x20;down&#x20;without&#x20;having&#x20;to&#x20;log&#x20;on','[{\"cis\": [\"2.3.13.1\"]}]'),(27070,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-&#x20;Windows&#x20;subsystems&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;case&#x20;insensitivity&#x20;is&#x20;enforced&#x20;for&#x20;all&#x20;subsystems.&#x20;The&#x20;Microsoft&#x20;Win32&#x20;subsystem&#x20;is&#x20;case&#x20;insensitive.&#x20;However,&#x20;the&#x20;kernel&#x20;supports&#x20;case&#x20;sensitivity&#x20;for&#x20;other&#x20;subsystems,&#x20;such&#x20;as&#x20;the&#x20;Portable&#x20;Operating&#x20;System&#x20;Interface&#x20;for&#x20;UNIX&#x20;&#40;POSIX&#41;.&#x20;Because&#x20;Windows&#x20;is&#x20;case&#x20;insensitive&#x20;&#40;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity&#41;,&#x20;failure&#x20;to&#x20;enforce&#x20;this&#x20;policy&#x20;setting&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;the&#x20;POSIX&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;by&#x20;using&#x20;mixed&#x20;case&#x20;to&#x20;label&#x20;it.&#x20;Such&#x20;a&#x20;situation&#x20;can&#x20;block&#x20;access&#x20;to&#x20;these&#x20;files&#x20;by&#x20;another&#x20;user&#x20;who&#x20;uses&#x20;typical&#x20;Win32&#x20;tools,&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Because&#x20;Windows&#x20;is&#x20;case-insensitive&#x20;but&#x20;the&#x20;POSIX&#x20;subsystem&#x20;will&#x20;support&#x20;case&#x20;sensitivity,&#x20;failure&#x20;to&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;would&#x20;make&#x20;it&#x20;possible&#x20;for&#x20;a&#x20;user&#x20;of&#x20;that&#x20;subsystem&#x20;to&#x20;create&#x20;a&#x20;file&#x20;with&#x20;the&#x20;same&#x20;name&#x20;as&#x20;another&#x20;file&#x20;but&#x20;with&#x20;a&#x20;different&#x20;mix&#x20;of&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letters.&#x20;Such&#x20;a&#x20;situation&#x20;could&#x20;potentially&#x20;confuse&#x20;users&#x20;when&#x20;they&#x20;try&#x20;to&#x20;access&#x20;such&#x20;files&#x20;from&#x20;normal&#x20;Win32&#x20;tools&#x20;because&#x20;only&#x20;one&#x20;of&#x20;the&#x20;files&#x20;will&#x20;be&#x20;available.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Require&#x20;case&#x20;insensitivity&#x20;for&#x20;non-&#x20;Windows&#x20;subsystems','[{\"cis\": [\"2.3.15.1\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27071,'Ensure&#x20;&#039;System&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;discretionary&#x20;access&#x20;control&#x20;list&#x20;&#40;DACL&#41;&#x20;for&#x20;objects.&#x20;Active&#x20;Directory&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;system&#x20;resources,&#x20;such&#x20;as&#x20;DOS&#x20;device&#x20;names,&#x20;mutexes,&#x20;and&#x20;semaphores.&#x20;In&#x20;this&#x20;way,&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;what&#x20;permissions&#x20;are&#x20;granted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;determines&#x20;the&#x20;strength&#x20;of&#x20;the&#x20;default&#x20;DACL&#x20;for&#x20;objects.&#x20;Windows&#x20;maintains&#x20;a&#x20;global&#x20;list&#x20;of&#x20;shared&#x20;computer&#x20;resources&#x20;so&#x20;that&#x20;objects&#x20;can&#x20;be&#x20;located&#x20;and&#x20;shared&#x20;among&#x20;processes.&#x20;Each&#x20;type&#x20;of&#x20;object&#x20;is&#x20;created&#x20;with&#x20;a&#x20;default&#x20;DACL&#x20;that&#x20;specifies&#x20;who&#x20;can&#x20;access&#x20;the&#x20;objects&#x20;and&#x20;with&#x20;what&#x20;permissions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsSystem&#x20;objects:&#x20;Strengthen&#x20;default&#x20;permissions&#x20;of&#x20;internal&#x20;system&#x20;objects&#x20;&#40;e.g.&#x20;Symbolic&#x20;Links&#41;','[{\"cis\": [\"2.3.15.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27072,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;built-in&#x20;Administrator&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;An&#x20;attack&#x20;vector&#x20;for&#x20;these&#x20;programs&#x20;was&#x20;to&#x20;discover&#x20;the&#x20;password&#x20;of&#x20;the&#x20;account&#x20;named&#x20;&quot;Administrator&quot;&#x20;because&#x20;that&#x20;user&#x20;account&#x20;was&#x20;created&#x20;for&#x20;all&#x20;installations&#x20;of&#x20;Windows.&#x20;To&#x20;address&#x20;this&#x20;risk,&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;newer,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;is&#x20;now&#x20;disabled&#x20;by&#x20;default.&#x20;In&#x20;a&#x20;default&#x20;installation&#x20;of&#x20;a&#x20;new&#x20;computer,&#x20;accounts&#x20;with&#x20;administrative&#x20;control&#x20;over&#x20;the&#x20;computer&#x20;are&#x20;initially&#x20;set&#x20;up&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;&#x20;-&#x20;&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;not&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;the&#x20;first&#x20;user&#x20;account&#x20;you&#x20;create&#x20;has&#x20;the&#x20;&#x20;equivalent&#x20;permissions&#x20;as&#x20;a&#x20;local&#x20;administrator.&#x20;&#x20;-&#x20;&#x20;If&#x20;the&#x20;computer&#x20;is&#x20;joined&#x20;to&#x20;a&#x20;domain,&#x20;no&#x20;local&#x20;administrator&#x20;accounts&#x20;are&#x20;created.&#x20;&#x20;The&#x20;Enterprise&#x20;or&#x20;Domain&#x20;Administrator&#x20;must&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;and&#x20;create&#x20;&#x20;one&#x20;if&#x20;a&#x20;local&#x20;administrator&#x20;account&#x20;is&#x20;warranted.&#x20;Once&#x20;Windows&#x20;is&#x20;installed,&#x20;the&#x20;built-in&#x20;Administrator&#x20;account&#x20;may&#x20;be&#x20;manually&#x20;enabled,&#x20;but&#x20;we&#x20;strongly&#x20;recommend&#x20;that&#x20;this&#x20;account&#x20;remain&#x20;disabled.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Admin&#x20;Approval&#x20;Mode&#x20;for&#x20;the&#x20;Built-in&#x20;Administrator&#x20;account','[{\"cis\": [\"2.3.17.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27073,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Prompt&#x20;for&#x20;consent&#x20','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;UAC&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;software&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;its&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;administrator&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;permits&#x20;the&#x20;administrator&#x20;to&#x20;prevent&#x20;a&#x20;malicious&#x20;program&#x20;from&#x20;elevating&#x20;its&#x20;privilege&#x20;when&#x20;the&#x20;program&#x20;attempts&#x20;to&#x20;do&#x20;so.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Prompt&#x20;for&#x20;consent&#x20;on&#x20;the&#x20;secure&#x20;desktop:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode','[{\"cis\": [\"2.3.17.2\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27074,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Automatically&#x20;deny&#x20;elevation&#x20;requests&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests.','One&#x20;of&#x20;the&#x20;risks&#x20;that&#x20;the&#x20;User&#x20;Account&#x20;Control&#x20;feature&#x20;introduced&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;trying&#x20;to&#x20;mitigate&#x20;is&#x20;that&#x20;of&#x20;malicious&#x20;programs&#x20;running&#x20;under&#x20;elevated&#x20;credentials&#x20;without&#x20;the&#x20;user&#x20;or&#x20;administrator&#x20;being&#x20;aware&#x20;of&#x20;their&#x20;activity.&#x20;This&#x20;setting&#x20;raises&#x20;awareness&#x20;to&#x20;the&#x20;user&#x20;that&#x20;a&#x20;program&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;elevated&#x20;privilege&#x20;operations&#x20;and&#x20;requires&#x20;that&#x20;the&#x20;user&#x20;be&#x20;able&#x20;to&#x20;supply&#x20;administrative&#x20;credentials&#x20;in&#x20;order&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Automatically&#x20;deny&#x20;elevation&#x20;requests:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Behavior&#x20;of&#x20;the&#x20;elevation&#x20;prompt&#x20;for&#x20;standard&#x20;users','[{\"cis\": [\"2.3.17.3\"]}, {\"pci_dss\": [\"7.1.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27075,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;application&#x20;installation&#x20;detection&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Some&#x20;malicious&#x20;software&#x20;will&#x20;attempt&#x20;to&#x20;install&#x20;itself&#x20;after&#x20;being&#x20;given&#x20;permission&#x20;to&#x20;run.&#x20;For&#x20;example,&#x20;malicious&#x20;software&#x20;with&#x20;a&#x20;trusted&#x20;application&#x20;shell.&#x20;The&#x20;user&#x20;may&#x20;have&#x20;given&#x20;permission&#x20;for&#x20;the&#x20;program&#x20;to&#x20;run&#x20;because&#x20;the&#x20;program&#x20;is&#x20;trusted,&#x20;but&#x20;if&#x20;they&#x20;are&#x20;then&#x20;prompted&#x20;for&#x20;installation&#x20;of&#x20;an&#x20;unknown&#x20;component&#x20;this&#x20;provides&#x20;another&#x20;way&#x20;of&#x20;trapping&#x20;the&#x20;software&#x20;before&#x20;it&#x20;can&#x20;do&#x20;damage','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Detect&#x20;application&#x20;installations&#x20;and&#x20;prompt&#x20;for&#x20;elevation','[{\"cis\": [\"2.3.17.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27076,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;applications&#x20;that&#x20;request&#x20;to&#x20;run&#x20;with&#x20;a&#x20;User&#x20;Interface&#x20;Accessibility&#x20;&#40;UIAccess&#41;&#x20;integrity&#x20;level&#x20;must&#x20;reside&#x20;in&#x20;a&#x20;secure&#x20;location&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;Secure&#x20;locations&#x20;are&#x20;limited&#x20;to&#x20;the&#x20;following:&#x20;&#x20;-&#x20;&#x20;&hellip;Program&#x20;Files,&#x20;including&#x20;subfolders&#x20;&#x20;-&#x20;&#x20;&hellip;WindowsSystem32&#x20;&#x20;-&#x20;&#x20;&hellip;Program&#x20;Files&#x20;&#40;x86&#41;,&#x20;including&#x20;subfolders&#x20;&#40;for&#x20;64-bit&#x20;versions&#x20;of&#x20;Windows&#41;&#x20;Note:&#x20;Windows&#x20;enforces&#x20;a&#x20;public&#x20;key&#x20;infrastructure&#x20;&#40;PKI&#41;&#x20;signature&#x20;check&#x20;on&#x20;any&#x20;interactive&#x20;application&#x20;that&#x20;requests&#x20;to&#x20;run&#x20;with&#x20;a&#x20;UIAccess&#x20;integrity&#x20;level&#x20;regardless&#x20;of&#x20;the&#x20;state&#x20;of&#x20;this&#x20;security&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','UIAccess&#x20;Integrity&#x20;allows&#x20;an&#x20;application&#x20;to&#x20;bypass&#x20;User&#x20;Interface&#x20;Privilege&#x20;Isolation&#x20;&#40;UIPI&#41;&#x20;restrictions&#x20;when&#x20;an&#x20;application&#x20;is&#x20;elevated&#x20;in&#x20;privilege&#x20;from&#x20;a&#x20;standard&#x20;user&#x20;to&#x20;an&#x20;administrator.&#x20;This&#x20;is&#x20;required&#x20;to&#x20;support&#x20;accessibility&#x20;features&#x20;such&#x20;as&#x20;screen&#x20;readers&#x20;that&#x20;are&#x20;transmitting&#x20;user&#x20;interfaces&#x20;to&#x20;alternative&#x20;forms.&#x20;A&#x20;process&#x20;that&#x20;is&#x20;started&#x20;with&#x20;UIAccess&#x20;rights&#x20;has&#x20;the&#x20;following&#x20;abilities:&#x20;&#x20;-&#x20;&#x20;To&#x20;set&#x20;the&#x20;foreground&#x20;window.&#x20;&#x20;-&#x20;&#x20;To&#x20;drive&#x20;any&#x20;application&#x20;window&#x20;using&#x20;SendInput&#x20;function.&#x20;&#x20;-&#x20;&#x20;To&#x20;use&#x20;read&#x20;input&#x20;for&#x20;all&#x20;integrity&#x20;levels&#x20;using&#x20;low-level&#x20;hooks,&#x20;raw&#x20;input,&#x20;&#x20;GetKeyState,&#x20;GetAsyncKeyState,&#x20;and&#x20;GetKeyboardInput.&#x20;&#x20;-&#x20;&#x20;To&#x20;set&#x20;journal&#x20;hooks.&#x20;&#x20;-&#x20;&#x20;To&#x20;uses&#x20;AttachThreadInput&#x20;to&#x20;attach&#x20;a&#x20;thread&#x20;to&#x20;a&#x20;higher&#x20;integrity&#x20;input&#x20;queue.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Only&#x20;elevate&#x20;UIAccess&#x20;applications&#x20;that&#x20;are&#x20;installed&#x20;in&#x20;secure&#x20;locations','[{\"cis\": [\"2.3.17.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27077,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;behavior&#x20;of&#x20;all&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;policy&#x20;settings&#x20;for&#x20;the&#x20;computer.&#x20;If&#x20;you&#x20;change&#x20;this&#x20;policy&#x20;setting,&#x20;you&#x20;must&#x20;restart&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;disabled,&#x20;the&#x20;Security&#x20;Center&#x20;notifies&#x20;you&#x20;that&#x20;the&#x20;overall&#x20;security&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;reduced.','This&#x20;is&#x20;the&#x20;setting&#x20;that&#x20;turns&#x20;on&#x20;or&#x20;off&#x20;UAC.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;disabled,&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;used&#x20;and&#x20;any&#x20;security&#x20;benefits&#x20;and&#x20;risk&#x20;mitigations&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;UAC&#x20;will&#x20;not&#x20;be&#x20;present&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Run&#x20;all&#x20;administrators&#x20;in&#x20;Admin&#x20;Approval&#x20;Mode','[{\"cis\": [\"2.3.17.6\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27078,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;elevation&#x20;request&#x20;prompt&#x20;is&#x20;displayed&#x20;on&#x20;the&#x20;interactive&#x20;user&#039;s&#x20;desktop&#x20;or&#x20;the&#x20;secure&#x20;desktop.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Standard&#x20;elevation&#x20;prompt&#x20;dialog&#x20;boxes&#x20;can&#x20;be&#x20;spoofed,&#x20;which&#x20;may&#x20;cause&#x20;users&#x20;to&#x20;disclose&#x20;their&#x20;passwords&#x20;to&#x20;malicious&#x20;software.&#x20;The&#x20;secure&#x20;desktop&#x20;presents&#x20;a&#x20;very&#x20;distinct&#x20;appearance&#x20;when&#x20;prompting&#x20;for&#x20;elevation,&#x20;where&#x20;the&#x20;user&#x20;desktop&#x20;dims,&#x20;and&#x20;the&#x20;elevation&#x20;prompt&#x20;UI&#x20;is&#x20;more&#x20;prominent.&#x20;This&#x20;increases&#x20;the&#x20;likelihood&#x20;that&#x20;users&#x20;who&#x20;become&#x20;accustomed&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;will&#x20;recognize&#x20;a&#x20;spoofed&#x20;elevation&#x20;prompt&#x20;dialog&#x20;box&#x20;and&#x20;not&#x20;fall&#x20;for&#x20;the&#x20;trick.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Switch&#x20;to&#x20;the&#x20;secure&#x20;desktop&#x20;when&#x20;prompting&#x20;for&#x20;elevation','[{\"cis\": [\"2.3.17.7\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27079,'Ensure&#x20;&#039;User&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;application&#x20;write&#x20;failures&#x20;are&#x20;redirected&#x20;to&#x20;defined&#x20;registry&#x20;and&#x20;file&#x20;system&#x20;locations.&#x20;This&#x20;policy&#x20;setting&#x20;mitigates&#x20;applications&#x20;that&#x20;run&#x20;as&#x20;administrator&#x20;and&#x20;write&#x20;run-time&#x20;application&#x20;data&#x20;to:&#x20;&#x20;-&#x20;&#x20;%ProgramFiles%&#x20;&#x20;-&#x20;&#x20;%windir%&#x20;&#x20;-&#x20;&#x20;%windir%System32&#x20;&#x20;-&#x20;&#x20;HKEY_LOCAL_MACHINESOFTWARE&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;reduces&#x20;vulnerabilities&#x20;by&#x20;ensuring&#x20;that&#x20;legacy&#x20;applications&#x20;only&#x20;write&#x20;data&#x20;to&#x20;permitted&#x20;locations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsLocal&#x20;PoliciesSecurity&#x20;OptionsUser&#x20;Account&#x20;Control:&#x20;Virtualize&#x20;file&#x20;and&#x20;registry&#x20;write&#x20;failures&#x20;to&#x20;per-user&#x20;locations','[{\"cis\": [\"2.3.17.8\"]}, {\"pci_dss\": [\"6.5.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27080,'Ensure&#x20;&#039;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;service&#x20;spools&#x20;print&#x20;jobs&#x20;and&#x20;handles&#x20;interaction&#x20;with&#x20;printers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;the&#x20;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#x20;service&#x20;mitigates&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;attacks&#x20;against&#x20;the&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPrint&#x20;Spooler','[{\"cis\": [\"5.1\"]}, {\"cis_csc\": [\"4.8\"]}]'),(27081,'Ensure&#x20;&#039;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;service&#x20;spools&#x20;print&#x20;jobs&#x20;and&#x20;handles&#x20;interaction&#x20;with&#x20;printers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;the&#x20;Print&#x20;Spooler&#x20;&#40;Spooler&#41;&#x20;service&#x20;mitigates&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;attacks&#x20;against&#x20;the&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to:&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsSystem&#x20;ServicesPrint&#x20;Spooler','[{\"cis\": [\"5.2\"]}, {\"cis_csc\": [\"4.8\"]}]'),(27082,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.1.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27083,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.1.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27084,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.1.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27085,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.1.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27086,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewalldomainfw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewalldomainfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewalldomainfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.1.5\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27087,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.1.6\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27088,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.1.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27089,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Domain:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesDomain&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.1.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27090,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.2.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27091,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.2.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27092,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.2.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27093,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','Firewall&#x20;notifications&#x20;can&#x20;be&#x20;complex&#x20;and&#x20;may&#x20;confuse&#x20;the&#x20;end&#x20;users,&#x20;who&#x20;would&#x20;not&#x20;be&#x20;able&#x20;to&#x20;address&#x20;the&#x20;alert.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.2.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27094,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewallprivatefw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewallprivatefw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewallprivatefw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.2.5\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27095,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.2.6\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27096,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.2.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27097,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Private:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPrivate&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.2.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27098,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Firewall&#x20;state&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;On&#x20;&#40;recommended&#41;&#039;.','Select&#x20;On&#x20;&#40;recommended&#41;&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;use&#x20;the&#x20;settings&#x20;for&#x20;this&#x20;profile&#x20;to&#x20;filter&#x20;network&#x20;traffic.&#x20;If&#x20;you&#x20;select&#x20;Off,&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;will&#x20;not&#x20;use&#x20;any&#x20;of&#x20;the&#x20;firewall&#x20;rules&#x20;or&#x20;connection&#x20;security&#x20;rules&#x20;for&#x20;this&#x20;profile.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;On&#x20;&#40;recommended&#41;.','If&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;off&#x20;all&#x20;traffic&#x20;will&#x20;be&#x20;able&#x20;to&#x20;access&#x20;the&#x20;system&#x20;and&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;On&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileFirewall&#x20;state','[{\"cis\": [\"9.3.1\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27099,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Inbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Block&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;inbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;inbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Block&#x20;&#40;default&#41;.','If&#x20;the&#x20;firewall&#x20;allows&#x20;all&#x20;traffic&#x20;to&#x20;access&#x20;the&#x20;system&#x20;then&#x20;an&#x20;attacker&#x20;may&#x20;be&#x20;more&#x20;easily&#x20;able&#x20;to&#x20;remotely&#x20;exploit&#x20;a&#x20;weakness&#x20;in&#x20;a&#x20;network&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Block&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileInbound&#x20;connections','[{\"cis\": [\"9.3.2\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27100,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Outbound&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Allow&#x20;&#40;default&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;the&#x20;behavior&#x20;for&#x20;outbound&#x20;connections&#x20;that&#x20;do&#x20;not&#x20;match&#x20;an&#x20;outbound&#x20;firewall&#x20;rule.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Allow&#x20;&#40;default&#41;.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;Outbound&#x20;connections&#x20;to&#x20;Block&#x20;and&#x20;then&#x20;deploy&#x20;the&#x20;firewall&#x20;policy&#x20;by&#x20;using&#x20;a&#x20;GPO,&#x20;computers&#x20;that&#x20;receive&#x20;the&#x20;GPO&#x20;settings&#x20;cannot&#x20;receive&#x20;subsequent&#x20;Group&#x20;Policy&#x20;updates&#x20;unless&#x20;you&#x20;create&#x20;and&#x20;deploy&#x20;an&#x20;outbound&#x20;rule&#x20;that&#x20;enables&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Predefined&#x20;rules&#x20;for&#x20;Core&#x20;Networking&#x20;include&#x20;outbound&#x20;rules&#x20;that&#x20;enable&#x20;Group&#x20;Policy&#x20;to&#x20;work.&#x20;Ensure&#x20;that&#x20;these&#x20;outbound&#x20;rules&#x20;are&#x20;active,&#x20;and&#x20;thoroughly&#x20;test&#x20;firewall&#x20;profiles&#x20;before&#x20;deploying.','Some&#x20;people&#x20;believe&#x20;that&#x20;it&#x20;is&#x20;prudent&#x20;to&#x20;block&#x20;all&#x20;outbound&#x20;connections&#x20;except&#x20;those&#x20;specifically&#x20;approved&#x20;by&#x20;the&#x20;user&#x20;or&#x20;administrator.&#x20;Microsoft&#x20;disagrees&#x20;with&#x20;this&#x20;opinion,&#x20;blocking&#x20;outbound&#x20;connections&#x20;by&#x20;default&#x20;will&#x20;force&#x20;users&#x20;to&#x20;deal&#x20;with&#x20;a&#x20;large&#x20;number&#x20;of&#x20;dialog&#x20;boxes&#x20;prompting&#x20;them&#x20;to&#x20;authorize&#x20;or&#x20;block&#x20;applications&#x20;such&#x20;as&#x20;their&#x20;web&#x20;browser&#x20;or&#x20;instant&#x20;messaging&#x20;software.&#x20;Additionally,&#x20;blocking&#x20;outbound&#x20;traffic&#x20;has&#x20;little&#x20;value&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;has&#x20;compromised&#x20;the&#x20;system&#x20;they&#x20;can&#x20;reconfigure&#x20;the&#x20;firewall&#x20;anyway.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Allow&#x20;&#40;default&#41;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileOutbound&#x20;connections','[{\"cis\": [\"9.3.3\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"1.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27101,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Display&#x20;a&#x20;notification&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','Select&#x20;this&#x20;option&#x20;to&#x20;have&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;display&#x20;notifications&#x20;to&#x20;the&#x20;user&#x20;when&#x20;a&#x20;program&#x20;is&#x20;blocked&#x20;from&#x20;receiving&#x20;inbound&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;avoid&#x20;alarming&#x20;users&#x20;when&#x20;firewall&#x20;rules&#x20;block&#x20;certain&#x20;types&#x20;of&#x20;network&#x20;activity.&#x20;However,&#x20;notifications&#x20;can&#x20;be&#x20;helpful&#x20;when&#x20;troubleshooting&#x20;network&#x20;issues&#x20;involving&#x20;the&#x20;firewall.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;&#039;No&#039;:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeDisplay&#x20;a&#x20;notification','[{\"cis\": [\"9.3.4\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27102,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;local&#x20;firewall&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;firewall&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.&#x20;Note:&#x20;When&#x20;the&#x20;Apply&#x20;local&#x20;firewall&#x20;rules&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;No,&#x20;it&#039;s&#x20;recommended&#x20;to&#x20;also&#x20;configure&#x20;the&#x20;Display&#x20;a&#x20;notification&#x20;setting&#x20;to&#x20;No.&#x20;Otherwise,&#x20;users&#x20;will&#x20;continue&#x20;to&#x20;receive&#x20;messages&#x20;that&#x20;ask&#x20;if&#x20;they&#x20;want&#x20;to&#x20;unblock&#x20;a&#x20;restricted&#x20;inbound&#x20;connection,&#x20;but&#x20;the&#x20;user&#039;s&#x20;response&#x20;will&#x20;be&#x20;ignored.','When&#x20;in&#x20;the&#x20;Public&#x20;profile,&#x20;there&#x20;should&#x20;be&#x20;no&#x20;special&#x20;local&#x20;firewall&#x20;exceptions&#x20;per&#x20;computer.&#x20;These&#x20;settings&#x20;should&#x20;be&#x20;managed&#x20;by&#x20;a&#x20;centralized&#x20;policy.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;firewall&#x20;rules','[{\"cis\": [\"9.3.5\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27103,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Settings:&#x20;Apply&#x20;local&#x20;connection&#x20;security&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;No&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;administrators&#x20;are&#x20;allowed&#x20;to&#x20;create&#x20;connection&#x20;security&#x20;rules&#x20;that&#x20;apply&#x20;together&#x20;with&#x20;connection&#x20;security&#x20;rules&#x20;configured&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;No.','Users&#x20;with&#x20;administrative&#x20;privileges&#x20;might&#x20;create&#x20;firewall&#x20;rules&#x20;that&#x20;expose&#x20;the&#x20;system&#x20;to&#x20;remote&#x20;attack.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;No:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileSettings&#x20;CustomizeApply&#x20;local&#x20;connection&#x20;security&#x20;rules','[{\"cis\": [\"9.3.6\"]}, {\"cis_csc\": [\"4.5\"]}, {\"pci_dss\": [\"7.2\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27104,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Name&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;%SystemRoot%System32logfilesfirewallpublicfw.log&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;path&#x20;and&#x20;name&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;%SystemRoot%System32logfilesfirewallpublicfw.log.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;%SystemRoot%System32logfilesfirewallpublicfw.log:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeName','[{\"cis\": [\"9.3.7\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27105,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Size&#x20;limit&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;16,384&#x20;KB&#x20;or&#x20;greater&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;specify&#x20;the&#x20;size&#x20;limit&#x20;of&#x20;the&#x20;file&#x20;in&#x20;which&#x20;Windows&#x20;Firewall&#x20;will&#x20;write&#x20;its&#x20;log&#x20;information.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;16,384&#x20;KB&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;16,384&#x20;KB&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeSize&#x20;limit&#x20;&#40;KB&#41;','[{\"cis\": [\"9.3.8\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27106,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;dropped&#x20;packets&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;discards&#x20;an&#x20;inbound&#x20;packet&#x20;for&#x20;any&#x20;reason.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;packet&#x20;was&#x20;dropped.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;DROP&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;dropped&#x20;packets','[{\"cis\": [\"9.3.9\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27107,'Ensure&#x20;&#039;Windows&#x20;Firewall:&#x20;Public:&#x20;Logging:&#x20;Log&#x20;successful&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Yes&#039;.','Use&#x20;this&#x20;option&#x20;to&#x20;log&#x20;when&#x20;Windows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;Security&#x20;allows&#x20;an&#x20;inbound&#x20;connection.&#x20;The&#x20;log&#x20;records&#x20;why&#x20;and&#x20;when&#x20;the&#x20;connection&#x20;was&#x20;formed.&#x20;Look&#x20;for&#x20;entries&#x20;with&#x20;the&#x20;word&#x20;ALLOW&#x20;in&#x20;the&#x20;action&#x20;column&#x20;of&#x20;the&#x20;log.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Yes.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Yes:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;with&#x20;Advanced&#x20;SecurityWindows&#x20;Firewall&#x20;PropertiesPublic&#x20;ProfileLogging&#x20;CustomizeLog&#x20;successful&#x20;connections','[{\"cis\": [\"9.3.10\"]}, {\"cis_csc\": [\"4.5\", \"8.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27108,'Ensure&#x20;&#039;Audit&#x20;Credential&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;results&#x20;of&#x20;validation&#x20;tests&#x20;on&#x20;credentials&#x20;submitted&#x20;for&#x20;a&#x20;user&#x20;account&#x20;logon&#x20;request.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;authoritative&#x20;for&#x20;the&#x20;credentials.&#x20;For&#x20;domain&#x20;accounts,&#x20;the&#x20;Domain&#x20;Controller&#x20;is&#x20;authoritative,&#x20;whereas&#x20;for&#x20;local&#x20;accounts,&#x20;the&#x20;local&#x20;computer&#x20;is&#x20;authoritative.&#x20;In&#x20;domain&#x20;environments,&#x20;most&#x20;of&#x20;the&#x20;Account&#x20;Logon&#x20;events&#x20;occur&#x20;in&#x20;the&#x20;Security&#x20;log&#x20;of&#x20;the&#x20;Domain&#x20;Controllers&#x20;that&#x20;are&#x20;authoritative&#x20;for&#x20;the&#x20;domain&#x20;accounts.&#x20;However,&#x20;these&#x20;events&#x20;can&#x20;occur&#x20;on&#x20;other&#x20;computers&#x20;in&#x20;the&#x20;organization&#x20;when&#x20;local&#x20;accounts&#x20;are&#x20;used&#x20;to&#x20;log&#x20;on.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4774:&#x20;An&#x20;account&#x20;was&#x20;mapped&#x20;for&#x20;logon.&#x20;&#x20;-&#x20;&#x20;4775:&#x20;An&#x20;account&#x20;could&#x20;not&#x20;be&#x20;mapped&#x20;for&#x20;logon.&#x20;&#x20;-&#x20;&#x20;4776:&#x20;The&#x20;Domain&#x20;Controller&#x20;attempted&#x20;to&#x20;validate&#x20;the&#x20;credentials&#x20;for&#x20;an&#x20;account.&#x20;&#x20;-&#x20;&#x20;4777:&#x20;The&#x20;Domain&#x20;Controller&#x20;failed&#x20;to&#x20;validate&#x20;the&#x20;credentials&#x20;for&#x20;an&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;LogonAudit&#x20;Credential&#x20;Validation','[{\"cis\": [\"17.1.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27109,'Ensure&#x20;&#039;Audit&#x20;Kerberos&#x20;Authentication&#x20;Service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;&#x20;&#40;DC&#x20;Only&#41;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;results&#x20;of&#x20;events&#x20;generated&#x20;after&#x20;a&#x20;Kerberos&#x20;authentication&#x20;TGT&#x20;request.&#x20;Kerberos&#x20;is&#x20;a&#x20;distributed&#x20;authentication&#x20;service&#x20;that&#x20;allows&#x20;a&#x20;client&#x20;running&#x20;on&#x20;behalf&#x20;of&#x20;a&#x20;user&#x20;to&#x20;prove&#x20;its&#x20;identity&#x20;to&#x20;a&#x20;server&#x20;without&#x20;sending&#x20;data&#x20;across&#x20;the&#x20;network.&#x20;This&#x20;helps&#x20;mitigate&#x20;an&#x20;attacker&#x20;or&#x20;server&#x20;from&#x20;impersonating&#x20;a&#x20;user.&#x20;&#x20;-&#x20;&#x20;4768:&#x20;A&#x20;Kerberos&#x20;authentication&#x20;ticket&#x20;&#40;TGT&#41;&#x20;was&#x20;requested.&#x20;&#x20;-&#x20;&#x20;4771:&#x20;Kerberos&#x20;pre-authentication&#x20;failed.&#x20;&#x20;-&#x20;&#x20;4772:&#x20;A&#x20;Kerberos&#x20;authentication&#x20;ticket&#x20;request&#x20;failed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;LogonAudit&#x20;Kerberos&#x20;Authentication&#x20;Service','[{\"cis\": [\"17.1.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27110,'Ensure&#x20;&#039;Audit&#x20;Kerberos&#x20;Service&#x20;Ticket&#x20;Operations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;&#x20;&#40;DC&#x20;Only&#41;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;results&#x20;of&#x20;events&#x20;generated&#x20;by&#x20;Kerberos&#x20;authentication&#x20;ticket-&#x20;granting&#x20;ticket&#x20;&#40;TGT&#41;&#x20;requests.&#x20;Kerberos&#x20;Service&#x20;Ticket&#x20;requests&#x20;&#40;TGS&#x20;requests&#41;&#x20;occur&#x20;as&#x20;part&#x20;of&#x20;service&#x20;use&#x20;and&#x20;access&#x20;requests&#x20;by&#x20;specific&#x20;accounts.&#x20;Auditing&#x20;these&#x20;events&#x20;will&#x20;record&#x20;the&#x20;IP&#x20;address&#x20;from&#x20;which&#x20;the&#x20;account&#x20;requested&#x20;TGS,&#x20;when&#x20;TGS&#x20;was&#x20;requested,&#x20;and&#x20;which&#x20;encryption&#x20;type&#x20;was&#x20;used.&#x20;&#x20;-&#x20;&#x20;4769:&#x20;A&#x20;Kerberos&#x20;service&#x20;ticket&#x20;was&#x20;requested.&#x20;&#x20;-&#x20;&#x20;4770:&#x20;A&#x20;Kerberos&#x20;service&#x20;ticket&#x20;was&#x20;renewed.&#x20;&#x20;-&#x20;&#x20;4773:&#x20;A&#x20;Kerberos&#x20;service&#x20;ticket&#x20;request&#x20;failed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;LogonAudit&#x20;Kerberos&#x20;Service&#x20;Ticket&#x20;Operations','[{\"cis\": [\"17.1.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27111,'Ensure&#x20;&#039;Audit&#x20;Application&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;events&#x20;generated&#x20;by&#x20;changes&#x20;to&#x20;application&#x20;groups&#x20;such&#x20;as&#x20;the&#x20;following:&#x20;&#x20;-&#x20;&#x20;Application&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;Member&#x20;is&#x20;added&#x20;or&#x20;removed&#x20;from&#x20;an&#x20;application&#x20;group.&#x20;Application&#x20;groups&#x20;are&#x20;utilized&#x20;by&#x20;Windows&#x20;Authorization&#x20;Manager,&#x20;which&#x20;is&#x20;a&#x20;flexible&#x20;framework&#x20;created&#x20;by&#x20;Microsoft&#x20;for&#x20;integrating&#x20;role-based&#x20;access&#x20;control&#x20;&#40;RBAC&#41;&#x20;into&#x20;applications.&#x20;More&#x20;information&#x20;on&#x20;Windows&#x20;Authorization&#x20;Manager&#x20;is&#x20;available&#x20;at&#x20;MSDN&#x20;-&#x20;Windows&#x20;Authorization&#x20;Manager.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;events&#x20;in&#x20;this&#x20;category&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Application&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27112,'Ensure&#x20;&#039;Audit&#x20;Computer&#x20;Account&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;computer&#x20;account&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;computer&#x20;account&#x20;is&#x20;created,&#x20;changed,&#x20;deleted,&#x20;renamed,&#x20;disabled,&#x20;or&#x20;enabled.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4741:&#x20;A&#x20;computer&#x20;account&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4742:&#x20;A&#x20;computer&#x20;account&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4743:&#x20;A&#x20;computer&#x20;account&#x20;was&#x20;deleted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;events&#x20;in&#x20;this&#x20;category&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Computer&#x20;Account&#x20;Management','[{\"cis\": [\"17.2.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27113,'Ensure&#x20;&#039;Audit&#x20;Distribution&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;distribution&#x20;group&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;distribution&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted&#x20;or&#x20;when&#x20;a&#x20;member&#x20;is&#x20;added&#x20;to&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;distribution&#x20;group.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;group&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4744:&#x20;A&#x20;security-disabled&#x20;local&#x20;group&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4745:&#x20;A&#x20;security-disabled&#x20;local&#x20;group&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4746:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-disabled&#x20;local&#x20;group.&#x20;&#x20;-&#x20;&#x20;4747:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-disabled&#x20;local&#x20;group.&#x20;&#x20;-&#x20;&#x20;4748:&#x20;A&#x20;security-disabled&#x20;local&#x20;group&#x20;was&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4749:&#x20;A&#x20;security-disabled&#x20;global&#x20;group&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4750:&#x20;A&#x20;security-disabled&#x20;global&#x20;group&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4751:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-disabled&#x20;global&#x20;group.&#x20;&#x20;-&#x20;&#x20;4752:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-disabled&#x20;global&#x20;group.&#x20;&#x20;-&#x20;&#x20;4753:&#x20;A&#x20;security-disabled&#x20;global&#x20;group&#x20;was&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4759:&#x20;A&#x20;security-disabled&#x20;universal&#x20;group&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4760:&#x20;A&#x20;security-disabled&#x20;universal&#x20;group&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4761:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-disabled&#x20;universal&#x20;group.&#x20;&#x20;-&#x20;&#x20;4762:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-disabled&#x20;universal&#x20;group.&#x20;&#x20;-&#x20;&#x20;4763:&#x20;A&#x20;security-disabled&#x20;universal&#x20;group&#x20;was&#x20;deleted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;provide&#x20;an&#x20;organization&#x20;with&#x20;insight&#x20;when&#x20;investigating&#x20;an&#x20;incident.&#x20;For&#x20;example,&#x20;when&#x20;a&#x20;given&#x20;unauthorized&#x20;user&#x20;was&#x20;added&#x20;to&#x20;a&#x20;sensitive&#x20;distribution&#x20;group.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Distribution&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27114,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Account&#x20;Management&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;subcategory&#x20;reports&#x20;other&#x20;account&#x20;management&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4782:&#x20;The&#x20;password&#x20;hash&#x20;an&#x20;account&#x20;was&#x20;accessed.&#x20;&#x20;-&#x20;&#x20;4793:&#x20;The&#x20;Password&#x20;Policy&#x20;Checking&#x20;API&#x20;was&#x20;called.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Other&#x20;Account&#x20;Management&#x20;Events','[{\"cis\": [\"17.2.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27115,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;Group&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;security&#x20;group&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;security&#x20;group&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted&#x20;or&#x20;when&#x20;a&#x20;member&#x20;is&#x20;added&#x20;to&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;security&#x20;group.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;security&#x20;group&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4727:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4728:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;global&#x20;group.&#x20;&#x20;-&#x20;&#x20;4729:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;global&#x20;group.&#x20;&#x20;-&#x20;&#x20;4730:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4731:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4732:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;local&#x20;group.&#x20;&#x20;-&#x20;&#x20;4733:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;local&#x20;group.&#x20;&#x20;-&#x20;&#x20;4734:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4735:&#x20;A&#x20;security-enabled&#x20;local&#x20;group&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4737:&#x20;A&#x20;security-enabled&#x20;global&#x20;group&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4754:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4755:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4756:&#x20;A&#x20;member&#x20;was&#x20;added&#x20;to&#x20;a&#x20;security-enabled&#x20;universal&#x20;group.&#x20;&#x20;-&#x20;&#x20;4757:&#x20;A&#x20;member&#x20;was&#x20;removed&#x20;from&#x20;a&#x20;security-enabled&#x20;universal&#x20;group.&#x20;&#x20;-&#x20;&#x20;4758:&#x20;A&#x20;security-enabled&#x20;universal&#x20;group&#x20;was&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4764:&#x20;A&#x20;group&#039;s&#x20;type&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;Security&#x20;Group&#x20;Management','[{\"cis\": [\"17.2.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27116,'Ensure&#x20;&#039;Audit&#x20;User&#x20;Account&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;each&#x20;event&#x20;of&#x20;user&#x20;account&#x20;management,&#x20;such&#x20;as&#x20;when&#x20;a&#x20;user&#x20;account&#x20;is&#x20;created,&#x20;changed,&#x20;or&#x20;deleted;&#x20;a&#x20;user&#x20;account&#x20;is&#x20;renamed,&#x20;disabled,&#x20;or&#x20;enabled;&#x20;or&#x20;a&#x20;password&#x20;is&#x20;set&#x20;or&#x20;changed.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;Audit&#x20;policy&#x20;setting,&#x20;administrators&#x20;can&#x20;track&#x20;events&#x20;to&#x20;detect&#x20;malicious,&#x20;accidental,&#x20;and&#x20;authorized&#x20;creation&#x20;of&#x20;user&#x20;accounts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4720:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4722:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;enabled.&#x20;&#x20;-&#x20;&#x20;4723:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;change&#x20;an&#x20;account&#039;s&#x20;password.&#x20;&#x20;-&#x20;&#x20;4724:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;reset&#x20;an&#x20;account&#039;s&#x20;password.&#x20;&#x20;-&#x20;&#x20;4725:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;disabled.&#x20;&#x20;-&#x20;&#x20;4726:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4738:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4740:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;locked&#x20;out.&#x20;&#x20;-&#x20;&#x20;4765:&#x20;SID&#x20;History&#x20;was&#x20;added&#x20;to&#x20;an&#x20;account.&#x20;&#x20;-&#x20;&#x20;4766:&#x20;An&#x20;attempt&#x20;to&#x20;add&#x20;SID&#x20;History&#x20;to&#x20;an&#x20;account&#x20;failed.&#x20;&#x20;-&#x20;&#x20;4767:&#x20;A&#x20;user&#x20;account&#x20;was&#x20;unlocked.&#x20;&#x20;-&#x20;&#x20;4780:&#x20;The&#x20;ACL&#x20;was&#x20;set&#x20;on&#x20;accounts&#x20;which&#x20;are&#x20;members&#x20;of&#x20;administrators&#x20;groups.&#x20;&#x20;-&#x20;&#x20;4781:&#x20;The&#x20;name&#x20;of&#x20;an&#x20;account&#x20;was&#x20;changed:&#x20;&#x20;-&#x20;&#x20;4794:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;set&#x20;the&#x20;Directory&#x20;Services&#x20;Restore&#x20;Mode.&#x20;&#x20;-&#x20;&#x20;5376:&#x20;Credential&#x20;Manager&#x20;credentials&#x20;were&#x20;backed&#x20;up.&#x20;&#x20;-&#x20;&#x20;5377:&#x20;Credential&#x20;Manager&#x20;credentials&#x20;were&#x20;restored&#x20;from&#x20;a&#x20;backup.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesAccount&#x20;ManagementAudit&#x20;User&#x20;Account&#x20;Management','[{\"cis\": [\"17.2.6\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27117,'Ensure&#x20;&#039;Audit&#x20;PNP&#x20;Activity&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;when&#x20;plug&#x20;and&#x20;play&#x20;detects&#x20;an&#x20;external&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.&#x20;Note:&#x20;A&#x20;Windows&#x20;10,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Enabling&#x20;this&#x20;setting&#x20;will&#x20;allow&#x20;a&#x20;user&#x20;to&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;device&#x20;is&#x20;plugged&#x20;into&#x20;a&#x20;system.&#x20;This&#x20;can&#x20;help&#x20;alert&#x20;IT&#x20;staff&#x20;if&#x20;unapproved&#x20;devices&#x20;are&#x20;plugged&#x20;in.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDetailed&#x20;TrackingAudit&#x20;PNP&#x20;Activity','[{\"cis\": [\"17.3.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27118,'Ensure&#x20;&#039;Audit&#x20;Process&#x20;Creation&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;process&#x20;and&#x20;the&#x20;name&#x20;of&#x20;the&#x20;program&#x20;or&#x20;user&#x20;that&#x20;created&#x20;it.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4688:&#x20;A&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;&#x20;-&#x20;&#x20;4696:&#x20;A&#x20;primary&#x20;token&#x20;was&#x20;assigned&#x20;to&#x20;process.&#x20;Refer&#x20;to&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;947226:&#x20;Description&#x20;of&#x20;security&#x20;events&#x20;in&#x20;Windows&#x20;Vista&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2008&#x20;for&#x20;the&#x20;most&#x20;recent&#x20;information&#x20;about&#x20;this&#x20;setting.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDetailed&#x20;TrackingAudit&#x20;Process&#x20;Creation','[{\"cis\": [\"17.3.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27119,'Ensure&#x20;&#039;Audit&#x20;Directory&#x20;Service&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;an&#x20;AD&#x20;DS&#x20;object&#x20;is&#x20;accessed.&#x20;Only&#x20;objects&#x20;with&#x20;SACLs&#x20;cause&#x20;audit&#x20;events&#x20;to&#x20;be&#x20;generated,&#x20;and&#x20;only&#x20;when&#x20;they&#x20;are&#x20;accessed&#x20;in&#x20;a&#x20;manner&#x20;that&#x20;matches&#x20;their&#x20;SACL.&#x20;These&#x20;events&#x20;are&#x20;similar&#x20;to&#x20;the&#x20;directory&#x20;service&#x20;access&#x20;events&#x20;in&#x20;previous&#x20;versions&#x20;of&#x20;Windows&#x20;Server.&#x20;This&#x20;subcategory&#x20;applies&#x20;only&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4662&#x20;:&#x20;An&#x20;operation&#x20;was&#x20;performed&#x20;on&#x20;an&#x20;object.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDS&#x20;AccessAudit&#x20;Directory&#x20;Service&#x20;Access','[{\"cis\": [\"17.4.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27120,'Ensure&#x20;&#039;Audit&#x20;Directory&#x20;Service&#x20;Changes&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;&#x20;&#40;DC&#x20;only&#41;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;to&#x20;objects&#x20;in&#x20;Active&#x20;Directory&#x20;Domain&#x20;Services&#x20;&#40;AD&#x20;DS&#41;.&#x20;The&#x20;types&#x20;of&#x20;changes&#x20;that&#x20;are&#x20;reported&#x20;are&#x20;create,&#x20;modify,&#x20;move,&#x20;and&#x20;undelete&#x20;operations&#x20;that&#x20;are&#x20;performed&#x20;on&#x20;an&#x20;object.&#x20;DS&#x20;Change&#x20;auditing,&#x20;where&#x20;appropriate,&#x20;indicates&#x20;the&#x20;old&#x20;and&#x20;new&#x20;values&#x20;of&#x20;the&#x20;changed&#x20;properties&#x20;of&#x20;the&#x20;objects&#x20;that&#x20;were&#x20;changed.&#x20;Only&#x20;objects&#x20;with&#x20;SACLs&#x20;cause&#x20;audit&#x20;events&#x20;to&#x20;be&#x20;generated,&#x20;and&#x20;only&#x20;when&#x20;they&#x20;are&#x20;accessed&#x20;in&#x20;a&#x20;manner&#x20;that&#x20;matches&#x20;their&#x20;SACL.&#x20;Some&#x20;objects&#x20;and&#x20;properties&#x20;do&#x20;not&#x20;cause&#x20;audit&#x20;events&#x20;to&#x20;be&#x20;generated&#x20;due&#x20;to&#x20;settings&#x20;on&#x20;the&#x20;object&#x20;class&#x20;in&#x20;the&#x20;schema.&#x20;This&#x20;subcategory&#x20;applies&#x20;only&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;5136&#x20;:&#x20;A&#x20;directory&#x20;service&#x20;object&#x20;was&#x20;modified.&#x20;&#x20;-&#x20;&#x20;5137&#x20;:&#x20;A&#x20;directory&#x20;service&#x20;object&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;5138&#x20;:&#x20;A&#x20;directory&#x20;service&#x20;object&#x20;was&#x20;undeleted.&#x20;&#x20;-&#x20;&#x20;5139&#x20;:&#x20;A&#x20;directory&#x20;service&#x20;object&#x20;was&#x20;moved.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesDS&#x20;AccessAudit&#x20;Directory&#x20;Service&#x20;Changes','[{\"cis\": [\"17.4.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27121,'Ensure&#x20;&#039;Audit&#x20;Account&#x20;Lockout&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#039;s&#x20;account&#x20;is&#x20;locked&#x20;out&#x20;as&#x20;a&#x20;result&#x20;of&#x20;too&#x20;many&#x20;failed&#x20;logon&#x20;attempts.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4625:&#x20;An&#x20;account&#x20;failed&#x20;to&#x20;log&#x20;on.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Account&#x20;Lockout','[{\"cis\": [\"17.5.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27122,'Ensure&#x20;&#039;Audit&#x20;Group&#x20;Membership&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;policy&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;the&#x20;group&#x20;membership&#x20;information&#x20;in&#x20;the&#x20;user&rsquo;s&#x20;logon&#x20;token.&#x20;Events&#x20;in&#x20;this&#x20;subcategory&#x20;are&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;on&#x20;which&#x20;a&#x20;logon&#x20;session&#x20;is&#x20;created.&#x20;For&#x20;an&#x20;interactive&#x20;logon,&#x20;the&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;the&#x20;user&#x20;logged&#x20;on&#x20;to.&#x20;For&#x20;a&#x20;network&#x20;logon,&#x20;such&#x20;as&#x20;accessing&#x20;a&#x20;shared&#x20;folder&#x20;on&#x20;the&#x20;network,&#x20;the&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;on&#x20;the&#x20;computer&#x20;hosting&#x20;the&#x20;resource.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.&#x20;Note:&#x20;A&#x20;Windows&#x20;10,&#x20;Server&#x20;2016&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Group&#x20;Membership','[{\"cis\": [\"17.5.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27123,'Ensure&#x20;&#039;Audit&#x20;Logoff&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;the&#x20;system.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;accessed&#x20;computer.&#x20;For&#x20;interactive&#x20;logons,&#x20;the&#x20;generation&#x20;of&#x20;these&#x20;events&#x20;occurs&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;logged&#x20;on&#x20;to.&#x20;If&#x20;a&#x20;network&#x20;logon&#x20;takes&#x20;place&#x20;to&#x20;access&#x20;a&#x20;share,&#x20;these&#x20;events&#x20;generate&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;hosts&#x20;the&#x20;accessed&#x20;resource.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;No&#x20;auditing,&#x20;it&#x20;is&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;which&#x20;user&#x20;has&#x20;accessed&#x20;or&#x20;attempted&#x20;to&#x20;access&#x20;organization&#x20;computers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4634:&#x20;An&#x20;account&#x20;was&#x20;logged&#x20;off.&#x20;&#x20;-&#x20;&#x20;4647:&#x20;User&#x20;initiated&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Logoff','[{\"cis\": [\"17.5.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27124,'Ensure&#x20;&#039;Audit&#x20;Logon&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;system.&#x20;These&#x20;events&#x20;occur&#x20;on&#x20;the&#x20;accessed&#x20;computer.&#x20;For&#x20;interactive&#x20;logons,&#x20;the&#x20;generation&#x20;of&#x20;these&#x20;events&#x20;occurs&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;is&#x20;logged&#x20;on&#x20;to.&#x20;If&#x20;a&#x20;network&#x20;logon&#x20;takes&#x20;place&#x20;to&#x20;access&#x20;a&#x20;share,&#x20;these&#x20;events&#x20;generate&#x20;on&#x20;the&#x20;computer&#x20;that&#x20;hosts&#x20;the&#x20;accessed&#x20;resource.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;No&#x20;auditing,&#x20;it&#x20;is&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;which&#x20;user&#x20;has&#x20;accessed&#x20;or&#x20;attempted&#x20;to&#x20;access&#x20;organization&#x20;computers.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4624:&#x20;An&#x20;account&#x20;was&#x20;successfully&#x20;logged&#x20;on.&#x20;&#x20;-&#x20;&#x20;4625:&#x20;An&#x20;account&#x20;failed&#x20;to&#x20;log&#x20;on.&#x20;&#x20;-&#x20;&#x20;4648:&#x20;A&#x20;logon&#x20;was&#x20;attempted&#x20;using&#x20;explicit&#x20;credentials.&#x20;&#x20;-&#x20;&#x20;4675:&#x20;SIDs&#x20;were&#x20;filtered.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Logon','[{\"cis\": [\"17.5.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27125,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Logon/Logoff&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;other&#x20;logon/logoff-related&#x20;events,&#x20;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;disconnects&#x20;and&#x20;reconnects,&#x20;using&#x20;RunAs&#x20;to&#x20;run&#x20;processes&#x20;under&#x20;a&#x20;different&#x20;account,&#x20;and&#x20;locking&#x20;and&#x20;unlocking&#x20;a&#x20;workstation.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4649:&#x20;A&#x20;replay&#x20;attack&#x20;was&#x20;detected.&#x20;&#x20;-&#x20;&#x20;4778:&#x20;A&#x20;session&#x20;was&#x20;reconnected&#x20;to&#x20;a&#x20;Window&#x20;Station.&#x20;&#x20;-&#x20;&#x20;4779:&#x20;A&#x20;session&#x20;was&#x20;disconnected&#x20;from&#x20;a&#x20;Window&#x20;Station.&#x20;&#x20;-&#x20;&#x20;4800:&#x20;The&#x20;workstation&#x20;was&#x20;locked.&#x20;&#x20;-&#x20;&#x20;4801:&#x20;The&#x20;workstation&#x20;was&#x20;unlocked.&#x20;&#x20;-&#x20;&#x20;4802:&#x20;The&#x20;screen&#x20;saver&#x20;was&#x20;invoked.&#x20;&#x20;-&#x20;&#x20;4803:&#x20;The&#x20;screen&#x20;saver&#x20;was&#x20;dismissed.&#x20;&#x20;-&#x20;&#x20;5378:&#x20;The&#x20;requested&#x20;credentials&#x20;delegation&#x20;was&#x20;disallowed&#x20;by&#x20;policy.&#x20;&#x20;-&#x20;&#x20;5632:&#x20;A&#x20;request&#x20;was&#x20;made&#x20;to&#x20;authenticate&#x20;to&#x20;a&#x20;wireless&#x20;network.&#x20;&#x20;-&#x20;&#x20;5633:&#x20;A&#x20;request&#x20;was&#x20;made&#x20;to&#x20;authenticate&#x20;to&#x20;a&#x20;wired&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Other&#x20;Logon/Logoff&#x20;Events','[{\"cis\": [\"17.5.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27126,'Ensure&#x20;&#039;Audit&#x20;Special&#x20;Logon&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;special&#x20;logon&#x20;is&#x20;used.&#x20;A&#x20;special&#x20;logon&#x20;is&#x20;a&#x20;logon&#x20;that&#x20;has&#x20;administrator-equivalent&#x20;privileges&#x20;and&#x20;can&#x20;be&#x20;used&#x20;to&#x20;elevate&#x20;a&#x20;process&#x20;to&#x20;a&#x20;higher&#x20;level.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4964&#x20;:&#x20;Special&#x20;groups&#x20;have&#x20;been&#x20;assigned&#x20;to&#x20;a&#x20;new&#x20;logon.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesLogon/LogoffAudit&#x20;Special&#x20;Logon','[{\"cis\": [\"17.5.6\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27127,'Ensure&#x20;&#039;Audit&#x20;Detailed&#x20;File&#x20;Share&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;attempts&#x20;to&#x20;access&#x20;files&#x20;and&#x20;folders&#x20;on&#x20;a&#x20;shared&#x20;folder.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;5145:&#x20;network&#x20;share&#x20;object&#x20;was&#x20;checked&#x20;to&#x20;see&#x20;whether&#x20;client&#x20;can&#x20;be&#x20;granted&#x20;&#x20;&#x20;desired&#x20;access.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure','Auditing&#x20;the&#x20;Failures&#x20;will&#x20;log&#x20;which&#x20;unauthorized&#x20;users&#x20;attempted&#x20;&#40;and&#x20;failed&#41;&#x20;to&#x20;get&#x20;access&#x20;to&#x20;a&#x20;file&#x20;or&#x20;folder&#x20;on&#x20;a&#x20;network&#x20;share&#x20;on&#x20;this&#x20;computer,&#x20;which&#x20;could&#x20;possibly&#x20;be&#x20;an&#x20;indication&#x20;of&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Detailed&#x20;File&#x20;Share','[{\"cis\": [\"17.6.1\"]}, {\"cis_csc\": [\"3.3\", \"8.5\"]}]'),(27128,'Ensure&#x20;&#039;Audit&#x20;File&#x20;Share&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;attempts&#x20;to&#x20;access&#x20;a&#x20;shared&#x20;folder.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.&#x20;Note:&#x20;There&#x20;are&#x20;no&#x20;system&#x20;access&#x20;control&#x20;lists&#x20;&#40;SACLs&#41;&#x20;for&#x20;shared&#x20;folders.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled,&#x20;access&#x20;to&#x20;all&#x20;shared&#x20;folders&#x20;on&#x20;the&#x20;system&#x20;is&#x20;audited.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;it&#039;s&#x20;important&#x20;to&#x20;track&#x20;deletion,&#x20;creation,&#x20;modification,&#x20;and&#x20;access&#x20;events&#x20;for&#x20;network&#x20;shares.&#x20;Any&#x20;unusual&#x20;file&#x20;sharing&#x20;activity&#x20;may&#x20;be&#x20;useful&#x20;in&#x20;an&#x20;investigation&#x20;of&#x20;potentially&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;File&#x20;Share','[{\"cis\": [\"17.6.2\"]}, {\"cis_csc\": [\"3.3\", \"8.5\"]}]'),(27129,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Object&#x20;Access&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;events&#x20;generated&#x20;by&#x20;the&#x20;management&#x20;of&#x20;task&#x20;scheduler&#x20;jobs&#x20;or&#x20;COM+&#x20;objects.&#x20;For&#x20;scheduler&#x20;jobs,&#x20;the&#x20;following&#x20;are&#x20;audited:&#x20;&#x20;-&#x20;&#x20;Job&#x20;created.&#x20;&#x20;-&#x20;&#x20;Job&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;Job&#x20;enabled.&#x20;&#x20;-&#x20;&#x20;Job&#x20;disabled.&#x20;&#x20;-&#x20;&#x20;Job&#x20;updated.&#x20;For&#x20;COM+&#x20;objects,&#x20;the&#x20;following&#x20;are&#x20;audited:&#x20;&#x20;-&#x20;&#x20;Catalog&#x20;object&#x20;added.&#x20;&#x20;-&#x20;&#x20;Catalog&#x20;object&#x20;updated.&#x20;&#x20;-&#x20;&#x20;Catalog&#x20;object&#x20;deleted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','The&#x20;unexpected&#x20;creation&#x20;of&#x20;scheduled&#x20;tasks&#x20;and&#x20;COM+&#x20;objects&#x20;could&#x20;potentially&#x20;be&#x20;an&#x20;indication&#x20;of&#x20;malicious&#x20;activity.&#x20;Since&#x20;these&#x20;types&#x20;of&#x20;actions&#x20;are&#x20;generally&#x20;low&#x20;volume,&#x20;it&#x20;may&#x20;be&#x20;useful&#x20;to&#x20;capture&#x20;them&#x20;in&#x20;the&#x20;audit&#x20;logs&#x20;for&#x20;use&#x20;during&#x20;an&#x20;investigation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Other&#x20;Object&#x20;Access&#x20;Events','[{\"cis\": [\"17.6.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27130,'Ensure&#x20;&#039;Audit&#x20;Removable&#x20;Storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;audit&#x20;user&#x20;attempts&#x20;to&#x20;access&#x20;file&#x20;system&#x20;objects&#x20;on&#x20;a&#x20;removable&#x20;storage&#x20;device.&#x20;A&#x20;security&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;only&#x20;for&#x20;all&#x20;objects&#x20;for&#x20;all&#x20;types&#x20;of&#x20;access&#x20;requested.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting,&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;each&#x20;time&#x20;an&#x20;account&#x20;accesses&#x20;a&#x20;file&#x20;system&#x20;object&#x20;on&#x20;a&#x20;removable&#x20;storage.&#x20;Success&#x20;audits&#x20;record&#x20;successful&#x20;attempts&#x20;and&#x20;Failure&#x20;audits&#x20;record&#x20;unsuccessful&#x20;attempts.&#x20;If&#x20;you&#x20;do&#x20;not&#x20;configure&#x20;this&#x20;policy&#x20;setting,&#x20;no&#x20;audit&#x20;event&#x20;is&#x20;generated&#x20;when&#x20;an&#x20;account&#x20;accesses&#x20;a&#x20;file&#x20;system&#x20;object&#x20;on&#x20;a&#x20;removable&#x20;storage.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.&#x20;Note:&#x20;A&#x20;Windows&#x20;8.0,&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;OS&#x20;is&#x20;required&#x20;to&#x20;access&#x20;and&#x20;set&#x20;this&#x20;value&#x20;in&#x20;Group&#x20;Policy.','Auditing&#x20;removable&#x20;storage&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;an&#x20;incident.&#x20;For&#x20;example,&#x20;if&#x20;an&#x20;individual&#x20;is&#x20;suspected&#x20;of&#x20;copying&#x20;sensitive&#x20;information&#x20;onto&#x20;a&#x20;USB&#x20;drive.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesObject&#x20;AccessAudit&#x20;Removable&#x20;Storage','[{\"cis\": [\"17.6.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27131,'Ensure&#x20;&#039;Audit&#x20;Audit&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;audit&#x20;policy&#x20;including&#x20;SACL&#x20;changes.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4715:&#x20;The&#x20;audit&#x20;policy&#x20;&#40;SACL&#41;&#x20;on&#x20;an&#x20;object&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4719:&#x20;System&#x20;audit&#x20;policy&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4902:&#x20;The&#x20;Per-user&#x20;audit&#x20;policy&#x20;table&#x20;was&#x20;created.&#x20;&#x20;-&#x20;&#x20;4904:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;register&#x20;a&#x20;security&#x20;event&#x20;source.&#x20;&#x20;-&#x20;&#x20;4905:&#x20;An&#x20;attempt&#x20;was&#x20;made&#x20;to&#x20;unregister&#x20;a&#x20;security&#x20;event&#x20;source.&#x20;&#x20;-&#x20;&#x20;4906:&#x20;The&#x20;CrashOnAuditFail&#x20;value&#x20;has&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4907:&#x20;Auditing&#x20;settings&#x20;on&#x20;object&#x20;were&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4908:&#x20;Special&#x20;Groups&#x20;Logon&#x20;table&#x20;modified.&#x20;&#x20;-&#x20;&#x20;4912:&#x20;Per&#x20;User&#x20;Audit&#x20;Policy&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Audit&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27132,'Ensure&#x20;&#039;Audit&#x20;Authentication&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;authentication&#x20;policy.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4706:&#x20;A&#x20;new&#x20;trust&#x20;was&#x20;created&#x20;to&#x20;a&#x20;domain.&#x20;&#x20;-&#x20;&#x20;4707:&#x20;A&#x20;trust&#x20;to&#x20;a&#x20;domain&#x20;was&#x20;removed.&#x20;&#x20;-&#x20;&#x20;4713:&#x20;Kerberos&#x20;policy&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4716:&#x20;Trusted&#x20;domain&#x20;information&#x20;was&#x20;modified.&#x20;&#x20;-&#x20;&#x20;4717:&#x20;System&#x20;security&#x20;access&#x20;was&#x20;granted&#x20;to&#x20;an&#x20;account.&#x20;&#x20;-&#x20;&#x20;4718:&#x20;System&#x20;security&#x20;access&#x20;was&#x20;removed&#x20;from&#x20;an&#x20;account.&#x20;&#x20;-&#x20;&#x20;4739:&#x20;Domain&#x20;Policy&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4864:&#x20;A&#x20;namespace&#x20;collision&#x20;was&#x20;detected.&#x20;&#x20;-&#x20;&#x20;4865:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;added.&#x20;&#x20;-&#x20;&#x20;4866:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;removed.&#x20;&#x20;-&#x20;&#x20;4867:&#x20;A&#x20;trusted&#x20;forest&#x20;information&#x20;entry&#x20;was&#x20;modified.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Authentication&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27133,'Ensure&#x20;&#039;Audit&#x20;Authorization&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;authorization&#x20;policy.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4704:&#x20;A&#x20;user&#x20;right&#x20;was&#x20;assigned.&#x20;&#x20;-&#x20;&#x20;4705:&#x20;A&#x20;user&#x20;right&#x20;was&#x20;removed.&#x20;&#x20;-&#x20;&#x20;4706:&#x20;A&#x20;new&#x20;trust&#x20;was&#x20;created&#x20;to&#x20;a&#x20;domain.&#x20;&#x20;-&#x20;&#x20;4707:&#x20;A&#x20;trust&#x20;to&#x20;a&#x20;domain&#x20;was&#x20;removed.&#x20;&#x20;-&#x20;&#x20;4714:&#x20;Encrypted&#x20;data&#x20;recovery&#x20;policy&#x20;was&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Authorization&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27134,'Ensure&#x20;&#039;Audit&#x20;MPSSVC&#x20;Rule-Level&#x20;Policy&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;determines&#x20;whether&#x20;the&#x20;operating&#x20;system&#x20;generates&#x20;audit&#x20;events&#x20;when&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;policy&#x20;rules&#x20;for&#x20;the&#x20;Microsoft&#x20;Protection&#x20;Service&#x20;&#40;MPSSVC.exe&#41;.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4944:&#x20;The&#x20;following&#x20;policy&#x20;was&#x20;active&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;started.&#x20;&#x20;-&#x20;&#x20;4945:&#x20;A&#x20;rule&#x20;was&#x20;listed&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;started.&#x20;&#x20;-&#x20;&#x20;4946:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;&#x20;added.&#x20;&#x20;-&#x20;&#x20;4947:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;&#x20;modified.&#x20;&#x20;-&#x20;&#x20;4948:&#x20;A&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;Windows&#x20;Firewall&#x20;exception&#x20;list.&#x20;A&#x20;rule&#x20;was&#x20;&#x20;deleted.&#x20;&#x20;-&#x20;&#x20;4949:&#x20;Windows&#x20;Firewall&#x20;settings&#x20;were&#x20;restored&#x20;to&#x20;the&#x20;default&#x20;values.&#x20;&#x20;-&#x20;&#x20;4950:&#x20;A&#x20;Windows&#x20;Firewall&#x20;setting&#x20;has&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4951:&#x20;A&#x20;rule&#x20;has&#x20;been&#x20;ignored&#x20;because&#x20;its&#x20;major&#x20;version&#x20;number&#x20;was&#x20;not&#x20;recognized&#x20;&#x20;by&#x20;Windows&#x20;Firewall.&#x20;&#x20;-&#x20;&#x20;4952:&#x20;Parts&#x20;of&#x20;a&#x20;rule&#x20;have&#x20;been&#x20;ignored&#x20;because&#x20;its&#x20;minor&#x20;version&#x20;number&#x20;was&#x20;not&#x20;&#x20;recognized&#x20;by&#x20;Windows&#x20;Firewall.&#x20;The&#x20;other&#x20;parts&#x20;of&#x20;the&#x20;rule&#x20;will&#x20;be&#x20;enforced.&#x20;&#x20;-&#x20;&#x20;4953:&#x20;A&#x20;rule&#x20;has&#x20;been&#x20;ignored&#x20;by&#x20;Windows&#x20;Firewall&#x20;because&#x20;it&#x20;could&#x20;not&#x20;parse&#x20;the&#x20;&#x20;rule.&#x20;&#x20;-&#x20;&#x20;4954:&#x20;Windows&#x20;Firewall&#x20;Group&#x20;Policy&#x20;settings&#x20;have&#x20;changed.&#x20;The&#x20;new&#x20;settings&#x20;have&#x20;&#x20;been&#x20;applied.&#x20;&#x20;-&#x20;&#x20;4956:&#x20;Windows&#x20;Firewall&#x20;has&#x20;changed&#x20;the&#x20;active&#x20;profile.&#x20;&#x20;-&#x20;&#x20;4957:&#x20;Windows&#x20;Firewall&#x20;did&#x20;not&#x20;apply&#x20;the&#x20;following&#x20;rule.&#x20;&#x20;-&#x20;&#x20;4958:&#x20;Windows&#x20;Firewall&#x20;did&#x20;not&#x20;apply&#x20;the&#x20;following&#x20;rule&#x20;because&#x20;the&#x20;rule&#x20;referred&#x20;&#x20;to&#x20;items&#x20;not&#x20;configured&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;:&#x20;Success&#x20;and&#x20;Failure','Changes&#x20;to&#x20;firewall&#x20;rules&#x20;are&#x20;important&#x20;for&#x20;understanding&#x20;the&#x20;security&#x20;state&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;how&#x20;well&#x20;it&#x20;is&#x20;protected&#x20;against&#x20;network&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;MPSSVC&#x20;Rule-&#x20;Level&#x20;Policy&#x20;Change','[{\"cis\": [\"17.7.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27135,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;Policy&#x20;Change&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Failure&#039;.','This&#x20;subcategory&#x20;contains&#x20;events&#x20;about&#x20;EFS&#x20;Data&#x20;Recovery&#x20;Agent&#x20;policy&#x20;changes,&#x20;changes&#x20;in&#x20;Windows&#x20;Filtering&#x20;Platform&#x20;filter,&#x20;status&#x20;on&#x20;Security&#x20;policy&#x20;settings&#x20;updates&#x20;for&#x20;local&#x20;Group&#x20;Policy&#x20;settings,&#x20;Central&#x20;Access&#x20;Policy&#x20;changes,&#x20;and&#x20;detailed&#x20;troubleshooting&#x20;events&#x20;for&#x20;Cryptographic&#x20;Next&#x20;Generation&#x20;&#40;CNG&#41;&#x20;operations.&#x20;&#x20;-&#x20;&#x20;5063:&#x20;A&#x20;cryptographic&#x20;provider&#x20;operation&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5064:&#x20;A&#x20;cryptographic&#x20;context&#x20;operation&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5065:&#x20;A&#x20;cryptographic&#x20;context&#x20;modification&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5066:&#x20;A&#x20;cryptographic&#x20;function&#x20;operation&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5067:&#x20;A&#x20;cryptographic&#x20;function&#x20;modification&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5068:&#x20;A&#x20;cryptographic&#x20;function&#x20;provider&#x20;operation&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5069:&#x20;A&#x20;cryptographic&#x20;function&#x20;property&#x20;operation&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;5070:&#x20;A&#x20;cryptographic&#x20;function&#x20;property&#x20;modification&#x20;was&#x20;attempted.&#x20;&#x20;-&#x20;&#x20;6145:&#x20;One&#x20;or&#x20;more&#x20;errors&#x20;occurred&#x20;while&#x20;processing&#x20;security&#x20;policy&#x20;in&#x20;the&#x20;group&#x20;&#x20;policy&#x20;objects.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Failure.','This&#x20;setting&#x20;can&#x20;help&#x20;detect&#x20;errors&#x20;in&#x20;applied&#x20;Security&#x20;settings&#x20;which&#x20;came&#x20;from&#x20;Group&#x20;Policy,&#x20;and&#x20;failure&#x20;events&#x20;related&#x20;to&#x20;Cryptographic&#x20;Next&#x20;Generation&#x20;&#40;CNG&#41;&#x20;functions.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPolicy&#x20;ChangeAudit&#x20;Other&#x20;Policy&#x20;Change&#x20;Events','[{\"cis\": [\"17.7.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27136,'Ensure&#x20;&#039;Audit&#x20;Sensitive&#x20;Privilege&#x20;Use&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;when&#x20;a&#x20;user&#x20;account&#x20;or&#x20;service&#x20;uses&#x20;a&#x20;sensitive&#x20;privilege.&#x20;A&#x20;sensitive&#x20;privilege&#x20;includes&#x20;the&#x20;following&#x20;user&#x20;rights:&#x20;&#x20;-&#x20;&#x20;Act&#x20;as&#x20;part&#x20;of&#x20;the&#x20;operating&#x20;system&#x20;&#x20;-&#x20;&#x20;Back&#x20;up&#x20;files&#x20;and&#x20;directories&#x20;&#x20;-&#x20;&#x20;Create&#x20;a&#x20;token&#x20;object&#x20;&#x20;-&#x20;&#x20;Debug&#x20;programs&#x20;&#x20;-&#x20;&#x20;Enable&#x20;computer&#x20;and&#x20;user&#x20;accounts&#x20;to&#x20;be&#x20;trusted&#x20;for&#x20;delegation&#x20;&#x20;-&#x20;&#x20;Generate&#x20;security&#x20;audits&#x20;&#x20;-&#x20;&#x20;Impersonate&#x20;a&#x20;client&#x20;after&#x20;authentication&#x20;&#x20;-&#x20;&#x20;Load&#x20;and&#x20;unload&#x20;device&#x20;drivers&#x20;&#x20;-&#x20;&#x20;Manage&#x20;auditing&#x20;and&#x20;security&#x20;log&#x20;&#x20;-&#x20;&#x20;Modify&#x20;firmware&#x20;environment&#x20;values&#x20;&#x20;-&#x20;&#x20;Replace&#x20;a&#x20;process-level&#x20;token&#x20;&#x20;-&#x20;&#x20;Restore&#x20;files&#x20;and&#x20;directories&#x20;&#x20;-&#x20;&#x20;Take&#x20;ownership&#x20;of&#x20;files&#x20;or&#x20;other&#x20;objects&#x20;Auditing&#x20;this&#x20;subcategory&#x20;will&#x20;create&#x20;a&#x20;high&#x20;volume&#x20;of&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4672:&#x20;Special&#x20;privileges&#x20;assigned&#x20;to&#x20;new&#x20;logon.&#x20;&#x20;-&#x20;&#x20;4673:&#x20;A&#x20;privileged&#x20;service&#x20;was&#x20;called.&#x20;&#x20;-&#x20;&#x20;4674:&#x20;An&#x20;operation&#x20;was&#x20;attempted&#x20;on&#x20;a&#x20;privileged&#x20;object.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesPrivilege&#x20;UseAudit&#x20;Sensitive&#x20;Privilege&#x20;Use','[{\"cis\": [\"17.8.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27137,'Ensure&#x20;&#039;Audit&#x20;IPsec&#x20;Driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;the&#x20;activities&#x20;of&#x20;the&#x20;Internet&#x20;Protocol&#x20;security&#x20;&#40;IPsec&#41;&#x20;driver.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4960:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;an&#x20;integrity&#x20;check.&#x20;If&#x20;this&#x20;&#x20;problem&#x20;persists,&#x20;it&#x20;could&#x20;indicate&#x20;a&#x20;network&#x20;issue&#x20;or&#x20;that&#x20;packets&#x20;are&#x20;being&#x20;&#x20;modified&#x20;in&#x20;transit&#x20;to&#x20;this&#x20;computer.&#x20;Verify&#x20;that&#x20;the&#x20;packets&#x20;sent&#x20;from&#x20;the&#x20;remote&#x20;&#x20;computer&#x20;are&#x20;the&#x20;same&#x20;as&#x20;those&#x20;received&#x20;by&#x20;this&#x20;computer.&#x20;This&#x20;error&#x20;might&#x20;also&#x20;&#x20;indicate&#x20;interoperability&#x20;problems&#x20;with&#x20;other&#x20;IPsec&#x20;implementations.&#x20;&#x20;-&#x20;&#x20;4961:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;a&#x20;replay&#x20;check.&#x20;If&#x20;this&#x20;problem&#x20;&#x20;persists,&#x20;it&#x20;could&#x20;indicate&#x20;a&#x20;replay&#x20;attack&#x20;against&#x20;this&#x20;computer.&#x20;&#x20;-&#x20;&#x20;4962:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;packet&#x20;that&#x20;failed&#x20;a&#x20;replay&#x20;check.&#x20;The&#x20;inbound&#x20;&#x20;packet&#x20;had&#x20;too&#x20;low&#x20;a&#x20;sequence&#x20;number&#x20;to&#x20;ensure&#x20;it&#x20;was&#x20;not&#x20;a&#x20;replay.&#x20;&#x20;-&#x20;&#x20;4963:&#x20;IPsec&#x20;dropped&#x20;an&#x20;inbound&#x20;clear&#x20;text&#x20;packet&#x20;that&#x20;should&#x20;have&#x20;been&#x20;secured.&#x20;&#x20;This&#x20;is&#x20;usually&#x20;due&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;changing&#x20;its&#x20;IPsec&#x20;policy&#x20;without&#x20;&#x20;informing&#x20;this&#x20;computer.&#x20;This&#x20;could&#x20;also&#x20;be&#x20;a&#x20;spoofing&#x20;attack&#x20;attempt.&#x20;&#x20;-&#x20;&#x20;4965:&#x20;IPsec&#x20;received&#x20;a&#x20;packet&#x20;from&#x20;a&#x20;remote&#x20;computer&#x20;with&#x20;an&#x20;incorrect&#x20;Security&#x20;&#x20;Parameter&#x20;Index&#x20;&#40;SPI&#41;.&#x20;This&#x20;is&#x20;usually&#x20;caused&#x20;by&#x20;malfunctioning&#x20;hardware&#x20;that&#x20;is&#x20;&#x20;corrupting&#x20;packets.&#x20;If&#x20;these&#x20;errors&#x20;persist,&#x20;verify&#x20;that&#x20;the&#x20;packets&#x20;sent&#x20;from&#x20;the&#x20;&#x20;remote&#x20;computer&#x20;are&#x20;the&#x20;same&#x20;as&#x20;those&#x20;received&#x20;by&#x20;this&#x20;computer.&#x20;This&#x20;error&#x20;may&#x20;&#x20;also&#x20;indicate&#x20;interoperability&#x20;problems&#x20;with&#x20;other&#x20;IPsec&#x20;implementations.&#x20;In&#x20;that&#x20;&#x20;case,&#x20;if&#x20;connectivity&#x20;is&#x20;not&#x20;impeded,&#x20;then&#x20;these&#x20;events&#x20;can&#x20;be&#x20;ignored.&#x20;&#x20;-&#x20;&#x20;5478:&#x20;IPsec&#x20;Services&#x20;has&#x20;started&#x20;successfully.&#x20;&#x20;-&#x20;&#x20;5479:&#x20;IPsec&#x20;Services&#x20;has&#x20;been&#x20;shut&#x20;down&#x20;successfully.&#x20;The&#x20;shutdown&#x20;of&#x20;IPsec&#x20;&#x20;Services&#x20;can&#x20;put&#x20;the&#x20;computer&#x20;at&#x20;greater&#x20;risk&#x20;of&#x20;network&#x20;attack&#x20;or&#x20;expose&#x20;the&#x20;&#x20;computer&#x20;to&#x20;potential&#x20;security&#x20;risks.&#x20;&#x20;-&#x20;&#x20;5480:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;get&#x20;the&#x20;complete&#x20;list&#x20;of&#x20;network&#x20;interfaces&#x20;on&#x20;the&#x20;&#x20;computer.&#x20;This&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;because&#x20;some&#x20;of&#x20;the&#x20;network&#x20;&#x20;interfaces&#x20;may&#x20;not&#x20;get&#x20;the&#x20;protection&#x20;provided&#x20;by&#x20;the&#x20;applied&#x20;IPsec&#x20;filters.&#x20;Use&#x20;the&#x20;&#x20;IP&#x20;Security&#x20;Monitor&#x20;snap-in&#x20;to&#x20;diagnose&#x20;the&#x20;problem.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;-&#x20;&#x20;5483:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;initialize&#x20;RPC&#x20;server.&#x20;IPsec&#x20;Services&#x20;could&#x20;not&#x20;be&#x20;&#x20;&#x20;started.&#x20;&#x20;-&#x20;&#x20;5484:&#x20;IPsec&#x20;Services&#x20;has&#x20;experienced&#x20;a&#x20;critical&#x20;failure&#x20;and&#x20;has&#x20;been&#x20;shut&#x20;down.&#x20;The&#x20;&#x20;&#x20;shutdown&#x20;of&#x20;IPsec&#x20;Services&#x20;can&#x20;put&#x20;the&#x20;computer&#x20;at&#x20;greater&#x20;risk&#x20;of&#x20;network&#x20;attack&#x20;&#x20;&#x20;or&#x20;expose&#x20;the&#x20;computer&#x20;to&#x20;potential&#x20;security&#x20;risks.&#x20;&#x20;-&#x20;&#x20;5485:&#x20;IPsec&#x20;Services&#x20;failed&#x20;to&#x20;process&#x20;some&#x20;IPsec&#x20;filters&#x20;on&#x20;a&#x20;plug-and-play&#x20;event&#x20;for&#x20;&#x20;&#x20;network&#x20;interfaces.&#x20;This&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;because&#x20;some&#x20;of&#x20;the&#x20;network&#x20;&#x20;&#x20;interfaces&#x20;may&#x20;not&#x20;get&#x20;the&#x20;protection&#x20;provided&#x20;by&#x20;the&#x20;applied&#x20;IPsec&#x20;filters.&#x20;Use&#x20;the&#x20;&#x20;&#x20;IP&#x20;Security&#x20;Monitor&#x20;snap-in&#x20;to&#x20;diagnose&#x20;the&#x20;problem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;IPsec&#x20;Driver','[{\"cis\": [\"17.9.1\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27138,'Ensure&#x20;&#039;Audit&#x20;Other&#x20;System&#x20;Events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;other&#x20;system&#x20;events.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;5024&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;has&#x20;started&#x20;successfully.&#x20;&#x20;-&#x20;&#x20;5025&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;has&#x20;been&#x20;stopped.&#x20;&#x20;-&#x20;&#x20;5027&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;was&#x20;unable&#x20;to&#x20;retrieve&#x20;the&#x20;security&#x20;policy&#x20;&#x20;from&#x20;the&#x20;local&#x20;storage.&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;enforcing&#x20;the&#x20;current&#x20;policy.&#x20;&#x20;-&#x20;&#x20;5028&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;was&#x20;unable&#x20;to&#x20;parse&#x20;the&#x20;new&#x20;security&#x20;policy.&#x20;&#x20;The&#x20;service&#x20;will&#x20;continue&#x20;with&#x20;currently&#x20;enforced&#x20;policy.&#x20;&#x20;-&#x20;&#x20;5029:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;failed&#x20;to&#x20;initialize&#x20;the&#x20;driver.&#x20;The&#x20;service&#x20;will&#x20;&#x20;continue&#x20;to&#x20;enforce&#x20;the&#x20;current&#x20;policy.&#x20;&#x20;-&#x20;&#x20;5030:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Service&#x20;failed&#x20;to&#x20;start.&#x20;&#x20;-&#x20;&#x20;5032:&#x20;Windows&#x20;Firewall&#x20;was&#x20;unable&#x20;to&#x20;notify&#x20;the&#x20;user&#x20;that&#x20;it&#x20;blocked&#x20;an&#x20;application&#x20;&#x20;from&#x20;accepting&#x20;incoming&#x20;connections&#x20;on&#x20;the&#x20;network.&#x20;&#x20;-&#x20;&#x20;5033&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;has&#x20;started&#x20;successfully.&#x20;&#x20;-&#x20;&#x20;5034&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;has&#x20;been&#x20;stopped.&#x20;&#x20;-&#x20;&#x20;5035&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;failed&#x20;to&#x20;start.&#x20;&#x20;-&#x20;&#x20;5037&#x20;:&#x20;The&#x20;Windows&#x20;Firewall&#x20;Driver&#x20;detected&#x20;critical&#x20;runtime&#x20;error.&#x20;Terminating.&#x20;&#x20;-&#x20;&#x20;5058:&#x20;Key&#x20;file&#x20;operation.&#x20;&#x20;-&#x20;&#x20;5059:&#x20;Key&#x20;migration&#x20;operation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Capturing&#x20;these&#x20;audit&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;for&#x20;identifying&#x20;when&#x20;the&#x20;Windows&#x20;Firewall&#x20;is&#x20;not&#x20;performing&#x20;as&#x20;expected.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Other&#x20;System&#x20;Events','[{\"cis\": [\"17.9.2\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27139,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;State&#x20;Change&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;changes&#x20;in&#x20;security&#x20;state&#x20;of&#x20;the&#x20;system,&#x20;such&#x20;as&#x20;when&#x20;the&#x20;security&#x20;subsystem&#x20;starts&#x20;and&#x20;stops.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4608:&#x20;Windows&#x20;is&#x20;starting&#x20;up.&#x20;&#x20;-&#x20;&#x20;4609:&#x20;Windows&#x20;is&#x20;shutting&#x20;down.&#x20;&#x20;-&#x20;&#x20;4616:&#x20;The&#x20;system&#x20;time&#x20;was&#x20;changed.&#x20;&#x20;-&#x20;&#x20;4621:&#x20;Administrator&#x20;recovered&#x20;system&#x20;from&#x20;CrashOnAuditFail.&#x20;Users&#x20;who&#x20;are&#x20;not&#x20;&#x20;&#x20;administrators&#x20;will&#x20;now&#x20;be&#x20;allowed&#x20;to&#x20;log&#x20;on.&#x20;Some&#x20;auditable&#x20;activity&#x20;might&#x20;not&#x20;&#x20;&#x20;have&#x20;been&#x20;recorded.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Security&#x20;State&#x20;Change','[{\"cis\": [\"17.9.3\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27140,'Ensure&#x20;&#039;Audit&#x20;Security&#x20;System&#x20;Extension&#039;&#x20;is&#x20;set&#x20;to&#x20;include&#x20;&#039;Success&#039;.','This&#x20;subcategory&#x20;reports&#x20;the&#x20;loading&#x20;of&#x20;extension&#x20;code&#x20;such&#x20;as&#x20;authentication&#x20;packages&#x20;by&#x20;the&#x20;security&#x20;subsystem.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4610:&#x20;An&#x20;authentication&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;&#x20;-&#x20;&#x20;4611:&#x20;A&#x20;trusted&#x20;logon&#x20;process&#x20;has&#x20;been&#x20;registered&#x20;with&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;&#x20;-&#x20;&#x20;4614:&#x20;A&#x20;notification&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Security&#x20;Account&#x20;Manager.&#x20;&#x20;-&#x20;&#x20;4622:&#x20;A&#x20;security&#x20;package&#x20;has&#x20;been&#x20;loaded&#x20;by&#x20;the&#x20;Local&#x20;Security&#x20;Authority.&#x20;&#x20;-&#x20;&#x20;4697:&#x20;A&#x20;service&#x20;was&#x20;installed&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;to&#x20;include:&#x20;Success.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;include&#x20;Success:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;Security&#x20;System&#x20;Extension','[{\"cis\": [\"17.9.4\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27141,'Ensure&#x20;&#039;Audit&#x20;System&#x20;Integrity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Success&#x20;and&#x20;Failure&#039;.','This&#x20;subcategory&#x20;reports&#x20;on&#x20;violations&#x20;of&#x20;integrity&#x20;of&#x20;the&#x20;security&#x20;subsystem.&#x20;Events&#x20;for&#x20;this&#x20;subcategory&#x20;include:&#x20;&#x20;-&#x20;&#x20;4612&#x20;:&#x20;Internal&#x20;resources&#x20;allocated&#x20;for&#x20;the&#x20;queuing&#x20;of&#x20;audit&#x20;messages&#x20;have&#x20;been&#x20;&#x20;exhausted,&#x20;leading&#x20;to&#x20;the&#x20;loss&#x20;of&#x20;some&#x20;audits.&#x20;&#x20;-&#x20;&#x20;4615&#x20;:&#x20;Invalid&#x20;use&#x20;of&#x20;LPC&#x20;port.&#x20;&#x20;-&#x20;&#x20;4618&#x20;:&#x20;A&#x20;monitored&#x20;security&#x20;event&#x20;pattern&#x20;has&#x20;occurred.&#x20;&#x20;-&#x20;&#x20;4816&#x20;:&#x20;RPC&#x20;detected&#x20;an&#x20;integrity&#x20;violation&#x20;while&#x20;decrypting&#x20;an&#x20;incoming&#x20;message.&#x20;&#x20;-&#x20;&#x20;5038&#x20;:&#x20;Code&#x20;integrity&#x20;determined&#x20;that&#x20;the&#x20;image&#x20;hash&#x20;of&#x20;a&#x20;file&#x20;is&#x20;not&#x20;valid.&#x20;The&#x20;file&#x20;&#x20;could&#x20;be&#x20;corrupt&#x20;due&#x20;to&#x20;unauthorized&#x20;modification&#x20;or&#x20;the&#x20;invalid&#x20;hash&#x20;could&#x20;indicate&#x20;&#x20;a&#x20;potential&#x20;disk&#x20;device&#x20;error.&#x20;&#x20;-&#x20;&#x20;5056:&#x20;A&#x20;cryptographic&#x20;self&#x20;test&#x20;was&#x20;performed.&#x20;&#x20;-&#x20;&#x20;5057:&#x20;A&#x20;cryptographic&#x20;primitive&#x20;operation&#x20;failed.&#x20;&#x20;-&#x20;&#x20;5060:&#x20;Verification&#x20;operation&#x20;failed.&#x20;&#x20;-&#x20;&#x20;5061:&#x20;Cryptographic&#x20;operation.&#x20;&#x20;-&#x20;&#x20;5062:&#x20;A&#x20;kernel-mode&#x20;cryptographic&#x20;self&#x20;test&#x20;was&#x20;performed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Success&#x20;and&#x20;Failure.','Auditing&#x20;these&#x20;events&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Success&#x20;and&#x20;Failure:&#x20;Computer&#x20;ConfigurationPoliciesWindows&#x20;SettingsSecurity&#x20;SettingsAdvanced&#x20;Audit&#x20;Policy&#x20;ConfigurationAudit&#x20;PoliciesSystemAudit&#x20;System&#x20;Integrity','[{\"cis\": [\"17.9.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27142,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Disables&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;toggle&#x20;switch&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;camera&#x20;from&#x20;being&#x20;invoked&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;camera&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;camera&#x20;features.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;camera&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27143,'Ensure&#x20;&#039;Prevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Disables&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;settings&#x20;in&#x20;PC&#x20;Settings&#x20;and&#x20;prevents&#x20;a&#x20;slide&#x20;show&#x20;from&#x20;playing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Disabling&#x20;the&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;extends&#x20;the&#x20;protection&#x20;afforded&#x20;by&#x20;the&#x20;lock&#x20;screen&#x20;to&#x20;slide&#x20;show&#x20;contents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelPersonalizationPrevent&#x20;enabling&#x20;lock&#x20;screen&#x20;slide&#x20;show&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanelDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.1.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27144,'Ensure&#x20;&#039;Allow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;enables&#x20;the&#x20;automatic&#x20;learning&#x20;component&#x20;of&#x20;input&#x20;personalization&#x20;that&#x20;includes&#x20;speech,&#x20;inking,&#x20;and&#x20;typing.&#x20;Automatic&#x20;learning&#x20;enables&#x20;the&#x20;collection&#x20;of&#x20;speech&#x20;and&#x20;handwriting&#x20;patterns,&#x20;typing&#x20;history,&#x20;contacts,&#x20;and&#x20;recent&#x20;calendar&#x20;information.&#x20;It&#x20;is&#x20;required&#x20;for&#x20;the&#x20;use&#x20;of&#x20;Cortana.&#x20;Some&#x20;of&#x20;this&#x20;collected&#x20;information&#x20;may&#x20;be&#x20;stored&#x20;on&#x20;the&#x20;user&#039;s&#x20;OneDrive,&#x20;in&#x20;the&#x20;case&#x20;of&#x20;inking&#x20;and&#x20;typing;&#x20;some&#x20;of&#x20;the&#x20;information&#x20;will&#x20;be&#x20;uploaded&#x20;to&#x20;Microsoft&#x20;to&#x20;personalize&#x20;speech.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;Enabled&#x20;sensitive&#x20;information&#x20;could&#x20;be&#x20;stored&#x20;in&#x20;the&#x20;cloud&#x20;or&#x20;sent&#x20;to&#x20;Microsoft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelRegional&#x20;and&#x20;Language&#x20;OptionsAllow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;input&#x20;personalization,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;users&#x20;to&#x20;enable&#x20;online&#x20;speech&#x20;recognition&#x20;services&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;R1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.1.2.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27145,'Ensure&#x20;&#039;Allow&#x20;Online&#x20;Tips&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;the&#x20;retrieval&#x20;of&#x20;online&#x20;tips&#x20;and&#x20;help&#x20;for&#x20;the&#x20;Settings&#x20;app.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesControl&#x20;PanelAllow&#x20;Online&#x20;Tips&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ControlPanel.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.1.3\"]}, {\"pci_dss\": [\"1.3.4\"]}, {\"tsc\": [\"CC6.6\"]}]'),(27146,'Ensure&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;is&#x20;installed&#x20;&#40;MS&#x20;only&#41;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','In&#x20;order&#x20;to&#x20;utilize&#x20;LAPS,&#x20;a&#x20;minor&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;is&#x20;required,&#x20;and&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;must&#x20;be&#x20;installed&#x20;on&#x20;each&#x20;managed&#x20;computer.&#x20;When&#x20;LAPS&#x20;is&#x20;installed,&#x20;the&#x20;file&#x20;AdmPwd.dll&#x20;must&#x20;be&#x20;present&#x20;in&#x20;the&#x20;following&#x20;location&#x20;and&#x20;registered&#x20;in&#x20;Windows&#x20;&#40;the&#x20;LAPS&#x20;AdmPwd&#x20;GPO&#x20;Extension&#x20;/&#x20;CSE&#x20;installation&#x20;does&#x20;this&#x20;for&#x20;you&#41;:&#x20;C:Program&#x20;FilesLAPSCSEAdmPwd.dll','[{\"cis\": [\"18.2.1\"]}, {\"cis_csc\": [\"5.2\", \"5.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27147,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSDo&#x20;not&#x20;allow&#x20;password&#x20;expiration&#x20;time&#x20;longer&#x20;than&#x20;required&#x20;by&#x20;policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.2\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27148,'Ensure&#x20;&#039;Enable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSEnable&#x20;Local&#x20;Admin&#x20;Password&#x20;Management&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.3\"]}, {\"cis_csc\": [\"5.2\", \"5.4\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27149,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Complexity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters&#039;&#x20;&#40;MS&#x','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Complexity&#x20;option&#x20;to&#x20;Large&#x20;letters&#x20;+&#x20;small&#x20;letters&#x20;+&#x20;numbers&#x20;+&#x20;special&#x20;characters:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.4\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27150,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Length&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;or&#x20;more&#039;&#x20;&#40;MS&#x20;only&#41;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;or&#x20;more.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Length&#x20;option&#x20;to&#x20;15&#x20;or&#x20;more:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.5\"]}, {\"cis_csc\": [\"5.2\"]}, {\"pci_dss\": [\"8.2.3\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27151,'Ensure&#x20;&#039;Password&#x20;Settings:&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;30&#x20;or&#x20;fewer&#039;&#x20;&#40;MS&#x20;only&#41;.','In&#x20;May&#x20;2015,&#x20;Microsoft&#x20;released&#x20;the&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;&#x20;tool,&#x20;which&#x20;is&#x20;free&#x20;and&#x20;supported&#x20;software&#x20;that&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;automatically&#x20;set&#x20;randomized&#x20;and&#x20;unique&#x20;local&#x20;Administrator&#x20;account&#x20;passwords&#x20;on&#x20;domain-attached&#x20;workstations&#x20;and&#x20;Member&#x20;Servers.&#x20;The&#x20;passwords&#x20;are&#x20;stored&#x20;in&#x20;a&#x20;confidential&#x20;attribute&#x20;of&#x20;the&#x20;domain&#x20;computer&#x20;account&#x20;and&#x20;can&#x20;be&#x20;retrieved&#x20;from&#x20;Active&#x20;Directory&#x20;by&#x20;approved&#x20;Sysadmins&#x20;when&#x20;needed.&#x20;The&#x20;LAPS&#x20;tool&#x20;requires&#x20;a&#x20;small&#x20;Active&#x20;Directory&#x20;Schema&#x20;update&#x20;in&#x20;order&#x20;to&#x20;implement,&#x20;as&#x20;well&#x20;as&#x20;installation&#x20;of&#x20;a&#x20;Group&#x20;Policy&#x20;Client&#x20;Side&#x20;Extension&#x20;&#40;CSE&#41;&#x20;on&#x20;targeted&#x20;computers.&#x20;Please&#x20;see&#x20;the&#x20;LAPS&#x20;documentation&#x20;for&#x20;details.&#x20;LAPS&#x20;supports&#x20;Windows&#x20;Vista&#x20;or&#x20;newer&#x20;workstation&#x20;OSes,&#x20;and&#x20;Server&#x20;2003&#x20;or&#x20;newer&#x20;server&#x20;OSes.&#x20;LAPS&#x20;does&#x20;not&#x20;support&#x20;standalone&#x20;computers&#x20;-&#x20;they&#x20;must&#x20;be&#x20;joined&#x20;to&#x20;a&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;30&#x20;or&#x20;fewer.&#x20;Note:&#x20;Organizations&#x20;that&#x20;utilize&#x20;3rd-party&#x20;commercial&#x20;software&#x20;to&#x20;manage&#x20;unique&#x20;&amp;&#x20;complex&#x20;local&#x20;Administrator&#x20;passwords&#x20;on&#x20;domain&#x20;members&#x20;may&#x20;opt&#x20;to&#x20;disregard&#x20;these&#x20;LAPS&#x20;recommendations.&#x20;Note&#x20;#2:&#x20;LAPS&#x20;is&#x20;only&#x20;designed&#x20;to&#x20;manage&#x20;local&#x20;Administrator&#x20;passwords,&#x20;and&#x20;is&#x20;therefore&#x20;not&#x20;recommended&#x20;&#40;or&#x20;supported&#41;&#x20;for&#x20;use&#x20;directly&#x20;on&#x20;Domain&#x20;Controllers,&#x20;which&#x20;do&#x20;not&#x20;have&#x20;a&#x20;traditional&#x20;local&#x20;Administrator&#x20;account.&#x20;We&#x20;strongly&#x20;encourage&#x20;you&#x20;to&#x20;only&#x20;deploy&#x20;the&#x20;LAPS&#x20;CSE&#x20;and&#x20;LAPS&#x20;GPO&#x20;settings&#x20;to&#x20;member&#x20;servers&#x20;and&#x20;workstations.','Due&#x20;to&#x20;the&#x20;difficulty&#x20;in&#x20;managing&#x20;local&#x20;Administrator&#x20;passwords,&#x20;many&#x20;organizations&#x20;choose&#x20;to&#x20;use&#x20;the&#x20;same&#x20;password&#x20;on&#x20;all&#x20;workstations&#x20;and/or&#x20;Member&#x20;Servers&#x20;when&#x20;deploying&#x20;them.&#x20;This&#x20;creates&#x20;a&#x20;serious&#x20;attack&#x20;surface&#x20;security&#x20;risk&#x20;because&#x20;if&#x20;an&#x20;attacker&#x20;manages&#x20;to&#x20;compromise&#x20;one&#x20;system&#x20;and&#x20;learn&#x20;the&#x20;password&#x20;to&#x20;its&#x20;local&#x20;Administrator&#x20;account,&#x20;then&#x20;they&#x20;can&#x20;leverage&#x20;that&#x20;account&#x20;to&#x20;instantly&#x20;gain&#x20;access&#x20;to&#x20;all&#x20;other&#x20;computers&#x20;that&#x20;also&#x20;use&#x20;that&#x20;password&#x20;for&#x20;their&#x20;local&#x20;Administrator&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;and&#x20;configure&#x20;the&#x20;Password&#x20;Age&#x20;&#40;Days&#41;&#x20;option&#x20;to&#x20;30&#x20;or&#x20;fewer:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesLAPSPassword&#x20;Settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;AdmPwd.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;Microsoft&#x20;Local&#x20;Administrator&#x20;Password&#x20;Solution&#x20;&#40;LAPS&#41;.','[{\"cis\": [\"18.2.6\"]}, {\"pci_dss\": [\"8.2.4\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27152,'Ensure&#x20;&#039;Apply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;local&#x20;accounts&#x20;can&#x20;be&#x20;used&#x20;for&#x20;remote&#x20;administration&#x20;via&#x20;network&#x20;logon&#x20;&#40;e.g.,&#x20;NET&#x20;USE,&#x20;connecting&#x20;to&#x20;C$,&#x20;etc.&#41;.&#x20;Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Enabling&#x20;this&#x20;policy&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.&#x20;Enabled:&#x20;Applies&#x20;UAC&#x20;token-filtering&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons.&#x20;Membership&#x20;in&#x20;powerful&#x20;group&#x20;such&#x20;as&#x20;Administrators&#x20;is&#x20;disabled&#x20;and&#x20;powerful&#x20;privileges&#x20;are&#x20;removed&#x20;from&#x20;the&#x20;resulting&#x20;access&#x20;token.&#x20;This&#x20;configures&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;0.&#x20;This&#x20;is&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Windows.&#x20;Disabled:&#x20;Allows&#x20;local&#x20;accounts&#x20;to&#x20;have&#x20;full&#x20;administrative&#x20;rights&#x20;when&#x20;authenticating&#x20;via&#x20;network&#x20;logon,&#x20;by&#x20;configuring&#x20;the&#x20;LocalAccountTokenFilterPolicy&#x20;registry&#x20;value&#x20;to&#x20;1.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&quot;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&quot;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;LocalAccountTokenFilterPolicy,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;951016:&#x20;Description&#x20;of&#x20;User&#x20;Account&#x20;Control&#x20;and&#x20;remote&#x20;restrictions&#x20;in&#x20;Windows&#x20;Vista.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Local&#x20;accounts&#x20;are&#x20;at&#x20;high&#x20;risk&#x20;for&#x20;credential&#x20;theft&#x20;when&#x20;the&#x20;same&#x20;account&#x20;and&#x20;password&#x20;is&#x20;configured&#x20;on&#x20;multiple&#x20;systems.&#x20;Ensuring&#x20;this&#x20;policy&#x20;is&#x20;Enabled&#x20;significantly&#x20;reduces&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideApply&#x20;UAC&#x20;restrictions&#x20;to&#x20;local&#x20;accounts&#x20;on&#x20;network&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.1\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27153,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;start&#x20;type&#x20;for&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;client&#x20;driver&#x20;service&#x20;&#40;MRxSmb10&#41;,&#x20;which&#x20;is&#x20;recommended&#x20;to&#x20;be&#x20;disabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;.&#x20;Note:&#x20;Do&#x20;not,&#x20;under&#x20;any&#x20;circumstances,&#x20;configure&#x20;this&#x20;overall&#x20;setting&#x20;as&#x20;Disabled,&#x20;as&#x20;doing&#x20;so&#x20;will&#x20;delete&#x20;the&#x20;underlying&#x20;registry&#x20;entry&#x20;altogether,&#x20;which&#x20;will&#x20;cause&#x20;serious&#x20;problems.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;driver&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;client&#x20;driver&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27154,'Ensure&#x20;&#039;Configure&#x20;SMB&#x20;v1&#x20;server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;configures&#x20;the&#x20;server-side&#x20;processing&#x20;of&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;version&#x20;1&#x20;&#40;SMBv1&#41;&#x20;protocol.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Since&#x20;September&#x20;2016,&#x20;Microsoft&#x20;has&#x20;strongly&#x20;encouraged&#x20;that&#x20;SMBv1&#x20;be&#x20;disabled&#x20;and&#x20;no&#x20;longer&#x20;used&#x20;on&#x20;modern&#x20;networks,&#x20;as&#x20;it&#x20;is&#x20;a&#x20;30&#x20;year&#x20;old&#x20;design&#x20;that&#x20;is&#x20;much&#x20;more&#x20;vulnerable&#x20;to&#x20;attacks&#x20;then&#x20;much&#x20;newer&#x20;designs&#x20;such&#x20;as&#x20;SMBv2&#x20;and&#x20;SMBv3.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideConfigure&#x20;SMB&#x20;v1&#x20;server&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.3.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27155,'Ensure&#x20;&#039;Enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Windows&#x20;includes&#x20;support&#x20;for&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;.&#x20;We&#x20;recommend&#x20;enabling&#x20;this&#x20;feature&#x20;to&#x20;improve&#x20;the&#x20;security&#x20;profile&#x20;of&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;block&#x20;exploits&#x20;that&#x20;use&#x20;the&#x20;Structured&#x20;Exception&#x20;Handler&#x20;&#40;SEH&#41;&#x20;overwrite&#x20;technique.&#x20;This&#x20;protection&#x20;mechanism&#x20;is&#x20;provided&#x20;at&#x20;run-time.&#x20;Therefore,&#x20;it&#x20;helps&#x20;protect&#x20;applications&#x20;regardless&#x20;of&#x20;whether&#x20;they&#x20;have&#x20;been&#x20;compiled&#x20;with&#x20;the&#x20;latest&#x20;improvements,&#x20;such&#x20;as&#x20;the&#x20;/SAFESEH&#x20;option.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideEnable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.&#x20;More&#x20;information&#x20;is&#x20;available&#x20;at&#x20;MSKB&#x20;956607:&#x20;How&#x20;to&#x20;enable&#x20;Structured&#x20;Exception&#x20;Handling&#x20;Overwrite&#x20;Protection&#x20;&#40;SEHOP&#41;&#x20;in&#x20;Windows&#x20;operating&#x20;systems','[{\"cis\": [\"18.3.4\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(27156,'Ensure&#x20;&#039;Limits&#x20;print&#x20;driver&#x20;installation&#x20;to&#x20;Administrators&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;that&#x20;aren&#039;t&#x20;Administrators&#x20;can&#x20;install&#x20;print&#x20;drivers&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.','Restricting&#x20;the&#x20;installation&#x20;of&#x20;print&#x20;drives&#x20;to&#x20;Administrators&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideLimits&#x20;print&#x20;driver&#x20;installation&#x20;to&#x20;Administrators&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;SecGuide.admx/adml&#x20;is&#x20;required.','[{\"cis\": [\"18.3.5\"]}]'),(27157,'Ensure&#x20;&#039;NetBT&#x20;NodeType&#x20;configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;P-&#x20;node&#x20;&#40;recommended&#41;&#039;.','This&#x20;setting&#x20;determines&#x20;which&#x20;method&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;NetBT&#41;&#x20;uses&#x20;to&#x20;register&#x20;and&#x20;resolve&#x20;names.&#x20;The&#x20;available&#x20;methods&#x20;are:&#x20;&#x20;-&#x20;&#x20;The&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;method&#x20;only&#x20;uses&#x20;broadcasts.&#x20;&#x20;-&#x20;&#x20;The&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;method&#x20;only&#x20;uses&#x20;name&#x20;queries&#x20;to&#x20;a&#x20;name&#x20;server&#x20;&#x20;&#40;WINS&#41;.&#x20;&#x20;-&#x20;&#x20;The&#x20;M-node&#x20;&#40;mixed&#41;&#x20;method&#x20;broadcasts&#x20;first,&#x20;then&#x20;queries&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;if&#x20;&#x20;broadcast&#x20;failed.&#x20;&#x20;-&#x20;&#x20;The&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;method&#x20;queries&#x20;a&#x20;name&#x20;server&#x20;&#40;WINS&#41;&#x20;first,&#x20;then&#x20;broadcasts&#x20;if&#x20;&#x20;the&#x20;query&#x20;failed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;P-node&#x20;&#40;recommended&#41;&#x20;&#40;point-to-&#x20;point&#41;.&#x20;Note:&#x20;Resolution&#x20;through&#x20;LMHOSTS&#x20;or&#x20;DNS&#x20;follows&#x20;these&#x20;methods.&#x20;If&#x20;the&#x20;NodeType&#x20;registry&#x20;value&#x20;is&#x20;present,&#x20;it&#x20;overrides&#x20;any&#x20;DhcpNodeType&#x20;registry&#x20;value.&#x20;If&#x20;neither&#x20;NodeType&#x20;nor&#x20;DhcpNodeType&#x20;is&#x20;present,&#x20;the&#x20;computer&#x20;uses&#x20;B-node&#x20;&#40;broadcast&#41;&#x20;if&#x20;there&#x20;are&#x20;no&#x20;WINS&#x20;servers&#x20;configured&#x20;for&#x20;the&#x20;network,&#x20;or&#x20;H-node&#x20;&#40;hybrid&#41;&#x20;if&#x20;there&#x20;is&#x20;at&#x20;least&#x20;one&#x20;WINS&#x20;server&#x20;configured.','In&#x20;order&#x20;to&#x20;help&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;NetBIOS&#x20;Name&#x20;Service&#x20;&#40;NBT-NS&#41;&#x20;poisoning&#x20;attacks,&#x20;setting&#x20;the&#x20;node&#x20;type&#x20;to&#x20;P-node&#x20;&#40;point-to-point&#41;&#x20;will&#x20;prevent&#x20;the&#x20;system&#x20;from&#x20;sending&#x20;out&#x20;NetBIOS&#x20;broadcasts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;P-node&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideNetBT&#x20;NodeType&#x20;configuration&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted.&#x20;Note&#x20;#2:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.&#x20;Please&#x20;note&#x20;that&#x20;this&#x20;setting&#x20;is&#x20;only&#x20;available&#x20;in&#x20;the&#x20;Security&#x20;baseline&#x20;&#40;FINAL&#41;&#x20;for&#x20;Windows&#x20;10&#x20;v1903&#x20;and&#x20;Windows&#x20;Server&#x20;v1903&#x20;&#40;or&#x20;newer&#41;&#x20;release&#x20;of&#x20;SecGuide.admx/adml,&#x20;so&#x20;if&#x20;you&#x20;previously&#x20;downloaded&#x20;this&#x20;template,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;update&#x20;it&#x20;from&#x20;a&#x20;newer&#x20;Microsoft&#x20;baseline&#x20;to&#x20;get&#x20;this&#x20;new&#x20;NetBT&#x20;NodeType&#x20;configuration&#x20;setting.','[{\"cis\": [\"18.3.6\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27158,'Ensure&#x20;&#039;WDigest&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','When&#x20;WDigest&#x20;authentication&#x20;is&#x20;enabled,&#x20;Lsass.exe&#x20;retains&#x20;a&#x20;copy&#x20;of&#x20;the&#x20;user&#039;s&#x20;plaintext&#x20;password&#x20;in&#x20;memory,&#x20;where&#x20;it&#x20;can&#x20;be&#x20;at&#x20;risk&#x20;of&#x20;theft.&#x20;If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured,&#x20;WDigest&#x20;authentication&#x20;is&#x20;disabled&#x20;in&#x20;Windows&#x20;8.1&#x20;and&#x20;in&#x20;Windows&#x20;Server&#x20;2012&#x20;R2;&#x20;it&#x20;is&#x20;enabled&#x20;by&#x20;default&#x20;in&#x20;earlier&#x20;versions&#x20;of&#x20;Windows&#x20;and&#x20;Windows&#x20;Server.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;local&#x20;accounts&#x20;and&#x20;credential&#x20;theft,&#x20;review&#x20;the&#x20;&quot;Mitigating&#x20;Pass-the-Hash&#x20;&#40;PtH&#41;&#x20;Attacks&#x20;and&#x20;Other&#x20;Credential&#x20;Theft&#x20;Techniques&quot;&#x20;documents.&#x20;For&#x20;more&#x20;information&#x20;about&#x20;UseLogonCredential,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;2871997:&#x20;Microsoft&#x20;Security&#x20;Advisory&#x20;Update&#x20;to&#x20;improve&#x20;credentials&#x20;protection&#x20;and&#x20;management&#x20;May&#x20;13,&#x20;2014.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Preventing&#x20;the&#x20;plaintext&#x20;storage&#x20;of&#x20;credentials&#x20;in&#x20;memory&#x20;may&#x20;reduce&#x20;opportunity&#x20;for&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMS&#x20;Security&#x20;GuideWDigest&#x20;Authentication&#x20;&#40;disabling&#x20;may&#x20;require&#x20;KB2871997&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;SecGuide.admx/adml&#41;&#x20;is&#x20;required.','[{\"cis\": [\"18.3.7\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27159,'Ensure&#x20;&#039;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;is&#x20;separate&#x20;from&#x20;the&#x20;Welcome&#x20;screen&#x20;feature&#x20;in&#x20;Windows&#x20;XP&#x20;and&#x20;Windows&#x20;Vista;&#x20;if&#x20;that&#x20;feature&#x20;is&#x20;disabled,&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;disabled.&#x20;If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;to&#x20;which&#x20;the&#x20;computer&#x20;is&#x20;connected.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext,&#x20;and&#x20;the&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;value&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;For&#x20;additional&#x20;information,&#x20;see&#x20;Microsoft&#x20;Knowledge&#x20;Base&#x20;article&#x20;324737:&#x20;How&#x20;to&#x20;turn&#x20;on&#x20;automatic&#x20;logon&#x20;in&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;you&#x20;configure&#x20;a&#x20;computer&#x20;for&#x20;automatic&#x20;logon,&#x20;anyone&#x20;who&#x20;can&#x20;physically&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;can&#x20;also&#x20;gain&#x20;access&#x20;to&#x20;everything&#x20;that&#x20;is&#x20;on&#x20;the&#x20;computer,&#x20;including&#x20;any&#x20;network&#x20;or&#x20;networks&#x20;that&#x20;the&#x20;computer&#x20;is&#x20;connected&#x20;to.&#x20;Also,&#x20;if&#x20;you&#x20;enable&#x20;automatic&#x20;logon,&#x20;the&#x20;password&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;registry&#x20;in&#x20;plaintext.&#x20;The&#x20;specific&#x20;registry&#x20;key&#x20;that&#x20;stores&#x20;this&#x20;setting&#x20;is&#x20;remotely&#x20;readable&#x20;by&#x20;the&#x20;Authenticated&#x20;Users&#x20;group.&#x20;As&#x20;a&#x20;result,&#x20;this&#x20;entry&#x20;is&#x20;appropriate&#x20;only&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;physically&#x20;secured&#x20;and&#x20;if&#x20;you&#x20;ensure&#x20;that&#x20;untrusted&#x20;users&#x20;cannot&#x20;remotely&#x20;see&#x20;the&#x20;registry.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;AutoAdminLogon&#41;&#x20;Enable&#x20;Automatic&#x20;Logon&#x20;&#40;not&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.1\"]}, {\"cis_csc\": [\"3.11\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27160,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highe','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;follow&#x20;through&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#x20;IPv6&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27161,'Ensure&#x20;&#039;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Highest&#x20;pr','IP&#x20;source&#x20;routing&#x20;is&#x20;a&#x20;mechanism&#x20;that&#x20;allows&#x20;the&#x20;sender&#x20;to&#x20;determine&#x20;the&#x20;IP&#x20;route&#x20;that&#x20;a&#x20;datagram&#x20;should&#x20;take&#x20;through&#x20;the&#x20;network.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;configure&#x20;this&#x20;setting&#x20;to&#x20;Not&#x20;Defined&#x20;for&#x20;enterprise&#x20;environments&#x20;and&#x20;to&#x20;Highest&#x20;Protection&#x20;for&#x20;high&#x20;security&#x20;environments&#x20;to&#x20;completely&#x20;disable&#x20;source&#x20;routing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;source&#x20;routed&#x20;packets&#x20;to&#x20;obscure&#x20;their&#x20;identity&#x20;and&#x20;location.&#x20;Source&#x20;routing&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;sends&#x20;a&#x20;packet&#x20;to&#x20;specify&#x20;the&#x20;route&#x20;that&#x20;the&#x20;packet&#x20;takes.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Highest&#x20;protection,&#x20;source&#x20;routing&#x20;is&#x20;completely&#x20;disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;DisableIPSourceRouting&#41;&#x20;IP&#x20;source&#x20;routing&#x20;protection&#x20;level&#x20;&#40;protects&#x20;against&#x20;packet&#x20;spoofing&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27162,'Ensure&#x20;&#039;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Internet&#x20;Control&#x20;Message&#x20;Protocol&#x20;&#40;ICMP&#41;&#x20;redirects&#x20;cause&#x20;the&#x20;IPv4&#x20;stack&#x20;to&#x20;plumb&#x20;host&#x20;routes.&#x20;These&#x20;routes&#x20;override&#x20;the&#x20;Open&#x20;Shortest&#x20;Path&#x20;First&#x20;&#40;OSPF&#41;&#x20;generated&#x20;routes.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;behavior&#x20;is&#x20;expected.&#x20;The&#x20;problem&#x20;is&#x20;that&#x20;the&#x20;10&#x20;minute&#x20;time-out&#x20;period&#x20;for&#x20;the&#x20;ICMP&#x20;redirect-plumbed&#x20;routes&#x20;temporarily&#x20;creates&#x20;a&#x20;network&#x20;situation&#x20;in&#x20;which&#x20;traffic&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;routed&#x20;properly&#x20;for&#x20;the&#x20;affected&#x20;host.&#x20;Ignoring&#x20;such&#x20;ICMP&#x20;redirects&#x20;will&#x20;limit&#x20;the&#x20;system&#039;s&#x20;exposure&#x20;to&#x20;attacks&#x20;that&#x20;will&#x20;impact&#x20;its&#x20;ability&#x20;to&#x20;participate&#x20;on&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;EnableICMPRedirect&#41;&#x20;Allow&#x20;ICMP&#x20;redirects&#x20;to&#x20;override&#x20;OSPF&#x20;generated&#x20;routes&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}, {\"nist_800_53\": [\"SC.5\"]}]'),(27163,'Ensure&#x20;&#039;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recomme','This&#x20;value&#x20;controls&#x20;how&#x20;often&#x20;TCP&#x20;attempts&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;idle&#x20;connection&#x20;is&#x20;still&#x20;intact&#x20;by&#x20;sending&#x20;a&#x20;keep-alive&#x20;packet.&#x20;If&#x20;the&#x20;remote&#x20;computer&#x20;is&#x20;still&#x20;reachable,&#x20;it&#x20;acknowledges&#x20;the&#x20;keep-alive&#x20;packet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;.','An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;network&#x20;applications&#x20;could&#x20;establish&#x20;numerous&#x20;connections&#x20;to&#x20;cause&#x20;a&#x20;DoS&#x20;condition.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;300,000&#x20;or&#x20;5&#x20;minutes&#x20;&#40;recommended&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;KeepAliveTime&#41;&#x20;How&#x20;often&#x20;keep-alive&#x20;packets&#x20;are&#x20;sent&#x20;in&#x20;milliseconds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.5\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27164,'Ensure&#x20;&#039;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enab','NetBIOS&#x20;over&#x20;TCP/IP&#x20;is&#x20;a&#x20;network&#x20;protocol&#x20;that&#x20;among&#x20;other&#x20;things&#x20;provides&#x20;a&#x20;way&#x20;to&#x20;easily&#x20;resolve&#x20;NetBIOS&#x20;names&#x20;that&#x20;are&#x20;registered&#x20;on&#x20;Windows-based&#x20;systems&#x20;to&#x20;the&#x20;IP&#x20;addresses&#x20;that&#x20;are&#x20;configured&#x20;on&#x20;those&#x20;systems.&#x20;This&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;computer&#x20;releases&#x20;its&#x20;NetBIOS&#x20;name&#x20;when&#x20;it&#x20;receives&#x20;a&#x20;name-release&#x20;request.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;NetBT&#x20;protocol&#x20;is&#x20;designed&#x20;not&#x20;to&#x20;use&#x20;authentication,&#x20;and&#x20;is&#x20;therefore&#x20;vulnerable&#x20;to&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;A&#x20;malicious&#x20;user&#x20;could&#x20;exploit&#x20;the&#x20;unauthenticated&#x20;nature&#x20;of&#x20;the&#x20;protocol&#x20;to&#x20;send&#x20;a&#x20;name-conflict&#x20;datagram&#x20;to&#x20;a&#x20;target&#x20;computer,&#x20;which&#x20;would&#x20;cause&#x20;the&#x20;computer&#x20;to&#x20;relinquish&#x20;its&#x20;name&#x20;and&#x20;not&#x20;respond&#x20;to&#x20;queries.&#x20;An&#x20;attacker&#x20;could&#x20;send&#x20;a&#x20;request&#x20;over&#x20;the&#x20;network&#x20;and&#x20;query&#x20;a&#x20;computer&#x20;to&#x20;release&#x20;its&#x20;NetBIOS&#x20;name.&#x20;As&#x20;with&#x20;any&#x20;change&#x20;that&#x20;could&#x20;affect&#x20;applications,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;test&#x20;this&#x20;change&#x20;in&#x20;a&#x20;non-production&#x20;environment&#x20;before&#x20;you&#x20;change&#x20;the&#x20;production&#x20;environment.&#x20;The&#x20;result&#x20;of&#x20;such&#x20;an&#x20;attack&#x20;could&#x20;be&#x20;to&#x20;cause&#x20;intermittent&#x20;connectivity&#x20;issues&#x20;on&#x20;the&#x20;target&#x20;computer,&#x20;or&#x20;even&#x20;to&#x20;prevent&#x20;the&#x20;use&#x20;of&#x20;Network&#x20;Neighborhood,&#x20;domain&#x20;logons,&#x20;the&#x20;NET&#x20;SEND&#x20;command,&#x20;or&#x20;additional&#x20;NetBIOS&#x20;name&#x20;resolution.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;NoNameReleaseOnDemand&#41;&#x20;Allow&#x20;the&#x20;computer&#x20;to&#x20;ignore&#x20;NetBIOS&#x20;name&#x20;release&#x20;requests&#x20;except&#x20;from&#x20;WINS&#x20;servers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;','[{\"cis\": [\"18.4.6\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27165,'Ensure&#x20;&#039;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','This&#x20;setting&#x20;is&#x20;used&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;the&#x20;Internet&#x20;Router&#x20;Discovery&#x20;Protocol&#x20;&#40;IRDP&#41;,&#x20;which&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;default&#x20;gateway&#x20;addresses&#x20;automatically&#x20;as&#x20;described&#x20;in&#x20;RFC&#x20;1256&#x20;on&#x20;a&#x20;per-interface&#x20;basis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','An&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;control&#x20;of&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;network&#x20;segment&#x20;could&#x20;configure&#x20;a&#x20;computer&#x20;on&#x20;the&#x20;network&#x20;to&#x20;impersonate&#x20;a&#x20;router.&#x20;Other&#x20;computers&#x20;with&#x20;IRDP&#x20;enabled&#x20;would&#x20;then&#x20;attempt&#x20;to&#x20;route&#x20;their&#x20;traffic&#x20;through&#x20;the&#x20;already&#x20;compromised&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;PerformRouterDiscovery&#41;&#x20;Allow&#x20;IRDP&#x20;to&#x20;detect&#x20;and&#x20;configure&#x20;Default&#x20;Gateway&#x20;addresses&#x20;&#40;could&#x20;lead&#x20;to&#x20;DoS&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.7\"]}, {\"cis_csc\": [\"4.8\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27166,'Ensure&#x20;&#039;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;DLL&#x20;search&#x20;order&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;that&#x20;are&#x20;requested&#x20;by&#x20;running&#x20;processes&#x20;in&#x20;one&#x20;of&#x20;two&#x20;ways:&#x20;&#x20;-&#x20;&#x20;Search&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;current&#x20;&#x20;working&#x20;folder.&#x20;&#x20;-&#x20;&#x20;Search&#x20;current&#x20;working&#x20;folder&#x20;first,&#x20;and&#x20;then&#x20;search&#x20;the&#x20;folders&#x20;specified&#x20;in&#x20;the&#x20;&#x20;system&#x20;path.&#x20;When&#x20;enabled,&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;1.&#x20;With&#x20;a&#x20;setting&#x20;of&#x20;1,&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder.&#x20;When&#x20;disabled&#x20;the&#x20;registry&#x20;value&#x20;is&#x20;set&#x20;to&#x20;0&#x20;and&#x20;the&#x20;system&#x20;first&#x20;searches&#x20;the&#x20;current&#x20;working&#x20;folder&#x20;and&#x20;then&#x20;searches&#x20;the&#x20;folders&#x20;that&#x20;are&#x20;specified&#x20;in&#x20;the&#x20;system&#x20;path.&#x20;Applications&#x20;will&#x20;be&#x20;forced&#x20;to&#x20;search&#x20;for&#x20;DLLs&#x20;in&#x20;the&#x20;system&#x20;path&#x20;first.&#x20;For&#x20;applications&#x20;that&#x20;require&#x20;unique&#x20;versions&#x20;of&#x20;these&#x20;DLLs&#x20;that&#x20;are&#x20;included&#x20;with&#x20;the&#x20;application,&#x20;this&#x20;entry&#x20;could&#x20;cause&#x20;performance&#x20;or&#x20;stability&#x20;problems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;user&#x20;unknowingly&#x20;executes&#x20;hostile&#x20;code&#x20;that&#x20;was&#x20;packaged&#x20;with&#x20;additional&#x20;files&#x20;that&#x20;include&#x20;modified&#x20;versions&#x20;of&#x20;system&#x20;DLLs,&#x20;the&#x20;hostile&#x20;code&#x20;could&#x20;load&#x20;its&#x20;own&#x20;versions&#x20;of&#x20;those&#x20;DLLs&#x20;and&#x20;potentially&#x20;increase&#x20;the&#x20;type&#x20;and&#x20;degree&#x20;of&#x20;damage&#x20;the&#x20;code&#x20;can&#x20;render.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;SafeDllSearchMode&#41;&#x20;Enable&#x20;Safe&#x20;DLL&#x20;search&#x20;mode&#x20;&#40;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.8\"]}, {\"cis_csc\": [\"2.6\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27167,'Ensure&#x20;&#039;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#03','Windows&#x20;includes&#x20;a&#x20;grace&#x20;period&#x20;between&#x20;when&#x20;the&#x20;screen&#x20;saver&#x20;is&#x20;launched&#x20;and&#x20;when&#x20;the&#x20;console&#x20;is&#x20;actually&#x20;locked&#x20;automatically&#x20;when&#x20;screen&#x20;saver&#x20;locking&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds.','The&#x20;default&#x20;grace&#x20;period&#x20;that&#x20;is&#x20;allowed&#x20;for&#x20;user&#x20;movement&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;lock&#x20;takes&#x20;effect&#x20;is&#x20;five&#x20;seconds.&#x20;If&#x20;you&#x20;leave&#x20;the&#x20;default&#x20;grace&#x20;period&#x20;configuration,&#x20;your&#x20;computer&#x20;is&#x20;vulnerable&#x20;to&#x20;a&#x20;potential&#x20;attack&#x20;from&#x20;someone&#x20;who&#x20;could&#x20;approach&#x20;the&#x20;console&#x20;and&#x20;attempt&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;computer&#x20;before&#x20;the&#x20;lock&#x20;takes&#x20;effect.&#x20;An&#x20;entry&#x20;to&#x20;the&#x20;registry&#x20;can&#x20;be&#x20;made&#x20;to&#x20;adjust&#x20;the&#x20;length&#x20;of&#x20;the&#x20;grace&#x20;period.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;5&#x20;or&#x20;fewer&#x20;seconds:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;ScreenSaverGracePeriod&#41;&#x20;The&#x20;time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;screen&#x20;saver&#x20;grace&#x20;period&#x20;expires&#x20;&#40;0&#x20;recommended&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.9\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27168,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;.','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#x20;IPv6&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.10\"]}, {\"cis_csc\": [\"9.2\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27169,'Ensure&#x20;&#039;MSS:&#x20;&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#039;.','This&#x20;setting&#x20;controls&#x20;the&#x20;number&#x20;of&#x20;times&#x20;that&#x20;TCP&#x20;retransmits&#x20;an&#x20;individual&#x20;data&#x20;segment&#x20;&#40;non-connect&#x20;segment&#41;&#x20;before&#x20;the&#x20;connection&#x20;is&#x20;aborted.&#x20;The&#x20;retransmission&#x20;time-out&#x20;is&#x20;doubled&#x20;with&#x20;each&#x20;successive&#x20;retransmission&#x20;on&#x20;a&#x20;connection.&#x20;It&#x20;is&#x20;reset&#x20;when&#x20;responses&#x20;resume.&#x20;The&#x20;base&#x20;time-out&#x20;value&#x20;is&#x20;dynamically&#x20;determined&#x20;by&#x20;the&#x20;measured&#x20;round-trip&#x20;time&#x20;on&#x20;the&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3.','A&#x20;malicious&#x20;user&#x20;could&#x20;exhaust&#x20;a&#x20;target&#x20;computer&#039;s&#x20;resources&#x20;if&#x20;it&#x20;never&#x20;sent&#x20;any&#x20;acknowledgment&#x20;messages&#x20;for&#x20;data&#x20;that&#x20;was&#x20;transmitted&#x20;by&#x20;the&#x20;target&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#40;TcpMaxDataRetransmissions&#41;&#x20;How&#x20;many&#x20;times&#x20;unacknowledged&#x20;data&#x20;is&#x20;retransmitted&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.11\"]}, {\"cis_csc\": [\"9.2\"]}, {\"nist_800_53\": [\"SC.5\"]}, {\"pci_dss\": [\"1.3.3\"]}, {\"tsc\": [\"A1.1\", \"CC6.1\", \"CC7.2\"]}]'),(27170,'Ensure&#x20;&#039;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#039;&#x20;is&#x20;set&#x20;to&#x20;&','This&#x20;setting&#x20;can&#x20;generate&#x20;a&#x20;security&#x20;audit&#x20;in&#x20;the&#x20;Security&#x20;event&#x20;log&#x20;when&#x20;the&#x20;log&#x20;reaches&#x20;a&#x20;user-defined&#x20;threshold.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;90%&#x20;or&#x20;less.&#x20;Note:&#x20;If&#x20;log&#x20;settings&#x20;are&#x20;configured&#x20;to&#x20;Overwrite&#x20;events&#x20;as&#x20;needed&#x20;or&#x20;Overwrite&#x20;events&#x20;older&#x20;than&#x20;x&#x20;days,&#x20;this&#x20;event&#x20;will&#x20;not&#x20;be&#x20;generated.','If&#x20;the&#x20;Security&#x20;log&#x20;reaches&#x20;90&#x20;percent&#x20;of&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;not&#x20;been&#x20;configured&#x20;to&#x20;overwrite&#x20;events&#x20;as&#x20;needed,&#x20;more&#x20;recent&#x20;events&#x20;will&#x20;not&#x20;be&#x20;written&#x20;to&#x20;the&#x20;log.&#x20;If&#x20;the&#x20;log&#x20;reaches&#x20;its&#x20;capacity&#x20;and&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;shut&#x20;down&#x20;when&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;record&#x20;events&#x20;to&#x20;the&#x20;Security&#x20;log,&#x20;the&#x20;computer&#x20;will&#x20;shut&#x20;down&#x20;and&#x20;will&#x20;no&#x20;longer&#x20;be&#x20;available&#x20;to&#x20;provide&#x20;network&#x20;services.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;90%&#x20;or&#x20;less:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesMSS&#x20;&#40;Legacy&#41;MSS:&#x20;&#40;WarningLevel&#41;&#x20;Percentage&#x20;threshold&#x20;for&#x20;the&#x20;security&#x20;event&#x20;log&#x20;at&#x20;which&#x20;the&#x20;system&#x20;will&#x20;generate&#x20;a&#x20;warning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;MSS-legacy.admx/adml&#41;&#x20;is&#x20;required','[{\"cis\": [\"18.4.12\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.7\"]}]'),(27171,'Ensure&#x20;&#039;Configure&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Allow&#x20;DoH&#039;&#x20;or&#x20;higher.','This&#x20;setting&#x20;determines&#x20;if&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;is&#x20;used&#x20;by&#x20;the&#x20;system.&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;is&#x20;a&#x20;protocol&#x20;for&#x20;performing&#x20;remote&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;resolution&#x20;over&#x20;the&#x20;Hypertext&#x20;Transfer&#x20;Protocol&#x20;Secure&#x20;&#40;HTTPS&#41;.&#x20;For&#x20;additional&#x20;information&#x20;on&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;,&#x20;visit:&#x20;Secure&#x20;DNS&#x20;Client&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;on&#x20;Windows&#x20;Server&#x20;2022&#x20;|&#x20;Microsoft&#x20;Docs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Allow&#x20;DoH.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Enabled:&#x20;Require&#x20;DoH&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;helps&#x20;protect&#x20;against&#x20;DNS&#x20;spoofing.&#x20;Spoofing&#x20;makes&#x20;a&#x20;transmission&#x20;appear&#x20;to&#x20;come&#x20;from&#x20;a&#x20;user&#x20;other&#x20;than&#x20;the&#x20;user&#x20;who&#x20;performed&#x20;the&#x20;action.&#x20;It&#x20;can&#x20;also&#x20;help&#x20;prevent&#x20;man-in-the-middle&#x20;&#40;MitM&#41;&#x20;attacks&#x20;because&#x20;the&#x20;session&#x20;in-between&#x20;is&#x20;encrypted.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Allow&#x20;DoH&#x20;&#40;configuring&#x20;to&#x20;Enabled:&#x20;Require&#x20;DoH&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientConfigure&#x20;DNS&#x20;over&#x20;HTTPS&#x20;&#40;DoH&#41;&#x20;name&#x20;resolution&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.1\"]}, {\"cis_csc\": [\"3.10\"]}]'),(27172,'Ensure&#x20;&#039;Turn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','LLMNR&#x20;is&#x20;a&#x20;secondary&#x20;name&#x20;resolution&#x20;protocol.&#x20;With&#x20;LLMNR,&#x20;queries&#x20;are&#x20;sent&#x20;using&#x20;multicast&#x20;over&#x20;a&#x20;local&#x20;network&#x20;link&#x20;on&#x20;a&#x20;single&#x20;subnet&#x20;from&#x20;a&#x20;client&#x20;computer&#x20;to&#x20;another&#x20;client&#x20;computer&#x20;on&#x20;the&#x20;same&#x20;subnet&#x20;that&#x20;also&#x20;has&#x20;LLMNR&#x20;enabled.&#x20;LLMNR&#x20;does&#x20;not&#x20;require&#x20;a&#x20;DNS&#x20;server&#x20;or&#x20;DNS&#x20;client&#x20;configuration,&#x20;and&#x20;provides&#x20;name&#x20;resolution&#x20;in&#x20;scenarios&#x20;in&#x20;which&#x20;conventional&#x20;DNS&#x20;name&#x20;resolution&#x20;is&#x20;not&#x20;possible.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;can&#x20;listen&#x20;on&#x20;a&#x20;network&#x20;for&#x20;these&#x20;LLMNR&#x20;&#40;UDP/5355&#41;&#x20;or&#x20;NBT-NS&#x20;&#40;UDP/137&#41;&#x20;broadcasts&#x20;and&#x20;respond&#x20;to&#x20;them,&#x20;tricking&#x20;the&#x20;host&#x20;into&#x20;thinking&#x20;that&#x20;it&#x20;knows&#x20;the&#x20;location&#x20;of&#x20;the&#x20;requested&#x20;system.&#x20;Note:&#x20;To&#x20;completely&#x20;mitigate&#x20;local&#x20;name&#x20;resolution&#x20;poisoning,&#x20;in&#x20;addition&#x20;to&#x20;this&#x20;setting,&#x20;the&#x20;properties&#x20;of&#x20;each&#x20;installed&#x20;NIC&#x20;should&#x20;also&#x20;be&#x20;set&#x20;to&#x20;Disable&#x20;NetBIOS&#x20;over&#x20;TCP/IP&#x20;&#40;on&#x20;the&#x20;WINS&#x20;tab&#x20;in&#x20;the&#x20;NIC&#x20;properties&#41;.&#x20;Unfortunately,&#x20;there&#x20;is&#x20;no&#x20;global&#x20;setting&#x20;to&#x20;achieve&#x20;this&#x20;that&#x20;automatically&#x20;applies&#x20;to&#x20;all&#x20;NICs&#x20;-&#x20;it&#x20;is&#x20;a&#x20;per-NIC&#x20;setting&#x20;that&#x20;varies&#x20;with&#x20;different&#x20;NIC&#x20;hardware&#x20;installations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkDNS&#x20;ClientTurn&#x20;off&#x20;multicast&#x20;name&#x20;resolution&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DnsClient.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.4.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27173,'Ensure&#x20;&#039;Enable&#x20;Font&#x20;Providers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;is&#x20;allowed&#x20;to&#x20;download&#x20;fonts&#x20;and&#x20;font&#x20;catalog&#x20;data&#x20;from&#x20;an&#x20;online&#x20;font&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;the&#x20;IT&#x20;department&#x20;should&#x20;be&#x20;managing&#x20;the&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;configuration,&#x20;to&#x20;ensure&#x20;all&#x20;changes&#x20;are&#x20;tested&#x20;and&#x20;approved.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkFontsEnable&#x20;Font&#x20;Providers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.5.1\"]}, {\"cis_csc\": [\"16.5\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(27174,'Ensure&#x20;&#039;Enable&#x20;insecure&#x20;guest&#x20;logons&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;if&#x20;the&#x20;SMB&#x20;client&#x20;will&#x20;allow&#x20;insecure&#x20;guest&#x20;logons&#x20;to&#x20;an&#x20;SMB&#x20;server.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Insecure&#x20;guest&#x20;logons&#x20;are&#x20;used&#x20;by&#x20;file&#x20;servers&#x20;to&#x20;allow&#x20;unauthenticated&#x20;access&#x20;to&#x20;shared&#x20;folders.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLanman&#x20;WorkstationEnable&#x20;insecure&#x20;guest&#x20;logons&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LanmanWorkstation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.8.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27175,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Mapper&#x20;I/O&#x20;network&#x20;protocol&#x20;driver.&#x20;LLTDIO&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;discover&#x20;the&#x20;topology&#x20;of&#x20;a&#x20;network&#x20;it&#039;s&#x20;connected&#x20;to.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;initiate&#x20;Quality-of-Service&#x20;requests&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Mapper&#x20;I/O&#x20;&#40;LLTDIO&#41;&#x20;driver&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27176,'Ensure&#x20;&#039;Turn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;changes&#x20;the&#x20;operational&#x20;behavior&#x20;of&#x20;the&#x20;Responder&#x20;network&#x20;protocol&#x20;driver.&#x20;The&#x20;Responder&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Link&#x20;Layer&#x20;Topology&#x20;Discovery&#x20;requests&#x20;so&#x20;that&#x20;it&#x20;can&#x20;be&#x20;discovered&#x20;and&#x20;located&#x20;on&#x20;the&#x20;network.&#x20;It&#x20;also&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;participate&#x20;in&#x20;Quality-of-Service&#x20;activities&#x20;such&#x20;as&#x20;bandwidth&#x20;estimation&#x20;and&#x20;network&#x20;health&#x20;analysis.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','To&#x20;help&#x20;protect&#x20;from&#x20;potentially&#x20;discovering&#x20;and&#x20;connecting&#x20;to&#x20;unauthorized&#x20;devices,&#x20;this&#x20;setting&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;prevent&#x20;responding&#x20;to&#x20;network&#x20;traffic&#x20;for&#x20;network&#x20;topology&#x20;discovery.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkLink-Layer&#x20;Topology&#x20;DiscoveryTurn&#x20;on&#x20;Responder&#x20;&#40;RSPNDR&#41;&#x20;driver&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;LinkLayerTopologyDiscovery.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.9.2\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27177,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;Peer&#x20;Name&#x20;Resolution&#x20;Protocol&#x20;&#40;PNRP&#41;&#x20;allows&#x20;for&#x20;distributed&#x20;resolution&#x20;of&#x20;a&#x20;name&#x20;to&#x20;an&#x20;IPv6&#x20;address&#x20;and&#x20;port&#x20;number.&#x20;The&#x20;protocol&#x20;operates&#x20;in&#x20;the&#x20;context&#x20;of&#x20;clouds.&#x20;A&#x20;cloud&#x20;is&#x20;a&#x20;set&#x20;of&#x20;peer&#x20;computers&#x20;that&#x20;can&#x20;communicate&#x20;with&#x20;each&#x20;other&#x20;by&#x20;using&#x20;the&#x20;same&#x20;IPv6&#x20;scope.&#x20;Peer-to-Peer&#x20;protocols&#x20;allow&#x20;for&#x20;applications&#x20;in&#x20;the&#x20;areas&#x20;of&#x20;RTC,&#x20;collaboration,&#x20;content&#x20;distribution&#x20;and&#x20;distributed&#x20;processing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;peer-to-peer&#x20;networking.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkMicrosoft&#x20;Peer-to-Peer&#x20;Networking&#x20;ServicesTurn&#x20;off&#x20;Microsoft&#x20;Peer-to-Peer&#x20;Networking&#x20;Services&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;P2P-&#x20;pnrp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.10.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27178,'Ensure&#x20;&#039;Prohibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','You&#x20;can&#x20;use&#x20;this&#x20;procedure&#x20;to&#x20;control&#x20;a&#x20;user&#039;s&#x20;ability&#x20;to&#x20;install&#x20;and&#x20;configure&#x20;a&#x20;Network&#x20;Bridge.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;Network&#x20;Bridge&#x20;setting,&#x20;if&#x20;enabled,&#x20;allows&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Layer&#x20;2&#x20;Media&#x20;Access&#x20;Control&#x20;&#40;MAC&#41;&#x20;bridge,&#x20;enabling&#x20;them&#x20;to&#x20;connect&#x20;two&#x20;or&#x20;more&#x20;physical&#x20;network&#x20;segments&#x20;together.&#x20;A&#x20;Network&#x20;Bridge&#x20;thus&#x20;allows&#x20;a&#x20;computer&#x20;that&#x20;has&#x20;connections&#x20;to&#x20;two&#x20;different&#x20;networks&#x20;to&#x20;share&#x20;data&#x20;between&#x20;those&#x20;networks.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;where&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;control&#x20;network&#x20;traffic&#x20;to&#x20;only&#x20;authorized&#x20;paths,&#x20;allowing&#x20;users&#x20;to&#x20;create&#x20;a&#x20;Network&#x20;Bridge&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface&#x20;from&#x20;the&#x20;bridged&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;installation&#x20;and&#x20;configuration&#x20;of&#x20;Network&#x20;Bridge&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.5\"]}]'),(27179,'Ensure&#x20;&#039;Prohibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Although&#x20;this&#x20;&quot;legacy&quot;&#x20;setting&#x20;traditionally&#x20;applied&#x20;to&#x20;the&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;&#40;ICS&#41;&#x20;in&#x20;Windows&#x20;2000,&#x20;Windows&#x20;XP&#x20;&amp;&#x20;Server&#x20;2003,&#x20;this&#x20;setting&#x20;now&#x20;freshly&#x20;applies&#x20;to&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;in&#x20;Windows&#x20;10&#x20;&amp;&#x20;Server&#x20;2016.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Non-administrators&#x20;should&#x20;not&#x20;be&#x20;able&#x20;to&#x20;turn&#x20;on&#x20;the&#x20;Mobile&#x20;Hotspot&#x20;feature&#x20;and&#x20;open&#x20;their&#x20;Internet&#x20;connectivity&#x20;up&#x20;to&#x20;nearby&#x20;mobile&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsProhibit&#x20;use&#x20;of&#x20;Internet&#x20;Connection&#x20;Sharing&#x20;on&#x20;your&#x20;DNS&#x20;domain&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.11.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(27180,'Ensure&#x20;&#039;Require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;to&#x20;require&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;regular&#x20;users&#x20;to&#x20;set&#x20;a&#x20;network&#x20;location&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ConnectionsRequire&#x20;domain&#x20;users&#x20;to&#x20;elevate&#x20;when&#x20;setting&#x20;a&#x20;network&#039;s&#x20;location&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;NetworkConnections.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.11.4\"]}, {\"pci_dss\": [\"1.3.5\"]}, {\"tsc\": [\"CC6.6\"]}]'),(27181,'Ensure&#x20;&#039;Hardened&#x20;UNC&#x20;Paths&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&','This&#x20;policy&#x20;setting&#x20;configures&#x20;secure&#x20;access&#x20;to&#x20;UNC&#x20;paths.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled,&#x20;with&#x20;&quot;Require&#x20;Mutual&#x20;Authentication&quot;&#x20;and&#x20;&quot;Require&#x20;Integrity&quot;&#x20;set&#x20;for&#x20;all&#x20;NETLOGON&#x20;and&#x20;SYSVOL&#x20;shares.&#x20;Note:&#x20;If&#x20;the&#x20;environment&#x20;exclusively&#x20;contains&#x20;Windows&#x20;8.0&#x20;/&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;systems,&#x20;then&#x20;the&#x20;&quot;Privacy&quot;&#x20;setting&#x20;may&#x20;&#40;optionally&#41;&#x20;also&#x20;be&#x20;set&#x20;to&#x20;enable&#x20;SMB&#x20;encryption.&#x20;However,&#x20;using&#x20;SMB&#x20;encryption&#x20;will&#x20;render&#x20;the&#x20;targeted&#x20;share&#x20;paths&#x20;completely&#x20;inaccessible&#x20;by&#x20;older&#x20;OSes,&#x20;so&#x20;only&#x20;use&#x20;this&#x20;additional&#x20;option&#x20;with&#x20;caution&#x20;and&#x20;thorough&#x20;testing.','In&#x20;February&#x20;2015,&#x20;Microsoft&#x20;released&#x20;a&#x20;new&#x20;control&#x20;mechanism&#x20;to&#x20;mitigate&#x20;a&#x20;security&#x20;risk&#x20;in&#x20;Group&#x20;Policy&#x20;as&#x20;part&#x20;of&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update.&#x20;This&#x20;mechanism&#x20;requires&#x20;both&#x20;the&#x20;installation&#x20;of&#x20;the&#x20;new&#x20;security&#x20;update&#x20;and&#x20;also&#x20;the&#x20;deployment&#x20;of&#x20;specific&#x20;group&#x20;policy&#x20;settings&#x20;to&#x20;all&#x20;computers&#x20;on&#x20;the&#x20;domain&#x20;from&#x20;Windows&#x20;Vista&#x20;/&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;or&#x20;newer&#x20;&#40;the&#x20;associated&#x20;security&#x20;patch&#x20;to&#x20;enable&#x20;this&#x20;feature&#x20;was&#x20;not&#x20;released&#x20;for&#x20;Server&#x20;2003&#41;.&#x20;A&#x20;new&#x20;group&#x20;policy&#x20;template&#x20;&#40;NetworkProvider.admx/adml&#41;&#x20;was&#x20;also&#x20;provided&#x20;with&#x20;the&#x20;security&#x20;update.&#x20;Once&#x20;the&#x20;new&#x20;GPO&#x20;template&#x20;is&#x20;in&#x20;place,&#x20;the&#x20;following&#x20;are&#x20;the&#x20;minimum&#x20;requirements&#x20;to&#x20;remediate&#x20;the&#x20;Group&#x20;Policy&#x20;security&#x20;risk:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Note:&#x20;A&#x20;reboot&#x20;may&#x20;be&#x20;required&#x20;after&#x20;the&#x20;setting&#x20;is&#x20;applied&#x20;to&#x20;a&#x20;client&#x20;machine&#x20;to&#x20;access&#x20;the&#x20;above&#x20;paths.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;the&#x20;following&#x20;paths&#x20;configured,&#x20;at&#x20;a&#x20;minimum:&#x20;&#92;*NETLOGON&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;&#92;*SYSVOL&#x20;RequireMutualAuthentication=1,&#x20;RequireIntegrity=1&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkNetwork&#x20;ProviderHardened&#x20;UNC&#x20;Paths&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;additional&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;NetworkProvider.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;the&#x20;MS15-011&#x20;/&#x20;MSKB&#x20;3000483&#x20;security&#x20;update&#x20;or&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.14.1\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27182,'Disable&#x20;IPv6&#x20;&#40;Ensure&#x20;TCPIP6&#x20;Parameter&#x20;&#039;DisabledComponents&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0xff&#x20;&#40;255&#41;&#039;&#41;.','Internet&#x20;Protocol&#x20;version&#x20;6&#x20;&#40;IPv6&#41;&#x20;is&#x20;a&#x20;set&#x20;of&#x20;protocols&#x20;that&#x20;computers&#x20;use&#x20;to&#x20;exchange&#x20;information&#x20;over&#x20;the&#x20;Internet&#x20;and&#x20;over&#x20;home&#x20;and&#x20;business&#x20;networks.&#x20;IPv6&#x20;allows&#x20;for&#x20;many&#x20;more&#x20;IP&#x20;addresses&#x20;to&#x20;be&#x20;assigned&#x20;than&#x20;IPv4&#x20;did.&#x20;Older&#x20;networking,&#x20;hosts&#x20;and&#x20;operating&#x20;systems&#x20;may&#x20;not&#x20;support&#x20;IPv6&#x20;natively.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;DisabledComponents&#x20;-&#x20;0xff&#x20;&#40;255&#41;','Since&#x20;the&#x20;vast&#x20;majority&#x20;of&#x20;private&#x20;enterprise&#x20;managed&#x20;networks&#x20;have&#x20;no&#x20;need&#x20;to&#x20;utilize&#x20;IPv6&#x20;&#40;because&#x20;they&#x20;have&#x20;access&#x20;to&#x20;private&#x20;IPv4&#x20;addressing&#41;,&#x20;disabling&#x20;IPv6&#x20;components&#x20;removes&#x20;a&#x20;possible&#x20;attack&#x20;surface&#x20;that&#x20;is&#x20;also&#x20;harder&#x20;to&#x20;monitor&#x20;the&#x20;traffic&#x20;on.&#x20;As&#x20;a&#x20;result,&#x20;we&#x20;recommend&#x20;configuring&#x20;IPv6&#x20;to&#x20;a&#x20;Disabled&#x20;state&#x20;when&#x20;it&#x20;is&#x20;not&#x20;needed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration,&#x20;set&#x20;the&#x20;following&#x20;Registry&#x20;value&#x20;to&#x20;0xff&#x20;&#40;255&#41;&#x20;&#40;DWORD&#41;:&#x20;HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTCPIP6Parameters:Disabl&#x20;edComponents&#x20;Note:&#x20;This&#x20;change&#x20;does&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;computer&#x20;has&#x20;been&#x20;restarted&#x20;Note&#x20;#2:&#x20;Although&#x20;Microsoft&#x20;does&#x20;not&#x20;provide&#x20;an&#x20;ADMX&#x20;template&#x20;to&#x20;configure&#x20;this&#x20;registry&#x20;value,&#x20;a&#x20;custom&#x20;.ADM&#x20;template&#x20;&#40;Disable-IPv6-Components-KB929852.adm&#41;&#x20;is&#x20;provided&#x20;in&#x20;the&#x20;CIS&#x20;Benchmark&#x20;Remediation&#x20;Kit&#x20;to&#x20;facilitate&#x20;its&#x20;configuration.&#x20;Be&#x20;aware&#x20;though&#x20;that&#x20;simply&#x20;turning&#x20;off&#x20;the&#x20;group&#x20;policy&#x20;setting&#x20;in&#x20;the&#x20;.ADM&#x20;template&#x20;will&#x20;not&#x20;&quot;undo&quot;&#x20;the&#x20;change&#x20;once&#x20;applied.&#x20;Instead,&#x20;the&#x20;opposite&#x20;setting&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;change&#x20;the&#x20;registry&#x20;value&#x20;to&#x20;the&#x20;opposite&#x20;state.','[{\"cis\": [\"18.5.19.2.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.2\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27183,'Ensure&#x20;&#039;Configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;the&#x20;configuration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;.&#x20;The&#x20;WCN&#x20;Registrar&#x20;enables&#x20;the&#x20;discovery&#x20;and&#x20;configuration&#x20;of&#x20;devices&#x20;over&#x20;Ethernet&#x20;&#40;UPnP&#41;&#x20;over&#x20;in-band&#x20;802.11&#x20;Wi-Fi&#x20;through&#x20;the&#x20;Windows&#x20;Portable&#x20;Device&#x20;API&#x20;&#40;WPD&#41;&#x20;and&#x20;via&#x20;USB&#x20;Flash&#x20;drives.&#x20;Additional&#x20;options&#x20;are&#x20;available&#x20;to&#x20;allow&#x20;discovery&#x20;and&#x20;configuration&#x20;over&#x20;a&#x20;specific&#x20;medium.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;enhances&#x20;the&#x20;security&#x20;of&#x20;the&#x20;environment&#x20;and&#x20;reduces&#x20;the&#x20;overall&#x20;risk&#x20;exposure&#x20;related&#x20;to&#x20;user&#x20;configuration&#x20;of&#x20;wireless&#x20;settings.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowConfiguration&#x20;of&#x20;wireless&#x20;settings&#x20;using&#x20;Windows&#x20;Connect&#x20;Now&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.20.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27184,'Ensure&#x20;&#039;Prohibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prohibits&#x20;access&#x20;to&#x20;Windows&#x20;Connect&#x20;Now&#x20;&#40;WCN&#41;&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;standard&#x20;users&#x20;to&#x20;access&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizard&#x20;increases&#x20;the&#x20;risk&#x20;and&#x20;attack&#x20;surface.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connect&#x20;NowProhibit&#x20;access&#x20;of&#x20;the&#x20;Windows&#x20;Connect&#x20;Now&#x20;wizards&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsConnectNow.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.20.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27185,'Ensure&#x20;&#039;Minimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;establishing&#x20;multiple&#x20;simultaneous&#x20;connections&#x20;to&#x20;either&#x20;the&#x20;Internet&#x20;or&#x20;to&#x20;a&#x20;Windows&#x20;domain.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20;when&#x20;on&#x20;Ethernet.','Preventing&#x20;bridged&#x20;network&#x20;connections&#x20;can&#x20;help&#x20;prevent&#x20;a&#x20;user&#x20;unknowingly&#x20;allowing&#x20;traffic&#x20;to&#x20;route&#x20;between&#x20;internal&#x20;and&#x20;external&#x20;networks,&#x20;which&#x20;risks&#x20;exposure&#x20;to&#x20;sensitive&#x20;internal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;3&#x20;=&#x20;Prevent&#x20;Wi-Fi&#x20;when&#x20;on&#x20;Ethernet:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerMinimize&#x20;the&#x20;number&#x20;of&#x20;simultaneous&#x20;connections&#x20;to&#x20;the&#x20;Internet&#x20;or&#x20;a&#x20;Windows&#x20;Domain&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;updated&#x20;with&#x20;a&#x20;new&#x20;Minimize&#x20;Policy&#x20;Options&#x20;sub-setting&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.5.21.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27186,'Ensure&#x20;&#039;Prohibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;computers&#x20;from&#x20;connecting&#x20;to&#x20;both&#x20;a&#x20;domain&#x20;based&#x20;network&#x20;and&#x20;a&#x20;non-domain&#x20;based&#x20;network&#x20;at&#x20;the&#x20;same&#x20;time.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;potential&#x20;concern&#x20;is&#x20;that&#x20;a&#x20;user&#x20;would&#x20;unknowingly&#x20;allow&#x20;network&#x20;traffic&#x20;to&#x20;flow&#x20;between&#x20;the&#x20;insecure&#x20;public&#x20;network&#x20;and&#x20;the&#x20;enterprise&#x20;managed&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesNetworkWindows&#x20;Connection&#x20;ManagerProhibit&#x20;connection&#x20;to&#x20;non-domain&#x20;networks&#x20;when&#x20;connected&#x20;to&#x20;domain&#x20;authenticated&#x20;network&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WCM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.5.21.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27187,'Ensure&#x20;&#039;Allow&#x20;Print&#x20;Spooler&#x20;to&#x20;accept&#x20;client&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Print&#x20;Spooler&#x20;service&#x20;will&#x20;accept&#x20;client&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;Print&#x20;Spooler&#x20;service&#x20;must&#x20;be&#x20;restarted&#x20;for&#x20;changes&#x20;to&#x20;this&#x20;policy&#x20;to&#x20;take&#x20;effect.&#x20;Warning:&#x20;An&#x20;exception&#x20;to&#x20;this&#x20;recommendation&#x20;must&#x20;be&#x20;made&#x20;for&#x20;print&#x20;servers&#x20;in&#x20;order&#x20;for&#x20;them&#x20;to&#x20;function&#x20;properly.&#x20;Users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;print&#x20;to&#x20;the&#x20;server&#x20;when&#x20;client&#x20;connections&#x20;are&#x20;disabled.','Disabling&#x20;the&#x20;ability&#x20;for&#x20;the&#x20;Print&#x20;Spooler&#x20;service&#x20;to&#x20;accept&#x20;client&#x20;connections&#x20;mitigates&#x20;remote&#x20;attacks&#x20;against&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;remote&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;However,&#x20;this&#x20;recommendation&#x20;does&#x20;not&#x20;mitigate&#x20;against&#x20;local&#x20;attacks&#x20;on&#x20;the&#x20;Print&#x20;Spooler&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrinters:Allow&#x20;Print&#x20;Spooler&#x20;to&#x20;accept&#x20;client&#x20;connections&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing2.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.1\"]}]'),(27188,'Ensure&#x20;&#039;Point&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;installing&#x20;drivers&#x20;for&#x20;a&#x20;new&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt&#0','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;computers&#x20;will&#x20;show&#x20;a&#x20;warning&#x20;and&#x20;a&#x20;security&#x20;elevation&#x20;prompt&#x20;when&#x20;users&#x20;create&#x20;a&#x20;new&#x20;printer&#x20;connection&#x20;using&#x20;Point&#x20;and&#x20;Print.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.&#x20;This&#x20;change&#x20;overrides&#x20;all&#x20;Point&#x20;and&#x20;Print&#x20;Group&#x20;Policy&#x20;settings&#x20;and&#x20;ensures&#x20;that&#x20;only&#x20;Administrators&#x20;can&#x20;install&#x20;printer&#x20;drivers&#x20;from&#x20;a&#x20;print&#x20;server&#x20;using&#x20;Point&#x20;and&#x20;Print.','Enabling&#x20;Windows&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;for&#x20;the&#x20;installation&#x20;of&#x20;new&#x20;print&#x20;drivers&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;Although&#x20;the&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;overrides&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;configure&#x20;this&#x20;as&#x20;a&#x20;backstop&#x20;in&#x20;the&#x20;event&#x20;that&#x20;behavior&#x20;is&#x20;reversed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersPoint&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;installing&#x20;drivers&#x20;for&#x20;a&#x20;new&#x20;connection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.2\"]}]'),(27189,'Ensure&#x20;&#039;Point&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;promp','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;computers&#x20;will&#x20;show&#x20;a&#x20;warning&#x20;and&#x20;a&#x20;security&#x20;elevation&#x20;prompt&#x20;when&#x20;users&#x20;are&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#x20;using&#x20;Point&#x20;and&#x20;Print.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt.&#x20;Note:&#x20;On&#x20;August&#x20;10,&#x20;2021,&#x20;Microsoft&#x20;announced&#x20;a&#x20;Point&#x20;and&#x20;Print&#x20;Default&#x20;Behavior&#x20;Change&#x20;which&#x20;modifies&#x20;the&#x20;default&#x20;Point&#x20;and&#x20;Print&#x20;driver&#x20;installation&#x20;and&#x20;update&#x20;behavior&#x20;to&#x20;require&#x20;Administrator&#x20;privileges.&#x20;This&#x20;is&#x20;documented&#x20;in&#x20;KB5005652&mdash;Manage&#x20;new&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;&#40;CVE-2021-34481&#41;.&#x20;This&#x20;change&#x20;overrides&#x20;all&#x20;Point&#x20;and&#x20;Print&#x20;Group&#x20;Policy&#x20;settings&#x20;and&#x20;ensures&#x20;that&#x20;only&#x20;Administrators&#x20;can&#x20;install&#x20;printer&#x20;drivers&#x20;from&#x20;a&#x20;print&#x20;server&#x20;using&#x20;Point&#x20;and&#x20;Print.','Enabling&#x20;Windows&#x20;User&#x20;Account&#x20;Control&#x20;&#40;UAC&#41;&#x20;for&#x20;updating&#x20;existing&#x20;print&#x20;drivers&#x20;can&#x20;help&#x20;mitigate&#x20;the&#x20;PrintNightmare&#x20;vulnerability&#x20;&#40;CVE-2021-34527&#41;&#x20;and&#x20;other&#x20;Print&#x20;Spooler&#x20;attacks.&#x20;Although&#x20;the&#x20;Point&#x20;and&#x20;Print&#x20;default&#x20;driver&#x20;installation&#x20;behavior&#x20;overrides&#x20;this&#x20;setting,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;configure&#x20;this&#x20;as&#x20;a&#x20;backstop&#x20;in&#x20;the&#x20;event&#x20;that&#x20;behavior&#x20;is&#x20;reversed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Show&#x20;warning&#x20;and&#x20;elevation&#x20;prompt:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesPrintersPoint&#x20;and&#x20;Print&#x20;Restrictions:&#x20;When&#x20;updating&#x20;drivers&#x20;for&#x20;an&#x20;existing&#x20;connection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Printing.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.6.3\"]}]'),(27190,'Ensure&#x20;&#039;Turn&#x20;off&#x20;notifications&#x20;network&#x20;usage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;blocks&#x20;applications&#x20;from&#x20;using&#x20;the&#x20;network&#x20;to&#x20;send&#x20;notifications&#x20;to&#x20;update&#x20;tiles,&#x20;tile&#x20;badges,&#x20;toast,&#x20;or&#x20;raw&#x20;notifications.&#x20;This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;connection&#x20;between&#x20;Windows&#x20;and&#x20;the&#x20;Windows&#x20;Push&#x20;Notification&#x20;Service&#x20;&#40;WNS&#41;.&#x20;This&#x20;policy&#x20;setting&#x20;also&#x20;stops&#x20;applications&#x20;from&#x20;being&#x20;able&#x20;to&#x20;poll&#x20;application&#x20;services&#x20;to&#x20;update&#x20;tiles.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Windows&#x20;Push&#x20;Notification&#x20;Services&#x20;&#40;WNS&#41;&#x20;is&#x20;a&#x20;mechanism&#x20;to&#x20;receive&#x20;3rd-party&#x20;notifications&#x20;and&#x20;updates&#x20;from&#x20;the&#x20;cloud/Internet.&#x20;In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;external&#x20;systems,&#x20;especially&#x20;those&#x20;hosted&#x20;outside&#x20;the&#x20;organization,&#x20;should&#x20;be&#x20;prevented&#x20;from&#x20;having&#x20;an&#x20;impact&#x20;on&#x20;the&#x20;secure&#x20;workstations.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesStart&#x20;Menu&#x20;and&#x20;TaskbarTurn&#x20;off&#x20;notifications&#x20;network&#x20;usage&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WPN.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.7.1.1\"]}, {\"cis_csc\": [\"4.8\"]}]'),(27191,'Ensure&#x20;&#039;Include&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;process&#x20;creation&#x20;command&#x20;line&#x20;text&#x20;is&#x20;logged&#x20;in&#x20;security&#x20;audit&#x20;events&#x20;when&#x20;a&#x20;new&#x20;process&#x20;has&#x20;been&#x20;created.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;feature&#x20;that&#x20;this&#x20;setting&#x20;controls&#x20;was&#x20;not&#x20;originally&#x20;supported&#x20;in&#x20;workstation&#x20;OSes&#x20;older&#x20;than&#x20;Windows&#x20;8.1.&#x20;However,&#x20;in&#x20;February&#x20;2015&#x20;Microsoft&#x20;added&#x20;support&#x20;for&#x20;the&#x20;feature&#x20;to&#x20;Windows&#x20;7&#x20;and&#x20;Windows&#x20;8.0&#x20;via&#x20;an&#x20;update&#x20;-&#x20;KB3004375.&#x20;Therefore,&#x20;this&#x20;setting&#x20;is&#x20;also&#x20;important&#x20;to&#x20;set&#x20;on&#x20;those&#x20;older&#x20;OSes.','Capturing&#x20;process&#x20;command&#x20;line&#x20;information&#x20;in&#x20;event&#x20;logs&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;when&#x20;performing&#x20;forensic&#x20;investigations&#x20;of&#x20;attack&#x20;incidents.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemAudit&#x20;Process&#x20;CreationInclude&#x20;command&#x20;line&#x20;in&#x20;process&#x20;creation&#x20;events&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AuditSettings.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.3.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27192,'Ensure&#x20;&#039;Encryption&#x20;Oracle&#x20;Remediation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Force&#x20;Updated&#x20;Clients&#039;.','Some&#x20;versions&#x20;of&#x20;the&#x20;CredSSP&#x20;protocol&#x20;that&#x20;is&#x20;used&#x20;by&#x20;some&#x20;applications&#x20;&#40;such&#x20;as&#x20;Remote&#x20;Desktop&#x20;Connection&#41;&#x20;are&#x20;vulnerable&#x20;to&#x20;an&#x20;encryption&#x20;oracle&#x20;attack&#x20;against&#x20;the&#x20;client.&#x20;This&#x20;policy&#x20;controls&#x20;compatibility&#x20;with&#x20;vulnerable&#x20;clients&#x20;and&#x20;servers&#x20;and&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;the&#x20;level&#x20;of&#x20;protection&#x20;desired&#x20;for&#x20;the&#x20;encryption&#x20;oracle&#x20;vulnerability.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients.','This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;mitigate&#x20;the&#x20;CredSSP&#x20;encryption&#x20;oracle&#x20;vulnerability,&#x20;for&#x20;which&#x20;information&#x20;was&#x20;published&#x20;by&#x20;Microsoft&#x20;on&#x20;03/13/2018&#x20;in&#x20;CVE-2018-0886&#x20;|&#x20;CredSSP&#x20;Remote&#x20;Code&#x20;Execution&#x20;Vulnerability.&#x20;All&#x20;versions&#x20;of&#x20;Windows&#x20;Server&#x20;from&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;onwards&#x20;are&#x20;affected&#x20;by&#x20;this&#x20;vulnerability,&#x20;and&#x20;will&#x20;be&#x20;compatible&#x20;with&#x20;this&#x20;recommendation&#x20;provided&#x20;that&#x20;they&#x20;have&#x20;been&#x20;patched&#x20;up&#x20;through&#x20;May&#x20;2018&#x20;&#40;or&#x20;later&#41;.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Force&#x20;Updated&#x20;Clients:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationEncryption&#x20;Oracle&#x20;Remediation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.1\"]}, {\"cis_csc\": [\"7.3\"]}]'),(27193,'Ensure&#x20;&#039;Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Remote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials.&#x20;When&#x20;using&#x20;credential&#x20;delegation,&#x20;devices&#x20;provide&#x20;an&#x20;exportable&#x20;version&#x20;of&#x20;credentials&#x20;to&#x20;the&#x20;remote&#x20;host.&#x20;This&#x20;exposes&#x20;users&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;credential&#x20;theft&#x20;from&#x20;attackers&#x20;on&#x20;the&#x20;remote&#x20;host.&#x20;The&#x20;Restricted&#x20;Admin&#x20;Mode&#x20;and&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;features&#x20;are&#x20;two&#x20;options&#x20;to&#x20;help&#x20;protect&#x20;against&#x20;this&#x20;risk.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Restricted&#x20;Admin&#x20;Mode&#x20;was&#x20;designed&#x20;to&#x20;help&#x20;protect&#x20;administrator&#x20;accounts&#x20;by&#x20;ensuring&#x20;that&#x20;reusable&#x20;credentials&#x20;are&#x20;not&#x20;stored&#x20;in&#x20;memory&#x20;on&#x20;remote&#x20;devices&#x20;that&#x20;could&#x20;potentially&#x20;be&#x20;compromised.&#x20;Windows&#x20;Defender&#x20;Remote&#x20;Credential&#x20;Guard&#x20;helps&#x20;you&#x20;protect&#x20;your&#x20;credentials&#x20;over&#x20;a&#x20;Remote&#x20;Desktop&#x20;connection&#x20;by&#x20;redirecting&#x20;Kerberos&#x20;requests&#x20;back&#x20;to&#x20;the&#x20;device&#x20;that&#x20;is&#x20;requesting&#x20;the&#x20;connection.&#x20;Both&#x20;features&#x20;should&#x20;be&#x20;enabled&#x20;and&#x20;supported,&#x20;as&#x20;they&#x20;reduce&#x20;the&#x20;chance&#x20;of&#x20;credential&#x20;theft.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemCredentials&#x20;DelegationRemote&#x20;host&#x20;allows&#x20;delegation&#x20;of&#x20;non-exportable&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredSsp.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.4.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27194,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Virtualization&#x20;Based&#x20;Security&#x20;is&#x20;enabled.&#x20;Virtualization&#x20;Based&#x20;Security&#x20;uses&#x20;the&#x20;Windows&#x20;Hypervisor&#x20;to&#x20;provide&#x20;support&#x20;for&#x20;security&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Kerberos,&#x20;NTLM,&#x20;and&#x20;Credential&#x20;manager&#x20;isolate&#x20;secrets&#x20;by&#x20;using&#x20;virtualization-based&#x20;security.&#x20;Previous&#x20;versions&#x20;of&#x20;Windows&#x20;stored&#x20;secrets&#x20;in&#x20;the&#x20;Local&#x20;Security&#x20;Authority&#x20;&#40;LSA&#41;.&#x20;Prior&#x20;to&#x20;Windows&#x20;10,&#x20;the&#x20;LSA&#x20;stored&#x20;secrets&#x20;used&#x20;by&#x20;the&#x20;operating&#x20;system&#x20;in&#x20;its&#x20;process&#x20;memory.&#x20;With&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;enabled,&#x20;the&#x20;LSA&#x20;process&#x20;in&#x20;the&#x20;operating&#x20;system&#x20;talks&#x20;to&#x20;a&#x20;new&#x20;component&#x20;called&#x20;the&#x20;isolated&#x20;LSA&#x20;process&#x20;that&#x20;stores&#x20;and&#x20;protects&#x20;those&#x20;secrets.&#x20;Data&#x20;stored&#x20;by&#x20;the&#x20;isolated&#x20;LSA&#x20;process&#x20;is&#x20;protected&#x20;using&#x20;virtualization-based&#x20;security&#x20;and&#x20;is&#x20;not&#x20;accessible&#x20;to&#x20;the&#x20;rest&#x20;of&#x20;the&#x20;operating&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.1\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27195,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Select&#x20;Platform&#x20;Security&#x20;Level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Virtualization&#x20;Based&#x20;Security&#x20;is&#x20;enabled.&#x20;Virtualization&#x20;Based&#x20;Security&#x20;uses&#x20;the&#x20;Windows&#x20;Hypervisor&#x20;to&#x20;provide&#x20;support&#x20;for&#x20;security&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Secure&#x20;Boot&#x20;can&#x20;help&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;bootloader&#x20;attacks&#x20;and&#x20;in&#x20;conjunction&#x20;with&#x20;DMA&#x20;protections&#x20;to&#x20;help&#x20;protect&#x20;data&#x20;from&#x20;being&#x20;scraped&#x20;from&#x20;memory.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Secure&#x20;Boot&#x20;and&#x20;DMA&#x20;Protection:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Select&#x20;Platform&#x20;Security&#x20;Level&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.2\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27196,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#x20;with&#x20;UEFI&#x20;lock&#039;.','This&#x20;setting&#x20;enables&#x20;virtualization&#x20;based&#x20;protection&#x20;of&#x20;Kernel&#x20;Mode&#x20;Code&#x20;Integrity.&#x20;When&#x20;this&#x20;is&#x20;enabled,&#x20;kernel&#x20;mode&#x20;memory&#x20;protections&#x20;are&#x20;enforced&#x20;and&#x20;the&#x20;Code&#x20;Integrity&#x20;validation&#x20;path&#x20;is&#x20;protected&#x20;by&#x20;the&#x20;Virtualization&#x20;Based&#x20;Security&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','The&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;option&#x20;ensures&#x20;that&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.3\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27197,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Require&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;True&#x20;&#40;checked&#41;&#039;.','This&#x20;option&#x20;will&#x20;only&#x20;enable&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;on&#x20;devices&#x20;with&#x20;UEFI&#x20;firmware&#x20;support&#x20;for&#x20;the&#x20;Memory&#x20;Attributes&#x20;Table.&#x20;Devices&#x20;without&#x20;the&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#x20;may&#x20;have&#x20;firmware&#x20;that&#x20;is&#x20;incompatible&#x20;with&#x20;Virtualization&#x20;Based&#x20;Protection&#x20;of&#x20;Code&#x20;Integrity&#x20;which&#x20;in&#x20;some&#x20;cases&#x20;can&#x20;lead&#x20;to&#x20;crashes&#x20;or&#x20;data&#x20;loss&#x20;or&#x20;incompatibility&#x20;with&#x20;certain&#x20;plug-in&#x20;cards.&#x20;If&#x20;not&#x20;setting&#x20;this&#x20;option&#x20;the&#x20;targeted&#x20;devices&#x20;should&#x20;be&#x20;tested&#x20;to&#x20;ensure&#x20;compatibility.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;True&#x20;&#40;checked&#41;&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','This&#x20;setting&#x20;will&#x20;help&#x20;protect&#x20;this&#x20;control&#x20;from&#x20;being&#x20;enabled&#x20;on&#x20;a&#x20;system&#x20;that&#x20;is&#x20;not&#x20;compatible&#x20;which&#x20;could&#x20;lead&#x20;to&#x20;a&#x20;crash&#x20;or&#x20;data&#x20;loss.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;TRUE:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Require&#x20;UEFI&#x20;Memory&#x20;Attributes&#x20;Table&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.4\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27198,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#x20;with&#x20;UEFI&#x20;lock&#039;&#x20;&#40;MS&#x20;Only&#41;.','This&#x20;setting&#x20;lets&#x20;users&#x20;turn&#x20;on&#x20;Credential&#x20;Guard&#x20;with&#x20;virtualization-based&#x20;security&#x20;to&#x20;help&#x20;protect&#x20;credentials.&#x20;The&#x20;&quot;Enabled&#x20;with&#x20;UEFI&#x20;lock&quot;&#x20;option&#x20;ensures&#x20;that&#x20;Credential&#x20;Guard&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.&#x20;In&#x20;order&#x20;to&#x20;disable&#x20;the&#x20;feature,&#x20;you&#x20;must&#x20;set&#x20;the&#x20;Group&#x20;Policy&#x20;to&#x20;&quot;Disabled&quot;&#x20;as&#x20;well&#x20;as&#x20;remove&#x20;the&#x20;security&#x20;functionality&#x20;from&#x20;each&#x20;computer,&#x20;with&#x20;a&#x20;physically&#x20;present&#x20;user,&#x20;in&#x20;order&#x20;to&#x20;clear&#x20;configuration&#x20;persisted&#x20;in&#x20;UEFI.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock,&#x20;but&#x20;only&#x20;on&#x20;Member&#x20;Servers&#x20;&#40;not&#x20;Domain&#x20;Controllers&#41;.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','The&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;option&#x20;ensures&#x20;that&#x20;Credential&#x20;Guard&#x20;cannot&#x20;be&#x20;disabled&#x20;remotely.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled&#x20;with&#x20;UEFI&#x20;lock&#x20;&#40;on&#x20;Member&#x20;Servers&#x20;only&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.5\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27199,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;DC&#x20;Only&#41;.','This&#x20;setting&#x20;lets&#x20;users&#x20;turn&#x20;on&#x20;Credential&#x20;Guard&#x20;with&#x20;virtualization-based&#x20;security&#x20;to&#x20;help&#x20;protect&#x20;credentials.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled&#x20;on&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Credential&#x20;Guard&#x20;is&#x20;not&#x20;useful&#x20;on&#x20;Domain&#x20;Controllers&#x20;and&#x20;can&#x20;cause&#x20;crashes&#x20;on&#x20;them.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Credential&#x20;Guard&#x20;Configuration&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.6\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27200,'Ensure&#x20;&#039;Turn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Secure&#x20;Launch&#x20;Configuration&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Secure&#x20;Launch&#x20;protects&#x20;the&#x20;Virtualization&#x20;Based&#x20;Security&#x20;environment&#x20;from&#x20;exploited&#x20;vulnerabilities&#x20;in&#x20;device&#x20;firmware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Virtualization&#x20;Based&#x20;Security&#x20;requires&#x20;a&#x20;64-bit&#x20;version&#x20;of&#x20;Windows&#x20;with&#x20;Secure&#x20;Boot&#x20;enabled,&#x20;which&#x20;in&#x20;turn&#x20;requires&#x20;that&#x20;Windows&#x20;was&#x20;installed&#x20;with&#x20;a&#x20;UEFI&#x20;BIOS&#x20;configuration,&#x20;not&#x20;a&#x20;Legacy&#x20;BIOS&#x20;configuration.&#x20;In&#x20;addition,&#x20;if&#x20;running&#x20;Windows&#x20;on&#x20;a&#x20;virtual&#x20;machine,&#x20;the&#x20;hardware-assisted&#x20;CPU&#x20;virtualization&#x20;feature&#x20;&#40;Intel&#x20;VT-x&#x20;or&#x20;AMD-V&#41;&#x20;must&#x20;be&#x20;exposed&#x20;by&#x20;the&#x20;host&#x20;to&#x20;the&#x20;guest&#x20;VM.&#x20;More&#x20;information&#x20;on&#x20;system&#x20;requirements&#x20;for&#x20;this&#x20;feature&#x20;can&#x20;be&#x20;found&#x20;at&#x20;Windows&#x20;Defender&#x20;Credential&#x20;Guard&#x20;Requirements&#x20;&#40;Windows&#x20;10&#41;&#x20;|&#x20;Microsoft&#x20;Docs&#x20;Note&#x20;#2:&#x20;Credential&#x20;Guard&#x20;and&#x20;Device&#x20;Guard&#x20;are&#x20;not&#x20;currently&#x20;supported&#x20;when&#x20;using&#x20;Azure&#x20;IaaS&#x20;VMs.','Secure&#x20;Launch&#x20;changes&#x20;the&#x20;way&#x20;windows&#x20;boots&#x20;to&#x20;use&#x20;Intel&#x20;Trusted&#x20;Execution&#x20;Technology&#x20;&#40;TXT&#41;&#x20;and&#x20;Runtime&#x20;BIOS&#x20;Resilience&#x20;features&#x20;to&#x20;prevent&#x20;firmware&#x20;exploits&#x20;from&#x20;being&#x20;able&#x20;to&#x20;impact&#x20;the&#x20;security&#x20;of&#x20;the&#x20;Windows&#x20;Virtualization&#x20;Based&#x20;Security&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;GuardTurn&#x20;On&#x20;Virtualization&#x20;Based&#x20;Security:&#x20;Secure&#x20;Launch&#x20;Configuration&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.5.7\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27201,'Ensure&#x20;&#039;Prevent&#x20;device&#x20;metadata&#x20;retrieval&#x20;from&#x20;the&#x20;Internet&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;Windows&#x20;from&#x20;retrieving&#x20;device&#x20;metadata&#x20;from&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;will&#x20;not&#x20;prevent&#x20;the&#x20;installation&#x20;of&#x20;basic&#x20;hardware&#x20;drivers,&#x20;but&#x20;does&#x20;prevent&#x20;associated&#x20;3rd-party&#x20;utility&#x20;software&#x20;from&#x20;automatically&#x20;being&#x20;installed&#x20;under&#x20;the&#x20;context&#x20;of&#x20;the&#x20;SYSTEM&#x20;account.','Installation&#x20;of&#x20;software&#x20;should&#x20;be&#x20;conducted&#x20;by&#x20;an&#x20;authorized&#x20;system&#x20;administrator&#x20;and&#x20;not&#x20;a&#x20;standard&#x20;user.&#x20;Allowing&#x20;automatic&#x20;3rd-party&#x20;software&#x20;installations&#x20;under&#x20;the&#x20;context&#x20;of&#x20;the&#x20;SYSTEM&#x20;account&#x20;has&#x20;potential&#x20;for&#x20;allowing&#x20;unauthorized&#x20;access&#x20;via&#x20;backdoors&#x20;or&#x20;installation&#x20;software&#x20;bugs.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemDevice&#x20;InstallationPrevent&#x20;device&#x20;metadata&#x20;retrieval&#x20;from&#x20;the&#x20;Internet&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceInstallation.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates,&#x20;or&#x20;with&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DeviceSetup.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.7.2\"]}]'),(27202,'Ensure&#x20;&#039;Boot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;which&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized&#x20;based&#x20;on&#x20;a&#x20;classification&#x20;determined&#x20;by&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;The&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;can&#x20;return&#x20;the&#x20;following&#x20;classifications&#x20;for&#x20;each&#x20;boot-start&#x20;driver:&#x20;&#x20;-&#x20;&#x20;Good:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;signed&#x20;and&#x20;has&#x20;not&#x20;been&#x20;tampered&#x20;with.&#x20;&#x20;-&#x20;&#x20;Bad:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;&#x20;allow&#x20;known&#x20;bad&#x20;drivers&#x20;to&#x20;be&#x20;initialized.&#x20;&#x20;-&#x20;&#x20;Bad,&#x20;but&#x20;required&#x20;for&#x20;boot:&#x20;The&#x20;driver&#x20;has&#x20;been&#x20;identified&#x20;as&#x20;malware,&#x20;but&#x20;the&#x20;&#x20;computer&#x20;cannot&#x20;successfully&#x20;boot&#x20;without&#x20;loading&#x20;this&#x20;driver.&#x20;&#x20;-&#x20;&#x20;Unknown:&#x20;This&#x20;driver&#x20;has&#x20;not&#x20;been&#x20;attested&#x20;to&#x20;by&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;&#x20;and&#x20;has&#x20;not&#x20;been&#x20;classified&#x20;by&#x20;the&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver.&#x20;If&#x20;you&#x20;enable&#x20;this&#x20;policy&#x20;setting&#x20;you&#x20;will&#x20;be&#x20;able&#x20;to&#x20;choose&#x20;which&#x20;boot-start&#x20;drivers&#x20;to&#x20;initialize&#x20;the&#x20;next&#x20;time&#x20;the&#x20;computer&#x20;is&#x20;started.&#x20;If&#x20;your&#x20;malware&#x20;detection&#x20;application&#x20;does&#x20;not&#x20;include&#x20;an&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-&#x20;start&#x20;driver&#x20;or&#x20;if&#x20;your&#x20;Early&#x20;Launch&#x20;Antimalware&#x20;boot-start&#x20;driver&#x20;has&#x20;been&#x20;disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;and&#x20;all&#x20;boot-start&#x20;drivers&#x20;are&#x20;initialized.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical.','This&#x20;policy&#x20;setting&#x20;helps&#x20;reduce&#x20;the&#x20;impact&#x20;of&#x20;malware&#x20;that&#x20;has&#x20;already&#x20;infected&#x20;your&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Good,&#x20;unknown&#x20;and&#x20;bad&#x20;but&#x20;critical:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemEarly&#x20;Launch&#x20;AntimalwareBoot-Start&#x20;Driver&#x20;Initialization&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EarlyLaunchAM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.14.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"5.1.1\"]}, {\"nist_800_53\": [\"SI.3\"]}, {\"tsc\": [\"CC6.8\"]}]'),(27203,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;FALSE&#039;.','The&#x20;&quot;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&quot;&#x20;option&#x20;prevents&#x20;the&#x20;system&#x20;from&#x20;updating&#x20;affected&#x20;policies&#x20;in&#x20;the&#x20;background&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;When&#x20;background&#x20;updates&#x20;are&#x20;disabled,&#x20;policy&#x20;changes&#x20;will&#x20;not&#x20;take&#x20;effect&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;FALSE&#x20;&#40;unchecked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;false&#x20;&#40;unchecked&#41;&#x20;will&#x20;ensure&#x20;that&#x20;domain&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Do&#x20;not&#x20;apply&#x20;during&#x20;periodic&#x20;background&#x20;processing&#x20;option&#x20;to&#x20;FALSE&#x20;&#40;unchecked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.2\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27204,'Ensure&#x20;&#039;Configure&#x20;registry&#x20;policy&#x20;processing:&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;TRUE&#039;.','The&#x20;&quot;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&quot;&#x20;option&#x20;updates&#x20;and&#x20;reapplies&#x20;policies&#x20;even&#x20;if&#x20;the&#x20;policies&#x20;have&#x20;not&#x20;changed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;TRUE&#x20;&#40;checked&#41;.','Setting&#x20;this&#x20;option&#x20;to&#x20;true&#x20;&#40;checked&#41;&#x20;will&#x20;ensure&#x20;unauthorized&#x20;changes&#x20;that&#x20;might&#x20;have&#x20;been&#x20;configured&#x20;locally&#x20;are&#x20;forced&#x20;to&#x20;match&#x20;the&#x20;domain-based&#x20;Group&#x20;Policy&#x20;settings&#x20;again.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled,&#x20;then&#x20;set&#x20;the&#x20;Process&#x20;even&#x20;if&#x20;the&#x20;Group&#x20;Policy&#x20;objects&#x20;have&#x20;not&#x20;changed&#x20;option&#x20;to&#x20;TRUE&#x20;&#40;checked&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyConfigure&#x20;registry&#x20;policy&#x20;processing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.3\"]}, {\"pci_dss\": [\"11.5.1\"]}, {\"tsc\": [\"PI1.4\", \"PI1.5\", \"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\", \"CC7.4\"]}]'),(27205,'Ensure&#x20;&#039;Continue&#x20;experiences&#x20;on&#x20;this&#x20;device&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;the&#x20;Windows&#x20;device&#x20;is&#x20;allowed&#x20;to&#x20;participate&#x20;in&#x20;cross-device&#x20;experiences&#x20;&#40;continue&#x20;experiences&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;cross-device&#x20;experience&#x20;is&#x20;when&#x20;a&#x20;system&#x20;can&#x20;access&#x20;app&#x20;and&#x20;send&#x20;messages&#x20;to&#x20;other&#x20;devices.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;only&#x20;trusted&#x20;systems&#x20;should&#x20;be&#x20;communicating&#x20;within&#x20;the&#x20;network.&#x20;Access&#x20;to&#x20;any&#x20;other&#x20;system&#x20;should&#x20;be&#x20;prohibited.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyContinue&#x20;experiences&#x20;on&#x20;this&#x20;device&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.21.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27206,'Ensure&#x20;&#039;Turn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;Group&#x20;Policy&#x20;from&#x20;being&#x20;updated&#x20;while&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;use.&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;to&#x20;Group&#x20;Policy&#x20;for&#x20;computers,&#x20;users&#x20;and&#x20;Domain&#x20;Controllers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;group&#x20;policy&#x20;changes&#x20;take&#x20;effect&#x20;more&#x20;quickly,&#x20;as&#x20;compared&#x20;to&#x20;waiting&#x20;until&#x20;the&#x20;next&#x20;user&#x20;logon&#x20;or&#x20;system&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemGroup&#x20;PolicyTurn&#x20;off&#x20;background&#x20;refresh&#x20;of&#x20;Group&#x20;Policy&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;GroupPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.21.5\"]}]'),(27207,'Ensure&#x20;&#039;Turn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;computer&#x20;can&#x20;download&#x20;print&#x20;driver&#x20;packages&#x20;over&#x20;HTTP.&#x20;To&#x20;set&#x20;up&#x20;HTTP&#x20;printing,&#x20;printer&#x20;drivers&#x20;that&#x20;are&#x20;not&#x20;available&#x20;in&#x20;the&#x20;standard&#x20;operating&#x20;system&#x20;installation&#x20;might&#x20;need&#x20;to&#x20;be&#x20;downloaded&#x20;over&#x20;HTTP.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;might&#x20;download&#x20;drivers&#x20;that&#x20;include&#x20;malicious&#x20;code.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;downloading&#x20;of&#x20;print&#x20;drivers&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27208,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;turns&#x20;off&#x20;data&#x20;sharing&#x20;from&#x20;the&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;personalization&#x20;tool&#x20;enables&#x20;Tablet&#x20;PC&#x20;users&#x20;to&#x20;adapt&#x20;handwriting&#x20;recognition&#x20;to&#x20;their&#x20;own&#x20;writing&#x20;style&#x20;by&#x20;providing&#x20;writing&#x20;samples.&#x20;The&#x20;tool&#x20;can&#x20;optionally&#x20;share&#x20;user&#x20;writing&#x20;samples&#x20;with&#x20;Microsoft&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;tool&#x20;generates&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;personalization&#x20;data&#x20;sharing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ShapeCollector.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.22.1.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27209,'Ensure&#x20;&#039;Turn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Turns&#x20;off&#x20;the&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool.&#x20;The&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;tool&#x20;enables&#x20;users&#x20;to&#x20;report&#x20;errors&#x20;encountered&#x20;in&#x20;Tablet&#x20;PC&#x20;Input&#x20;Panel.&#x20;The&#x20;tool&#x20;generates&#x20;error&#x20;reports&#x20;and&#x20;transmits&#x20;them&#x20;to&#x20;Microsoft&#x20;over&#x20;a&#x20;secure&#x20;connection.&#x20;Microsoft&#x20;uses&#x20;these&#x20;error&#x20;reports&#x20;to&#x20;improve&#x20;handwriting&#x20;recognition&#x20;in&#x20;future&#x20;versions&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;person&#039;s&#x20;handwriting&#x20;is&#x20;Personally&#x20;Identifiable&#x20;Information&#x20;&#40;PII&#41;,&#x20;especially&#x20;when&#x20;it&#x20;comes&#x20;to&#x20;your&#x20;signature.&#x20;As&#x20;such,&#x20;it&#x20;is&#x20;unacceptable&#x20;in&#x20;many&#x20;environments&#x20;to&#x20;automatically&#x20;upload&#x20;PII&#x20;to&#x20;a&#x20;website&#x20;without&#x20;explicit&#x20;approval&#x20;by&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;handwriting&#x20;recognition&#x20;error&#x20;reporting&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InkWatson.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.3\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27210,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;can&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;Internet&#x20;Service&#x20;Providers&#x20;&#40;ISPs&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;Connection&#x20;Wizard&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.4\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27211,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;will&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;for&#x20;the&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Although&#x20;the&#x20;risk&#x20;is&#x20;minimal,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;downloading&#x20;malicious&#x20;content&#x20;through&#x20;this&#x20;feature.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Internet&#x20;download&#x20;for&#x20;Web&#x20;publishing&#x20;and&#x20;online&#x20;ordering&#x20;wizards&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.5\"]}, {\"cis_csc\": [\"4.8\"]}]'),(27212,'Ensure&#x20;&#039;Turn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;disable&#x20;the&#x20;client&#x20;computer&#039;s&#x20;ability&#x20;to&#x20;print&#x20;over&#x20;HTTP,&#x20;which&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;print&#x20;to&#x20;printers&#x20;on&#x20;the&#x20;intranet&#x20;as&#x20;well&#x20;as&#x20;the&#x20;Internet.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;This&#x20;control&#x20;affects&#x20;printing&#x20;over&#x20;both&#x20;HTTP&#x20;and&#x20;HTTPS.','Information&#x20;that&#x20;is&#x20;transmitted&#x20;over&#x20;HTTP&#x20;through&#x20;this&#x20;capability&#x20;is&#x20;not&#x20;protected&#x20;and&#x20;can&#x20;be&#x20;intercepted&#x20;by&#x20;malicious&#x20;users.&#x20;For&#x20;this&#x20;reason,&#x20;it&#x20;is&#x20;not&#x20;often&#x20;used&#x20;in&#x20;enterprise&#x20;managed&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;printing&#x20;over&#x20;HTTP&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.6\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27213,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Registration&#x20;Wizard&#x20;connects&#x20;to&#x20;Microsoft.com&#x20;for&#x20;online&#x20;registration.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;should&#x20;not&#x20;be&#x20;registering&#x20;their&#x20;own&#x20;copies&#x20;of&#x20;Windows,&#x20;providing&#x20;their&#x20;own&#x20;PII&#x20;in&#x20;the&#x20;process.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Registration&#x20;if&#x20;URL&#x20;connection&#x20;is&#x20;referring&#x20;to&#x20;Microsoft.com&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.7\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27214,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Search&#x20;Companion&#x20;should&#x20;automatically&#x20;download&#x20;content&#x20;updates&#x20;during&#x20;local&#x20;and&#x20;Internet&#x20;searches.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;users&#x20;will&#x20;unknowingly&#x20;reveal&#x20;sensitive&#x20;information&#x20;because&#x20;of&#x20;the&#x20;topics&#x20;they&#x20;are&#x20;searching&#x20;for.&#x20;This&#x20;risk&#x20;is&#x20;very&#x20;low&#x20;because&#x20;even&#x20;if&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;users&#x20;still&#x20;must&#x20;submit&#x20;search&#x20;queries&#x20;to&#x20;the&#x20;desired&#x20;search&#x20;engine&#x20;in&#x20;order&#x20;to&#x20;perform&#x20;searches.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Search&#x20;Companion&#x20;content&#x20;file&#x20;updates&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.8\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27215,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;&quot;Order&#x20;Prints&#x20;Online&quot;&#x20;task&#x20;is&#x20;available&#x20;from&#x20;Picture&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;Order&#x20;Prints&#x20;Online&#x20;Wizard&#x20;is&#x20;used&#x20;to&#x20;download&#x20;a&#x20;list&#x20;of&#x20;providers&#x20;and&#x20;allow&#x20;users&#x20;to&#x20;order&#x20;prints&#x20;online.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;we&#x20;want&#x20;to&#x20;lower&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;user&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Order&#x20;Prints&quot;&#x20;picture&#x20;task&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.9\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27216,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;tasks&#x20;Publish&#x20;this&#x20;file&#x20;to&#x20;the&#x20;Web,&#x20;Publish&#x20;this&#x20;folder&#x20;to&#x20;the&#x20;Web,&#x20;and&#x20;Publish&#x20;the&#x20;selected&#x20;items&#x20;to&#x20;the&#x20;Web&#x20;are&#x20;available&#x20;from&#x20;File&#x20;and&#x20;Folder&#x20;Tasks&#x20;in&#x20;Windows&#x20;folders.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;may&#x20;publish&#x20;confidential&#x20;or&#x20;sensitive&#x20;information&#x20;to&#x20;a&#x20;public&#x20;service&#x20;outside&#x20;of&#x20;the&#x20;control&#x20;of&#x20;the&#x20;organization.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;&quot;Publish&#x20;to&#x20;Web&quot;&#x20;task&#x20;for&#x20;files&#x20;and&#x20;folders&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.10\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27217,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Windows&#x20;Messenger&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;the&#x20;Windows&#x20;Messenger&#x20;software&#x20;and&#x20;service&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;detect&#x20;software&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly,&#x20;enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;the&#x20;Windows&#x20;Messenger&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.11\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27218,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;can&#x20;collect&#x20;anonymous&#x20;information&#x20;about&#x20;how&#x20;Windows&#x20;is&#x20;used.&#x20;Microsoft&#x20;uses&#x20;information&#x20;collected&#x20;through&#x20;the&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;to&#x20;improve&#x20;features&#x20;that&#x20;are&#x20;most&#x20;used&#x20;and&#x20;to&#x20;detect&#x20;flaws&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;corrected&#x20;more&#x20;quickly.&#x20;Enabling&#x20;this&#x20;setting&#x20;will&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;data&#x20;Microsoft&#x20;is&#x20;able&#x20;to&#x20;gather&#x20;for&#x20;this&#x20;purpose.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Large&#x20;enterprise&#x20;managed&#x20;environments&#x20;may&#x20;not&#x20;want&#x20;to&#x20;have&#x20;information&#x20;collected&#x20;by&#x20;Microsoft&#x20;from&#x20;managed&#x20;client&#x20;computers.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Customer&#x20;Experience&#x20;Improvement&#x20;Program&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.12\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27219,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;errors&#x20;are&#x20;reported&#x20;to&#x20;Microsoft.&#x20;Error&#x20;Reporting&#x20;is&#x20;used&#x20;to&#x20;report&#x20;information&#x20;about&#x20;a&#x20;system&#x20;or&#x20;application&#x20;that&#x20;has&#x20;failed&#x20;or&#x20;has&#x20;stopped&#x20;responding&#x20;and&#x20;is&#x20;used&#x20;to&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;the&#x20;product.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;a&#x20;Windows&#x20;Error&#x20;occurs&#x20;in&#x20;a&#x20;secure,&#x20;enterprise&#x20;managed&#x20;environment,&#x20;the&#x20;error&#x20;should&#x20;be&#x20;reported&#x20;directly&#x20;to&#x20;IT&#x20;staff&#x20;for&#x20;troubleshooting&#x20;and&#x20;remediation.&#x20;There&#x20;is&#x20;no&#x20;benefit&#x20;to&#x20;the&#x20;corporation&#x20;to&#x20;report&#x20;these&#x20;errors&#x20;directly&#x20;to&#x20;Microsoft,&#x20;and&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;unknowingly&#x20;exposing&#x20;sensitive&#x20;data&#x20;as&#x20;part&#x20;of&#x20;the&#x20;error.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemInternet&#x20;Communication&#x20;ManagementInternet&#x20;Communication&#x20;settingsTurn&#x20;off&#x20;Windows&#x20;Error&#x20;Reporting&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;ICM.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.22.1.13\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27220,'Ensure&#x20;&#039;Support&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Automatic&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;set&#x20;support&#x20;for&#x20;Kerberos&#x20;to&#x20;attempt&#x20;authentication&#x20;using&#x20;the&#x20;certificate&#x20;for&#x20;the&#x20;device&#x20;to&#x20;the&#x20;domain.&#x20;Support&#x20;for&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;will&#x20;require&#x20;connectivity&#x20;to&#x20;a&#x20;DC&#x20;in&#x20;the&#x20;device&#x20;account&#x20;domain&#x20;which&#x20;supports&#x20;certificate&#x20;authentication&#x20;for&#x20;computer&#x20;accounts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Automatic.','Having&#x20;stronger&#x20;device&#x20;authentication&#x20;with&#x20;the&#x20;use&#x20;of&#x20;certificates&#x20;is&#x20;strongly&#x20;encouraged&#x20;over&#x20;standard&#x20;username&#x20;and&#x20;password&#x20;authentication.&#x20;Having&#x20;this&#x20;set&#x20;to&#x20;Automatic&#x20;will&#x20;allow&#x20;certificate&#x20;based&#x20;authentication&#x20;to&#x20;be&#x20;used&#x20;whenever&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Automatic:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKerberosSupport&#x20;device&#x20;authentication&#x20;using&#x20;certificate&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Kerberos.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.25.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27221,'Ensure&#x20;&#039;Enumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#x20;All&#039;.','This&#x20;policy&#x20;is&#x20;intended&#x20;to&#x20;provide&#x20;additional&#x20;security&#x20;against&#x20;external&#x20;DMA-capable&#x20;devices.&#x20;It&#x20;allows&#x20;for&#x20;more&#x20;control&#x20;over&#x20;the&#x20;enumeration&#x20;of&#x20;external&#x20;DMA-capable&#x20;devices&#x20;that&#x20;are&#x20;not&#x20;compatible&#x20;with&#x20;DMA&#x20;Remapping/device&#x20;memory&#x20;isolation&#x20;and&#x20;sandboxing.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block&#x20;All.&#x20;Note:&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;1394,&#x20;PCMCIA&#x20;or&#x20;ExpressCard&#x20;devices.&#x20;The&#x20;protection&#x20;also&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;R1803&#x20;or&#x20;higher,&#x20;and&#x20;also&#x20;requires&#x20;a&#x20;UEFI&#x20;BIOS&#x20;to&#x20;function.','Device&#x20;memory&#x20;sandboxing&#x20;allows&#x20;the&#x20;OS&#x20;to&#x20;leverage&#x20;the&#x20;I/O&#x20;Memory&#x20;Management&#x20;Unit&#x20;&#40;IOMMU&#41;&#x20;of&#x20;a&#x20;device&#x20;to&#x20;block&#x20;unpermitted&#x20;I/O,&#x20;or&#x20;memory&#x20;access,&#x20;by&#x20;the&#x20;peripheral.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block&#x20;All:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemKernel&#x20;DMA&#x20;ProtectionEnumeration&#x20;policy&#x20;for&#x20;external&#x20;devices&#x20;incompatible&#x20;with&#x20;Kernel&#x20;DMA&#x20;Protection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DmaGuard.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.26.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27222,'Ensure&#x20;&#039;Disallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;prevents&#x20;automatic&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;use&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;user&#x20;is&#x20;restricted&#x20;to&#x20;the&#x20;set&#x20;of&#x20;input&#x20;methods&#x20;that&#x20;are&#x20;enabled&#x20;in&#x20;the&#x20;system&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;way&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system&#x20;account.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLocale&#x20;ServicesDisallow&#x20;copying&#x20;of&#x20;user&#x20;input&#x20;methods&#x20;to&#x20;the&#x20;system&#x20;account&#x20;for&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Globalization.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.27.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27223,'Ensure&#x20;&#039;Block&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-&#x20;in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;&#40;email&#x20;address&#x20;or&#x20;user&#x20;name&#41;&#x20;on&#x20;the&#x20;sign-in&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;with&#x20;access&#x20;to&#x20;the&#x20;console&#x20;&#40;for&#x20;example,&#x20;someone&#x20;with&#x20;physical&#x20;access&#x20;or&#x20;someone&#x20;who&#x20;is&#x20;able&#x20;to&#x20;connect&#x20;to&#x20;the&#x20;server&#x20;through&#x20;Remote&#x20;Desktop&#x20;Services&#41;&#x20;could&#x20;view&#x20;the&#x20;name&#x20;of&#x20;the&#x20;last&#x20;user&#x20;who&#x20;logged&#x20;on&#x20;to&#x20;the&#x20;server.&#x20;The&#x20;attacker&#x20;could&#x20;then&#x20;try&#x20;to&#x20;guess&#x20;the&#x20;password,&#x20;use&#x20;a&#x20;dictionary,&#x20;or&#x20;use&#x20;a&#x20;brute-force&#x20;attack&#x20;to&#x20;try&#x20;and&#x20;log&#x20;on.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonBlock&#x20;user&#x20;from&#x20;showing&#x20;account&#x20;details&#x20;on&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27224,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;anyone&#x20;can&#x20;interact&#x20;with&#x20;available&#x20;networks&#x20;UI&#x20;on&#x20;the&#x20;logon&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;unauthorized&#x20;user&#x20;could&#x20;disconnect&#x20;the&#x20;PC&#x20;from&#x20;the&#x20;network&#x20;or&#x20;can&#x20;connect&#x20;the&#x20;PC&#x20;to&#x20;other&#x20;available&#x20;networks&#x20;without&#x20;signing&#x20;into&#x20;Windows.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;display&#x20;network&#x20;selection&#x20;UI&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27225,'Ensure&#x20;&#039;Do&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-&#x20;joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;connected&#x20;users&#x20;from&#x20;being&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonDo&#x20;not&#x20;enumerate&#x20;connected&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.3\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27226,'Ensure&#x20;&#039;Enumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;local&#x20;users&#x20;to&#x20;be&#x20;enumerated&#x20;on&#x20;domain-joined&#x20;computers.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;malicious&#x20;user&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;gather&#x20;account&#x20;names&#x20;of&#x20;other&#x20;users,&#x20;that&#x20;information&#x20;could&#x20;then&#x20;be&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;other&#x20;types&#x20;of&#x20;attacks&#x20;such&#x20;as&#x20;guessing&#x20;passwords&#x20;or&#x20;social&#x20;engineering.&#x20;The&#x20;value&#x20;of&#x20;this&#x20;countermeasure&#x20;is&#x20;small&#x20;because&#x20;a&#x20;user&#x20;with&#x20;domain&#x20;credentials&#x20;could&#x20;gather&#x20;the&#x20;same&#x20;account&#x20;information&#x20;using&#x20;other&#x20;methods.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonEnumerate&#x20;local&#x20;users&#x20;on&#x20;domain-joined&#x20;computers&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.4\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27227,'Ensure&#x20;&#039;Turn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;prevent&#x20;app&#x20;notifications&#x20;from&#x20;appearing&#x20;on&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','App&#x20;notifications&#x20;might&#x20;display&#x20;sensitive&#x20;business&#x20;or&#x20;personal&#x20;data.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;app&#x20;notifications&#x20;on&#x20;the&#x20;lock&#x20;screen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Logon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27228,'Ensure&#x20;&#039;Turn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;picture&#x20;password.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;the&#x20;picture&#x20;password&#x20;feature&#x20;is&#x20;permitted,&#x20;the&#x20;user&#039;s&#x20;domain&#x20;password&#x20;is&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;it.','Picture&#x20;passwords&#x20;bypass&#x20;the&#x20;requirement&#x20;for&#x20;a&#x20;typed&#x20;complex&#x20;password.&#x20;In&#x20;a&#x20;shared&#x20;work&#x20;environment,&#x20;a&#x20;simple&#x20;shoulder&#x20;surf&#x20;where&#x20;someone&#x20;observed&#x20;the&#x20;on-screen&#x20;gestures&#x20;would&#x20;allow&#x20;that&#x20;person&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;the&#x20;need&#x20;to&#x20;know&#x20;the&#x20;complex&#x20;password.&#x20;Vertical&#x20;monitor&#x20;screens&#x20;with&#x20;an&#x20;image&#x20;are&#x20;much&#x20;more&#x20;visible&#x20;at&#x20;a&#x20;distance&#x20;than&#x20;horizontal&#x20;key&#x20;strokes,&#x20;increasing&#x20;the&#x20;likelihood&#x20;of&#x20;a&#x20;successful&#x20;observation&#x20;of&#x20;the&#x20;mouse&#x20;gestures.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;off&#x20;picture&#x20;password&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.28.6\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27229,'Ensure&#x20;&#039;Turn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;whether&#x20;a&#x20;domain&#x20;user&#x20;can&#x20;sign&#x20;in&#x20;using&#x20;a&#x20;convenience&#x20;PIN.&#x20;In&#x20;Windows&#x20;10,&#x20;convenience&#x20;PIN&#x20;was&#x20;replaced&#x20;with&#x20;Passport,&#x20;which&#x20;has&#x20;stronger&#x20;security&#x20;properties.&#x20;To&#x20;configure&#x20;Passport&#x20;for&#x20;domain&#x20;users,&#x20;use&#x20;the&#x20;policies&#x20;under&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Passport&#x20;for&#x20;Work.&#x20;Note:&#x20;The&#x20;user&#039;s&#x20;domain&#x20;password&#x20;will&#x20;be&#x20;cached&#x20;in&#x20;the&#x20;system&#x20;vault&#x20;when&#x20;using&#x20;this&#x20;feature.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;PIN&#x20;is&#x20;created&#x20;from&#x20;a&#x20;much&#x20;smaller&#x20;selection&#x20;of&#x20;characters&#x20;than&#x20;a&#x20;password,&#x20;so&#x20;in&#x20;most&#x20;cases&#x20;a&#x20;PIN&#x20;will&#x20;be&#x20;much&#x20;less&#x20;robust&#x20;than&#x20;a&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemLogonTurn&#x20;on&#x20;convenience&#x20;PIN&#x20;sign-in&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredentialProviders.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;on&#x20;PIN&#x20;sign-in,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.28.7\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27230,'Ensure&#x20;&#039;Allow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Clipboard&#x20;contents&#x20;can&#x20;be&#x20;synchronized&#x20;across&#x20;devices.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;clipboard&#x20;data&#x20;should&#x20;stay&#x20;local&#x20;to&#x20;the&#x20;system&#x20;and&#x20;not&#x20;synced&#x20;across&#x20;devices.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;Clipboard&#x20;synchronization&#x20;across&#x20;devices','[{\"cis\": [\"18.8.31.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27231,'Ensure&#x20;&#039;Allow&#x20;upload&#x20;of&#x20;User&#x20;Activities&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;published&#x20;User&#x20;Activities&#x20;can&#x20;be&#x20;uploaded&#x20;to&#x20;the&#x20;cloud.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemOS&#x20;PoliciesAllow&#x20;upload&#x20;of&#x20;User&#x20;Activities&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;OSPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1803&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.31.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27232,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;on&#x20;battery&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.1\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27233,'Ensure&#x20;&#039;Allow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;network&#x20;connectivity&#x20;state&#x20;in&#x20;standby&#x20;on&#x20;modern&#x20;standby-capable&#x20;systems.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;be&#x20;accessible&#x20;to&#x20;attackers&#x20;over&#x20;a&#x20;WLAN&#x20;network&#x20;while&#x20;left&#x20;unattended,&#x20;plugged&#x20;in&#x20;and&#x20;in&#x20;a&#x20;sleep&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsAllow&#x20;network&#x20;connectivity&#x20;during&#x20;connected-standby&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.2\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27234,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;on&#x20;battery&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.3\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27235,'Ensure&#x20;&#039;Require&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','Specifies&#x20;whether&#x20;or&#x20;not&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;a&#x20;password&#x20;when&#x20;the&#x20;system&#x20;resumes&#x20;from&#x20;sleep.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;ensures&#x20;that&#x20;anyone&#x20;who&#x20;wakes&#x20;an&#x20;unattended&#x20;computer&#x20;from&#x20;sleep&#x20;state&#x20;will&#x20;have&#x20;to&#x20;provide&#x20;logon&#x20;credentials&#x20;before&#x20;they&#x20;can&#x20;access&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemPower&#x20;ManagementSleep&#x20;SettingsRequire&#x20;a&#x20;password&#x20;when&#x20;a&#x20;computer&#x20;wakes&#x20;&#40;plugged&#x20;in&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Power.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.34.6.4\"]}, {\"cis_csc\": [\"4.3\"]}, {\"pci_dss\": [\"8.2\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27236,'Ensure&#x20;&#039;Configure&#x20;Offer&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Offer&#x20;&#40;Unsolicited&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;Help&#x20;desk&#x20;and&#x20;support&#x20;personnel&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;proactively&#x20;offer&#x20;assistance,&#x20;although&#x20;they&#x20;can&#x20;still&#x20;respond&#x20;to&#x20;user&#x20;assistance&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','A&#x20;user&#x20;might&#x20;be&#x20;tricked&#x20;and&#x20;accept&#x20;an&#x20;unsolicited&#x20;Remote&#x20;Assistance&#x20;offer&#x20;from&#x20;a&#x20;malicious&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Offer&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27237,'Ensure&#x20;&#039;Configure&#x20;Solicited&#x20;Remote&#x20;Assistance&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;turn&#x20;on&#x20;or&#x20;turn&#x20;off&#x20;Solicited&#x20;&#40;Ask&#x20;for&#41;&#x20;Remote&#x20;Assistance&#x20;on&#x20;this&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','There&#x20;is&#x20;slight&#x20;risk&#x20;that&#x20;a&#x20;rogue&#x20;administrator&#x20;will&#x20;gain&#x20;access&#x20;to&#x20;another&#x20;user&#039;s&#x20;desktop&#x20;session,&#x20;however,&#x20;they&#x20;cannot&#x20;connect&#x20;to&#x20;a&#x20;user&#039;s&#x20;computer&#x20;unannounced&#x20;or&#x20;control&#x20;it&#x20;without&#x20;permission&#x20;from&#x20;the&#x20;user.&#x20;When&#x20;an&#x20;expert&#x20;tries&#x20;to&#x20;connect,&#x20;the&#x20;user&#x20;can&#x20;still&#x20;choose&#x20;to&#x20;deny&#x20;the&#x20;connection&#x20;or&#x20;give&#x20;the&#x20;expert&#x20;view-only&#x20;privileges.&#x20;The&#x20;user&#x20;must&#x20;explicitly&#x20;click&#x20;the&#x20;Yes&#x20;button&#x20;to&#x20;allow&#x20;the&#x20;expert&#x20;to&#x20;remotely&#x20;control&#x20;the&#x20;workstation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;AssistanceConfigure&#x20;Solicited&#x20;Remote&#x20;Assistance&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RemoteAssistance.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.36.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27238,'Ensure&#x20;&#039;Enable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;RPC&#x20;clients&#x20;authenticate&#x20;with&#x20;the&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;when&#x20;the&#x20;call&#x20;they&#x20;are&#x20;making&#x20;contains&#x20;authentication&#x20;information.&#x20;The&#x20;Endpoint&#x20;Mapper&#x20;Service&#x20;on&#x20;computers&#x20;running&#x20;Windows&#x20;NT4&#x20;&#40;all&#x20;service&#x20;packs&#41;&#x20;cannot&#x20;process&#x20;authentication&#x20;information&#x20;supplied&#x20;in&#x20;this&#x20;manner.&#x20;This&#x20;policy&#x20;setting&#x20;can&#x20;cause&#x20;a&#x20;specific&#x20;issue&#x20;with&#x20;1-way&#x20;forest&#x20;trusts&#x20;if&#x20;it&#x20;is&#x20;applied&#x20;to&#x20;the&#x20;trusting&#x20;domain&#x20;DCs&#x20;&#40;see&#x20;Microsoft&#x20;KB3073942&#41;,&#x20;so&#x20;we&#x20;do&#x20;not&#x20;recommend&#x20;applying&#x20;it&#x20;to&#x20;Domain&#x20;Controllers.&#x20;Note:&#x20;This&#x20;policy&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Anonymous&#x20;access&#x20;to&#x20;RPC&#x20;services&#x20;could&#x20;result&#x20;in&#x20;accidental&#x20;disclosure&#x20;of&#x20;information&#x20;to&#x20;unauthenticated&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallEnable&#x20;RPC&#x20;Endpoint&#x20;Mapper&#x20;Client&#x20;Authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27239,'Ensure&#x20;&#039;Restrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Authenticated&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;how&#x20;the&#x20;RPC&#x20;server&#x20;runtime&#x20;handles&#x20;unauthenticated&#x20;RPC&#x20;clients&#x20;connecting&#x20;to&#x20;RPC&#x20;servers.&#x20;This&#x20;policy&#x20;setting&#x20;impacts&#x20;all&#x20;RPC&#x20;applications.&#x20;In&#x20;a&#x20;domain&#x20;environment&#x20;this&#x20;policy&#x20;setting&#x20;should&#x20;be&#x20;used&#x20;with&#x20;caution&#x20;as&#x20;it&#x20;can&#x20;impact&#x20;a&#x20;wide&#x20;range&#x20;of&#x20;functionality&#x20;including&#x20;group&#x20;policy&#x20;processing&#x20;itself.&#x20;Reverting&#x20;a&#x20;change&#x20;to&#x20;this&#x20;policy&#x20;setting&#x20;can&#x20;require&#x20;manual&#x20;intervention&#x20;on&#x20;each&#x20;affected&#x20;machine.&#x20;This&#x20;policy&#x20;setting&#x20;should&#x20;never&#x20;be&#x20;applied&#x20;to&#x20;a&#x20;Domain&#x20;Controller.&#x20;A&#x20;client&#x20;will&#x20;be&#x20;considered&#x20;an&#x20;authenticated&#x20;client&#x20;if&#x20;it&#x20;uses&#x20;a&#x20;named&#x20;pipe&#x20;to&#x20;communicate&#x20;with&#x20;the&#x20;server&#x20;or&#x20;if&#x20;it&#x20;uses&#x20;RPC&#x20;Security.&#x20;RPC&#x20;Interfaces&#x20;that&#x20;have&#x20;specifically&#x20;requested&#x20;to&#x20;be&#x20;accessible&#x20;by&#x20;unauthenticated&#x20;clients&#x20;may&#x20;be&#x20;exempt&#x20;from&#x20;this&#x20;restriction,&#x20;depending&#x20;on&#x20;the&#x20;selected&#x20;value&#x20;for&#x20;this&#x20;policy&#x20;setting.&#x20;--&#x20;&quot;None&quot;&#x20;allows&#x20;all&#x20;RPC&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;--&#x20;&quot;Authenticated&quot;&#x20;allows&#x20;only&#x20;authenticated&#x20;RPC&#x20;Clients&#x20;&#40;per&#x20;the&#x20;definition&#x20;above&#41;&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;Exemptions&#x20;are&#x20;granted&#x20;to&#x20;interfaces&#x20;that&#x20;have&#x20;requested&#x20;them.&#x20;--&#x20;&quot;Authenticated&#x20;without&#x20;exceptions&quot;&#x20;allows&#x20;only&#x20;authenticated&#x20;RPC&#x20;Clients&#x20;&#40;per&#x20;the&#x20;definition&#x20;above&#41;&#x20;to&#x20;connect&#x20;to&#x20;RPC&#x20;Servers&#x20;running&#x20;on&#x20;the&#x20;machine&#x20;on&#x20;which&#x20;the&#x20;policy&#x20;setting&#x20;is&#x20;applied.&#x20;No&#x20;exceptions&#x20;are&#x20;allowed.&#x20;This&#x20;value&#x20;has&#x20;the&#x20;potential&#x20;to&#x20;cause&#x20;serious&#x20;problems&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;will&#x20;not&#x20;be&#x20;applied&#x20;until&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Authenticated.','Unauthenticated&#x20;RPC&#x20;communication&#x20;can&#x20;create&#x20;a&#x20;security&#x20;vulnerability.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Authenticated:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemRemote&#x20;Procedure&#x20;CallRestrict&#x20;Unauthenticated&#x20;RPC&#x20;clients&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;RPC.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.37.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27240,'Ensure&#x20;&#039;Configure&#x20;validation&#x20;of&#x20;ROCA-vulnerable&#x20;WHfB&#x20;keys&#x20;during&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Audit&#039;&#x20;or&#x20;higher&#x20;&#40;DC&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;how&#x20;Domain&#x20;Controllers&#x20;handle&#x20;Windows&#x20;Hello&#x20;for&#x20;Business&#x20;&#40;WHfB&#41;&#x20;keys&#x20;that&#x20;are&#x20;vulnerable&#x20;to&#x20;the&#x20;&quot;Return&#x20;of&#x20;Coppersmiths&#x20;attack&quot;&#x20;&#40;ROCA&#41;&#x20;vulnerability.&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;is&#x20;enabled&#x20;the&#x20;following&#x20;options&#x20;are&#x20;supported:&#x20;Ignore:&#x20;during&#x20;authentication&#x20;the&#x20;domain&#x20;controller&#x20;will&#x20;not&#x20;probe&#x20;any&#x20;WHfB&#x20;keys&#x20;for&#x20;the&#x20;ROCA&#x20;vulnerability.&#x20;Audit:&#x20;during&#x20;authentication&#x20;the&#x20;domain&#x20;controller&#x20;will&#x20;emit&#x20;audit&#x20;events&#x20;for&#x20;WHfB&#x20;keys&#x20;that&#x20;are&#x20;subject&#x20;to&#x20;the&#x20;ROCA&#x20;vulnerability&#x20;&#40;authentications&#x20;will&#x20;still&#x20;succeed&#41;.&#x20;Block:&#x20;during&#x20;authentication&#x20;the&#x20;domain&#x20;controller&#x20;will&#x20;block&#x20;the&#x20;use&#x20;of&#x20;WHfB&#x20;keys&#x20;that&#x20;are&#x20;subject&#x20;to&#x20;the&#x20;ROCA&#x20;vulnerability&#x20;&#40;authentications&#x20;will&#x20;fail&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Audit.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Enabled:&#x20;Block:&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.&#x20;Note:&#x20;This&#x20;setting&#x20;only&#x20;takes&#x20;effect&#x20;on&#x20;Domain&#x20;Controllers.&#x20;Note&#x20;#2:&#x20;A&#x20;reboot&#x20;is&#x20;not&#x20;required&#x20;for&#x20;changes&#x20;to&#x20;this&#x20;setting&#x20;to&#x20;take&#x20;effect.','The&#x20;&quot;Return&#x20;of&#x20;Coppersmiths&#x20;attack&quot;&#x20;or&#x20;ROCA&#x20;vulnerability&#x20;is&#x20;a&#x20;cryptographic&#x20;weakness&#x20;in&#x20;a&#x20;widely&#x20;used&#x20;cryptographic&#x20;library.&#x20;An&#x20;attacker&#x20;can&#x20;reveal&#x20;secret&#x20;keys&#x20;&#40;offline&#x20;with&#x20;no&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;affected&#x20;device&#41;&#x20;on&#x20;certified&#x20;devices&#x20;using&#x20;this&#x20;library.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;this&#x20;vulnerability,&#x20;visit&#x20;ADV170012&#x20;-&#x20;Security&#x20;Update&#x20;Guide&#x20;-&#x20;Microsoft&#x20;-&#x20;Vulnerability&#x20;in&#x20;TPM&#x20;could&#x20;allow&#x20;Security&#x20;Feature&#x20;Bypass.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Audit&#x20;&#40;configuring&#x20;to&#x20;Enabled:&#x20;Block&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemSecurity&#x20;Account&#x20;ManagerConfigure&#x20;validation&#x20;of&#x20;ROCA-vulnerable&#x20;WHfB&#x20;keys&#x20;during&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sam.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.40.1\"]}, {\"cis_csc\": [\"10.5\"]}]'),(27241,'Ensure&#x20;&#039;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;Microsoft&#x20;Support&#x20;Diagnostic&#x20;Tool&#x20;&#40;MSDT&#41;&#x20;interactive&#x20;communication&#x20;with&#x20;the&#x20;support&#x20;provider.&#x20;MSDT&#x20;gathers&#x20;diagnostic&#x20;data&#x20;for&#x20;analysis&#x20;by&#x20;support&#x20;professionals.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsMicrosoft&#x20;Support&#x20;Diagnostic&#x20;ToolMicrosoft&#x20;Support&#x20;Diagnostic&#x20;Tool:&#x20;Turn&#x20;on&#x20;MSDT&#x20;interactive&#x20;communication&#x20;with&#x20;support&#x20;provider&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSDT.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.48.5.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27242,'Ensure&#x20;&#039;Enable/Disable&#x20;PerfTrack&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;enable&#x20;or&#x20;disable&#x20;tracking&#x20;of&#x20;responsiveness&#x20;events.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;enabled&#x20;the&#x20;aggregated&#x20;data&#x20;of&#x20;a&#x20;given&#x20;event&#x20;will&#x20;be&#x20;transmitted&#x20;to&#x20;Microsoft.&#x20;The&#x20;option&#x20;exists&#x20;to&#x20;restrict&#x20;this&#x20;feature&#x20;for&#x20;a&#x20;specific&#x20;user,&#x20;set&#x20;the&#x20;consent&#x20;level,&#x20;and&#x20;designate&#x20;specific&#x20;programs&#x20;for&#x20;which&#x20;error&#x20;reports&#x20;could&#x20;be&#x20;sent.&#x20;However,&#x20;centrally&#x20;restricting&#x20;the&#x20;ability&#x20;to&#x20;execute&#x20;PerfTrack&#x20;to&#x20;limit&#x20;the&#x20;potential&#x20;for&#x20;unauthorized&#x20;or&#x20;undesired&#x20;usage,&#x20;data&#x20;leakage,&#x20;or&#x20;unintentional&#x20;communications&#x20;is&#x20;highly&#x20;recommended.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemTroubleshooting&#x20;and&#x20;DiagnosticsWindows&#x20;Performance&#x20;PerfTrackEnable/Disable&#x20;PerfTrack&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PerformancePerftrack.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.48.11.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27243,'Ensure&#x20;&#039;Turn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;advertising&#x20;ID,&#x20;preventing&#x20;apps&#x20;from&#x20;using&#x20;the&#x20;ID&#x20;for&#x20;experiences&#x20;across&#x20;apps.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Tracking&#x20;user&#x20;activity&#x20;for&#x20;advertising&#x20;purposes,&#x20;even&#x20;anonymously,&#x20;may&#x20;be&#x20;a&#x20;privacy&#x20;concern.&#x20;In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;applications&#x20;should&#x20;not&#x20;need&#x20;or&#x20;require&#x20;tracking&#x20;for&#x20;targeted&#x20;advertising.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemUser&#x20;ProfilesTurn&#x20;off&#x20;the&#x20;advertising&#x20;ID&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;UserProfiles.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.8.50.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27244,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Client&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;is&#x20;enabled.&#x20;Enabling&#x20;the&#x20;Windows&#x20;NTP&#x20;Client&#x20;allows&#x20;your&#x20;computer&#x20;to&#x20;synchronize&#x20;its&#x20;computer&#x20;clock&#x20;with&#x20;other&#x20;NTP&#x20;servers.&#x20;You&#x20;might&#x20;want&#x20;to&#x20;disable&#x20;this&#x20;service&#x20;if&#x20;you&#x20;decide&#x20;to&#x20;use&#x20;a&#x20;third-party&#x20;time&#x20;provider.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','A&#x20;reliable&#x20;and&#x20;accurate&#x20;account&#x20;of&#x20;time&#x20;is&#x20;important&#x20;for&#x20;a&#x20;number&#x20;of&#x20;services&#x20;and&#x20;security&#x20;requirements,&#x20;including&#x20;but&#x20;not&#x20;limited&#x20;to&#x20;distributed&#x20;applications,&#x20;authentication&#x20;services,&#x20;multi-user&#x20;databases&#x20;and&#x20;logging&#x20;services.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;NTP&#x20;client&#x20;&#40;with&#x20;secure&#x20;operation&#41;&#x20;establishes&#x20;functional&#x20;accuracy&#x20;and&#x20;is&#x20;a&#x20;focal&#x20;point&#x20;when&#x20;reviewing&#x20;security&#x20;relevant&#x20;events','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Client&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.53.1.1\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(27245,'Ensure&#x20;&#039;Enable&#x20;Windows&#x20;NTP&#x20;Server&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;&#x20;&#40;MS&#x20;only&#41;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;is&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;In&#x20;most&#x20;enterprise&#x20;managed&#x20;environments,&#x20;you&#x20;should&#x20;not&#x20;disable&#x20;the&#x20;Windows&#x20;NTP&#x20;Server&#x20;on&#x20;Domain&#x20;Controllers,&#x20;as&#x20;it&#x20;is&#x20;very&#x20;important&#x20;for&#x20;the&#x20;operation&#x20;of&#x20;NT5DS&#x20;&#40;domain&#x20;hierarchy-based&#41;&#x20;time&#x20;synchronization.','The&#x20;configuration&#x20;of&#x20;proper&#x20;time&#x20;synchronization&#x20;is&#x20;critically&#x20;important&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;both&#x20;due&#x20;to&#x20;the&#x20;sensitivity&#x20;of&#x20;Kerberos&#x20;authentication&#x20;timestamps&#x20;and&#x20;also&#x20;to&#x20;ensure&#x20;accurate&#x20;security&#x20;logging.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesSystemWindows&#x20;Time&#x20;ServiceTime&#x20;ProvidersEnable&#x20;Windows&#x20;NTP&#x20;Server&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;W32Time.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.8.53.1.2\"]}, {\"cis_csc\": [\"8.4\"]}, {\"pci_dss\": [\"10.4\"]}, {\"nist_800_53\": [\"AU.8\"]}, {\"tsc\": [\"CC7.2\"]}]'),(27246,'Ensure&#x20;&#039;Allow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Manages&#x20;a&#x20;Windows&#x20;app&#039;s&#x20;ability&#x20;to&#x20;share&#x20;data&#x20;between&#x20;users&#x20;who&#x20;have&#x20;installed&#x20;the&#x20;app.&#x20;Data&#x20;is&#x20;shared&#x20;through&#x20;the&#x20;SharedLocal&#x20;folder.&#x20;This&#x20;folder&#x20;is&#x20;available&#x20;through&#x20;the&#x20;Windows.Storage&#x20;API.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;of&#x20;a&#x20;system&#x20;could&#x20;accidentally&#x20;share&#x20;sensitive&#x20;data&#x20;with&#x20;other&#x20;users&#x20;on&#x20;the&#x20;same&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;Package&#x20;DeploymentAllow&#x20;a&#x20;Windows&#x20;app&#x20;to&#x20;share&#x20;application&#x20;data&#x20;between&#x20;users&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppxPackageManager.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.4.1\"]}, {\"cis_csc\": [\"3.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27247,'Ensure&#x20;&#039;Allow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;control&#x20;whether&#x20;Microsoft&#x20;accounts&#x20;are&#x20;optional&#x20;for&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;require&#x20;an&#x20;account&#x20;to&#x20;sign&#x20;in.&#x20;This&#x20;policy&#x20;only&#x20;affects&#x20;Windows&#x20;Store&#x20;apps&#x20;that&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;use&#x20;their&#x20;enterprise&#x20;user&#x20;accounts&#x20;instead&#x20;of&#x20;using&#x20;their&#x20;Microsoft&#x20;accounts&#x20;when&#x20;accessing&#x20;Windows&#x20;store&#x20;apps.&#x20;This&#x20;provides&#x20;the&#x20;organization&#x20;with&#x20;greater&#x20;control&#x20;over&#x20;relevant&#x20;credentials.&#x20;Microsoft&#x20;accounts&#x20;cannot&#x20;be&#x20;centrally&#x20;managed&#x20;and&#x20;as&#x20;such&#x20;enterprise&#x20;credential&#x20;security&#x20;policies&#x20;cannot&#x20;be&#x20;applied&#x20;to&#x20;them,&#x20;which&#x20;could&#x20;put&#x20;any&#x20;information&#x20;accessed&#x20;by&#x20;using&#x20;Microsoft&#x20;accounts&#x20;at&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsApp&#x20;runtimeAllow&#x20;Microsoft&#x20;accounts&#x20;to&#x20;be&#x20;optional&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AppXRuntime.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.6.1\"]}, {\"cis_csc\": [\"5.6\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27248,'Ensure&#x20;&#039;Disallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;disallows&#x20;AutoPlay&#x20;for&#x20;MTP&#x20;devices&#x20;like&#x20;cameras&#x20;or&#x20;phones.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesDisallow&#x20;Autoplay&#x20;for&#x20;non-volume&#x20;devices&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.1\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27249,'Ensure&#x20;&#039;Set&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands&#039;.','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;Autorun&#x20;commands.&#x20;Autorun&#x20;commands&#x20;are&#x20;generally&#x20;stored&#x20;in&#x20;autorun.inf&#x20;files.&#x20;They&#x20;often&#x20;launch&#x20;the&#x20;installation&#x20;program&#x20;or&#x20;other&#x20;routines.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands.','Prior&#x20;to&#x20;Windows&#x20;Vista,&#x20;when&#x20;media&#x20;containing&#x20;an&#x20;autorun&#x20;command&#x20;is&#x20;inserted,&#x20;the&#x20;system&#x20;will&#x20;automatically&#x20;execute&#x20;the&#x20;program&#x20;without&#x20;user&#x20;intervention.&#x20;This&#x20;creates&#x20;a&#x20;major&#x20;security&#x20;concern&#x20;as&#x20;code&#x20;may&#x20;be&#x20;executed&#x20;without&#x20;user&#039;s&#x20;knowledge.&#x20;The&#x20;default&#x20;behavior&#x20;starting&#x20;with&#x20;Windows&#x20;Vista&#x20;is&#x20;to&#x20;prompt&#x20;the&#x20;user&#x20;whether&#x20;autorun&#x20;command&#x20;is&#x20;to&#x20;be&#x20;run.&#x20;The&#x20;autorun&#x20;command&#x20;is&#x20;represented&#x20;as&#x20;a&#x20;handler&#x20;in&#x20;the&#x20;Autoplay&#x20;dialog.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Do&#x20;not&#x20;execute&#x20;any&#x20;autorun&#x20;commands:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesSet&#x20;the&#x20;default&#x20;behavior&#x20;for&#x20;AutoRun&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.8.2\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27250,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Autoplay&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;All&#x20;drives&#039;.','Autoplay&#x20;starts&#x20;to&#x20;read&#x20;from&#x20;a&#x20;drive&#x20;as&#x20;soon&#x20;as&#x20;you&#x20;insert&#x20;media&#x20;in&#x20;the&#x20;drive,&#x20;which&#x20;causes&#x20;the&#x20;setup&#x20;file&#x20;for&#x20;programs&#x20;or&#x20;audio&#x20;media&#x20;to&#x20;start&#x20;immediately.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;the&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.&#x20;Autoplay&#x20;is&#x20;disabled&#x20;by&#x20;default&#x20;on&#x20;some&#x20;removable&#x20;drive&#x20;types,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives,&#x20;but&#x20;not&#x20;on&#x20;CD-ROM&#x20;drives.&#x20;Note:&#x20;You&#x20;cannot&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enable&#x20;Autoplay&#x20;on&#x20;computer&#x20;drives&#x20;in&#x20;which&#x20;it&#x20;is&#x20;disabled&#x20;by&#x20;default,&#x20;such&#x20;as&#x20;floppy&#x20;disk&#x20;and&#x20;network&#x20;drives.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;All&#x20;drives.','An&#x20;attacker&#x20;could&#x20;use&#x20;this&#x20;feature&#x20;to&#x20;launch&#x20;a&#x20;program&#x20;to&#x20;damage&#x20;a&#x20;client&#x20;computer&#x20;or&#x20;data&#x20;on&#x20;the&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;All&#x20;drives:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsAutoPlay&#x20;PoliciesTurn&#x20;off&#x20;Autoplay&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AutoPlay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.8.3\"]}, {\"cis_csc\": [\"10.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27251,'Ensure&#x20;&#039;Configure&#x20;enhanced&#x20;anti-spoofing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;enhanced&#x20;anti-spoofing&#x20;is&#x20;configured&#x20;for&#x20;devices&#x20;which&#x20;support&#x20;it.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enterprise&#x20;managed&#x20;environments&#x20;are&#x20;now&#x20;supporting&#x20;a&#x20;wider&#x20;range&#x20;of&#x20;mobile&#x20;devices,&#x20;increasing&#x20;the&#x20;security&#x20;on&#x20;these&#x20;devices&#x20;will&#x20;help&#x20;protect&#x20;against&#x20;unauthorized&#x20;access&#x20;on&#x20;your&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsBiometricsFacial&#x20;FeaturesConfigure&#x20;enhanced&#x20;anti-spoofing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Biometrics.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;and&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Use&#x20;enhanced&#x20;anti-spoofing&#x20;when&#x20;available.&#x20;It&#x20;was&#x20;renamed&#x20;to&#x20;Configure&#x20;enhanced&#x20;anti-spoofing&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.10.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27252,'Ensure&#x20;&#039;Allow&#x20;Use&#x20;of&#x20;Camera&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;use&#x20;of&#x20;Camera&#x20;devices&#x20;on&#x20;the&#x20;machine&#x20;are&#x20;permitted.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Cameras&#x20;in&#x20;a&#x20;high&#x20;security&#x20;environment&#x20;can&#x20;pose&#x20;serious&#x20;privacy&#x20;and&#x20;data&#x20;exfiltration&#x20;risks&#x20;-&#x20;they&#x20;should&#x20;be&#x20;disabled&#x20;to&#x20;help&#x20;mitigate&#x20;that&#x20;risk.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCameraAllow&#x20;Use&#x20;of&#x20;Camera&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Camera.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.12.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27253,'Ensure&#x20;&#039;Turn&#x20;off&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;&#x20;&#40;Manual&#41;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#x20;is&#x20;allowed&#x20;in&#x20;all&#x20;Windows&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','The&#x20;use&#x20;of&#x20;consumer&#x20;accounts&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;as&#x20;it&#x20;could&#x20;lead&#x20;to&#x20;possible&#x20;data&#x20;leakage.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;cloud&#x20;consumer&#x20;account&#x20;state&#x20;content&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.1\"]}]'),(27254,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;experiences&#x20;that&#x20;help&#x20;consumers&#x20;make&#x20;the&#x20;most&#x20;of&#x20;their&#x20;devices&#x20;and&#x20;Microsoft&#x20;account.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Per&#x20;Microsoft&#x20;TechNet,&#x20;this&#x20;policy&#x20;setting&#x20;only&#x20;applies&#x20;to&#x20;Windows&#x20;10&#x20;Enterprise&#x20;and&#x20;Windows&#x20;10&#x20;Education&#x20;editions.','Having&#x20;apps&#x20;silently&#x20;install&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;is&#x20;not&#x20;good&#x20;security&#x20;practice&#x20;-&#x20;especially&#x20;if&#x20;the&#x20;apps&#x20;send&#x20;data&#x20;back&#x20;to&#x20;a&#x20;3rd&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCloud&#x20;ContentTurn&#x20;off&#x20;Microsoft&#x20;consumer&#x20;experiences&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CloudContent.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.14.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27255,'Ensure&#x20;&#039;Require&#x20;pin&#x20;for&#x20;pairing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;First&#x20;Time&#039;&#x20;OR&#x20;&#039;Enabled:&#x20;Always&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;PIN&#x20;is&#x20;required&#x20;for&#x20;pairing&#x20;to&#x20;a&#x20;wireless&#x20;display&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;First&#x20;Time&#x20;OR&#x20;Enabled:&#x20;Always.','If&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;configured&#x20;or&#x20;disabled&#x20;then&#x20;a&#x20;PIN&#x20;would&#x20;not&#x20;be&#x20;required&#x20;when&#x20;pairing&#x20;wireless&#x20;display&#x20;devices&#x20;to&#x20;the&#x20;system,&#x20;increasing&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;use.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;First&#x20;Time&#x20;OR&#x20;Enabled:&#x20;Always:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsConnectRequire&#x20;pin&#x20;for&#x20;pairing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WirelessDisplay.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;The&#x20;new&#x20;Choose&#x20;one&#x20;of&#x20;the&#x20;following&#x20;actions&#x20;sub-option&#x20;was&#x20;later&#x20;added&#x20;as&#x20;of&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;Administrative&#x20;Templates.&#x20;Choosing&#x20;Enabled&#x20;in&#x20;the&#x20;older&#x20;templates&#x20;is&#x20;the&#x20;equivalent&#x20;of&#x20;choosing&#x20;Enabled:&#x20;First&#x20;Time&#x20;in&#x20;the&#x20;newer&#x20;templates.','[{\"cis\": [\"18.9.15.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27256,'Ensure&#x20;&#039;Do&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;display&#x20;of&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;in&#x20;password&#x20;entry&#x20;user&#x20;experiences.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;is&#x20;a&#x20;useful&#x20;feature&#x20;when&#x20;entering&#x20;a&#x20;long&#x20;and&#x20;complex&#x20;password,&#x20;especially&#x20;when&#x20;using&#x20;a&#x20;touchscreen.&#x20;The&#x20;potential&#x20;risk&#x20;is&#x20;that&#x20;someone&#x20;else&#x20;may&#x20;see&#x20;your&#x20;password&#x20;while&#x20;surreptitiously&#x20;observing&#x20;your&#x20;screen.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceDo&#x20;not&#x20;display&#x20;the&#x20;password&#x20;reveal&#x20;button&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.16.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27257,'Ensure&#x20;&#039;Enumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;administrator&#x20;accounts&#x20;are&#x20;displayed&#x20;when&#x20;a&#x20;user&#x20;attempts&#x20;to&#x20;elevate&#x20;a&#x20;running&#x20;application.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;could&#x20;see&#x20;the&#x20;list&#x20;of&#x20;administrator&#x20;accounts,&#x20;making&#x20;it&#x20;slightly&#x20;easier&#x20;for&#x20;a&#x20;malicious&#x20;user&#x20;who&#x20;has&#x20;logged&#x20;onto&#x20;a&#x20;console&#x20;session&#x20;to&#x20;try&#x20;to&#x20;crack&#x20;the&#x20;passwords&#x20;of&#x20;those&#x20;accounts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsCredential&#x20;User&#x20;InterfaceEnumerate&#x20;administrator&#x20;accounts&#x20;on&#x20;elevation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;CredUI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.16.2\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27258,'Ensure&#x20;&#039;Allow&#x20;Diagnostic&#x20;Data&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#039;&#x20;or&#x20;&#039;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data','This&#x20;policy&#x20;setting&#x20;determines&#x20;the&#x20;amount&#x20;of&#x20;diagnostic&#x20;and&#x20;usage&#x20;data&#x20;reported&#x20;to&#x20;Microsoft:&#x20;&#x20;-&#x20;&#x20;A&#x20;value&#x20;of&#x20;&#40;0&#41;&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;.&#x20;Using&#x20;this&#x20;value,&#x20;no&#x20;&#x20;diagnostic&#x20;data&#x20;is&#x20;sent&#x20;from&#x20;the&#x20;device.&#x20;This&#x20;value&#x20;is&#x20;only&#x20;supported&#x20;on&#x20;Enterprise,&#x20;&#x20;Education,&#x20;and&#x20;Server&#x20;editions.&#x20;If&#x20;you&#x20;choose&#x20;this&#x20;setting,&#x20;devices&#x20;in&#x20;your&#x20;&#x20;organization&#x20;will&#x20;still&#x20;be&#x20;secure.&#x20;&#x20;-&#x20;&#x20;A&#x20;value&#x20;of&#x20;&#40;1&#41;&#x20;Send&#x20;required&#x20;diagnostic&#x20;data.&#x20;This&#x20;is&#x20;the&#x20;minimum&#x20;diagnostic&#x20;&#x20;data&#x20;necessary&#x20;to&#x20;keep&#x20;Windows&#x20;secure,&#x20;up&#x20;to&#x20;date,&#x20;and&#x20;performing&#x20;as&#x20;&#x20;expected.&#x20;Using&#x20;this&#x20;value&#x20;disables&#x20;the&#x20;Optional&#x20;diagnostic&#x20;data&#x20;control&#x20;in&#x20;the&#x20;&#x20;Settings&#x20;app.&#x20;&#x20;-&#x20;&#x20;A&#x20;value&#x20;of&#x20;&#40;3&#41;Send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Additional&#x20;diagnostic&#x20;data&#x20;is&#x20;&#x20;collected&#x20;that&#x20;helps&#x20;us&#x20;to&#x20;detect,&#x20;diagnose&#x20;and&#x20;fix&#x20;issues,&#x20;as&#x20;well&#x20;as&#x20;make&#x20;product&#x20;&#x20;improvements.&#x20;Required&#x20;diagnostic&#x20;data&#x20;will&#x20;always&#x20;be&#x20;included&#x20;when&#x20;you&#x20;choose&#x20;&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Optional&#x20;diagnostic&#x20;data&#x20;can&#x20;also&#x20;include&#x20;&#x20;diagnostic&#x20;log&#x20;files&#x20;and&#x20;crash&#x20;dumps.&#x20;Use&#x20;the&#x20;Limit&#x20;Dump&#x20;Collection&#x20;and&#x20;the&#x20;Limit&#x20;&#x20;Diagnostic&#x20;Log&#x20;Collection&#x20;policies&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;of&#x20;what&#x20;optional&#x20;&#x20;diagnostic&#x20;data&#x20;is&#x20;sent.&#x20;Windows&#x20;telemetry&#x20;settings&#x20;apply&#x20;to&#x20;the&#x20;Windows&#x20;operating&#x20;system&#x20;and&#x20;some&#x20;first&#x20;party&#x20;apps.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;third&#x20;party&#x20;apps&#x20;running&#x20;on&#x20;Windows&#x20;10/11.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data.&#x20;Note:&#x20;If&#x20;your&#x20;organization&#x20;relies&#x20;on&#x20;Windows&#x20;Update,&#x20;the&#x20;minimum&#x20;recommended&#x20;setting&#x20;is&#x20;Required&#x20;diagnostic&#x20;data.&#x20;Because&#x20;no&#x20;Windows&#x20;Update&#x20;information&#x20;is&#x20;collected&#x20;when&#x20;diagnostic&#x20;data&#x20;is&#x20;off,&#x20;important&#x20;information&#x20;about&#x20;update&#x20;failures&#x20;is&#x20;not&#x20;sent.&#x20;Microsoft&#x20;uses&#x20;this&#x20;information&#x20;to&#x20;fix&#x20;the&#x20;causes&#x20;of&#x20;those&#x20;failures&#x20;and&#x20;improve&#x20;the&#x20;quality&#x20;of&#x20;updates.&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;Note&#x20;#2:&#x20;The&#x20;Configure&#x20;diagnostic&#x20;data&#x20;opt-in&#x20;settings&#x20;user&#x20;interface&#x20;group&#x20;policy&#x20;can&#x20;be&#x20;used&#x20;to&#x20;prevent&#x20;end&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;data&#x20;collection&#x20;settings.&#x20;Note&#x20;#3:&#x20;Enhanced&#x20;diagnostic&#x20;data&#x20;setting&#x20;is&#x20;not&#x20;available&#x20;on&#x20;Windows&#x20;11&#x20;and&#x20;Windows&#x20;Server&#x20;2022&#x20;and&#x20;has&#x20;been&#x20;replaced&#x20;with&#x20;policies&#x20;that&#x20;can&#x20;control&#x20;the&#x20;amount&#x20;of&#x20;optional&#x20;diagnostic&#x20;data&#x20;that&#x20;is&#x20;sent.&#x20;For&#x20;more&#x20;information&#x20;on&#x20;these&#x20;settings&#x20;visit&#x20;Manage&#x20;diagnostic&#x20;data&#x20;using&#x20;Group&#x20;Policy&#x20;and&#x20;MDM','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsAllow&#x20;Diagnostic&#x20;Data&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;11&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;Telemetry,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;11&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.17.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27259,'Ensure&#x20;&#039;Configure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Pr','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;can&#x20;automatically&#x20;use&#x20;an&#x20;authenticated&#x20;proxy&#x20;to&#x20;send&#x20;data&#x20;back&#x20;to&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage.','Sending&#x20;any&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Authenticated&#x20;Proxy&#x20;usage:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsConfigure&#x20;Authenticated&#x20;Proxy&#x20;usage&#x20;for&#x20;the&#x20;Connected&#x20;User&#x20;Experience&#x20;and&#x20;Telemetry&#x20;service&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.2\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27260,'Ensure&#x20;&#039;Disable&#x20;OneSettings&#x20;Downloads&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;attempts&#x20;to&#x20;connect&#x20;with&#x20;the&#x20;OneSettings&#x20;service&#x20;to&#x20;download&#x20;configuration&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as-&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDisable&#x20;OneSettings&#x20;Downloads&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.3\"]}]'),(27261,'Ensure&#x20;&#039;Do&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;an&#x20;organization&#x20;to&#x20;prevent&#x20;its&#x20;devices&#x20;from&#x20;showing&#x20;feedback&#x20;questions&#x20;from&#x20;Microsoft.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;should&#x20;not&#x20;be&#x20;sending&#x20;any&#x20;feedback&#x20;to&#x20;3rd&#x20;party&#x20;vendors&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsDo&#x20;not&#x20;show&#x20;feedback&#x20;notifications&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;FeedbackNotifications.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1511&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.4\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27262,'Ensure&#x20;&#039;Enable&#x20;OneSettings&#x20;Auditing&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Windows&#x20;records&#x20;attempts&#x20;to&#x20;connect&#x20;with&#x20;the&#x20;OneSettings&#x20;service&#x20;to&#x20;the&#x20;Operational&#x20;EventLog.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsEnable&#x20;OneSettings&#x20;Auditing&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.5\"]}, {\"cis_csc\": [\"8.5\"]}]'),(27263,'Ensure&#x20;&#039;Limit&#x20;Diagnostic&#x20;Log&#x20;Collection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;additional&#x20;diagnostic&#x20;logs&#x20;are&#x20;collected&#x20;when&#x20;more&#x20;information&#x20;is&#x20;needed&#x20;to&#x20;troubleshoot&#x20;a&#x20;problem&#x20;on&#x20;the&#x20;device.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Diagnostic&#x20;logs&#x20;are&#x20;only&#x20;sent&#x20;when&#x20;the&#x20;device&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Diagnostic&#x20;data&#x20;is&#x20;limited&#x20;with&#x20;recommendation&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;is&#x20;set&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data&#x20;to&#x20;send&#x20;only&#x20;basic&#x20;information.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd-party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as-&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsLimit&#x20;Diagnostic&#x20;Log&#x20;Collection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.6\"]}]'),(27264,'Ensure&#x20;&#039;Limit&#x20;Dump&#x20;Collection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;limits&#x20;the&#x20;type&#x20;of&#x20;dumps&#x20;that&#x20;can&#x20;be&#x20;collected&#x20;when&#x20;more&#x20;information&#x20;is&#x20;needed&#x20;to&#x20;troubleshoot&#x20;a&#x20;problem.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;Dumps&#x20;are&#x20;only&#x20;sent&#x20;when&#x20;the&#x20;device&#x20;has&#x20;been&#x20;configured&#x20;to&#x20;send&#x20;optional&#x20;diagnostic&#x20;data.&#x20;Diagnostic&#x20;data&#x20;is&#x20;limited&#x20;with&#x20;recommendation&#x20;Ensure&#x20;Allow&#x20;Diagnostic&#x20;Data&#x20;is&#x20;set&#x20;to&#x20;Enabled:&#x20;Diagnostic&#x20;data&#x20;off&#x20;&#40;not&#x20;recommended&#41;&#x20;or&#x20;Enabled:&#x20;Send&#x20;required&#x20;diagnostic&#x20;data&#x20;to&#x20;send&#x20;only&#x20;basic&#x20;information.','Sending&#x20;data&#x20;to&#x20;a&#x20;3rd&#x20;party&#x20;vendor&#x20;is&#x20;a&#x20;security&#x20;concern&#x20;and&#x20;should&#x20;only&#x20;be&#x20;done&#x20;on&#x20;an&#x20;as&#x20;needed&#x20;basis.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled.&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsLimit&#x20;Dump&#x20;Collection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;DataCollection.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.7\"]}]'),(27265,'Ensure&#x20;&#039;Toggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;users&#x20;can&#x20;access&#x20;the&#x20;Insider&#x20;build&#x20;controls&#x20;in&#x20;the&#x20;Advanced&#x20;Options&#x20;for&#x20;Windows&#x20;Update.&#x20;These&#x20;controls&#x20;are&#x20;located&#x20;under&#x20;&quot;Get&#x20;Insider&#x20;builds,&quot;&#x20;and&#x20;enable&#x20;users&#x20;to&#x20;make&#x20;their&#x20;devices&#x20;available&#x20;for&#x20;downloading&#x20;and&#x20;installing&#x20;Windows&#x20;preview&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;policy&#x20;setting&#x20;applies&#x20;only&#x20;to&#x20;devices&#x20;running&#x20;Windows&#x20;Server&#x20;2016,&#x20;up&#x20;until&#x20;Release&#x20;1703.&#x20;For&#x20;Release&#x20;1709&#x20;or&#x20;newer,&#x20;Microsoft&#x20;encourages&#x20;using&#x20;the&#x20;Manage&#x20;preview&#x20;builds&#x20;setting&#x20;&#40;recommendation&#x20;title&#x20;&#039;Manage&#x20;preview&#x20;builds&#039;&#41;.&#x20;We&#x20;have&#x20;kept&#x20;this&#x20;setting&#x20;in&#x20;the&#x20;benchmark&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;older&#x20;builds&#x20;of&#x20;Windows&#x20;Server&#x20;2016&#x20;in&#x20;the&#x20;environment&#x20;are&#x20;still&#x20;enforced.','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsData&#x20;Collection&#x20;and&#x20;Preview&#x20;BuildsToggle&#x20;user&#x20;control&#x20;over&#x20;Insider&#x20;builds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AllowBuildPreview.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.17.8\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27266,'Ensure&#x20;&#039;Application:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.1.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27267,'Ensure&#x20;&#039;Application:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceApplicationSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.1.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27268,'Ensure&#x20;&#039;Security:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecurityControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.2.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27269,'Ensure&#x20;&#039;Security:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;196,608&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;196,608&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSecuritySpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.2.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27270,'Ensure&#x20;&#039;Setup:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.3.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27271,'Ensure&#x20;&#039;Setup:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSetupSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.3.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27272,'Ensure&#x20;&#039;System:&#x20;Control&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Old&#x20;events&#x20;may&#x20;or&#x20;may&#x20;not&#x20;be&#x20;retained&#x20;according&#x20;to&#x20;the&#x20;Backup&#x20;log&#x20;automatically&#x20;when&#x20;full&#x20;policy&#x20;setting.','If&#x20;new&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemControl&#x20;Event&#x20;Log&#x20;behavior&#x20;when&#x20;the&#x20;log&#x20;file&#x20;reaches&#x20;its&#x20;maximum&#x20;size&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Retain&#x20;old&#x20;events,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.4.1\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27273,'Ensure&#x20;&#039;System:&#x20;Specify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;32,768&#x20;or&#x20;greater&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;log&#x20;file&#x20;in&#x20;kilobytes.&#x20;The&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;can&#x20;be&#x20;configured&#x20;between&#x20;1&#x20;megabyte&#x20;&#40;1,024&#x20;kilobytes&#41;&#x20;and&#x20;4&#x20;terabytes&#x20;&#40;4,194,240&#x20;kilobytes&#41;&#x20;in&#x20;kilobyte&#x20;increments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater.','If&#x20;events&#x20;are&#x20;not&#x20;recorded&#x20;it&#x20;may&#x20;be&#x20;difficult&#x20;or&#x20;impossible&#x20;to&#x20;determine&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;system&#x20;problems&#x20;or&#x20;the&#x20;unauthorized&#x20;activities&#x20;of&#x20;malicious&#x20;users','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;32,768&#x20;or&#x20;greater:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsEvent&#x20;Log&#x20;ServiceSystemSpecify&#x20;the&#x20;maximum&#x20;log&#x20;file&#x20;size&#x20;&#40;KB&#41;&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;EventLog.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Maximum&#x20;Log&#x20;Size&#x20;&#40;KB&#41;,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.27.4.2\"]}, {\"cis_csc\": [\"8.3\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27274,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Disabling&#x20;Data&#x20;Execution&#x20;Prevention&#x20;can&#x20;allow&#x20;certain&#x20;legacy&#x20;plug-in&#x20;applications&#x20;to&#x20;function&#x20;without&#x20;terminating&#x20;Explorer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Some&#x20;legacy&#x20;plug-in&#x20;applications&#x20;and&#x20;other&#x20;software&#x20;may&#x20;not&#x20;function&#x20;with&#x20;Data&#x20;Execution&#x20;Prevention&#x20;and&#x20;will&#x20;require&#x20;an&#x20;exception&#x20;to&#x20;be&#x20;defined&#x20;for&#x20;that&#x20;specific&#x20;plug-&#x20;in/software.','Data&#x20;Execution&#x20;Prevention&#x20;is&#x20;an&#x20;important&#x20;security&#x20;feature&#x20;supported&#x20;by&#x20;Explorer&#x20;that&#x20;helps&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;of&#x20;certain&#x20;types&#x20;of&#x20;malware.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;Data&#x20;Execution&#x20;Prevention&#x20;for&#x20;Explorer&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.31.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"10.6.1\"]}, {\"nist_800_53\": [\"AU.6\"]}, {\"gpg13\": [\"4.12\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC6.1\", \"CC6.8\", \"CC7.2\", \"CC7.3\"]}]'),(27275,'Ensure&#x20;&#039;Turn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','Without&#x20;heap&#x20;termination&#x20;on&#x20;corruption,&#x20;legacy&#x20;plug-in&#x20;applications&#x20;may&#x20;continue&#x20;to&#x20;function&#x20;when&#x20;a&#x20;File&#x20;Explorer&#x20;session&#x20;has&#x20;become&#x20;corrupt.&#x20;Ensuring&#x20;that&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#x20;is&#x20;active&#x20;will&#x20;prevent&#x20;this.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Allowing&#x20;an&#x20;application&#x20;to&#x20;function&#x20;after&#x20;its&#x20;session&#x20;has&#x20;become&#x20;corrupt&#x20;increases&#x20;the&#x20;risk&#x20;posture&#x20;to&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;heap&#x20;termination&#x20;on&#x20;corruption&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Explorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.31.3\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27276,'Ensure&#x20;&#039;Turn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;the&#x20;amount&#x20;of&#x20;functionality&#x20;that&#x20;the&#x20;shell&#x20;protocol&#x20;can&#x20;have.&#x20;When&#x20;using&#x20;the&#x20;full&#x20;functionality&#x20;of&#x20;this&#x20;protocol,&#x20;applications&#x20;can&#x20;open&#x20;folders&#x20;and&#x20;launch&#x20;files.&#x20;The&#x20;protected&#x20;mode&#x20;reduces&#x20;the&#x20;functionality&#x20;of&#x20;this&#x20;protocol&#x20;allowing&#x20;applications&#x20;to&#x20;only&#x20;open&#x20;a&#x20;limited&#x20;set&#x20;of&#x20;folders.&#x20;Applications&#x20;are&#x20;not&#x20;able&#x20;to&#x20;open&#x20;files&#x20;with&#x20;this&#x20;protocol&#x20;when&#x20;it&#x20;is&#x20;in&#x20;the&#x20;protected&#x20;mode.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;leave&#x20;this&#x20;protocol&#x20;in&#x20;the&#x20;protected&#x20;mode&#x20;to&#x20;increase&#x20;the&#x20;security&#x20;of&#x20;Windows.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Limiting&#x20;the&#x20;opening&#x20;of&#x20;files&#x20;and&#x20;folders&#x20;to&#x20;a&#x20;limited&#x20;set&#x20;reduces&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsFile&#x20;ExplorerTurn&#x20;off&#x20;shell&#x20;protocol&#x20;protected&#x20;mode&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.31.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27277,'Ensure&#x20;&#039;Turn&#x20;off&#x20;location&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;the&#x20;location&#x20;feature&#x20;for&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;affects&#x20;the&#x20;location&#x20;feature&#x20;&#40;e.g.&#x20;GPS&#x20;or&#x20;other&#x20;location&#x20;tracking&#41;.&#x20;From&#x20;a&#x20;security&#x20;perspective,&#x20;it&rsquo;s&#x20;not&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;reveal&#x20;your&#x20;location&#x20;to&#x20;software&#x20;in&#x20;most&#x20;cases,&#x20;but&#x20;there&#x20;are&#x20;legitimate&#x20;uses,&#x20;such&#x20;as&#x20;mapping&#x20;software.&#x20;However,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;used&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsLocation&#x20;and&#x20;SensorsTurn&#x20;off&#x20;location&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Sensors.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.41.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27278,'Ensure&#x20;&#039;Allow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;backup&#x20;and&#x20;restore&#x20;of&#x20;cellular&#x20;text&#x20;messages&#x20;to&#x20;Microsoft&#039;s&#x20;cloud&#x20;services.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;a&#x20;high&#x20;security&#x20;environment,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMessagingAllow&#x20;Message&#x20;Service&#x20;Cloud&#x20;Sync&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Messaging.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.45.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27279,'Ensure&#x20;&#039;Block&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;applications&#x20;and&#x20;services&#x20;on&#x20;the&#x20;device&#x20;can&#x20;utilize&#x20;new&#x20;consumer&#x20;Microsoft&#x20;account&#x20;authentication&#x20;via&#x20;the&#x20;Windows&#x20;OnlineID&#x20;and&#x20;WebAccountManager&#x20;APIs.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Organizations&#x20;that&#x20;want&#x20;to&#x20;effectively&#x20;implement&#x20;identity&#x20;management&#x20;policies&#x20;and&#x20;maintain&#x20;firm&#x20;control&#x20;of&#x20;what&#x20;accounts&#x20;are&#x20;used&#x20;on&#x20;their&#x20;computers&#x20;will&#x20;probably&#x20;want&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts.&#x20;Organizations&#x20;may&#x20;also&#x20;need&#x20;to&#x20;block&#x20;Microsoft&#x20;accounts&#x20;in&#x20;order&#x20;to&#x20;meet&#x20;the&#x20;requirements&#x20;of&#x20;compliance&#x20;standards&#x20;that&#x20;apply&#x20;to&#x20;their&#x20;information&#x20;systems.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;accountsBlock&#x20;all&#x20;consumer&#x20;Microsoft&#x20;account&#x20;user&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSAPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.46.1\"]}, {\"cis_csc\": [\"5.3\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27280,'Ensure&#x20;&#039;Configure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;a&#x20;local&#x20;override&#x20;for&#x20;the&#x20;configuration&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;&quot;Microsft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&quot;.&#x20;This&#x20;setting&#x20;can&#x20;only&#x20;be&#x20;set&#x20;by&#x20;Group&#x20;Policy.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;decision&#x20;on&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;participate&#x20;in&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;for&#x20;malicious&#x20;software&#x20;reporting&#x20;should&#x20;be&#x20;made&#x20;centrally&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;so&#x20;that&#x20;all&#x20;computers&#x20;within&#x20;it&#x20;behave&#x20;consistently&#x20;in&#x20;that&#x20;regard.&#x20;Configuring&#x20;this&#x20;setting&#x20;to&#x20;Disabled&#x20;ensures&#x20;that&#x20;the&#x20;decision&#x20;remains&#x20;centrally&#x20;managed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMAPSConfigure&#x20;local&#x20;setting&#x20;override&#x20;for&#x20;reporting&#x20;to&#x20;Microsoft&#x20;MAPS&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.4.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27281,'Ensure&#x20;&#039;Join&#x20;Microsoft&#x20;MAPS&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;join&#x20;Microsoft&#x20;Active&#x20;Protection&#x20;Service&#x20;&#40;MAPS&#41;,&#x20;which&#x20;Microsoft&#x20;has&#x20;now&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;and&#x20;then&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service.&#x20;Microsoft&#x20;MAPS&#x20;/&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;Cloud&#x20;Protection&#x20;Service&#x20;is&#x20;the&#x20;online&#x20;community&#x20;that&#x20;helps&#x20;you&#x20;choose&#x20;how&#x20;to&#x20;respond&#x20;to&#x20;potential&#x20;threats.&#x20;The&#x20;community&#x20;also&#x20;helps&#x20;stop&#x20;the&#x20;spread&#x20;of&#x20;new&#x20;malicious&#x20;software&#x20;infections.&#x20;You&#x20;can&#x20;choose&#x20;to&#x20;send&#x20;basic&#x20;or&#x20;additional&#x20;information&#x20;about&#x20;detected&#x20;software.&#x20;Additional&#x20;information&#x20;helps&#x20;Microsoft&#x20;create&#x20;new&#x20;definitions&#x20;and&#x20;help&#x20;it&#x20;to&#x20;protect&#x20;your&#x20;computer.&#x20;Possible&#x20;options&#x20;are:&#x20;&#x20;-&#x20;&#x20;&#40;0x0&#41;&#x20;Disabled&#x20;&#40;default&#41;&#x20;&#x20;-&#x20;&#x20;&#40;0x1&#41;&#x20;Basic&#x20;membership&#x20;&#x20;-&#x20;&#x20;&#40;0x2&#41;&#x20;Advanced&#x20;membership&#x20;Basic&#x20;membership&#x20;will&#x20;send&#x20;basic&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;software&#x20;that&#x20;has&#x20;been&#x20;detected&#x20;including&#x20;where&#x20;the&#x20;software&#x20;came&#x20;from&#x20;the&#x20;actions&#x20;that&#x20;you&#x20;apply&#x20;or&#x20;that&#x20;are&#x20;applied&#x20;automatically&#x20;and&#x20;whether&#x20;the&#x20;actions&#x20;were&#x20;successful.&#x20;Advanced&#x20;membership&#x20;in&#x20;addition&#x20;to&#x20;basic&#x20;information&#x20;will&#x20;send&#x20;more&#x20;information&#x20;to&#x20;Microsoft&#x20;about&#x20;malicious&#x20;software&#x20;spyware&#x20;and&#x20;potentially&#x20;unwanted&#x20;software&#x20;including&#x20;the&#x20;location&#x20;of&#x20;the&#x20;software&#x20;file&#x20;names&#x20;how&#x20;the&#x20;software&#x20;operates&#x20;and&#x20;how&#x20;it&#x20;has&#x20;impacted&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','The&#x20;information&#x20;that&#x20;would&#x20;be&#x20;sent&#x20;can&#x20;include&#x20;things&#x20;like&#x20;location&#x20;of&#x20;detected&#x20;items&#x20;on&#x20;your&#x20;computer&#x20;if&#x20;harmful&#x20;software&#x20;was&#x20;removed.&#x20;The&#x20;information&#x20;would&#x20;be&#x20;automatically&#x20;collected&#x20;and&#x20;sent.&#x20;In&#x20;some&#x20;instances&#x20;personal&#x20;information&#x20;might&#x20;unintentionally&#x20;be&#x20;sent&#x20;to&#x20;Microsoft.&#x20;However,&#x20;Microsoft&#x20;states&#x20;that&#x20;it&#x20;will&#x20;not&#x20;use&#x20;this&#x20;information&#x20;to&#x20;identify&#x20;you&#x20;or&#x20;contact&#x20;you.&#x20;For&#x20;privacy&#x20;reasons&#x20;in&#x20;high&#x20;security&#x20;environments,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;prevent&#x20;these&#x20;data&#x20;submissions&#x20;altogether.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMAPSJoin&#x20;Microsoft&#x20;MAPS&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.4.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27282,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;state&#x20;for&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;&#40;ASR&#41;&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-&#x20;seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27283,'Ensure&#x20;&#039;Configure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules:&#x20;Set&#x20;the&#x20;state&#x20;for&#x20;each&#x20;ASR&#x20;rule&#039;&#x20;is&#x20;configured.','This&#x20;policy&#x20;setting&#x20;sets&#x20;the&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;26190899-1602-49e8-8b27-eb1d0a1ce869&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;communication&#x20;application&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;3b576869-a4ec-4529-8536-b80a7769e899&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;creating&#x20;executable&#x20;content&#41;&#x20;5beb7efe-fd9a-4556-801d-275e5ffc04cc&#x20;-&#x20;1&#x20;&#40;Block&#x20;execution&#x20;of&#x20;potentially&#x20;obfuscated&#x20;scripts&#41;&#x20;75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;injecting&#x20;code&#x20;into&#x20;other&#x20;processes&#41;&#x20;7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c&#x20;-&#x20;1&#x20;&#40;Block&#x20;Adobe&#x20;Reader&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b&#x20;-&#x20;1&#x20;&#40;Block&#x20;Win32&#x20;API&#x20;calls&#x20;from&#x20;Office&#x20;macro&#41;&#x20;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2&#x20;-&#x20;1&#x20;&#40;Block&#x20;credential&#x20;stealing&#x20;from&#x20;the&#x20;Windows&#x20;local&#x20;security&#x20;authority&#x20;subsystem&#x20;&#40;lsass.exe&#41;&#41;&#x20;b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4&#x20;-&#x20;1&#x20;&#40;Block&#x20;untrusted&#x20;and&#x20;unsigned&#x20;processes&#x20;that&#x20;run&#x20;from&#x20;USB&#41;&#x20;be9ba2d9-53ea-4cdc-84e5-9b1eeee46550&#x20;-&#x20;1&#x20;&#40;Block&#x20;executable&#x20;content&#x20;from&#x20;email&#x20;client&#x20;and&#x20;webmail&#41;&#x20;d3e037e1-3eb8-44c8-a917-57927947596d&#x20;-&#x20;1&#x20;&#40;Block&#x20;JavaScript&#x20;or&#x20;VBScript&#x20;from&#x20;launching&#x20;downloaded&#x20;executable&#x20;content&#41;&#x20;d4f940ab-401b-4efc-aadc-ad5f3c50688a&#x20;-&#x20;1&#x20;&#40;Block&#x20;Office&#x20;applications&#x20;from&#x20;creating&#x20;child&#x20;processes&#41;&#x20;e6db77e5-3df2-4cf1-b95a-636979351e5b&#x20;-&#x20;1&#x20;&#40;Block&#x20;persistence&#x20;through&#x20;WMI&#x20;event&#x20;subscription&#41;','Attack&#x20;surface&#x20;reduction&#x20;helps&#x20;prevent&#x20;actions&#x20;and&#x20;apps&#x20;that&#x20;are&#x20;typically&#x20;used&#x20;by&#x20;exploit-&#x20;seeking&#x20;malware&#x20;to&#x20;infect&#x20;machines.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;so&#x20;that&#x20;26190899-1602-49e8-8b27-eb1d0a1ce869,&#x20;3b576869-a4ec-4529-8536-b80a7769e899,&#x20;5beb7efe-fd9a-4556-801d-275e5ffc04cc,&#x20;75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84,&#x20;7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c,&#x20;92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b,&#x20;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2,&#x20;b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4,&#x20;be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,&#x20;d3e037e1-3eb8-44c8-a917-57927947596d,&#x20;d4f940ab-401b-4efc-aadc-ad5f3c50688a,&#x20;and&#x20;e6db77e5-3df2-4cf1-b95a-636979351e5b&#x20;are&#x20;each&#x20;set&#x20;to&#x20;a&#x20;value&#x20;of&#x20;1:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardAttack&#x20;Surface&#x20;ReductionConfigure&#x20;Attack&#x20;Surface&#x20;Reduction&#x20;rules:&#x20;Set&#x20;the&#x20;state&#x20;for&#x20;each&#x20;ASR&#x20;rule&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.1.2\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27284,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;Microsoft&#x20;Defender&#x20;Exploit&#x20;Guard&#x20;network&#x20;protection.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block.','This&#x20;setting&#x20;can&#x20;help&#x20;prevent&#x20;employees&#x20;from&#x20;using&#x20;any&#x20;application&#x20;to&#x20;access&#x20;dangerous&#x20;domains&#x20;that&#x20;may&#x20;host&#x20;phishing&#x20;scams,&#x20;exploit-hosting&#x20;sites,&#x20;and&#x20;other&#x20;malicious&#x20;content&#x20;on&#x20;the&#x20;Internet.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMicrosoft&#x20;Defender&#x20;Exploit&#x20;GuardNetwork&#x20;ProtectionPrevent&#x20;users&#x20;and&#x20;apps&#x20;from&#x20;accessing&#x20;dangerous&#x20;websites&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.5.3.1\"]}, {\"cis_csc\": [\"9.3\", \"10.5\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27285,'Ensure&#x20;&#039;Enable&#x20;file&#x20;hash&#x20;computation&#x20;feature&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;setting&#x20;determines&#x20;whether&#x20;hash&#x20;values&#x20;are&#x20;computed&#x20;for&#x20;files&#x20;scanned&#x20;by&#x20;Microsoft&#x20;Defender.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;monitor&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.&#x20;File&#x20;hashes&#x20;are&#x20;a&#x20;reliable&#x20;way&#x20;of&#x20;detecting&#x20;changes&#x20;to&#x20;files,&#x20;and&#x20;can&#x20;speed&#x20;up&#x20;the&#x20;scan&#x20;process&#x20;by&#x20;skipping&#x20;files&#x20;that&#x20;have&#x20;not&#x20;changed&#x20;since&#x20;they&#x20;were&#x20;last&#x20;scanned&#x20;and&#x20;determined&#x20;to&#x20;be&#x20;safe.&#x20;A&#x20;changed&#x20;file&#x20;hash&#x20;can&#x20;also&#x20;be&#x20;cause&#x20;for&#x20;additional&#x20;scrutiny.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusMpEngineEnable&#x20;file&#x20;hash&#x20;computation&#x20;feature&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.6.1\"]}, {\"cis_csc\": [\"10.1\"]}]'),(27286,'Ensure&#x20;&#039;Scan&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;scanning&#x20;for&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionScan&#x20;all&#x20;downloaded&#x20;files&#x20;and&#x20;attachments&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.1\"]}]'),(27287,'Ensure&#x20;&#039;Turn&#x20;off&#x20;real-time&#x20;protection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;configures&#x20;real-time&#x20;protection&#x20;prompts&#x20;for&#x20;known&#x20;malware&#x20;detection.&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;alerts&#x20;you&#x20;when&#x20;malware&#x20;or&#x20;potentially&#x20;unwanted&#x20;software&#x20;attempts&#x20;to&#x20;install&#x20;itself&#x20;or&#x20;to&#x20;run&#x20;on&#x20;your&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;off&#x20;real-&#x20;time&#x20;protection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.2\"]}]'),(27288,'Ensure&#x20;&#039;Turn&#x20;on&#x20;behavior&#x20;monitoring&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;behavior&#x20;monitoring&#x20;for&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;behavior&#x20;monitoring&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.3\"]}, {\"cis_csc\": [\"10.7\"]}]'),(27289,'Ensure&#x20;&#039;Turn&#x20;on&#x20;script&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;script&#x20;scanning&#x20;to&#x20;be&#x20;turned&#x20;on/off.&#x20;Script&#x20;scanning&#x20;intercepts&#x20;scripts&#x20;then&#x20;scans&#x20;them&#x20;before&#x20;they&#x20;are&#x20;executed&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','When&#x20;running&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;it&#x20;is&#x20;configured&#x20;to&#x20;heuristically&#x20;monitor&#x20;in&#x20;real-time&#x20;for&#x20;suspicious&#x20;and&#x20;known&#x20;malicious&#x20;activity.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReal-Time&#x20;ProtectionTurn&#x20;on&#x20;script&#x20;scanning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.9.4\"]}, {\"cis_csc\": [\"10.7\"]}]'),(27290,'Ensure&#x20;&#039;Configure&#x20;Watson&#x20;events&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;whether&#x20;or&#x20;not&#x20;Watson&#x20;events&#x20;are&#x20;sent.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Watson&#x20;events&#x20;are&#x20;the&#x20;reports&#x20;that&#x20;get&#x20;sent&#x20;to&#x20;Microsoft&#x20;when&#x20;a&#x20;program&#x20;or&#x20;service&#x20;crashes&#x20;or&#x20;fails,&#x20;including&#x20;the&#x20;possibility&#x20;of&#x20;automatic&#x20;submission.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusReportingConfigure&#x20;Watson&#x20;events&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.11.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27291,'Ensure&#x20;&#039;Scan&#x20;removable&#x20;drives&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;or&#x20;not&#x20;to&#x20;scan&#x20;for&#x20;malicious&#x20;software&#x20;and&#x20;unwanted&#x20;software&#x20;in&#x20;the&#x20;contents&#x20;of&#x20;removable&#x20;drives,&#x20;such&#x20;as&#x20;USB&#x20;flash&#x20;drives,&#x20;when&#x20;running&#x20;a&#x20;full&#x20;scan.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;present&#x20;removable&#x20;drives&#x20;are&#x20;always&#x20;included&#x20;in&#x20;any&#x20;type&#x20;of&#x20;scan,&#x20;as&#x20;removable&#x20;drives&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;contain&#x20;malicious&#x20;software&#x20;brought&#x20;in&#x20;to&#x20;the&#x20;enterprise&#x20;managed&#x20;environment&#x20;from&#x20;an&#x20;external,&#x20;unmanaged&#x20;computer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusScanScan&#x20;removable&#x20;drives&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.12.1\"]}, {\"cis_csc\": [\"10.4\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27292,'Ensure&#x20;&#039;Turn&#x20;on&#x20;e-mail&#x20;scanning&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;e-mail&#x20;scanning.&#x20;When&#x20;e-mail&#x20;scanning&#x20;is&#x20;enabled,&#x20;the&#x20;engine&#x20;will&#x20;parse&#x20;the&#x20;mailbox&#x20;and&#x20;mail&#x20;files,&#x20;according&#x20;to&#x20;their&#x20;specific&#x20;format,&#x20;in&#x20;order&#x20;to&#x20;analyze&#x20;the&#x20;mail&#x20;bodies&#x20;and&#x20;attachments.&#x20;Several&#x20;e-mail&#x20;formats&#x20;are&#x20;currently&#x20;supported,&#x20;for&#x20;example:&#x20;pst&#x20;&#40;Outlook&#41;,&#x20;dbx,&#x20;mbx,&#x20;mime&#x20;&#40;Outlook&#x20;Express&#41;,&#x20;binhex&#x20;&#40;Mac&#41;.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Incoming&#x20;e-mails&#x20;should&#x20;be&#x20;scanned&#x20;by&#x20;an&#x20;antivirus&#x20;solution&#x20;such&#x20;as&#x20;Microsoft&#x20;Defender&#x20;Antivirus,&#x20;as&#x20;email&#x20;attachments&#x20;are&#x20;a&#x20;commonly&#x20;used&#x20;attack&#x20;vector&#x20;to&#x20;infiltrate&#x20;computers&#x20;with&#x20;malicious&#x20;software.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusScanTurn&#x20;on&#x20;e-mail&#x20;scanning&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.12.2\"]}, {\"pci_dss\": [\"2.2.3\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27293,'Ensure&#x20;&#039;Configure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Block&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;detection&#x20;and&#x20;action&#x20;for&#x20;Potentially&#x20;Unwanted&#x20;Applications&#x20;&#40;PUA&#41;,&#x20;which&#x20;are&#x20;sneaky&#x20;unwanted&#x20;application&#x20;bundlers&#x20;or&#x20;their&#x20;bundled&#x20;applications,&#x20;that&#x20;can&#x20;deliver&#x20;adware&#x20;or&#x20;malware.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Block.','Potentially&#x20;unwanted&#x20;applications&#x20;can&#x20;increase&#x20;the&#x20;risk&#x20;of&#x20;your&#x20;network&#x20;being&#x20;infected&#x20;with&#x20;malware,&#x20;cause&#x20;malware&#x20;infections&#x20;to&#x20;be&#x20;harder&#x20;to&#x20;identify,&#x20;and&#x20;can&#x20;waste&#x20;IT&#x20;resources&#x20;in&#x20;cleaning&#x20;up&#x20;the&#x20;applications.&#x20;They&#x20;should&#x20;be&#x20;blocked&#x20;from&#x20;installation.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Block:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusConfigure&#x20;detection&#x20;for&#x20;potentially&#x20;unwanted&#x20;applications&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1809&#x20;&amp;&#x20;Server&#x20;2019&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.47.15\"]}, {\"cis_csc\": [\"2.5\", \"10.6\"]}]'),(27294,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;AntiVirus&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;turns&#x20;off&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;If&#x20;the&#x20;setting&#x20;is&#x20;configured&#x20;to&#x20;Disabled,&#x20;Microsoft&#x20;Defender&#x20;Antivirus&#x20;runs&#x20;and&#x20;computers&#x20;are&#x20;scanned&#x20;for&#x20;malware&#x20;and&#x20;other&#x20;potentially&#x20;unwanted&#x20;software.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;current,&#x20;updated&#x20;antivirus&#x20;product&#x20;is&#x20;scanning&#x20;each&#x20;computer&#x20;for&#x20;malicious&#x20;file&#x20;activity.&#x20;Microsoft&#x20;provides&#x20;a&#x20;competent&#x20;solution&#x20;out&#x20;of&#x20;the&#x20;box&#x20;in&#x20;Microsoft&#x20;Defender&#x20;Antivirus.&#x20;Organizations&#x20;that&#x20;choose&#x20;to&#x20;purchase&#x20;a&#x20;reputable&#x20;3rd-party&#x20;antivirus&#x20;solution&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation&#x20;in&#x20;lieu&#x20;of&#x20;the&#x20;commercial&#x20;alternative.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsMicrosoft&#x20;Defender&#x20;AntivirusTurn&#x20;off&#x20;Microsoft&#x20;Defender&#x20;AntiVirus&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefender.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Turn&#x20;off&#x20;Windows&#x20;Defender,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.&#x20;It&#x20;was&#x20;again&#x20;renamed&#x20;to&#x20;Windows&#x20;Defender&#x20;Antivirus&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;2004&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.47.16\"]}, {\"cis_csc\": [\"10.6\"]}]'),(27295,'Ensure&#x20;&#039;Prevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;prevent&#x20;apps&#x20;and&#x20;features&#x20;from&#x20;working&#x20;with&#x20;files&#x20;on&#x20;OneDrive&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Enabling&#x20;this&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;accidentally&#x20;&#40;or&#x20;intentionally&#41;&#x20;uploading&#x20;confidential&#x20;or&#x20;sensitive&#x20;corporate&#x20;information&#x20;to&#x20;the&#x20;OneDrive&#x20;cloud&#x20;service&#x20;using&#x20;the&#x20;Next&#x20;Generation&#x20;Sync&#x20;Client.&#x20;Note:&#x20;This&#x20;security&#x20;concern&#x20;applies&#x20;to&#x20;any&#x20;cloud-based&#x20;file&#x20;storage&#x20;application&#x20;installed&#x20;on&#x20;a&#x20;server,&#x20;not&#x20;just&#x20;the&#x20;one&#x20;supplied&#x20;with&#x20;Windows&#x20;Server.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsOneDrivePrevent&#x20;the&#x20;usage&#x20;of&#x20;OneDrive&#x20;for&#x20;file&#x20;storage&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;SkyDrive.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;However,&#x20;we&#x20;strongly&#x20;recommend&#x20;you&#x20;only&#x20;use&#x20;the&#x20;version&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Older&#x20;versions&#x20;of&#x20;the&#x20;templates&#x20;had&#x20;conflicting&#x20;settings&#x20;in&#x20;different&#x20;template&#x20;files&#x20;for&#x20;both&#x20;OneDrive&#x20;&amp;&#x20;SkyDrive,&#x20;until&#x20;it&#x20;was&#x20;cleaned&#x20;up&#x20;properly&#x20;in&#x20;the&#x20;above&#x20;version.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Prevent&#x20;the&#x20;usage&#x20;of&#x20;SkyDrive&#x20;for&#x20;file&#x20;storage,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.58.1\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27296,'Ensure&#x20;&#039;Turn&#x20;off&#x20;Push&#x20;To&#x20;Install&#x20;service&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;can&#x20;push&#x20;Apps&#x20;to&#x20;the&#x20;device&#x20;from&#x20;the&#x20;Microsoft&#x20;Store&#x20;App&#x20;running&#x20;on&#x20;other&#x20;devices&#x20;or&#x20;the&#x20;web.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;high&#x20;security&#x20;managed&#x20;environment,&#x20;application&#x20;installations&#x20;should&#x20;be&#x20;managed&#x20;centrally&#x20;by&#x20;IT&#x20;staff,&#x20;not&#x20;by&#x20;end&#x20;users.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsPush&#x20;to&#x20;InstallTurn&#x20;off&#x20;Push&#x20;To&#x20;Install&#x20;service&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PushToInstall.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.64.1\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27297,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;helps&#x20;prevent&#x20;Remote&#x20;Desktop&#x20;clients&#x20;from&#x20;saving&#x20;passwords&#x20;on&#x20;a&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;this&#x20;policy&#x20;setting&#x20;was&#x20;previously&#x20;configured&#x20;as&#x20;Disabled&#x20;or&#x20;Not&#x20;configured,&#x20;any&#x20;previously&#x20;saved&#x20;passwords&#x20;will&#x20;be&#x20;deleted&#x20;the&#x20;first&#x20;time&#x20;a&#x20;Remote&#x20;Desktop&#x20;client&#x20;disconnects&#x20;from&#x20;any&#x20;server.','An&#x20;attacker&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;may&#x20;be&#x20;able&#x20;to&#x20;break&#x20;the&#x20;protection&#x20;guarding&#x20;saved&#x20;passwords.&#x20;An&#x20;attacker&#x20;who&#x20;compromises&#x20;a&#x20;user&#039;s&#x20;account&#x20;and&#x20;connects&#x20;to&#x20;their&#x20;computer&#x20;could&#x20;use&#x20;saved&#x20;passwords&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;additional&#x20;hosts.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Connection&#x20;ClientDo&#x20;not&#x20;allow&#x20;passwords&#x20;to&#x20;be&#x20;saved&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.2.2\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(27298,'Ensure&#x20;&#039;Restrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;restrict&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','This&#x20;setting&#x20;ensures&#x20;that&#x20;users&#x20;&amp;&#x20;administrators&#x20;who&#x20;Remote&#x20;Desktop&#x20;to&#x20;a&#x20;server&#x20;will&#x20;continue&#x20;to&#x20;use&#x20;the&#x20;same&#x20;session&#x20;-&#x20;if&#x20;they&#x20;disconnect&#x20;and&#x20;reconnect,&#x20;they&#x20;will&#x20;go&#x20;back&#x20;to&#x20;the&#x20;same&#x20;session&#x20;they&#x20;were&#x20;using&#x20;before,&#x20;preventing&#x20;the&#x20;creation&#x20;of&#x20;a&#x20;second&#x20;simultaneous&#x20;session.&#x20;This&#x20;both&#x20;prevents&#x20;unnecessary&#x20;resource&#x20;usage&#x20;by&#x20;having&#x20;the&#x20;server&#x20;host&#x20;unnecessary&#x20;additional&#x20;sessions&#x20;&#40;which&#x20;would&#x20;put&#x20;extra&#x20;load&#x20;on&#x20;the&#x20;server&#41;&#x20;and&#x20;also&#x20;ensures&#x20;a&#x20;consistency&#x20;of&#x20;experience&#x20;for&#x20;the&#x20;user.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostConnectionsRestrict&#x20;Remote&#x20;Desktop&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Restrict&#x20;Terminal&#x20;Services&#x20;users&#x20;to&#x20;a&#x20;single&#x20;remote&#x20;session,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.2.1\"]}, {\"cis_csc\": [\"9.2\"]}]'),(27299,'Ensure&#x20;&#039;Allow&#x20;UI&#x20;Automation&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;User&#x20;Interface&#x20;&#40;UI&#41;&#x20;Automation&#x20;client&#x20;applications&#x20;running&#x20;on&#x20;the&#x20;local&#x20;computer&#x20;can&#x20;access&#x20;UI&#x20;elements&#x20;on&#x20;the&#x20;server.&#x20;UI&#x20;Automation&#x20;gives&#x20;programs&#x20;access&#x20;to&#x20;most&#x20;UI&#x20;elements,&#x20;which&#x20;allows&#x20;use&#x20;of&#x20;assistive&#x20;technology&#x20;products&#x20;like&#x20;Magnifier&#x20;and&#x20;Narrator&#x20;that&#x20;need&#x20;to&#x20;interact&#x20;with&#x20;the&#x20;UI&#x20;in&#x20;order&#x20;to&#x20;work&#x20;properly.&#x20;UI&#x20;information&#x20;also&#x20;allows&#x20;automated&#x20;test&#x20;scripts&#x20;to&#x20;interact&#x20;with&#x20;the&#x20;UI.&#x20;For&#x20;example,&#x20;the&#x20;local&#x20;computers&#x20;Narrator&#x20;and&#x20;Magnifier&#x20;clients&#x20;can&#x20;be&#x20;used&#x20;to&#x20;interact&#x20;with&#x20;UI&#x20;on&#x20;a&#x20;web&#x20;page&#x20;opened&#x20;in&#x20;a&#x20;remote&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;dont&#x20;currently&#x20;support&#x20;UI&#x20;Automation&#x20;redirection.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;UI&#x20;Automation&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;rare,&#x20;and&#x20;not&#x20;supported&#x20;at&#x20;this&#x20;time,&#x20;but&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;malicious&#x20;activity&#x20;to&#x20;occur.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionAllow&#x20;UI&#x20;Automation&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.3.3.1\"]}]'),(27300,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;COM&#x20;ports&#x20;from&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;COM&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;COM&#x20;port&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.2\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27301,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;users&#x20;from&#x20;sharing&#x20;the&#x20;local&#x20;drives&#x20;on&#x20;their&#x20;client&#x20;computers&#x20;to&#x20;Remote&#x20;Desktop&#x20;Servers&#x20;that&#x20;they&#x20;access.&#x20;Mapped&#x20;drives&#x20;appear&#x20;in&#x20;the&#x20;session&#x20;folder&#x20;tree&#x20;in&#x20;Windows&#x20;Explorer&#x20;in&#x20;the&#x20;following&#x20;format:&#x20;&#92;TSClient&lt;driveletter&gt;$&#x20;If&#x20;local&#x20;drives&#x20;are&#x20;shared&#x20;they&#x20;are&#x20;left&#x20;vulnerable&#x20;to&#x20;intruders&#x20;who&#x20;want&#x20;to&#x20;exploit&#x20;the&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;them.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Data&#x20;could&#x20;be&#x20;forwarded&#x20;from&#x20;the&#x20;user&#039;s&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;without&#x20;any&#x20;direct&#x20;user&#x20;interaction.&#x20;Malicious&#x20;software&#x20;already&#x20;present&#x20;on&#x20;a&#x20;compromised&#x20;server&#x20;would&#x20;have&#x20;direct&#x20;and&#x20;stealthy&#x20;disk&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;local&#x20;computer&#x20;during&#x20;the&#x20;Remote&#x20;Desktop&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;drive&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27302,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;location&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;the&#x20;redirection&#x20;of&#x20;location&#x20;data&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;location&#x20;data&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;rare,&#x20;so&#x20;it&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;malicious&#x20;activity&#x20;to&#x20;occur.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;location&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;21H2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.65.3.3.4\"]}]'),(27303,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;prevent&#x20;the&#x20;redirection&#x20;of&#x20;data&#x20;to&#x20;client&#x20;LPT&#x20;ports&#x20;during&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;LPT&#x20;port&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;LPT&#x20;port&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27304,'Ensure&#x20;&#039;Do&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;control&#x20;the&#x20;redirection&#x20;of&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;devices,&#x20;such&#x20;as&#x20;Windows&#x20;Portable&#x20;Devices,&#x20;to&#x20;the&#x20;remote&#x20;computer&#x20;in&#x20;a&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','In&#x20;a&#x20;more&#x20;security-sensitive&#x20;environment,&#x20;it&#x20;is&#x20;desirable&#x20;to&#x20;reduce&#x20;the&#x20;possible&#x20;attack&#x20;surface.&#x20;The&#x20;need&#x20;for&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;within&#x20;a&#x20;Remote&#x20;Desktop&#x20;session&#x20;is&#x20;very&#x20;rare,&#x20;so&#x20;makes&#x20;sense&#x20;to&#x20;reduce&#x20;the&#x20;number&#x20;of&#x20;unexpected&#x20;avenues&#x20;for&#x20;data&#x20;exfiltration&#x20;and/or&#x20;malicious&#x20;code&#x20;transfer.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostDevice&#x20;and&#x20;Resource&#x20;RedirectionDo&#x20;not&#x20;allow&#x20;supported&#x20;Plug&#x20;and&#x20;Play&#x20;device&#x20;redirection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.3.6\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27305,'Ensure&#x20;&#039;Always&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;always&#x20;prompts&#x20;the&#x20;client&#x20;computer&#x20;for&#x20;a&#x20;password&#x20;upon&#x20;connection.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;enforce&#x20;a&#x20;password&#x20;prompt&#x20;for&#x20;users&#x20;who&#x20;log&#x20;on&#x20;to&#x20;Remote&#x20;Desktop&#x20;Services,&#x20;even&#x20;if&#x20;they&#x20;already&#x20;provided&#x20;the&#x20;password&#x20;in&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Users&#x20;have&#x20;the&#x20;option&#x20;to&#x20;store&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;when&#x20;they&#x20;create&#x20;a&#x20;new&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut.&#x20;If&#x20;the&#x20;server&#x20;that&#x20;runs&#x20;Remote&#x20;Desktop&#x20;Services&#x20;allows&#x20;users&#x20;who&#x20;have&#x20;used&#x20;this&#x20;feature&#x20;to&#x20;log&#x20;on&#x20;to&#x20;the&#x20;server&#x20;but&#x20;not&#x20;enter&#x20;their&#x20;password,&#x20;then&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;an&#x20;attacker&#x20;who&#x20;has&#x20;gained&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer&#x20;could&#x20;connect&#x20;to&#x20;a&#x20;Remote&#x20;Desktop&#x20;Server&#x20;through&#x20;the&#x20;Remote&#x20;Desktop&#x20;Connection&#x20;shortcut,&#x20;even&#x20;though&#x20;they&#x20;may&#x20;not&#x20;know&#x20;the&#x20;user&#039;s&#x20;password.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityAlways&#x20;prompt&#x20;for&#x20;password&#x20;upon&#x20;connection&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Always&#x20;prompt&#x20;client&#x20;for&#x20;password&#x20;upon&#x20;connection,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.1\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27306,'Ensure&#x20;&#039;Require&#x20;secure&#x20;RPC&#x20;communication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;requires&#x20;secure&#x20;Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;communication&#x20;with&#x20;all&#x20;clients&#x20;or&#x20;allows&#x20;unsecured&#x20;communication.&#x20;You&#x20;can&#x20;use&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;strengthen&#x20;the&#x20;security&#x20;of&#x20;RPC&#x20;communication&#x20;with&#x20;clients&#x20;by&#x20;allowing&#x20;only&#x20;authenticated&#x20;and&#x20;encrypted&#x20;requests.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;unsecure&#x20;RPC&#x20;communication&#x20;can&#x20;exposes&#x20;the&#x20;server&#x20;to&#x20;man&#x20;in&#x20;the&#x20;middle&#x20;attacks&#x20;and&#x20;data&#x20;disclosure&#x20;attacks.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;secure&#x20;RPC&#x20;communication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.2\"]}, {\"pci_dss\": [\"8.2.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27307,'Ensure&#x20;&#039;Require&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;SSL&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;security&#x20;layer&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;SSL.&#x20;Note:&#x20;In&#x20;spite&#x20;of&#x20;this&#x20;setting&#x20;being&#x20;labeled&#x20;SSL,&#x20;it&#x20;is&#x20;actually&#x20;enforcing&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;version&#x20;1.0,&#x20;not&#x20;the&#x20;older&#x20;&#40;and&#x20;less&#x20;secure&#41;&#x20;SSL&#x20;protocol.','The&#x20;native&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;encryption&#x20;is&#x20;now&#x20;considered&#x20;a&#x20;weak&#x20;protocol,&#x20;so&#x20;enforcing&#x20;the&#x20;use&#x20;of&#x20;stronger&#x20;Transport&#x20;Layer&#x20;Security&#x20;&#40;TLS&#41;&#x20;encryption&#x20;for&#x20;all&#x20;RDP&#x20;communications&#x20;between&#x20;clients&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;is&#x20;preferred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;SSL:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;use&#x20;of&#x20;specific&#x20;security&#x20;layer&#x20;for&#x20;remote&#x20;&#40;RDP&#41;&#x20;connections&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.3\"]}, {\"cis_csc\": [\"3.10\"]}]'),(27308,'Ensure&#x20;&#039;Require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;whether&#x20;to&#x20;require&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;to&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Requiring&#x20;that&#x20;user&#x20;authentication&#x20;occur&#x20;earlier&#x20;in&#x20;the&#x20;remote&#x20;connection&#x20;process&#x20;enhances&#x20;security.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecurityRequire&#x20;user&#x20;authentication&#x20;for&#x20;remote&#x20;connections&#x20;by&#x20;using&#x20;Network&#x20;Level&#x20;Authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Vista&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Require&#x20;user&#x20;authentication&#x20;using&#x20;RDP&#x20;6.0&#x20;for&#x20;remote&#x20;connections,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;Server&#x20;2008&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.4\"]}, {\"cis_csc\": [\"3.10\"]}]'),(27309,'Ensure&#x20;&#039;Set&#x20;client&#x20;connection&#x20;encryption&#x20;level&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;High&#x20;Level&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;to&#x20;require&#x20;the&#x20;use&#x20;of&#x20;a&#x20;specific&#x20;encryption&#x20;level&#x20;to&#x20;secure&#x20;communications&#x20;between&#x20;client&#x20;computers&#x20;and&#x20;RD&#x20;Session&#x20;Host&#x20;servers&#x20;during&#x20;Remote&#x20;Desktop&#x20;Protocol&#x20;&#40;RDP&#41;&#x20;connections.&#x20;This&#x20;policy&#x20;only&#x20;applies&#x20;when&#x20;you&#x20;are&#x20;using&#x20;native&#x20;RDP&#x20;encryption.&#x20;However,&#x20;native&#x20;RDP&#x20;encryption&#x20;&#40;as&#x20;opposed&#x20;to&#x20;SSL&#x20;encryption&#41;&#x20;is&#x20;not&#x20;recommended.&#x20;This&#x20;policy&#x20;does&#x20;not&#x20;apply&#x20;to&#x20;SSL&#x20;encryption.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;High&#x20;Level.','If&#x20;Remote&#x20;Desktop&#x20;client&#x20;connections&#x20;that&#x20;use&#x20;low&#x20;level&#x20;encryption&#x20;are&#x20;allowed,&#x20;it&#x20;is&#x20;more&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;any&#x20;captured&#x20;Remote&#x20;Desktop&#x20;Services&#x20;network&#x20;traffic.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;High&#x20;Level:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSecuritySet&#x20;client&#x20;connection&#x20;encryption&#x20;level&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.9.5\"]}, {\"cis_csc\": [\"3.10\"]}]'),(27310,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;specify&#x20;the&#x20;maximum&#x20;amount&#x20;of&#x20;time&#x20;that&#x20;an&#x20;active&#x20;Remote&#x20;Desktop&#x20;Services&#x20;session&#x20;can&#x20;be&#x20;idle&#x20;&#40;without&#x20;user&#x20;input&#41;&#x20;before&#x20;it&#x20;is&#x20;automatically&#x20;disconnected.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never&#x20;&#40;0&#41;.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;inactive&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;15&#x20;minutes&#x20;or&#x20;less,&#x20;but&#x20;not&#x20;Never&#x20;&#40;0&#41;:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Set&#x20;time&#x20;limit&#x20;for&#x20;active&#x20;but&#x20;idle&#x20;Terminal&#x20;Services&#x20;sessions,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.10.1\"]}, {\"pci_dss\": [\"8.1.8\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27311,'Ensure&#x20;&#039;Set&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;1&#x20;minute&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;configure&#x20;a&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;Remote&#x20;Desktop&#x20;Services&#x20;sessions.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;1&#x20;minute.','This&#x20;setting&#x20;helps&#x20;to&#x20;prevent&#x20;active&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;from&#x20;tying&#x20;up&#x20;the&#x20;computer&#x20;for&#x20;long&#x20;periods&#x20;of&#x20;time&#x20;while&#x20;not&#x20;in&#x20;use,&#x20;preventing&#x20;computing&#x20;resources&#x20;from&#x20;being&#x20;consumed&#x20;by&#x20;large&#x20;numbers&#x20;of&#x20;disconnected&#x20;but&#x20;still&#x20;active&#x20;sessions.&#x20;In&#x20;addition,&#x20;old,&#x20;forgotten&#x20;Remote&#x20;Desktop&#x20;sessions&#x20;that&#x20;are&#x20;still&#x20;active&#x20;can&#x20;cause&#x20;password&#x20;lockouts&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;has&#x20;changed&#x20;but&#x20;the&#x20;old&#x20;session&#x20;is&#x20;still&#x20;running.&#x20;For&#x20;systems&#x20;that&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;connected&#x20;users&#x20;&#40;e.g.&#x20;servers&#x20;in&#x20;the&#x20;default&#x20;Administrative&#x20;mode&#x20;-&#x20;2&#x20;sessions&#x20;only&#41;,&#x20;other&#x20;users&#039;&#x20;old&#x20;but&#x20;still&#x20;active&#x20;sessions&#x20;can&#x20;prevent&#x20;another&#x20;user&#x20;from&#x20;connecting,&#x20;resulting&#x20;in&#x20;an&#x20;effective&#x20;denial&#x20;of&#x20;service.&#x20;This&#x20;setting&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;a&#x20;disconnected&#x20;session&#x20;is&#x20;properly&#x20;terminated.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;1&#x20;minute:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostSession&#x20;Time&#x20;LimitsSet&#x20;time&#x20;limit&#x20;for&#x20;disconnected&#x20;sessions&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.10.2\"]}, {\"pci_dss\": [\"8.1\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27312,'Ensure&#x20;&#039;Do&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;Remote&#x20;Desktop&#x20;Services&#x20;retains&#x20;a&#x20;user&#039;s&#x20;per-session&#x20;temporary&#x20;folders&#x20;at&#x20;logoff.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Sensitive&#x20;information&#x20;could&#x20;be&#x20;contained&#x20;inside&#x20;the&#x20;temporary&#x20;folders&#x20;and&#x20;visible&#x20;to&#x20;other&#x20;administrators&#x20;that&#x20;log&#x20;into&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;delete&#x20;temp&#x20;folders&#x20;upon&#x20;exit&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Do&#x20;not&#x20;delete&#x20;temp&#x20;folder&#x20;upon&#x20;exit,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.11.1\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27313,'Ensure&#x20;&#039;Do&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','By&#x20;default,&#x20;Remote&#x20;Desktop&#x20;Services&#x20;creates&#x20;a&#x20;separate&#x20;temporary&#x20;folder&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;for&#x20;each&#x20;active&#x20;session&#x20;that&#x20;a&#x20;user&#x20;maintains&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server.&#x20;The&#x20;temporary&#x20;folder&#x20;is&#x20;created&#x20;on&#x20;the&#x20;RD&#x20;Session&#x20;Host&#x20;server&#x20;in&#x20;a&#x20;Temp&#x20;folder&#x20;under&#x20;the&#x20;user&#039;s&#x20;profile&#x20;folder&#x20;and&#x20;is&#x20;named&#x20;with&#x20;the&#x20;sessionid.&#x20;This&#x20;temporary&#x20;folder&#x20;is&#x20;used&#x20;to&#x20;store&#x20;individual&#x20;temporary&#x20;files.&#x20;To&#x20;reclaim&#x20;disk&#x20;space,&#x20;the&#x20;temporary&#x20;folder&#x20;is&#x20;deleted&#x20;when&#x20;the&#x20;user&#x20;logs&#x20;off&#x20;from&#x20;a&#x20;session.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;setting&#x20;keeps&#x20;the&#x20;cached&#x20;data&#x20;independent&#x20;for&#x20;each&#x20;session,&#x20;both&#x20;reducing&#x20;the&#x20;chance&#x20;of&#x20;problems&#x20;from&#x20;shared&#x20;cached&#x20;data&#x20;between&#x20;sessions,&#x20;and&#x20;keeping&#x20;possibly&#x20;sensitive&#x20;data&#x20;separate&#x20;to&#x20;each&#x20;user&#x20;session.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRemote&#x20;Desktop&#x20;ServicesRemote&#x20;Desktop&#x20;Session&#x20;HostTemporary&#x20;FoldersDo&#x20;not&#x20;use&#x20;temporary&#x20;folders&#x20;per&#x20;session&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;TerminalServer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.65.3.11.2\"]}]'),(27314,'Ensure&#x20;&#039;Prevent&#x20;downloading&#x20;of&#x20;enclosures&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevents&#x20;the&#x20;user&#x20;from&#x20;having&#x20;enclosures&#x20;&#40;file&#x20;attachments&#41;&#x20;downloaded&#x20;from&#x20;an&#x20;RSS&#x20;feed&#x20;to&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Allowing&#x20;attachments&#x20;to&#x20;be&#x20;downloaded&#x20;through&#x20;the&#x20;RSS&#x20;feed&#x20;can&#x20;introduce&#x20;files&#x20;that&#x20;could&#x20;have&#x20;malicious&#x20;intent.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsRSS&#x20;FeedsPrevent&#x20;downloading&#x20;of&#x20;enclosures&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;InetRes.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Turn&#x20;off&#x20;downloading&#x20;of&#x20;enclosures,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.66.1\"]}, {\"cis_csc\": [\"9.4\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27315,'Ensure&#x20;&#039;Allow&#x20;Cloud&#x20;Search&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;search&#x20;and&#x20;Cortana&#x20;to&#x20;search&#x20;cloud&#x20;sources&#x20;like&#x20;OneDrive&#x20;and&#x20;SharePoint.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search.','Due&#x20;to&#x20;privacy&#x20;concerns,&#x20;data&#x20;should&#x20;never&#x20;be&#x20;sent&#x20;to&#x20;any&#x20;3rd&#x20;party&#x20;since&#x20;this&#x20;data&#x20;could&#x20;contain&#x20;sensitive&#x20;information.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Disable&#x20;Cloud&#x20;Search:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;Cloud&#x20;Search&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.67.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27316,'Ensure&#x20;&#039;Allow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;encrypted&#x20;items&#x20;are&#x20;allowed&#x20;to&#x20;be&#x20;indexed.&#x20;When&#x20;this&#x20;setting&#x20;is&#x20;changed,&#x20;the&#x20;index&#x20;is&#x20;rebuilt&#x20;completely.&#x20;Full&#x20;volume&#x20;encryption&#x20;&#40;such&#x20;as&#x20;BitLocker&#x20;Drive&#x20;Encryption&#x20;or&#x20;a&#x20;non-Microsoft&#x20;solution&#41;&#x20;must&#x20;be&#x20;used&#x20;for&#x20;the&#x20;location&#x20;of&#x20;the&#x20;index&#x20;to&#x20;maintain&#x20;security&#x20;for&#x20;encrypted&#x20;files.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Indexing&#x20;and&#x20;allowing&#x20;users&#x20;to&#x20;search&#x20;encrypted&#x20;files&#x20;could&#x20;potentially&#x20;reveal&#x20;confidential&#x20;data&#x20;stored&#x20;within&#x20;the&#x20;encrypted&#x20;files.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSearchAllow&#x20;indexing&#x20;of&#x20;encrypted&#x20;files&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;Search.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.67.3\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27317,'Ensure&#x20;&#039;Turn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','The&#x20;Key&#x20;Management&#x20;Service&#x20;&#40;KMS&#41;&#x20;is&#x20;a&#x20;Microsoft&#x20;license&#x20;activation&#x20;method&#x20;that&#x20;entails&#x20;setting&#x20;up&#x20;a&#x20;local&#x20;server&#x20;to&#x20;store&#x20;the&#x20;software&#x20;licenses.&#x20;The&#x20;KMS&#x20;server&#x20;itself&#x20;needs&#x20;to&#x20;connect&#x20;to&#x20;Microsoft&#x20;to&#x20;activate&#x20;the&#x20;KMS&#x20;service,&#x20;but&#x20;subsequent&#x20;on-network&#x20;clients&#x20;can&#x20;activate&#x20;Microsoft&#x20;Windows&#x20;OS&#x20;and/or&#x20;their&#x20;Microsoft&#x20;Office&#x20;via&#x20;the&#x20;KMS&#x20;server&#x20;instead&#x20;of&#x20;connecting&#x20;directly&#x20;to&#x20;Microsoft.&#x20;This&#x20;policy&#x20;setting&#x20;lets&#x20;you&#x20;opt-out&#x20;of&#x20;sending&#x20;KMS&#x20;client&#x20;activation&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Even&#x20;though&#x20;the&#x20;KMS&#x20;licensing&#x20;method&#x20;does&#x20;not&#x20;require&#x20;KMS&#x20;clients&#x20;to&#x20;connect&#x20;to&#x20;Microsoft,&#x20;they&#x20;still&#x20;send&#x20;KMS&#x20;client&#x20;activation&#x20;state&#x20;data&#x20;to&#x20;Microsoft&#x20;automatically.&#x20;Preventing&#x20;this&#x20;information&#x20;from&#x20;being&#x20;sent&#x20;can&#x20;help&#x20;reduce&#x20;privacy&#x20;concerns&#x20;in&#x20;high&#x20;security&#x20;environments.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsSoftware&#x20;Protection&#x20;PlatformTurn&#x20;off&#x20;KMS&#x20;Client&#x20;Online&#x20;AVS&#x20;Validation&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;AVSValidationGP.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.72.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27318,'Ensure&#x20;&#039;Configure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;the&#x20;behavior&#x20;of&#x20;Windows&#x20;SmartScreen.&#x20;Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;Some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;with&#x20;this&#x20;feature&#x20;enabled.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass.','Windows&#x20;SmartScreen&#x20;helps&#x20;keep&#x20;PCs&#x20;safer&#x20;by&#x20;warning&#x20;users&#x20;before&#x20;running&#x20;unrecognized&#x20;programs&#x20;downloaded&#x20;from&#x20;the&#x20;Internet.&#x20;However,&#x20;due&#x20;to&#x20;the&#x20;fact&#x20;that&#x20;some&#x20;information&#x20;is&#x20;sent&#x20;to&#x20;Microsoft&#x20;about&#x20;files&#x20;and&#x20;programs&#x20;run&#x20;on&#x20;PCs&#x20;some&#x20;organizations&#x20;may&#x20;prefer&#x20;to&#x20;disable&#x20;it.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Warn&#x20;and&#x20;prevent&#x20;bypass:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Defender&#x20;SmartScreenExplorerConfigure&#x20;Windows&#x20;Defender&#x20;SmartScreen&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsExplorer.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Configure&#x20;Windows&#x20;SmartScreen,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1703&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.85.1.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"2.2.4\"]}, {\"nist_800_53\": [\"CM.1\"]}, {\"tsc\": [\"CC5.2\"]}]'),(27319,'Ensure&#x20;&#039;Allow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;are&#x20;allowed.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','This&#x20;Microsoft&#x20;feature&#x20;is&#x20;designed&#x20;to&#x20;collect&#x20;data&#x20;and&#x20;suggest&#x20;apps&#x20;based&#x20;on&#x20;that&#x20;data&#x20;collected.&#x20;Disabling&#x20;this&#x20;setting&#x20;will&#x20;help&#x20;ensure&#x20;your&#x20;data&#x20;is&#x20;not&#x20;shared&#x20;with&#x20;any&#x20;third&#x20;party.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;suggested&#x20;apps&#x20;in&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.89.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27320,'Ensure&#x20;&#039;Allow&#x20;Windows&#x20;Ink&#x20;Workspace&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#039;&#x20;OR&#x20;&#039;Disabled&#039;&#x20;but&#x20;not&#x20;&#039;Enabled:&','This&#x20;policy&#x20;setting&#x20;determines&#x20;whether&#x20;Windows&#x20;Ink&#x20;items&#x20;are&#x20;allowed&#x20;above&#x20;the&#x20;lock&#x20;screen.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled.','Allowing&#x20;any&#x20;apps&#x20;to&#x20;be&#x20;accessed&#x20;while&#x20;system&#x20;is&#x20;locked&#x20;is&#x20;not&#x20;recommended.&#x20;If&#x20;this&#x20;feature&#x20;is&#x20;permitted,&#x20;it&#x20;should&#x20;only&#x20;be&#x20;accessible&#x20;once&#x20;a&#x20;user&#x20;authenticates&#x20;with&#x20;the&#x20;proper&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;On,&#x20;but&#x20;disallow&#x20;access&#x20;above&#x20;lock&#x20;OR&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Ink&#x20;WorkspaceAllow&#x20;Windows&#x20;Ink&#x20;Workspace&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsInkWorkspace.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.89.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27321,'Ensure&#x20;&#039;Allow&#x20;user&#x20;control&#x20;over&#x20;installs&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;users&#x20;are&#x20;permitted&#x20;to&#x20;change&#x20;installation&#x20;options&#x20;that&#x20;typically&#x20;are&#x20;available&#x20;only&#x20;to&#x20;system&#x20;administrators.&#x20;The&#x20;security&#x20;features&#x20;of&#x20;Windows&#x20;Installer&#x20;normally&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;installation&#x20;options&#x20;that&#x20;are&#x20;typically&#x20;reserved&#x20;for&#x20;system&#x20;administrators,&#x20;such&#x20;as&#x20;specifying&#x20;the&#x20;directory&#x20;to&#x20;which&#x20;files&#x20;are&#x20;installed.&#x20;If&#x20;Windows&#x20;Installer&#x20;detects&#x20;that&#x20;an&#x20;installation&#x20;package&#x20;has&#x20;permitted&#x20;the&#x20;user&#x20;to&#x20;change&#x20;a&#x20;protected&#x20;option,&#x20;it&#x20;stops&#x20;the&#x20;installation&#x20;and&#x20;displays&#x20;a&#x20;message.&#x20;These&#x20;security&#x20;features&#x20;operate&#x20;only&#x20;when&#x20;the&#x20;installation&#x20;program&#x20;is&#x20;running&#x20;in&#x20;a&#x20;privileged&#x20;security&#x20;context&#x20;in&#x20;which&#x20;it&#x20;has&#x20;access&#x20;to&#x20;directories&#x20;denied&#x20;to&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','In&#x20;an&#x20;enterprise&#x20;managed&#x20;environment,&#x20;only&#x20;IT&#x20;staff&#x20;with&#x20;administrative&#x20;rights&#x20;should&#x20;be&#x20;installing&#x20;or&#x20;changing&#x20;software&#x20;on&#x20;a&#x20;system.&#x20;Allowing&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;have&#x20;any&#x20;control&#x20;over&#x20;installs&#x20;can&#x20;risk&#x20;unapproved&#x20;software&#x20;from&#x20;being&#x20;installed&#x20;or&#x20;removed&#x20;from&#x20;a&#x20;system,&#x20;which&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;become&#x20;vulnerable&#x20;to&#x20;compromise.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAllow&#x20;user&#x20;control&#x20;over&#x20;installs&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;named&#x20;Enable&#x20;user&#x20;control&#x20;over&#x20;installs,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27322,'Ensure&#x20;&#039;Always&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;setting&#x20;controls&#x20;whether&#x20;or&#x20;not&#x20;Windows&#x20;Installer&#x20;should&#x20;use&#x20;system&#x20;permissions&#x20;when&#x20;it&#x20;installs&#x20;any&#x20;program&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;This&#x20;setting&#x20;appears&#x20;both&#x20;in&#x20;the&#x20;Computer&#x20;Configuration&#x20;and&#x20;User&#x20;Configuration&#x20;folders.&#x20;To&#x20;make&#x20;this&#x20;setting&#x20;effective,&#x20;you&#x20;must&#x20;enable&#x20;the&#x20;setting&#x20;in&#x20;both&#x20;folders.&#x20;Caution:&#x20;If&#x20;enabled,&#x20;skilled&#x20;users&#x20;can&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;permissions&#x20;this&#x20;setting&#x20;grants&#x20;to&#x20;change&#x20;their&#x20;privileges&#x20;and&#x20;gain&#x20;permanent&#x20;access&#x20;to&#x20;restricted&#x20;files&#x20;and&#x20;folders.&#x20;Note&#x20;that&#x20;the&#x20;User&#x20;Configuration&#x20;version&#x20;of&#x20;this&#x20;setting&#x20;is&#x20;not&#x20;guaranteed&#x20;to&#x20;be&#x20;secure.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Users&#x20;with&#x20;limited&#x20;privileges&#x20;can&#x20;exploit&#x20;this&#x20;feature&#x20;by&#x20;creating&#x20;a&#x20;Windows&#x20;Installer&#x20;installation&#x20;package&#x20;that&#x20;creates&#x20;a&#x20;new&#x20;local&#x20;account&#x20;that&#x20;belongs&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;adds&#x20;their&#x20;current&#x20;account&#x20;to&#x20;the&#x20;local&#x20;built-in&#x20;Administrators&#x20;group,&#x20;installs&#x20;malicious&#x20;software,&#x20;or&#x20;performs&#x20;other&#x20;unauthorized&#x20;activities.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerAlways&#x20;install&#x20;with&#x20;elevated&#x20;privileges&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.2\"]}, {\"cis_csc\": [\"5.4\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27323,'Ensure&#x20;&#039;Prevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;Web-based&#x20;programs&#x20;are&#x20;allowed&#x20;to&#x20;install&#x20;software&#x20;on&#x20;the&#x20;computer&#x20;without&#x20;notifying&#x20;the&#x20;user.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Suppressing&#x20;the&#x20;system&#x20;warning&#x20;can&#x20;pose&#x20;a&#x20;security&#x20;risk&#x20;and&#x20;increase&#x20;the&#x20;attack&#x20;surface&#x20;on&#x20;the&#x20;system.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;InstallerPrevent&#x20;Internet&#x20;Explorer&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;MSI.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Disable&#x20;IE&#x20;security&#x20;prompt&#x20;for&#x20;Windows&#x20;Installer&#x20;scripts,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.90.3\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"2.2.5\"]}, {\"tsc\": [\"CC6.3\"]}]'),(27324,'Ensure&#x20;&#039;Sign-in&#x20;and&#x20;lock&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;restart&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;controls&#x20;whether&#x20;a&#x20;device&#x20;will&#x20;automatically&#x20;sign-in&#x20;the&#x20;last&#x20;interactive&#x20;user&#x20;after&#x20;Windows&#x20;Update&#x20;restarts&#x20;the&#x20;system.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Disabling&#x20;this&#x20;feature&#x20;will&#x20;prevent&#x20;the&#x20;caching&#x20;of&#x20;user&#039;s&#x20;credentials&#x20;and&#x20;unauthorized&#x20;use&#x20;of&#x20;the&#x20;device,&#x20;and&#x20;also&#x20;ensure&#x20;the&#x20;user&#x20;is&#x20;aware&#x20;of&#x20;the&#x20;restart.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Logon&#x20;OptionsSign-in&#x20;and&#x20;lock&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;restart&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WinLogon.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.1&#x20;&amp;&#x20;Server&#x20;2012&#x20;R2&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Sign-in&#x20;last&#x20;interactive&#x20;user&#x20;automatically&#x20;after&#x20;a&#x20;system-initiated&#x20;restart,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1903&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.91.1\"]}, {\"pci_dss\": [\"8.6\"]}, {\"tsc\": [\"CC6.1\"]}]'),(27325,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;enables&#x20;logging&#x20;of&#x20;all&#x20;PowerShell&#x20;script&#x20;input&#x20;to&#x20;the&#x20;Applications&#x20;and&#x20;Services&#x20;LogsMicrosoftWindowsPowerShellOperational&#x20;Event&#x20;Log&#x20;channel.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;logging&#x20;of&#x20;Script&#x20;Block&#x20;Invocation&#x20;Start/Stop&#x20;Events&#x20;is&#x20;enabled&#x20;&#40;option&#x20;box&#x20;checked&#41;,&#x20;PowerShell&#x20;will&#x20;log&#x20;additional&#x20;events&#x20;when&#x20;invocation&#x20;of&#x20;a&#x20;command,&#x20;script&#x20;block,&#x20;function,&#x20;or&#x20;script&#x20;starts&#x20;or&#x20;stops.&#x20;Enabling&#x20;this&#x20;option&#x20;generates&#x20;a&#x20;high&#x20;volume&#x20;of&#x20;event&#x20;logs.&#x20;CIS&#x20;has&#x20;intentionally&#x20;chosen&#x20;not&#x20;to&#x20;make&#x20;a&#x20;recommendation&#x20;for&#x20;this&#x20;option,&#x20;since&#x20;it&#x20;generates&#x20;a&#x20;large&#x20;volume&#x20;of&#x20;events.&#x20;If&#x20;an&#x20;organization&#x20;chooses&#x20;to&#x20;enable&#x20;the&#x20;optional&#x20;setting&#x20;&#40;checked&#41;,&#x20;this&#x20;also&#x20;conforms&#x20;to&#x20;the&#x20;benchmark.','Logs&#x20;of&#x20;PowerShell&#x20;script&#x20;input&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;when&#x20;performing&#x20;forensic&#x20;investigations&#x20;of&#x20;PowerShell&#x20;attack&#x20;incidents&#x20;to&#x20;determine&#x20;what&#x20;occurred.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Script&#x20;Block&#x20;Logging&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.100.1\"]}, {\"cis_csc\": [\"8.8\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(27326,'Ensure&#x20;&#039;Turn&#x20;on&#x20;PowerShell&#x20;Transcription&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;Policy&#x20;setting&#x20;lets&#x20;you&#x20;capture&#x20;the&#x20;input&#x20;and&#x20;output&#x20;of&#x20;Windows&#x20;PowerShell&#x20;commands&#x20;into&#x20;text-based&#x20;transcripts.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','If&#x20;this&#x20;setting&#x20;is&#x20;enabled&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;that&#x20;passwords&#x20;could&#x20;get&#x20;stored&#x20;in&#x20;plain&#x20;text&#x20;in&#x20;the&#x20;PowerShell_transcript&#x20;output&#x20;file.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;PowerShellTurn&#x20;on&#x20;PowerShell&#x20;Transcription&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;PowerShellExecutionPolicy.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;RTM&#x20;&#40;Release&#x20;1507&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.100.2\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(27327,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;uses&#x20;Basic&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27328,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.2\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27329,'Ensure&#x20;&#039;Disallow&#x20;Digest&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;client&#x20;will&#x20;not&#x20;use&#x20;Digest&#x20;authentication.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Digest&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM,&#x20;an&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ClientDisallow&#x20;Digest&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.1.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27330,'Ensure&#x20;&#039;Allow&#x20;Basic&#x20;authentication&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;accepts&#x20;Basic&#x20;authentication&#x20;from&#x20;a&#x20;remote&#x20;client.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Basic&#x20;authentication&#x20;is&#x20;less&#x20;robust&#x20;than&#x20;other&#x20;authentication&#x20;methods&#x20;available&#x20;in&#x20;WinRM&#x20;because&#x20;credentials&#x20;including&#x20;passwords&#x20;are&#x20;transmitted&#x20;in&#x20;plain&#x20;text.&#x20;An&#x20;attacker&#x20;who&#x20;is&#x20;able&#x20;to&#x20;capture&#x20;packets&#x20;on&#x20;the&#x20;network&#x20;where&#x20;WinRM&#x20;is&#x20;running&#x20;may&#x20;be&#x20;able&#x20;to&#x20;determine&#x20;the&#x20;credentials&#x20;used&#x20;for&#x20;accessing&#x20;remote&#x20;hosts&#x20;via&#x20;WinRM.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;Basic&#x20;authentication&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.1\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27331,'Ensure&#x20;&#039;Allow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;automatically&#x20;listens&#x20;on&#x20;the&#x20;network&#x20;for&#x20;requests&#x20;on&#x20;the&#x20;HTTP&#x20;transport&#x20;over&#x20;the&#x20;default&#x20;HTTP&#x20;port.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;remote&#x20;server&#x20;management&#x20;through&#x20;WinRM&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Allow&#x20;automatic&#x20;configuration&#x20;of&#x20;listeners,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.2\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27332,'Ensure&#x20;&#039;Allow&#x20;unencrypted&#x20;traffic&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;sends&#x20;and&#x20;receives&#x20;unencrypted&#x20;messages&#x20;over&#x20;the&#x20;network.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.','Encrypting&#x20;WinRM&#x20;network&#x20;traffic&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;viewing&#x20;or&#x20;modifying&#x20;WinRM&#x20;messages&#x20;as&#x20;they&#x20;transit&#x20;the&#x20;network.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceAllow&#x20;unencrypted&#x20;traffic&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.102.2.3\"]}, {\"cis_csc\": [\"3.10\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27333,'Ensure&#x20;&#039;Disallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;whether&#x20;the&#x20;Windows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;&#x20;service&#x20;will&#x20;allow&#x20;RunAs&#x20;credentials&#x20;to&#x20;be&#x20;stored&#x20;for&#x20;any&#x20;plug-ins.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;If&#x20;you&#x20;enable&#x20;and&#x20;then&#x20;disable&#x20;this&#x20;policy&#x20;setting,&#x20;any&#x20;values&#x20;that&#x20;were&#x20;previously&#x20;configured&#x20;for&#x20;RunAsPassword&#x20;will&#x20;need&#x20;to&#x20;be&#x20;reset.','Although&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;RunAs&#x20;credentials&#x20;is&#x20;a&#x20;convenient&#x20;feature&#x20;it&#x20;increases&#x20;the&#x20;risk&#x20;of&#x20;account&#x20;compromise&#x20;slightly.&#x20;For&#x20;example,&#x20;if&#x20;you&#x20;forget&#x20;to&#x20;lock&#x20;your&#x20;desktop&#x20;before&#x20;leaving&#x20;it&#x20;unattended&#x20;for&#x20;a&#x20;few&#x20;minutes&#x20;another&#x20;person&#x20;could&#x20;access&#x20;not&#x20;only&#x20;the&#x20;desktop&#x20;of&#x20;your&#x20;computer&#x20;but&#x20;also&#x20;any&#x20;hosts&#x20;you&#x20;manage&#x20;via&#x20;WinRM&#x20;with&#x20;cached&#x20;RunAs&#x20;credentials.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;Management&#x20;&#40;WinRM&#41;WinRM&#x20;ServiceDisallow&#x20;WinRM&#x20;from&#x20;storing&#x20;RunAs&#x20;credentials&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteManagement.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;8.0&#x20;&amp;&#x20;Server&#x20;2012&#x20;&#40;non-R2&#41;&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.102.2.4\"]}, {\"pci_dss\": [\"12.3.8\"]}]'),(27334,'Ensure&#x20;&#039;Allow&#x20;Remote&#x20;Shell&#x20;Access&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;allows&#x20;you&#x20;to&#x20;manage&#x20;configuration&#x20;of&#x20;remote&#x20;access&#x20;to&#x20;all&#x20;supported&#x20;shells&#x20;to&#x20;execute&#x20;scripts&#x20;and&#x20;commands.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;The&#x20;GPME&#x20;help&#x20;text&#x20;for&#x20;this&#x20;setting&#x20;is&#x20;incorrectly&#x20;worded,&#x20;implying&#x20;that&#x20;configuring&#x20;it&#x20;to&#x20;Enabled&#x20;will&#x20;reject&#x20;new&#x20;Remote&#x20;Shell&#x20;connections,&#x20;and&#x20;setting&#x20;it&#x20;to&#x20;Disabled&#x20;will&#x20;allow&#x20;Remote&#x20;Shell&#x20;connections.&#x20;The&#x20;opposite&#x20;is&#x20;true&#x20;&#40;and&#x20;is&#x20;consistent&#x20;with&#x20;the&#x20;title&#x20;of&#x20;the&#x20;setting&#41;.&#x20;This&#x20;is&#x20;a&#x20;wording&#x20;mistake&#x20;by&#x20;Microsoft&#x20;in&#x20;the&#x20;Administrative&#x20;Template.','Any&#x20;feature&#x20;is&#x20;a&#x20;potential&#x20;avenue&#x20;of&#x20;attack,&#x20;those&#x20;that&#x20;enable&#x20;inbound&#x20;network&#x20;connections&#x20;are&#x20;particularly&#x20;risky.&#x20;Only&#x20;enable&#x20;the&#x20;use&#x20;of&#x20;the&#x20;Windows&#x20;Remote&#x20;Shell&#x20;on&#x20;trusted&#x20;networks&#x20;and&#x20;when&#x20;feasible&#x20;employ&#x20;additional&#x20;controls&#x20;such&#x20;as&#x20;IPsec.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;Remote&#x20;ShellAllow&#x20;Remote&#x20;Shell&#x20;Access&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsRemoteShell.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.103.1\"]}, {\"cis_csc\": [\"4.8\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27335,'Ensure&#x20;&#039;Prevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;prevent&#x20;users&#x20;from&#x20;making&#x20;changes&#x20;to&#x20;the&#x20;Exploit&#x20;protection&#x20;settings&#x20;area&#x20;in&#x20;the&#x20;Windows&#x20;Security&#x20;settings.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.','Only&#x20;authorized&#x20;IT&#x20;staff&#x20;should&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;to&#x20;the&#x20;exploit&#x20;protection&#x20;settings&#x20;in&#x20;order&#x20;to&#x20;ensure&#x20;the&#x20;organizations&#x20;specific&#x20;configuration&#x20;is&#x20;not&#x20;modified.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;SecurityApp&#x20;and&#x20;browser&#x20;protectionPrevent&#x20;users&#x20;from&#x20;modifying&#x20;settings&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsDefenderSecurityCenter.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.105.2.1\"]}, {\"cis_csc\": [\"10.5\"]}, {\"pci_dss\": [\"7.1\"]}, {\"tsc\": [\"CC6.4\"]}]'),(27336,'Ensure&#x20;&#039;No&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;that&#x20;Automatic&#x20;Updates&#x20;will&#x20;wait&#x20;for&#x20;computers&#x20;to&#x20;be&#x20;restarted&#x20;by&#x20;the&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;on&#x20;to&#x20;them&#x20;to&#x20;complete&#x20;a&#x20;scheduled&#x20;installation.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;This&#x20;setting&#x20;applies&#x20;only&#x20;when&#x20;you&#x20;configure&#x20;Automatic&#x20;Updates&#x20;to&#x20;perform&#x20;scheduled&#x20;update&#x20;installations.&#x20;If&#x20;you&#x20;configure&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;to&#x20;Disabled,&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect.','Some&#x20;security&#x20;updates&#x20;require&#x20;that&#x20;the&#x20;computer&#x20;be&#x20;restarted&#x20;to&#x20;complete&#x20;an&#x20;installation.&#x20;If&#x20;the&#x20;computer&#x20;cannot&#x20;restart&#x20;automatically,&#x20;then&#x20;the&#x20;most&#x20;recent&#x20;update&#x20;will&#x20;not&#x20;completely&#x20;install&#x20;and&#x20;no&#x20;new&#x20;updates&#x20;will&#x20;download&#x20;to&#x20;the&#x20;computer&#x20;until&#x20;it&#x20;is&#x20;restarted.&#x20;Without&#x20;the&#x20;auto-restart&#x20;functionality,&#x20;users&#x20;who&#x20;are&#x20;not&#x20;security-conscious&#x20;may&#x20;choose&#x20;to&#x20;indefinitely&#x20;delay&#x20;the&#x20;restart,&#x20;therefore&#x20;keeping&#x20;the&#x20;computer&#x20;in&#x20;a&#x20;less&#x20;secure&#x20;state.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateLegacy&#x20;PoliciesNo&#x20;auto-restart&#x20;with&#x20;logged&#x20;on&#x20;users&#x20;for&#x20;scheduled&#x20;automatic&#x20;updates&#x20;installations&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;No&#x20;auto-restart&#x20;for&#x20;scheduled&#x20;Automatic&#x20;Updates&#x20;installations,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;7&#x20;&amp;&#x20;Server&#x20;2008&#x20;R2&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.1.1\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(27337,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;whether&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;If&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;recognize&#x20;when&#x20;a&#x20;network&#x20;connection&#x20;is&#x20;available&#x20;and&#x20;then&#x20;use&#x20;the&#x20;network&#x20;connection&#x20;to&#x20;search&#x20;Windows&#x20;Update&#x20;or&#x20;your&#x20;designated&#x20;intranet&#x20;site&#x20;for&#x20;updates&#x20;that&#x20;apply&#x20;to&#x20;them.&#x20;After&#x20;you&#x20;configure&#x20;this&#x20;policy&#x20;setting&#x20;to&#x20;Enabled,&#x20;select&#x20;one&#x20;of&#x20;the&#x20;following&#x20;three&#x20;options&#x20;in&#x20;the&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;Properties&#x20;dialog&#x20;box&#x20;to&#x20;specify&#x20;how&#x20;the&#x20;service&#x20;will&#x20;work:&#x20;&#x20;-&#x20;&#x20;2&#x20;-&#x20;Notify&#x20;for&#x20;download&#x20;and&#x20;auto&#x20;install&#x20;&#40;Notify&#x20;before&#x20;downloading&#x20;any&#x20;updates&#41;&#x20;&#x20;-&#x20;&#x20;3&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;notify&#x20;for&#x20;install&#x20;&#40;Download&#x20;the&#x20;updates&#x20;automatically&#x20;and&#x20;&#x20;notify&#x20;when&#x20;they&#x20;are&#x20;ready&#x20;to&#x20;be&#x20;installed.&#41;&#x20;&#40;Default&#x20;setting&#41;&#x20;&#x20;-&#x20;&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;&#40;Automatically&#x20;download&#x20;updates&#x20;and&#x20;&#x20;install&#x20;them&#x20;on&#x20;the&#x20;schedule&#x20;specified&#x20;below.&#41;&#41;&#x20;&#x20;-&#x20;&#x20;5&#x20;-&#x20;Allow&#x20;local&#x20;admin&#x20;to&#x20;choose&#x20;setting&#x20;&#40;Leave&#x20;decision&#x20;on&#x20;above&#x20;choices&#x20;up&#x20;to&#x20;the&#x20;&#x20;local&#x20;Administrators&#x20;&#40;Not&#x20;Recommended&#41;&#41;&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled.&#x20;Note:&#x20;The&#x20;sub-setting&#x20;&quot;Configure&#x20;automatic&#x20;updating:&quot;&#x20;has&#x20;4&#x20;possible&#x20;values&#x20;&ndash;&#x20;all&#x20;of&#x20;them&#x20;are&#x20;valid&#x20;depending&#x20;on&#x20;specific&#x20;organizational&#x20;needs,&#x20;however&#x20;if&#x20;feasible&#x20;we&#x20;suggest&#x20;using&#x20;a&#x20;value&#x20;of&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install.&#x20;This&#x20;suggestion&#x20;is&#x20;not&#x20;a&#x20;scored&#x20;requirement.&#x20;Note&#x20;#2:&#x20;Organizations&#x20;that&#x20;utilize&#x20;a&#x20;3rd-party&#x20;solution&#x20;for&#x20;patching&#x20;may&#x20;choose&#x20;to&#x20;exempt&#x20;themselves&#x20;from&#x20;this&#x20;recommendation,&#x20;and&#x20;instead&#x20;configure&#x20;it&#x20;to&#x20;Disabled&#x20;so&#x20;that&#x20;the&#x20;native&#x20;Windows&#x20;Update&#x20;mechanism&#x20;does&#x20;not&#x20;interfere&#x20;with&#x20;the&#x20;3rd-party&#x20;patching&#x20;process.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceConfigure&#x20;Automatic&#x20;Updates&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.2.1\"]}, {\"cis_csc\": [\"7.3\"]}]'),(27338,'Ensure&#x20;&#039;Configure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;0&#x20;-&#x20;Every&#x20;day&#039;.','This&#x20;policy&#x20;setting&#x20;specifies&#x20;when&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;receive&#x20;security&#x20;updates&#x20;from&#x20;Windows&#x20;Update&#x20;or&#x20;WSUS.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;0&#x20;-&#x20;Every&#x20;day.&#x20;Note:&#x20;This&#x20;setting&#x20;is&#x20;only&#x20;applicable&#x20;if&#x20;4&#x20;-&#x20;Auto&#x20;download&#x20;and&#x20;schedule&#x20;the&#x20;install&#x20;is&#x20;selected&#x20;in&#x20;recommendation&#x20;&#039;Configure&#x20;Automatic&#x20;Updates&#039;.&#x20;It&#x20;will&#x20;have&#x20;no&#x20;impact&#x20;if&#x20;any&#x20;other&#x20;option&#x20;is&#x20;selected.','Although&#x20;each&#x20;version&#x20;of&#x20;Windows&#x20;is&#x20;thoroughly&#x20;tested&#x20;before&#x20;release,&#x20;it&#x20;is&#x20;possible&#x20;that&#x20;problems&#x20;will&#x20;be&#x20;discovered&#x20;after&#x20;the&#x20;products&#x20;are&#x20;shipped.&#x20;The&#x20;Configure&#x20;Automatic&#x20;Updates&#x20;setting&#x20;can&#x20;help&#x20;you&#x20;ensure&#x20;that&#x20;the&#x20;computers&#x20;in&#x20;your&#x20;environment&#x20;will&#x20;always&#x20;have&#x20;the&#x20;most&#x20;recent&#x20;critical&#x20;operating&#x20;system&#x20;updates&#x20;and&#x20;service&#x20;packs&#x20;installed.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;0&#x20;-&#x20;Every&#x20;day:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;end&#x20;user&#x20;experienceConfigure&#x20;Automatic&#x20;Updates:&#x20;Scheduled&#x20;install&#x20;day&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;all&#x20;versions&#x20;of&#x20;the&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.2.2\"]}, {\"cis_csc\": [\"7.3\"]}]'),(27339,'Ensure&#x20;&#039;Manage&#x20;preview&#x20;builds&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Disabled&#039;.','This&#x20;policy&#x20;setting&#x20;manage&#x20;which&#x20;updates&#x20;that&#x20;are&#x20;receive&#x20;prior&#x20;to&#x20;the&#x20;update&#x20;being&#x20;released.&#x20;Dev&#x20;Channel:&#x20;Ideal&#x20;for&#x20;highly&#x20;technical&#x20;users.&#x20;Insiders&#x20;in&#x20;the&#x20;Dev&#x20;Channel&#x20;will&#x20;receive&#x20;builds&#x20;from&#x20;our&#x20;active&#x20;development&#x20;branch&#x20;that&#x20;is&#x20;earliest&#x20;in&#x20;a&#x20;development&#x20;cycle.&#x20;These&#x20;builds&#x20;are&#x20;not&#x20;matched&#x20;to&#x20;a&#x20;specific&#x20;Windows&#x20;10&#x20;release.&#x20;Beta&#x20;Channel:&#x20;Ideal&#x20;for&#x20;feature&#x20;explorers&#x20;who&#x20;want&#x20;to&#x20;see&#x20;upcoming&#x20;Windows&#x20;10&#x20;features.&#x20;Your&#x20;feedback&#x20;will&#x20;be&#x20;especially&#x20;important&#x20;here&#x20;as&#x20;it&#x20;will&#x20;help&#x20;our&#x20;engineers&#x20;ensure&#x20;key&#x20;issues&#x20;are&#x20;fixed&#x20;before&#x20;a&#x20;major&#x20;release.&#x20;Release&#x20;Preview&#x20;Channel&#x20;&#40;default&#41;:&#x20;Insiders&#x20;in&#x20;the&#x20;Release&#x20;Preview&#x20;Channel&#x20;will&#x20;have&#x20;access&#x20;to&#x20;the&#x20;upcoming&#x20;release&#x20;of&#x20;Windows&#x20;10&#x20;prior&#x20;to&#x20;it&#x20;being&#x20;released&#x20;to&#x20;the&#x20;world.&#x20;These&#x20;builds&#x20;are&#x20;supported&#x20;by&#x20;Microsoft.&#x20;The&#x20;Release&#x20;Preview&#x20;Channel&#x20;is&#x20;where&#x20;we&#x20;recommend&#x20;companies&#x20;preview&#x20;and&#x20;validate&#x20;upcoming&#x20;Windows&#x20;10&#x20;releases&#x20;before&#x20;broad&#x20;deployment&#x20;within&#x20;their&#x20;organization.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Disabled.&#x20;Note:&#x20;Preview&#x20;Build&#x20;enrollment&#x20;requires&#x20;a&#x20;telemetry&#x20;level&#x20;setting&#x20;of&#x20;2&#x20;or&#x20;higher&#x20;and&#x20;your&#x20;domain&#x20;registered&#x20;on&#x20;insider.windows.com.&#x20;For&#x20;additional&#x20;information&#x20;on&#x20;Preview&#x20;Builds,&#x20;see:&#x20;https://aka.ms/wipforbiz','It&#x20;can&#x20;be&#x20;risky&#x20;for&#x20;experimental&#x20;features&#x20;to&#x20;be&#x20;allowed&#x20;in&#x20;an&#x20;enterprise&#x20;managed&#x20;environment&#x20;because&#x20;this&#x20;can&#x20;introduce&#x20;bugs&#x20;and&#x20;security&#x20;holes&#x20;into&#x20;systems,&#x20;making&#x20;it&#x20;easier&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;access.&#x20;It&#x20;is&#x20;generally&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;production-ready&#x20;builds.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Disabled:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;updates&#x20;offered&#x20;from&#x20;Windows&#x20;UpdateManage&#x20;preview&#x20;builds&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.4.1\"]}, {\"cis_csc\": [\"2.5\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27340,'Ensure&#x20;&#039;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;180&#x20;or&#x20;more&#x20;days&#039;.','This&#x20;policy&#x20;setting&#x20;determines&#x20;when&#x20;Preview&#x20;Build&#x20;or&#x20;Feature&#x20;Updates&#x20;are&#x20;received.&#x20;Defer&#x20;Updates&#x20;This&#x20;enables&#x20;devices&#x20;to&#x20;defer&#x20;taking&#x20;the&#x20;next&#x20;Feature&#x20;Update&#x20;available&#x20;to&#x20;your&#x20;channel&#x20;for&#x20;up&#x20;to&#x20;14&#x20;days&#x20;for&#x20;all&#x20;the&#x20;pre-release&#x20;channels&#x20;and&#x20;up&#x20;to&#x20;365&#x20;days&#x20;for&#x20;the&#x20;Semi-Annual&#x20;Channel.&#x20;Or,&#x20;if&#x20;the&#x20;device&#x20;is&#x20;updating&#x20;from&#x20;the&#x20;Semi-Annual&#x20;Channel,&#x20;a&#x20;version&#x20;for&#x20;the&#x20;device&#x20;to&#x20;move&#x20;to&#x20;and/or&#x20;stay&#x20;on&#x20;until&#x20;the&#x20;policy&#x20;is&#x20;updated&#x20;or&#x20;the&#x20;device&#x20;reaches&#x20;end&#x20;of&#x20;service&#x20;can&#x20;be&#x20;specified.&#x20;Note:&#x20;If&#x20;you&#x20;set&#x20;both&#x20;policies,&#x20;the&#x20;version&#x20;specified&#x20;will&#x20;take&#x20;precedence&#x20;and&#x20;the&#x20;deferrals&#x20;will&#x20;not&#x20;be&#x20;in&#x20;effect.&#x20;Please&#x20;see&#x20;the&#x20;Windows&#x20;Release&#x20;Information&#x20;page&#x20;for&#x20;OS&#x20;version&#x20;information.&#x20;Pause&#x20;Updates&#x20;To&#x20;prevent&#x20;Feature&#x20;Updates&#x20;from&#x20;being&#x20;received&#x20;on&#x20;their&#x20;scheduled&#x20;time,&#x20;you&#x20;can&#x20;temporarily&#x20;pause&#x20;Feature&#x20;Updates.&#x20;The&#x20;pause&#x20;will&#x20;remain&#x20;in&#x20;effect&#x20;for&#x20;35&#x20;days&#x20;from&#x20;the&#x20;specified&#x20;start&#x20;date&#x20;or&#x20;until&#x20;the&#x20;field&#x20;is&#x20;cleared&#x20;&#40;Quality&#x20;Updates&#x20;will&#x20;still&#x20;be&#x20;offered&#41;.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Diagnostic&#x20;Data&quot;&#x20;&#40;formerly&#x20;&quot;Allow&#x20;Telemetry&quot;&#41;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1607,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.&#x20;Note&#x20;#2:&#x20;Prior&#x20;to&#x20;Windows&#x20;10&#x20;R1703,&#x20;values&#x20;above&#x20;180&#x20;days&#x20;are&#x20;not&#x20;recognized&#x20;by&#x20;the&#x20;OS.&#x20;Starting&#x20;with&#x20;Windows&#x20;10&#x20;R1703,&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;days&#x20;you&#x20;can&#x20;defer&#x20;is&#x20;365&#x20;days.','In&#x20;a&#x20;production&#x20;environment,&#x20;it&#x20;is&#x20;preferred&#x20;to&#x20;only&#x20;use&#x20;software&#x20;and&#x20;features&#x20;that&#x20;are&#x20;publicly&#x20;available,&#x20;after&#x20;they&#x20;have&#x20;gone&#x20;through&#x20;rigorous&#x20;testing&#x20;in&#x20;beta.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:&#x20;180&#x20;or&#x20;more&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateManage&#x20;updates&#x20;offered&#x20;from&#x20;Windows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;may&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;It&#x20;is&#x20;provided&#x20;by&#x20;the&#x20;Group&#x20;Policy&#x20;template&#x20;WindowsUpdate.admx/adml&#x20;that&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.&#x20;Note&#x20;#2:&#x20;In&#x20;older&#x20;Microsoft&#x20;Windows&#x20;Administrative&#x20;Templates,&#x20;this&#x20;setting&#x20;was&#x20;initially&#x20;named&#x20;Select&#x20;when&#x20;Feature&#x20;Updates&#x20;are&#x20;received,&#x20;but&#x20;it&#x20;was&#x20;renamed&#x20;to&#x20;Select&#x20;when&#x20;Preview&#x20;Builds&#x20;and&#x20;Feature&#x20;Updates&#x20;are&#x20;received&#x20;starting&#x20;with&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates.','[{\"cis\": [\"18.9.108.4.2\"]}, {\"cis_csc\": [\"2.5\", \"7.3\"]}, {\"pci_dss\": [\"4.1\"]}, {\"hipaa\": [\"164.312.a.2.IV\", \"164.312.e.1\", \"164.312.e.2.I\", \"164.312.e.2.II\"]}, {\"nist_800_53\": [\"SC.8\"]}, {\"tsc\": [\"CC6.1\", \"CC6.7\", \"CC7.2\"]}]'),(27341,'Ensure&#x20;&#039;Select&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#039;&#x20;is&#x20;set&#x20;to&#x20;&#039;Enabled:&#x20;0&#x20;days&#039;.','This&#x20;settings&#x20;controls&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received.&#x20;The&#x20;recommended&#x20;state&#x20;for&#x20;this&#x20;setting&#x20;is:&#x20;Enabled:&#x20;0&#x20;days.&#x20;Note:&#x20;If&#x20;the&#x20;&quot;Allow&#x20;Diagnostic&#x20;Data&quot;&#x20;&#40;formerly&#x20;&quot;Allow&#x20;Telemetry&quot;&#41;&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;0,&#x20;this&#x20;policy&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;Note&#x20;#2:&#x20;Starting&#x20;with&#x20;Windows&#x20;Server&#x20;2016&#x20;RTM&#x20;&#40;Release&#x20;1607&#41;,&#x20;Microsoft&#x20;introduced&#x20;a&#x20;new&#x20;Windows&#x20;Update&#x20;&#40;WU&#41;&#x20;client&#x20;behavior&#x20;called&#x20;Dual&#x20;Scan,&#x20;with&#x20;an&#x20;eye&#x20;to&#x20;cloud-based&#x20;update&#x20;management.&#x20;In&#x20;some&#x20;cases,&#x20;this&#x20;Dual&#x20;Scan&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;Windows&#x20;Updates&#x20;from&#x20;Windows&#x20;Server&#x20;Update&#x20;Services&#x20;&#40;WSUS&#41;&#x20;and/or&#x20;manual&#x20;WU&#x20;updates.&#x20;If&#x20;you&#x20;are&#x20;using&#x20;WSUS&#x20;in&#x20;your&#x20;environment,&#x20;you&#x20;may&#x20;need&#x20;to&#x20;set&#x20;the&#x20;above&#x20;setting&#x20;to&#x20;Not&#x20;Configured&#x20;or&#x20;configure&#x20;the&#x20;setting&#x20;Do&#x20;not&#x20;allow&#x20;update&#x20;deferral&#x20;policies&#x20;to&#x20;cause&#x20;scans&#x20;against&#x20;Windows&#x20;Update&#x20;&#40;added&#x20;in&#x20;the&#x20;Windows&#x20;10&#x20;Release&#x20;1709&#x20;Administrative&#x20;Templates&#41;&#x20;in&#x20;order&#x20;to&#x20;prevent&#x20;the&#x20;Dual&#x20;Scan&#x20;feature&#x20;from&#x20;interfering.','Quality&#x20;Updates&#x20;can&#x20;contain&#x20;important&#x20;bug&#x20;fixes&#x20;and/or&#x20;security&#x20;patches,&#x20;and&#x20;should&#x20;be&#x20;installed&#x20;as&#x20;soon&#x20;as&#x20;possible.','','To&#x20;establish&#x20;the&#x20;recommended&#x20;configuration&#x20;via&#x20;GP,&#x20;set&#x20;the&#x20;following&#x20;UI&#x20;path&#x20;to&#x20;Enabled:0&#x20;days:&#x20;Computer&#x20;ConfigurationPoliciesAdministrative&#x20;TemplatesWindows&#x20;ComponentsWindows&#x20;UpdateWindows&#x20;Update&#x20;for&#x20;BusinessSelect&#x20;when&#x20;Quality&#x20;Updates&#x20;are&#x20;received&#x20;Note:&#x20;This&#x20;Group&#x20;Policy&#x20;path&#x20;does&#x20;not&#x20;exist&#x20;by&#x20;default.&#x20;An&#x20;updated&#x20;Group&#x20;Policy&#x20;template&#x20;&#40;WindowsUpdate.admx/adml&#41;&#x20;is&#x20;required&#x20;-&#x20;it&#x20;is&#x20;included&#x20;with&#x20;the&#x20;Microsoft&#x20;Windows&#x20;10&#x20;Release&#x20;1607&#x20;&amp;&#x20;Server&#x20;2016&#x20;Administrative&#x20;Templates&#x20;&#40;or&#x20;newer&#41;.','[{\"cis\": [\"18.9.108.4.3\"]}, {\"cis_csc\": [\"7.3\"]}, {\"pci_dss\": [\"6.2\"]}, {\"nist_800_53\": [\"SI.2\", \"SA.11\", \"SI.4\"]}, {\"gpg_13\": [\"4.3\"]}, {\"gdpr_IV\": [\"35.7.d\"]}, {\"hipaa\": [\"164.312.b\"]}, {\"tsc\": [\"A1.2\", \"CC6.8\"]}]'),(28000,'Ensure&#x20;/tmp&#x20;is&#x20;a&#x20;separate&#x20;partition.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hard&#x20;link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard&#x20;link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','By&#x20;design&#x20;files&#x20;saved&#x20;to&#x20;/tmp&#x20;should&#x20;have&#x20;no&#x20;expectation&#x20;of&#x20;surviving&#x20;a&#x20;reboot&#x20;of&#x20;the&#x20;system.&#x20;tmpfs&#x20;is&#x20;ram&#x20;based&#x20;and&#x20;all&#x20;files&#x20;stored&#x20;to&#x20;tmpfs&#x20;will&#x20;be&#x20;lost&#x20;when&#x20;the&#x20;system&#x20;is&#x20;rebooted.&#x20;If&#x20;files&#x20;need&#x20;to&#x20;be&#x20;persistent&#x20;through&#x20;a&#x20;reboot,&#x20;they&#x20;should&#x20;be&#x20;saved&#x20;to&#x20;/var/tmp&#x20;not&#x20;/tmp.&#x20;Running&#x20;out&#x20;of&#x20;/tmp&#x20;space&#x20;is&#x20;a&#x20;problem&#x20;regardless&#x20;of&#x20;what&#x20;kind&#x20;of&#x20;filesystem&#x20;lies&#x20;under&#x20;it,&#x20;but&#x20;in&#x20;a&#x20;configuration&#x20;where&#x20;/tmp&#x20;is&#x20;not&#x20;a&#x20;separate&#x20;file&#x20;system&#x20;it&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available,&#x20;as&#x20;the&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;On&#x20;the&#x20;other&#x20;hand,&#x20;a&#x20;RAM-based&#x20;/tmp&#x20;&#40;as&#x20;with&#x20;tmpfs&#41;&#x20;will&#x20;almost&#x20;certainly&#x20;be&#x20;much&#x20;smaller,&#x20;which&#x20;can&#x20;lead&#x20;to&#x20;applications&#x20;filling&#x20;up&#x20;the&#x20;filesystem&#x20;much&#x20;more&#x20;easily.&#x20;Another&#x20;alternative&#x20;is&#x20;to&#x20;create&#x20;a&#x20;dedicated&#x20;partition&#x20;for&#x20;/tmp&#x20;from&#x20;a&#x20;separate&#x20;volume&#x20;or&#x20;disk.&#x20;One&#x20;of&#x20;the&#x20;downsides&#x20;of&#x20;a&#x20;disk-based&#x20;dedicated&#x20;partition&#x20;is&#x20;that&#x20;it&#x20;will&#x20;be&#x20;slower&#x20;than&#x20;tmpfs&#x20;which&#x20;is&#x20;RAM-based.','First&#x20;ensure&#x20;that&#x20;systemd&#x20;is&#x20;correctly&#x20;configured&#x20;to&#x20;ensure&#x20;that&#x20;/tmp&#x20;will&#x20;be&#x20;mounted&#x20;at&#x20;boot&#x20;time.&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;For&#x20;specific&#x20;configuration&#x20;requirements&#x20;of&#x20;the&#x20;/tmp&#x20;mount&#x20;for&#x20;your&#x20;environment,&#x20;modify&#x20;/etc/fstab.&#x20;Example&#x20;of&#x20;using&#x20;tmpfs&#x20;with&#x20;specific&#x20;mount&#x20;options:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime,size=2G&#x20;0&#x20;0&#x20;Example&#x20;of&#x20;using&#x20;a&#x20;volume&#x20;or&#x20;disk&#x20;with&#x20;specific&#x20;mount&#x20;options.&#x20;The&#x20;source&#x20;location&#x20;of&#x20;the&#x20;volume&#x20;or&#x20;disk&#x20;will&#x20;vary&#x20;depending&#x20;on&#x20;your&#x20;environment.&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,nodev,nosuid,noexec&#x20;0&#x20;0.','[{\"cis\": [\"1.1.2.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28001,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28002,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28003,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28004,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var&#x20;and&#x20;cause&#x20;unintended&#x20;behavior&#x20;across&#x20;the&#x20;system&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;See&#x20;man&#x20;auditd.conf&#x20;for&#x20;details.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;from&#x20;exploitation:&#x20;An&#x20;example&#x20;of&#x20;exploiting&#x20;/var&#x20;may&#x20;be&#x20;an&#x20;attacker&#x20;establishing&#x20;a&#x20;hard-link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.3.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0006\"]}]'),(28005,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var.','[{\"cis\": [\"1.1.3.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28006,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;variable&#x20;files&#x20;such&#x20;as&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var.','[{\"cis\": [\"1.1.3.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28007,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.&#x20;Temporary&#x20;files&#x20;residing&#x20;in&#x20;/var/tmp&#x20;are&#x20;to&#x20;be&#x20;preserved&#x20;between&#x20;reboots.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/tmp&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var/tmp&#x20;and&#x20;cause&#x20;potential&#x20;disruption&#x20;to&#x20;daemons&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var/tmp&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;from&#x20;exploitation:&#x20;An&#x20;example&#x20;of&#x20;exploiting&#x20;/var/tmp&#x20;may&#x20;be&#x20;an&#x20;attacker&#x20;establishing&#x20;a&#x20;hard-link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard-link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.4.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28008,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28009,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28010,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28011,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/log&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/log&#x20;directory&#x20;contains&#x20;log&#x20;files&#x20;which&#x20;can&#x20;grow&#x20;quite&#x20;large,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var/log&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limit&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;of&#x20;log&#x20;data:&#x20;As&#x20;/var/log&#x20;contains&#x20;log&#x20;files,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.5.1\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28012,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/log.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(28013,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;log&#x20;files,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/log.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28014,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;log&#x20;files,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/log.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28015,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/log/audit&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/log/audit&#x20;directory&#x20;contains&#x20;the&#x20;audit.log&#x20;file&#x20;which&#x20;can&#x20;grow&#x20;quite&#x20;large,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var/log/audit&#x20;and&#x20;cause&#x20;auditd&#x20;to&#x20;trigger&#x20;it&#039;s&#x20;space_left_action&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;See&#x20;man&#x20;auditd.conf&#x20;for&#x20;details.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var/log/audit&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limit&#x20;an&#x20;attacker&#039;s&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;of&#x20;audit&#x20;data:&#x20;As&#x20;/var/log/audit&#x20;contains&#x20;audit&#x20;logs,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6.1\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28016,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;audit&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/log/audit.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28017,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/log/audit.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log/audit&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28018,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;variable&#x20;files&#x20;such&#x20;as&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/log/audit.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log/audit&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28019,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/home&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/home&#x20;directory&#x20;contains&#x20;user&#x20;generated&#x20;data,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/home&#x20;and&#x20;impact&#x20;all&#x20;local&#x20;users.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/home&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limit&#x20;an&#x20;attacker&#039;s&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;/home&#x20;options&#x20;such&#x20;as&#x20;usrquota/grpquota&#x20;may&#x20;be&#x20;considered&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;that&#x20;users&#x20;can&#x20;have&#x20;on&#x20;each&#x20;other&#x20;with&#x20;regards&#x20;to&#x20;disk&#x20;resource&#x20;exhaustion.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;of&#x20;user&#x20;data:&#x20;As&#x20;/home&#x20;contains&#x20;user&#x20;data,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(28020,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/home&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/home.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/home&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/home.','[{\"cis\": [\"1.1.7.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(28021,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/home&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;user&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/home.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/home&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/home.','[{\"cis\": [\"1.1.7.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28022,'Ensure&#x20;/dev/shm&#x20;is&#x20;a&#x20;separate&#x20;partition.','The&#x20;/dev/shm&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;that&#x20;can&#x20;function&#x20;as&#x20;shared&#x20;memory&#x20;that&#x20;facilitates&#x20;inter&#x20;process&#x20;communication&#x20;&#40;IPC&#41;.','Making&#x20;/dev/shm&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/dev/shm&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hard&#x20;link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard&#x20;link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/dev/shm.','Since&#x20;the&#x20;/dev/shm&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;/dev/shm&#x20;utilizing&#x20;tmpfs&#x20;can&#x20;be&#x20;resized&#x20;using&#x20;the&#x20;size={size}&#x20;parameter&#x20;in&#x20;the&#x20;relevant&#x20;entry&#x20;in&#x20;/etc/fstab.','For&#x20;specific&#x20;configuration&#x20;requirements&#x20;of&#x20;the&#x20;/dev/shm&#x20;mount&#x20;for&#x20;your&#x20;environment,&#x20;modify&#x20;/etc/fstab.&#x20;Example&#x20;of&#x20;using&#x20;tmpfs&#x20;with&#x20;specific&#x20;mount&#x20;options:&#x20;tmpfs&#x20;/dev/shm&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime,size=2G&#x20;0&#x20;0.','[{\"cis\": [\"1.1.8.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28023,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;using&#x20;the&#x20;updated&#x20;options&#x20;from&#x20;/etc/fstab:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm.','[{\"cis\": [\"1.1.8.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28024,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/dev/shm&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm.&#x20;NOTE&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;use&#x20;tmpfs&#x20;as&#x20;the&#x20;device/filesystem&#x20;type&#x20;as&#x20;/dev/shm&#x20;is&#x20;used&#x20;as&#x20;shared&#x20;memory&#x20;space&#x20;by&#x20;applications.','[{\"cis\": [\"1.1.8.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28025,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;using&#x20;the&#x20;updated&#x20;options&#x20;from&#x20;/etc/fstab:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm.','[{\"cis\": [\"1.1.8.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(28026,'Ensure&#x20;gpgcheck&#x20;is&#x20;globally&#x20;activated.','The&#x20;gpgcheck&#x20;option,&#x20;found&#x20;in&#x20;the&#x20;main&#x20;section&#x20;of&#x20;the&#x20;/etc/dnf/dnf.conf&#x20;and&#x20;individual&#x20;/etc/yum.repos.d&#47;&#42;&#x20;files,&#x20;determines&#x20;if&#x20;an&#x20;RPM&#x20;package&#039;s&#x20;signature&#x20;is&#x20;checked&#x20;prior&#x20;to&#x20;its&#x20;installation.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;an&#x20;RPM&#039;s&#x20;package&#x20;signature&#x20;is&#x20;always&#x20;checked&#x20;prior&#x20;to&#x20;installation&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;software&#x20;is&#x20;obtained&#x20;from&#x20;a&#x20;trusted&#x20;source.','','Edit&#x20;/etc/dnf/dnf.conf&#x20;and&#x20;set&#x20;gpgcheck=1&#x20;in&#x20;the&#x20;[main]&#x20;section.&#x20;Example:&#x20;#&#x20;sed&#x20;-i&#x20;&#039;s/^gpgchecks*=s*.&#42;&#47;gpgcheck=1/&#039;&#x20;/etc/dnf/dnf.conf.&#x20;Edit&#x20;any&#x20;failing&#x20;files&#x20;in&#x20;/etc/yum.repos.d&#47;&#42;&#x20;and&#x20;set&#x20;all&#x20;instances&#x20;starting&#x20;with&#x20;gpgcheck&#x20;to&#x20;1.&#x20;Example:&#x20;#&#x20;find&#x20;/etc/yum.repos.d/&#x20;-name&#x20;&quot;*.repo&quot;&#x20;-exec&#x20;echo&#x20;&quot;Checking:&quot;&#x20;{}&#x20;;&#x20;-exec&#x20;sed&#x20;-i&#x20;&#039;s/^gpgchecks*=s*.&#42;&#47;gpgcheck=1/&#039;&#x20;{}&#x20;;.','[{\"cis\": [\"1.2.2\"]}, {\"cis_csc_v8\": [\"7.3\"]}, {\"cis_csc_v7\": [\"3.4\"]}, {\"nist_sp_800-53\": [\"SI-2\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"pci_dss_3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1195\", \"T1195.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28027,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','Advanced&#x20;Intrusion&#x20;Detection&#x20;Environment&#x20;&#40;AIDE&#41;&#x20;is&#x20;a&#x20;intrusion&#x20;detection&#x20;tool&#x20;that&#x20;uses&#x20;predefined&#x20;rules&#x20;to&#x20;check&#x20;the&#x20;integrity&#x20;of&#x20;files&#x20;and&#x20;directories&#x20;in&#x20;the&#x20;Linux&#x20;operating&#x20;system.&#x20;AIDE&#x20;has&#x20;its&#x20;own&#x20;database&#x20;to&#x20;check&#x20;the&#x20;integrity&#x20;of&#x20;files&#x20;and&#x20;directories.&#x20;AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;files&#x20;and&#x20;directories&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;AIDE:&#x20;#&#x20;dnf&#x20;install&#x20;aide.&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Initialize&#x20;AIDE:&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;aide&#x20;--init&#x20;#&#x20;mv&#x20;/var/lib/aide/aide.db.new.gz&#x20;/var/lib/aide/aide.db.gz.','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc_v8\": [\"3.14\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"nist_sp_800-53\": [\"AU-2\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\"]}, {\"hipaa\": [\"164.312(b)\", \"164.312(c)(1)\", \"164.312(c)(2)\"]}, {\"pci_dss_3.2.1\": [\"10.2.1\", \"11.5\"]}, {\"pci_dss_4.0\": [\"10.2.1\", \"10.2.1.1\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"mitre_techniques\": [\"T1565\", \"T1565.001\"]}, {\"mitre_tactics\": [\"TA0001\"]}]'),(28028,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check.&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e.&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/sbin/aide&#x20;--check.&#x20;OR&#x20;if&#x20;aidecheck.service&#x20;and&#x20;aidecheck.timer&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.service&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;[Unit]&#x20;Description=Aide&#x20;Check&#x20;[Service]&#x20;Type=simple&#x20;ExecStart=/usr/sbin/aide&#x20;--check&#x20;[Install]&#x20;WantedBy=multi-user.target.&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.timer&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;[Unit]&#x20;Description=Aide&#x20;check&#x20;every&#x20;day&#x20;at&#x20;5AM&#x20;[Timer]&#x20;OnCalendar=*-*-*&#x20;05:00:00&#x20;Unit=aidecheck.service&#x20;[Install]&#x20;WantedBy=multi-user.target.&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/systemd/system/aidecheck.*&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;#&#x20;systemctl&#x20;enable&#x20;aidecheck.service&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;aidecheck.timer.','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc_v8\": [\"3.14\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"nist_sp_800-53\": [\"AU-2\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\"]}, {\"hipaa\": [\"164.312(b)\", \"164.312(c)(1)\", \"164.312(c)(2)\"]}, {\"pci_dss_3.2.1\": [\"10.2.1\", \"11.5\"]}, {\"pci_dss_4.0\": [\"10.2.1\", \"10.2.1.1\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1036\", \"T1036.005\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28029,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;SELinux&#x20;at&#x20;boot&#x20;time&#41;.','If&#x20;password&#x20;protection&#x20;is&#x20;enabled,&#x20;only&#x20;the&#x20;designated&#x20;superuser&#x20;can&#x20;edit&#x20;a&#x20;Grub&#x20;2&#x20;menu&#x20;item&#x20;by&#x20;pressing&#x20;&quot;e&quot;&#x20;or&#x20;access&#x20;the&#x20;GRUB&#x20;2&#x20;command&#x20;line&#x20;by&#x20;pressing&#x20;&quot;c&quot;.&#x20;If&#x20;GRUB&#x20;2&#x20;is&#x20;set&#x20;up&#x20;to&#x20;boot&#x20;automatically&#x20;to&#x20;a&#x20;password-protected&#x20;menu&#x20;entry&#x20;the&#x20;user&#x20;has&#x20;no&#x20;option&#x20;to&#x20;back&#x20;out&#x20;of&#x20;the&#x20;password&#x20;prompt&#x20;to&#x20;select&#x20;another&#x20;menu&#x20;entry.&#x20;Holding&#x20;the&#x20;SHIFT&#x20;key&#x20;will&#x20;not&#x20;display&#x20;the&#x20;menu&#x20;in&#x20;this&#x20;case.&#x20;The&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;correct&#x20;username&#x20;and&#x20;password.&#x20;If&#x20;unable,&#x20;the&#x20;configuration&#x20;files&#x20;will&#x20;have&#x20;to&#x20;be&#x20;edited&#x20;via&#x20;the&#x20;LiveCD&#x20;or&#x20;other&#x20;means&#x20;to&#x20;fix&#x20;the&#x20;problem.','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub2-setpassword:&#x20;#&#x20;grub2-setpassword&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;Confirm&#x20;password:&#x20;&lt;password&gt;.','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1542\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1046\"]}]'),(28030,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;files&#x20;contain&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration&#x20;files:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;grub.cfg:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grub.cfg&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/boot/grub2/grub.cfg&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;grubenv:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/grubenv&#x20;#&#x20;chmod&#x20;u-x,og-rwx&#x20;/boot/grub2/grubenv&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;user.cfg:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub2/user.cfg&#x20;#&#x20;chmod&#x20;u-x,og-rwx&#x20;/boot/grub2/user.cfg&#x20;Note:&#x20;This&#x20;may&#x20;require&#x20;a&#x20;re-boot&#x20;to&#x20;enable&#x20;the&#x20;change.','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1542\"]}, {\"mitre_tactics\": [\"TA0005\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28031,'Ensure&#x20;core&#x20;dump&#x20;storage&#x20;is&#x20;disabled.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','A&#x20;core&#x20;dump&#x20;includes&#x20;a&#x20;memory&#x20;image&#x20;taken&#x20;at&#x20;the&#x20;time&#x20;the&#x20;operating&#x20;system&#x20;terminates&#x20;an&#x20;application.&#x20;The&#x20;memory&#x20;image&#x20;could&#x20;contain&#x20;sensitive&#x20;data&#x20;and&#x20;is&#x20;generally&#x20;useful&#x20;only&#x20;for&#x20;developers&#x20;trying&#x20;to&#x20;debug&#x20;problems.','','Edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;edit&#x20;or&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=none.','[{\"cis\": [\"1.5.1\"]}, {\"mitre_techniques\": [\"T1005\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28032,'Ensure&#x20;core&#x20;dump&#x20;backtraces&#x20;are&#x20;disabled.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.','A&#x20;core&#x20;dump&#x20;includes&#x20;a&#x20;memory&#x20;image&#x20;taken&#x20;at&#x20;the&#x20;time&#x20;the&#x20;operating&#x20;system&#x20;terminates&#x20;an&#x20;application.&#x20;The&#x20;memory&#x20;image&#x20;could&#x20;contain&#x20;sensitive&#x20;data&#x20;and&#x20;is&#x20;generally&#x20;useful&#x20;only&#x20;for&#x20;developers&#x20;trying&#x20;to&#x20;debug&#x20;problems,&#x20;increasing&#x20;the&#x20;risk&#x20;to&#x20;the&#x20;system.','','Edit&#x20;or&#x20;add&#x20;the&#x20;following&#x20;line&#x20;in&#x20;/etc/systemd/coredump.conf:&#x20;ProcessSizeMax=0.','[{\"cis\": [\"1.5.2\"]}, {\"nist_sp_800-53\": [\"CM-6b\"]}, {\"mitre_techniques\": [\"T1005\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28033,'Ensure&#x20;SELinux&#x20;is&#x20;installed.','SELinux&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Control.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;SELinux:&#x20;#&#x20;dnf&#x20;install&#x20;libselinux.','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1068\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28034,'Ensure&#x20;SELinux&#x20;is&#x20;not&#x20;disabled&#x20;in&#x20;bootloader&#x20;configuration.','Configure&#x20;SELINUX&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;grub&#x20;boot&#x20;parameters.','SELinux&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;grub&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','Files&#x20;created&#x20;while&#x20;SELinux&#x20;is&#x20;disabled&#x20;are&#x20;not&#x20;labeled&#x20;at&#x20;all.&#x20;This&#x20;behavior&#x20;causes&#x20;problems&#x20;when&#x20;changing&#x20;to&#x20;enforcing&#x20;mode&#x20;because&#x20;files&#x20;are&#x20;labeled&#x20;incorrectly&#x20;or&#x20;are&#x20;not&#x20;labeled&#x20;at&#x20;all.&#x20;To&#x20;prevent&#x20;incorrectly&#x20;labeled&#x20;and&#x20;unlabeled&#x20;files&#x20;from&#x20;causing&#x20;problems,&#x20;file&#x20;systems&#x20;are&#x20;automatically&#x20;relabeled&#x20;when&#x20;changing&#x20;from&#x20;the&#x20;disabled&#x20;state&#x20;to&#x20;permissive&#x20;or&#x20;enforcing&#x20;mode.&#x20;This&#x20;can&#x20;be&#x20;a&#x20;long&#x20;running&#x20;process&#x20;that&#x20;should&#x20;be&#x20;accounted&#x20;for&#x20;as&#x20;it&#x20;may&#x20;extend&#x20;downtime&#x20;during&#x20;initial&#x20;re-boot.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;parameters:&#x20;grubby&#x20;--update-kernel&#x20;ALL&#x20;--remove-args&#x20;&quot;selinux=0&#x20;enforcing=0&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;selinux=0&#x20;and&#x20;enforcing=0&#x20;parameters&#x20;if&#x20;they&#x20;were&#x20;created&#x20;by&#x20;the&#x20;deprecated&#x20;grub2-mkconfig&#x20;command:&#x20;#&#x20;grep&#x20;-Prsq&#x20;--&#x20;&#039;h*&#40;[^#&#x0a;&#x0d;]+h+&#41;?kernelopts=&#40;[^#&#x0a;&#x0d;]+h+&#41;?&#40;selinux|enforcing&#41;=0&#x08;&#039;&#x20;/boot/grub2&#x20;/boot/efi&#x20;&amp;&amp;&#x20;grub2-mkconfig&#x20;-o&#x20;&quot;$&#40;grep&#x20;-Prl&#x20;--&#x20;&#039;h*&#40;[^#&#x0a;&#x0d;]+h+&#41;?kernelopts=&#40;[^#&#x0a;&#x0d;]+h+&#41;?&#40;selinux|enforcing&#41;=0&#x08;&#039;&#x20;/boot/grub2&#x20;/boot/efi&#41;.','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1068\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28035,'Ensure&#x20;SELinux&#x20;policy&#x20;is&#x20;configured.','Configure&#x20;SELinux&#x20;to&#x20;meet&#x20;or&#x20;exceed&#x20;the&#x20;default&#x20;targeted&#x20;policy,&#x20;which&#x20;constrains&#x20;daemons&#x20;and&#x20;system&#x20;software&#x20;only.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;at&#x20;least&#x20;the&#x20;default&#x20;recommendations&#x20;are&#x20;met.','','Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUXTYPE&#x20;parameter:&#x20;SELINUXTYPE=targeted.','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1068\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28036,'Ensure&#x20;the&#x20;SELinux&#x20;mode&#x20;is&#x20;not&#x20;disabled.','SELinux&#x20;can&#x20;run&#x20;in&#x20;one&#x20;of&#x20;three&#x20;modes:&#x20;disabled,&#x20;permissive,&#x20;or&#x20;enforcing:&#x20;-&#x20;Enforcing&#x20;-&#x20;Is&#x20;the&#x20;default,&#x20;and&#x20;recommended,&#x20;mode&#x20;of&#x20;operation;&#x20;in&#x20;enforcing&#x20;mode&#x20;SELinux&#x20;operates&#x20;normally,&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy&#x20;on&#x20;the&#x20;entire&#x20;system.&#x20;-&#x20;Permissive&#x20;-&#x20;The&#x20;system&#x20;acts&#x20;as&#x20;if&#x20;SELinux&#x20;is&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy,&#x20;including&#x20;labeling&#x20;objects&#x20;and&#x20;emitting&#x20;access&#x20;denial&#x20;entries&#x20;in&#x20;the&#x20;logs,&#x20;but&#x20;it&#x20;does&#x20;not&#x20;actually&#x20;deny&#x20;any&#x20;operations.&#x20;While&#x20;not&#x20;recommended&#x20;for&#x20;production&#x20;systems,&#x20;permissive&#x20;mode&#x20;can&#x20;be&#x20;helpful&#x20;for&#x20;SELinux&#x20;policy&#x20;development.&#x20;-&#x20;Disabled&#x20;-&#x20;Is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.&#x20;Note:&#x20;you&#x20;can&#x20;set&#x20;individual&#x20;domains&#x20;to&#x20;permissive&#x20;mode&#x20;while&#x20;the&#x20;system&#x20;runs&#x20;in&#x20;enforcing&#x20;mode.&#x20;For&#x20;example,&#x20;to&#x20;make&#x20;the&#x20;httpd_t&#x20;domain&#x20;permissive:&#x20;#&#x20;semanage&#x20;permissive&#x20;-a&#x20;httpd_t.','Running&#x20;SELinux&#x20;in&#x20;disabled&#x20;mode&#x20;is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;SELinux&#039;s&#x20;running&#x20;mode:&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Enforcing:&#x20;#&#x20;setenforce&#x20;1&#x20;OR&#x20;To&#x20;set&#x20;SELinux&#x20;mode&#x20;to&#x20;Permissive:&#x20;#&#x20;setenforce&#x20;0&#x20;Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;For&#x20;Enforcing&#x20;mode:&#x20;SELINUX=enforcing&#x20;OR&#x20;For&#x20;Permissive&#x20;mode:&#x20;SELINUX=permissive.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28037,'Ensure&#x20;the&#x20;SELinux&#x20;mode&#x20;is&#x20;enforcing.','SELinux&#x20;can&#x20;run&#x20;in&#x20;one&#x20;of&#x20;three&#x20;modes:&#x20;disabled,&#x20;permissive,&#x20;or&#x20;enforcing:&#x20;-&#x20;Enforcing&#x20;-&#x20;Is&#x20;the&#x20;default,&#x20;and&#x20;recommended,&#x20;mode&#x20;of&#x20;operation;&#x20;in&#x20;enforcing&#x20;mode&#x20;SELinux&#x20;operates&#x20;normally,&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy&#x20;on&#x20;the&#x20;entire&#x20;system.&#x20;-&#x20;Permissive&#x20;-&#x20;The&#x20;system&#x20;acts&#x20;as&#x20;if&#x20;SELinux&#x20;is&#x20;enforcing&#x20;the&#x20;loaded&#x20;security&#x20;policy,&#x20;including&#x20;labeling&#x20;objects&#x20;and&#x20;emitting&#x20;access&#x20;denial&#x20;entries&#x20;in&#x20;the&#x20;logs,&#x20;but&#x20;it&#x20;does&#x20;not&#x20;actually&#x20;deny&#x20;any&#x20;operations.&#x20;While&#x20;not&#x20;recommended&#x20;for&#x20;production&#x20;systems,&#x20;permissive&#x20;mode&#x20;can&#x20;be&#x20;helpful&#x20;for&#x20;SELinux&#x20;policy&#x20;development.&#x20;-&#x20;Disabled&#x20;-&#x20;Is&#x20;strongly&#x20;discouraged;&#x20;not&#x20;only&#x20;does&#x20;the&#x20;system&#x20;avoid&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.&#x20;Note:&#x20;you&#x20;can&#x20;set&#x20;individual&#x20;domains&#x20;to&#x20;permissive&#x20;mode&#x20;while&#x20;the&#x20;system&#x20;runs&#x20;in&#x20;enforcing&#x20;mode.&#x20;For&#x20;example,&#x20;to&#x20;make&#x20;the&#x20;httpd_t&#x20;domain&#x20;permissive:&#x20;#&#x20;semanage&#x20;permissive&#x20;-a&#x20;httpd_t.','Running&#x20;SELinux&#x20;in&#x20;disabled&#x20;mode&#x20;the&#x20;system&#x20;not&#x20;only&#x20;avoids&#x20;enforcing&#x20;the&#x20;SELinux&#x20;policy,&#x20;it&#x20;also&#x20;avoids&#x20;labeling&#x20;any&#x20;persistent&#x20;objects&#x20;such&#x20;as&#x20;files,&#x20;making&#x20;it&#x20;difficult&#x20;to&#x20;enable&#x20;SELinux&#x20;in&#x20;the&#x20;future.&#x20;Running&#x20;SELinux&#x20;in&#x20;Permissive&#x20;mode,&#x20;though&#x20;helpful&#x20;for&#x20;developing&#x20;SELinux&#x20;policy,&#x20;only&#x20;logs&#x20;access&#x20;denial&#x20;entries,&#x20;but&#x20;does&#x20;not&#x20;deny&#x20;any&#x20;operations.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;SELinux&#039;s&#x20;running&#x20;mode:&#x20;#&#x20;setenforce&#x20;1&#x20;Edit&#x20;the&#x20;/etc/selinux/config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;SELINUX&#x20;parameter:&#x20;For&#x20;Enforcing&#x20;mode:&#x20;SELINUX=enforcing.','[{\"cis\": [\"1.6.1.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28038,'Ensure&#x20;no&#x20;unconfined&#x20;services&#x20;exist.','Unconfined&#x20;processes&#x20;run&#x20;in&#x20;unconfined&#x20;domains.','For&#x20;unconfined&#x20;processes,&#x20;SELinux&#x20;policy&#x20;rules&#x20;are&#x20;applied,&#x20;but&#x20;policy&#x20;rules&#x20;exist&#x20;that&#x20;allow&#x20;processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;almost&#x20;all&#x20;access.&#x20;Processes&#x20;running&#x20;in&#x20;unconfined&#x20;domains&#x20;fall&#x20;back&#x20;to&#x20;using&#x20;DAC&#x20;rules&#x20;exclusively.&#x20;If&#x20;an&#x20;unconfined&#x20;process&#x20;is&#x20;compromised,&#x20;SELinux&#x20;does&#x20;not&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;system&#x20;resources&#x20;and&#x20;data,&#x20;but&#x20;of&#x20;course,&#x20;DAC&#x20;rules&#x20;are&#x20;still&#x20;used.&#x20;SELinux&#x20;is&#x20;a&#x20;security&#x20;enhancement&#x20;on&#x20;top&#x20;of&#x20;DAC&#x20;rules&#x20;-&#x20;it&#x20;does&#x20;not&#x20;replace&#x20;them.','','Investigate&#x20;any&#x20;unconfined&#x20;processes&#x20;found&#x20;during&#x20;the&#x20;audit&#x20;action.&#x20;They&#x20;may&#x20;need&#x20;to&#x20;have&#x20;an&#x20;existing&#x20;security&#x20;context&#x20;assigned&#x20;to&#x20;them&#x20;or&#x20;a&#x20;policy&#x20;built&#x20;for&#x20;them.','[{\"cis\": [\"1.6.1.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28039,'Ensure&#x20;SETroubleshoot&#x20;is&#x20;not&#x20;installed.','The&#x20;SETroubleshoot&#x20;service&#x20;notifies&#x20;desktop&#x20;users&#x20;of&#x20;SELinux&#x20;denials&#x20;through&#x20;a&#x20;user-friendly&#x20;interface.&#x20;The&#x20;service&#x20;provides&#x20;important&#x20;information&#x20;around&#x20;configuration&#x20;errors,&#x20;unauthorized&#x20;intrusions,&#x20;and&#x20;other&#x20;potential&#x20;errors.','The&#x20;SETroubleshoot&#x20;service&#x20;is&#x20;an&#x20;unnecessary&#x20;daemon&#x20;to&#x20;have&#x20;running&#x20;on&#x20;a&#x20;server,&#x20;especially&#x20;if&#x20;X&#x20;Windows&#x20;is&#x20;disabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;setroubleshoot:&#x20;#&#x20;dnf&#x20;remove&#x20;setroubleshoot.','[{\"cis\": [\"1.6.1.7\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28040,'Ensure&#x20;the&#x20;MCS&#x20;Translation&#x20;Service&#x20;&#40;mcstrans&#41;&#x20;is&#x20;not&#x20;installed.','The&#x20;mcstransd&#x20;daemon&#x20;provides&#x20;category&#x20;label&#x20;information&#x20;to&#x20;client&#x20;processes&#x20;requesting&#x20;information.&#x20;The&#x20;label&#x20;translations&#x20;are&#x20;defined&#x20;in&#x20;/etc/selinux/targeted/setrans.conf.','Since&#x20;this&#x20;service&#x20;is&#x20;not&#x20;used&#x20;very&#x20;often,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;amount&#x20;of&#x20;potentially&#x20;vulnerable&#x20;code&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;mcstrans:&#x20;#&#x20;dnf&#x20;remove&#x20;mcstrans.','[{\"cis\": [\"1.6.1.8\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28041,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;uname&#x20;-a&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;OR&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd.','[{\"cis\": [\"1.7.1\"]}, {\"mitre_techniques\": [\"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28042,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-&#x20;or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.','[{\"cis\": [\"1.7.2\"]}, {\"mitre_techniques\": [\"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28043,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net.','[{\"cis\": [\"1.7.3\"]}, {\"mitre_techniques\": [\"T1018\", \"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28044,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/motd&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/motd.','[{\"cis\": [\"1.7.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28045,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue.','[{\"cis\": [\"1.7.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28046,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/issue.net&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/issue.net.','[{\"cis\": [\"1.7.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28047,'Ensure&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;removed.','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;&#40;GDM&#41;&#x20;is&#x20;a&#x20;program&#x20;that&#x20;manages&#x20;graphical&#x20;display&#x20;servers&#x20;and&#x20;handles&#x20;graphical&#x20;user&#x20;logins.','If&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Removing&#x20;the&#x20;GNOME&#x20;Display&#x20;manager&#x20;will&#x20;remove&#x20;the&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;from&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;gdm&#x20;package&#x20;#&#x20;dnf&#x20;remove&#x20;gdm.','[{\"cis\": [\"1.8.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0002\"]}]'),(28048,'Ensure&#x20;XDCMP&#x20;is&#x20;not&#x20;enabled.','X&#x20;Display&#x20;Manager&#x20;Control&#x20;Protocol&#x20;&#40;XDMCP&#41;&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;authenticated&#x20;access&#x20;to&#x20;display&#x20;management&#x20;services&#x20;for&#x20;remote&#x20;displays.','XDMCP&#x20;is&#x20;inherently&#x20;insecure.&#x20;-&#x20;XDMCP&#x20;is&#x20;not&#x20;a&#x20;ciphered&#x20;protocol.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;capture&#x20;keystrokes&#x20;entered&#x20;by&#x20;a&#x20;user.&#x20;-&#x20;XDMCP&#x20;is&#x20;vulnerable&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;steal&#x20;the&#x20;credentials&#x20;of&#x20;legitimate&#x20;users&#x20;by&#x20;impersonating&#x20;the&#x20;XDMCP&#x20;server.','','Edit&#x20;the&#x20;file&#x20;/etc/gdm/custom.conf&#x20;and&#x20;remove&#x20;the&#x20;line:&#x20;Enable=true.','[{\"cis\": [\"1.8.10\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1040\", \"T1056\", \"T1056.001\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1050\"]}]'),(28049,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Use&#x20;your&#x20;package&#x20;manager&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;on&#x20;the&#x20;system&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;The&#x20;following&#x20;command&#x20;will&#x20;install&#x20;all&#x20;available&#x20;updates:&#x20;#&#x20;dnf&#x20;update.&#x20;Once&#x20;the&#x20;update&#x20;process&#x20;is&#x20;complete,&#x20;verify&#x20;if&#x20;reboot&#x20;is&#x20;required&#x20;to&#x20;load&#x20;changes.&#x20;dnf&#x20;needs-restarting&#x20;-r.','[{\"cis\": [\"1.9\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"pci_dss_3.2.1\": [\"6.2\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1211\"]}, {\"mitre_tactics\": [\"TA0004\", \"TA0008\"]}, {\"mitre_mitigations\": [\"M1051\"]}]'),(28050,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;not&#x20;legacy.','The&#x20;system-wide&#x20;crypto-policies&#x20;followed&#x20;by&#x20;the&#x20;crypto&#x20;core&#x20;components&#x20;allow&#x20;consistently&#x20;deprecating&#x20;and&#x20;disabling&#x20;algorithms&#x20;system-wide.&#x20;The&#x20;individual&#x20;policy&#x20;levels&#x20;&#40;DEFAULT,&#x20;LEGACY,&#x20;FUTURE,&#x20;and&#x20;FIPS&#41;&#x20;are&#x20;included&#x20;in&#x20;the&#x20;crypto-policies&#40;7&#41;&#x20;package.','If&#x20;the&#x20;Legacy&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;selected,&#x20;it&#x20;includes&#x20;support&#x20;for&#x20;TLS&#x20;1.0,&#x20;TLS&#x20;1.1,&#x20;and&#x20;SSH2&#x20;protocols&#x20;or&#x20;later.&#x20;The&#x20;algorithms&#x20;DSA,&#x20;3DES,&#x20;and&#x20;RC4&#x20;are&#x20;allowed,&#x20;while&#x20;RSA&#x20;and&#x20;Diffie-Hellman&#x20;parameters&#x20;are&#x20;accepted&#x20;if&#x20;larger&#x20;than&#x20;1023-bits.&#x20;These&#x20;legacy&#x20;protocols&#x20;and&#x20;algorithms&#x20;can&#x20;make&#x20;the&#x20;system&#x20;vulnerable&#x20;to&#x20;attacks,&#x20;including&#x20;those&#x20;listed&#x20;in&#x20;RFC&#x20;7457.','Environments&#x20;that&#x20;require&#x20;compatibility&#x20;with&#x20;older&#x20;insecure&#x20;protocols&#x20;may&#x20;require&#x20;the&#x20;use&#x20;of&#x20;the&#x20;less&#x20;secure&#x20;LEGACY&#x20;policy&#x20;level.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;&lt;CRYPTO&#x20;POLICY&gt;&#x20;Example:&#x20;#&#x20;update-crypto-policies&#x20;--set&#x20;DEFAULT&#x20;Run&#x20;the&#x20;following&#x20;to&#x20;make&#x20;the&#x20;updated&#x20;system-wide&#x20;crypto&#x20;policy&#x20;active&#x20;#&#x20;update-crypto-policies.','[{\"cis\": [\"1.10\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"nist_sp_800-53\": [\"SC-8\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.10.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}]'),(28051,'Ensure&#x20;time&#x20;synchronization&#x20;is&#x20;in&#x20;use.','System&#x20;time&#x20;should&#x20;be&#x20;synchronized&#x20;between&#x20;all&#x20;systems&#x20;in&#x20;an&#x20;environment.&#x20;This&#x20;is&#x20;typically&#x20;done&#x20;by&#x20;establishing&#x20;an&#x20;authoritative&#x20;time&#x20;server&#x20;or&#x20;set&#x20;of&#x20;servers&#x20;and&#x20;having&#x20;all&#x20;systems&#x20;synchronize&#x20;their&#x20;clocks&#x20;to&#x20;them.&#x20;Note:&#x20;If&#x20;another&#x20;method&#x20;for&#x20;time&#x20;synchronization&#x20;is&#x20;being&#x20;used,&#x20;this&#x20;section&#x20;may&#x20;be&#x20;skipped.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;like&#x20;Kerberos&#x20;and&#x20;also&#x20;ensures&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise,&#x20;which&#x20;aids&#x20;in&#x20;forensic&#x20;investigations.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;chrony:&#x20;#&#x20;dnf&#x20;install&#x20;chrony.','[{\"cis\": [\"2.1.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"nist_sp_800-53\": [\"AU-3\", \"AU-12\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28052,'Ensure&#x20;chrony&#x20;is&#x20;configured.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;which&#x20;implements&#x20;the&#x20;Network&#x20;Time&#x20;Protocol&#x20;&#40;NTP&#41;&#x20;and&#x20;is&#x20;designed&#x20;to&#x20;synchronize&#x20;system&#x20;clocks&#x20;across&#x20;a&#x20;variety&#x20;of&#x20;systems&#x20;and&#x20;use&#x20;a&#x20;source&#x20;that&#x20;is&#x20;highly&#x20;accurate.&#x20;More&#x20;information&#x20;on&#x20;chrony&#x20;can&#x20;be&#x20;found&#x20;at&#x20;http://chrony.tuxfamily.org/.&#x20;chrony&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;be&#x20;a&#x20;client&#x20;and/or&#x20;a&#x20;server.','If&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;working&#x20;properly.','','Add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;to&#x20;/etc/chrony.conf&#x20;as&#x20;appropriate:&#x20;server&#x20;&lt;remote-server&gt;&#x20;Add&#x20;or&#x20;edit&#x20;the&#x20;OPTIONS&#x20;in&#x20;/etc/sysconfig/chronyd&#x20;to&#x20;include&#x20;&#039;-u&#x20;chrony&#039;:&#x20;OPTIONS=&quot;-u&#x20;chrony&quot;.','[{\"cis\": [\"2.1.2\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"nist_sp_800-53\": [\"AU-3\", \"AU-12\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28053,'Ensure&#x20;xorg-x11-server-common&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Many&#x20;Linux&#x20;systems&#x20;run&#x20;applications&#x20;which&#x20;require&#x20;a&#x20;Java&#x20;runtime.&#x20;Some&#x20;Linux&#x20;Java&#x20;packages&#x20;have&#x20;a&#x20;dependency&#x20;on&#x20;specific&#x20;X&#x20;Windows&#x20;xorg-x11-fonts.&#x20;One&#x20;workaround&#x20;to&#x20;avoid&#x20;this&#x20;dependency&#x20;is&#x20;to&#x20;use&#x20;the&#x20;&quot;headless&quot;&#x20;Java&#x20;packages&#x20;for&#x20;your&#x20;specific&#x20;Java&#x20;runtime.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;X&#x20;Windows&#x20;Server&#x20;packages:&#x20;#&#x20;dnf&#x20;remove&#x20;xorg-x11-server-common.','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28054,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop,&#x20;mask&#x20;and&#x20;remove&#x20;avahi:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;avahi-daemon.service&#x20;#&#x20;dnf&#x20;remove&#x20;avahi.','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28055,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Note:&#x20;Removing&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system.','Disabling&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;cups:&#x20;#&#x20;dnf&#x20;remove&#x20;cups.','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28056,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;dhcp-server&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dhcp:&#x20;#&#x20;dnf&#x20;remove&#x20;dhcp-server.','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28057,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;bind:&#x20;#&#x20;dnf&#x20;remove&#x20;bind.','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]');
INSERT INTO `tsca` VALUES (28058,'Ensure&#x20;VSFTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','FTP&#x20;&#40;File&#x20;Transfer&#x20;Protocol&#41;&#x20;is&#x20;a&#x20;traditional&#x20;and&#x20;widely&#x20;used&#x20;standard&#x20;tool&#x20;for&#x20;transferring&#x20;files&#x20;between&#x20;a&#x20;server&#x20;and&#x20;clients&#x20;over&#x20;a&#x20;network,&#x20;especially&#x20;where&#x20;no&#x20;authentication&#x20;is&#x20;necessary&#x20;&#40;permits&#x20;anonymous&#x20;users&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#41;.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;vsftpd:&#x20;#&#x20;dnf&#x20;remove&#x20;vsftpd.','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28059,'Ensure&#x20;TFTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;protocol&#x20;for&#x20;exchanging&#x20;files&#x20;between&#x20;two&#x20;TCP/IP&#x20;machines.&#x20;TFTP&#x20;servers&#x20;allow&#x20;connections&#x20;from&#x20;a&#x20;TFTP&#x20;Client&#x20;for&#x20;sending&#x20;and&#x20;receiving&#x20;files.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;TFTP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;TFTP&#x20;does&#x20;not&#x20;have&#x20;built-in&#x20;encryption,&#x20;access&#x20;control&#x20;or&#x20;authentication.&#x20;This&#x20;makes&#x20;it&#x20;very&#x20;easy&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;exploit&#x20;TFTP&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;files.','TFTP&#x20;is&#x20;often&#x20;used&#x20;to&#x20;provide&#x20;files&#x20;for&#x20;network&#x20;booting&#x20;such&#x20;as&#x20;for&#x20;PXE&#x20;based&#x20;installation&#x20;of&#x20;servers.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;tftp-server:&#x20;#&#x20;dnf&#x20;remove&#x20;tftp-server.','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28060,'Ensure&#x20;a&#x20;web&#x20;server&#x20;is&#x20;not&#x20;installed.','Web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;packages&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Note:&#x20;Several&#x20;http&#x20;servers&#x20;exist.&#x20;They&#x20;should&#x20;also&#x20;be&#x20;audited,&#x20;and&#x20;removed,&#x20;if&#x20;not&#x20;required.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;httpd&#x20;and&#x20;nginx:&#x20;#&#x20;dnf&#x20;remove&#x20;httpd&#x20;nginx.','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28061,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;is&#x20;not&#x20;installed.','dovecot&#x20;is&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Note:&#x20;Several&#x20;IMAP/POP3&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;These&#x20;should&#x20;also&#x20;be&#x20;audited&#x20;and&#x20;the&#x20;packages&#x20;removed&#x20;if&#x20;not&#x20;required.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dovecot&#x20;and&#x20;cyrus-imapd:&#x20;#&#x20;dnf&#x20;remove&#x20;dovecot&#x20;cyrus-imapd.','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28062,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;package&#x20;can&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;samba:&#x20;#&#x20;dnf&#x20;remove&#x20;samba.','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1005\", \"T1039\", \"T1083\", \"T1135\", \"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28063,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.&#x20;Note:&#x20;Several&#x20;HTTP&#x20;proxy&#x20;servers&#x20;exist.&#x20;These&#x20;should&#x20;be&#x20;checked&#x20;and&#x20;removed&#x20;unless&#x20;required.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;squid&#x20;package:&#x20;#&#x20;dnf&#x20;remove&#x20;squid.','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28064,'Ensure&#x20;net-snmp&#x20;is&#x20;not&#x20;installed.','Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;is&#x20;a&#x20;widely&#x20;used&#x20;protocol&#x20;for&#x20;monitoring&#x20;the&#x20;health&#x20;and&#x20;welfare&#x20;of&#x20;network&#x20;equipment,&#x20;computer&#x20;equipment&#x20;and&#x20;devices&#x20;like&#x20;UPSs.&#x20;Net-SNMP&#x20;is&#x20;a&#x20;suite&#x20;of&#x20;applications&#x20;used&#x20;to&#x20;implement&#x20;SNMPv1&#x20;&#40;RFC&#x20;1157&#41;,&#x20;SNMPv2&#x20;&#40;RFCs&#x20;1901-1908&#41;,&#x20;and&#x20;SNMPv3&#x20;&#40;RFCs&#x20;3411-3418&#41;&#x20;using&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6.&#x20;Support&#x20;for&#x20;SNMPv2&#x20;classic&#x20;&#40;a.k.a.&#x20;&quot;SNMPv2&#x20;historic&quot;&#x20;-&#x20;RFCs&#x20;1441-1452&#41;&#x20;was&#x20;dropped&#x20;with&#x20;the&#x20;4.0&#x20;release&#x20;of&#x20;the&#x20;UCD-snmp&#x20;package.&#x20;The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3&#x20;replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2&#x20;with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;required:&#x20;-&#x20;The&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;for&#x20;SNMP&#x20;v3&#x20;only.&#x20;User&#x20;Authentication&#x20;and&#x20;Message&#x20;Encryption&#x20;should&#x20;be&#x20;configured.&#x20;-&#x20;If&#x20;SNMP&#x20;v2&#x20;is&#x20;absolutely&#x20;necessary,&#x20;modify&#x20;the&#x20;community&#x20;strings&#039;&#x20;values.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;net-snmpd:&#x20;#&#x20;dnf&#x20;remove&#x20;net-snmp.','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"2.6\", \"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28065,'Ensure&#x20;telnet-server&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet-server&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;daemon,&#x20;which&#x20;accepts&#x20;connections&#x20;from&#x20;users&#x20;from&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;a&#x20;user&#x20;with&#x20;access&#x20;to&#x20;sniff&#x20;network&#x20;traffic&#x20;the&#x20;ability&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;telnet-server&#x20;package:&#x20;#&#x20;dnf&#x20;remove&#x20;telnet-server.','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"2.6\", \"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28066,'Ensure&#x20;dnsmasq&#x20;is&#x20;not&#x20;installed.','dnsmasq&#x20;is&#x20;a&#x20;lightweight&#x20;tool&#x20;that&#x20;provides&#x20;DNS&#x20;caching,&#x20;DNS&#x20;forwarding&#x20;and&#x20;DHCP&#x20;&#40;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#41;&#x20;services.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;caching,&#x20;DNS&#x20;forwarding&#x20;and/or&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;dnsmasq:&#x20;#&#x20;dnf&#x20;remove&#x20;dnsmasq.','[{\"cis\": [\"2.2.14\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28067,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.&#x20;Note:&#x20;-&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;postfix&#x20;mail&#x20;server.&#x20;-&#x20;Depending&#x20;on&#x20;your&#x20;environment&#x20;you&#x20;may&#x20;have&#x20;an&#x20;alternative&#x20;MTA&#x20;installed&#x20;such&#x20;as&#x20;sendmail.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case&#x20;consult&#x20;the&#x20;documentation&#x20;for&#x20;your&#x20;installed&#x20;MTA&#x20;to&#x20;configure&#x20;the&#x20;recommended&#x20;state.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix.','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1018\", \"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28068,'Ensure&#x20;nfs-utils&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;nfs-server&#x20;service&#x20;is&#x20;masked.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;require&#x20;network&#x20;shares,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;nfs-utils&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Many&#x20;of&#x20;the&#x20;libvirt&#x20;packages&#x20;used&#x20;by&#x20;Enterprise&#x20;Linux&#x20;virtualization&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;nfs-utils&#x20;package.&#x20;If&#x20;the&#x20;nfs-utils&#x20;package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency,&#x20;the&#x20;nfs-server&#x20;service&#x20;should&#x20;be&#x20;disabled&#x20;and&#x20;masked&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs-utils:&#x20;#&#x20;dnf&#x20;remove&#x20;nfs-utils&#x20;OR&#x20;If&#x20;the&#x20;nfs-utils&#x20;package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;nfs-server&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;nfs-server.','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1005\", \"T1039\", \"T1083\", \"T1135\", \"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28069,'Ensure&#x20;rpcbind&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rpcbind&#x20;services&#x20;are&#x20;masked.','The&#x20;rpcbind&#x20;utility&#x20;maps&#x20;RPC&#x20;services&#x20;to&#x20;the&#x20;ports&#x20;on&#x20;which&#x20;they&#x20;listen.&#x20;RPC&#x20;processes&#x20;notify&#x20;rpcbind&#x20;when&#x20;they&#x20;start,&#x20;registering&#x20;the&#x20;ports&#x20;they&#x20;are&#x20;listening&#x20;on&#x20;and&#x20;the&#x20;RPC&#x20;program&#x20;numbers&#x20;they&#x20;expect&#x20;to&#x20;serve.&#x20;The&#x20;client&#x20;system&#x20;then&#x20;contacts&#x20;rpcbind&#x20;on&#x20;the&#x20;server&#x20;with&#x20;a&#x20;particular&#x20;RPC&#x20;program&#x20;number.&#x20;The&#x20;rpcbind&#x20;service&#x20;redirects&#x20;the&#x20;client&#x20;to&#x20;the&#x20;proper&#x20;port&#x20;number&#x20;so&#x20;it&#x20;can&#x20;communicate&#x20;with&#x20;the&#x20;requested&#x20;service.&#x20;Portmapper&#x20;is&#x20;an&#x20;RPC&#x20;service,&#x20;which&#x20;always&#x20;listens&#x20;on&#x20;tcp&#x20;and&#x20;udp&#x20;111,&#x20;and&#x20;is&#x20;used&#x20;to&#x20;map&#x20;other&#x20;RPC&#x20;services&#x20;&#40;such&#x20;as&#x20;nfs,&#x20;nlockmgr,&#x20;quotad,&#x20;mountd,&#x20;etc.&#41;&#x20;to&#x20;their&#x20;corresponding&#x20;port&#x20;number&#x20;on&#x20;the&#x20;server.&#x20;When&#x20;a&#x20;remote&#x20;host&#x20;makes&#x20;an&#x20;RPC&#x20;call&#x20;to&#x20;that&#x20;server,&#x20;it&#x20;first&#x20;consults&#x20;with&#x20;portmap&#x20;to&#x20;determine&#x20;where&#x20;the&#x20;RPC&#x20;server&#x20;is&#x20;listening.','A&#x20;small&#x20;request&#x20;&#40;~82&#x20;bytes&#x20;via&#x20;UDP&#41;&#x20;sent&#x20;to&#x20;the&#x20;Portmapper&#x20;generates&#x20;a&#x20;large&#x20;response&#x20;&#40;7x&#x20;to&#x20;28x&#x20;amplification&#41;,&#x20;which&#x20;makes&#x20;it&#x20;a&#x20;suitable&#x20;tool&#x20;for&#x20;DDoS&#x20;attacks.&#x20;If&#x20;rpcbind&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;rpcbind&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Many&#x20;of&#x20;the&#x20;libvirt&#x20;packages&#x20;used&#x20;by&#x20;Enterprise&#x20;Linux&#x20;virtualization,&#x20;and&#x20;the&#x20;nfs-utils&#x20;package&#x20;used&#x20;for&#x20;The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;,&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;rpcbind&#x20;package.&#x20;If&#x20;the&#x20;rpcbind&#x20;package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency,&#x20;the&#x20;services&#x20;rpcbind.service&#x20;and&#x20;rpcbind.socket&#x20;should&#x20;be&#x20;stopped&#x20;and&#x20;masked&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rpcbind:&#x20;#&#x20;dnf&#x20;remove&#x20;rpcbind&#x20;OR&#x20;If&#x20;the&#x20;rpcbind&#x20;package&#x20;is&#x20;required&#x20;as&#x20;a&#x20;dependency,&#x20;run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;the&#x20;rpcbind.service&#x20;and&#x20;rpcbind.socket&#x20;systemd&#x20;units:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rpcbind.service&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rpcbind.socket.','[{\"cis\": [\"2.2.17\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1498\", \"T1498.002\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28070,'Ensure&#x20;rsync-daemon&#x20;is&#x20;not&#x20;installed&#x20;or&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;masked.','The&#x20;rsyncd&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','Unless&#x20;required,&#x20;the&#x20;rsync-daemon&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;area&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;rsyncd&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.&#x20;Note:&#x20;If&#x20;a&#x20;required&#x20;dependency&#x20;exists&#x20;for&#x20;the&#x20;rsync-daemon&#x20;package,&#x20;but&#x20;the&#x20;rsyncd&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;service&#x20;should&#x20;be&#x20;masked.','There&#x20;are&#x20;packages&#x20;that&#x20;are&#x20;dependent&#x20;on&#x20;the&#x20;rsync&#x20;package.&#x20;If&#x20;the&#x20;rsync&#x20;package&#x20;is&#x20;removed,&#x20;these&#x20;packages&#x20;will&#x20;be&#x20;removed&#x20;as&#x20;well.&#x20;Before&#x20;removing&#x20;the&#x20;rsync-daemon&#x20;package,&#x20;review&#x20;any&#x20;dependent&#x20;packages&#x20;to&#x20;determine&#x20;if&#x20;they&#x20;are&#x20;required&#x20;on&#x20;the&#x20;system.&#x20;If&#x20;a&#x20;dependent&#x20;package&#x20;is&#x20;required,&#x20;mask&#x20;the&#x20;rsyncd&#x20;service&#x20;and&#x20;leave&#x20;the&#x20;rsync-daemon&#x20;package&#x20;installed.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;rsync&#x20;package:&#x20;#&#x20;dnf&#x20;remove&#x20;rsync-daemon&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;mask&#x20;the&#x20;rsyncd&#x20;service:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;rsyncd.','[{\"cis\": [\"2.2.18\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1105\", \"T1203\", \"T1210\", \"T1543\", \"T1543.002\", \"T1570\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28071,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;telnet&#x20;package:&#x20;#&#x20;dnf&#x20;remove&#x20;telnet.','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1040\", \"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0006\", \"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}]'),(28072,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;the&#x20;LDAP&#x20;client&#x20;will&#x20;prevent&#x20;or&#x20;inhibit&#x20;using&#x20;LDAP&#x20;for&#x20;authentication&#x20;in&#x20;your&#x20;environment.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;openldap-clients&#x20;package:&#x20;#&#x20;dnf&#x20;remove&#x20;openldap-clients.','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28073,'Ensure&#x20;TFTP&#x20;client&#x20;is&#x20;not&#x20;installed.','Trivial&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;TFTP&#41;&#x20;is&#x20;a&#x20;simple&#x20;protocol&#x20;for&#x20;exchanging&#x20;files&#x20;between&#x20;two&#x20;TCP/IP&#x20;machines.&#x20;TFTP&#x20;servers&#x20;allow&#x20;connections&#x20;from&#x20;a&#x20;TFTP&#x20;Client&#x20;for&#x20;sending&#x20;and&#x20;receiving&#x20;files.','TFTP&#x20;does&#x20;not&#x20;have&#x20;built-in&#x20;encryption,&#x20;access&#x20;control&#x20;or&#x20;authentication.&#x20;This&#x20;makes&#x20;it&#x20;very&#x20;easy&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;exploit&#x20;TFTP&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;files.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;tftp:&#x20;#&#x20;dnf&#x20;remove&#x20;tftp.','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28074,'Ensure&#x20;FTP&#x20;client&#x20;is&#x20;not&#x20;installed.','FTP&#x20;&#40;File&#x20;Transfer&#x20;Protocol&#41;&#x20;is&#x20;a&#x20;traditional&#x20;and&#x20;widely&#x20;used&#x20;standard&#x20;tool&#x20;for&#x20;transferring&#x20;files&#x20;between&#x20;a&#x20;server&#x20;and&#x20;clients&#x20;over&#x20;a&#x20;network,&#x20;especially&#x20;where&#x20;no&#x20;authentication&#x20;is&#x20;necessary&#x20;&#40;permits&#x20;anonymous&#x20;users&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;server&#41;.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;SFTP&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ftp:&#x20;#&#x20;dnf&#x20;remove&#x20;ftp.','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28075,'Ensure&#x20;nftables&#x20;is&#x20;installed.','nftables&#x20;provides&#x20;a&#x20;new&#x20;in-kernel&#x20;packet&#x20;classification&#x20;framework&#x20;that&#x20;is&#x20;based&#x20;on&#x20;a&#x20;network-specific&#x20;Virtual&#x20;Machine&#x20;&#40;VM&#41;&#x20;and&#x20;a&#x20;new&#x20;nft&#x20;userspace&#x20;command&#x20;line&#x20;tool.&#x20;nftables&#x20;reuses&#x20;the&#x20;existing&#x20;Netfilter&#x20;subsystems&#x20;such&#x20;as&#x20;the&#x20;existing&#x20;hook&#x20;infrastructure,&#x20;the&#x20;connection&#x20;tracking&#x20;system,&#x20;NAT,&#x20;userspace&#x20;queuing&#x20;and&#x20;logging&#x20;subsystem.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;the&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;nftables&#x20;#&#x20;dnf&#x20;install&#x20;nftables.','[{\"cis\": [\"3.4.1.1\"]}, {\"cis_csc_v8\": [\"4.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"nist_sp_800-53\": [\"CA-9\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(28076,'Ensure&#x20;at&#x20;least&#x20;one&#x20;nftables&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','Without&#x20;a&#x20;table,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','Adding&#x20;or&#x20;modifying&#x20;firewall&#x20;rules&#x20;can&#x20;cause&#x20;loss&#x20;of&#x20;connectivity&#x20;to&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;Example&#x20;if&#x20;FirewallD&#x20;is&#x20;not&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter&#x20;Note:&#x20;FirewallD&#x20;uses&#x20;the&#x20;table&#x20;inet&#x20;firewalld&#x20;NFTables&#x20;table&#x20;that&#x20;is&#x20;created&#x20;when&#x20;FirewallD&#x20;is&#x20;installed.','[{\"cis\": [\"3.4.2.2\"]}, {\"cis_csc_v8\": [\"4.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"nist_sp_800-53\": [\"CA-9\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}]'),(28077,'Ensure&#x20;nftables&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','If&#x20;configuring&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}.','[{\"cis\": [\"3.4.2.3\"]}, {\"cis_csc_v8\": [\"4.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"nist_sp_800-53\": [\"CA-9\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}]'),(28078,'Ensure&#x20;nftables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;traversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;explicitly&#x20;permit&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;deny&#x20;unacceptable&#x20;usage.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;the&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','If&#x20;NFTables&#x20;utility&#x20;is&#x20;in&#x20;use&#x20;on&#x20;your&#x20;system:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}.','[{\"cis\": [\"3.4.2.7\"]}, {\"cis_csc_v8\": [\"4.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"nist_sp_800-53\": [\"CA-9\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}]'),(28079,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd:&#x20;#&#x20;dnf&#x20;install&#x20;audit.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-3\", \"AU-3(1)\", \"AU-12\", \"SI-5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"9.4.5\", \"10.2\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28080,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub2&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration&#x20;with&#x20;audit=1:&#x20;#&#x20;grubby&#x20;--update-kernel&#x20;ALL&#x20;--args&#x20;&#039;audit=1&#039;.','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28081,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient.','The&#x20;backlog&#x20;limit&#x20;has&#x20;a&#x20;default&#x20;setting&#x20;of&#x20;64.','During&#x20;boot&#x20;if&#x20;audit=1,&#x20;then&#x20;the&#x20;backlog&#x20;will&#x20;hold&#x20;64&#x20;records.&#x20;If&#x20;more&#x20;that&#x20;64&#x20;records&#x20;are&#x20;created&#x20;during&#x20;boot,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;add&#x20;audit_backlog_limit=&lt;BACKLOG&#x20;SIZE&gt;&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;#&#x20;grubby&#x20;--update-kernel&#x20;ALL&#x20;--args&#x20;&#039;audit_backlog_limit=&lt;BACKLOG&#x20;SIZE&gt;&#039;&#x20;Example:&#x20;#&#x20;grubby&#x20;--update-kernel&#x20;ALL&#x20;--args&#x20;&#039;audit_backlog_limit=8192&#039;.','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"SI-5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28082,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd.','[{\"cis\": [\"4.1.1.4\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"SI-5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28083,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;.','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"nist_sp_800-53\": [\"AU-8\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1053\"]}]'),(28084,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs.','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"nist_sp_800-53\": [\"AU-8\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28085,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.&#x20;The&#x20;admin_space_left_action&#x20;parameter&#x20;tells&#x20;the&#x20;system&#x20;what&#x20;action&#x20;to&#x20;take&#x20;when&#x20;the&#x20;system&#x20;has&#x20;detected&#x20;that&#x20;it&#x20;is&#x20;low&#x20;on&#x20;disk&#x20;space.&#x20;Valid&#x20;values&#x20;are&#x20;ignore,&#x20;syslog,&#x20;suspend,&#x20;single,&#x20;and&#x20;halt.&#x20;-&#x20;ignore,&#x20;the&#x20;audit&#x20;daemon&#x20;does&#x20;nothing&#x20;-&#x20;Syslog,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;issue&#x20;a&#x20;warning&#x20;to&#x20;syslog&#x20;-&#x20;Suspend,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;stop&#x20;writing&#x20;records&#x20;to&#x20;the&#x20;disk&#x20;-&#x20;single,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;put&#x20;the&#x20;computer&#x20;system&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;-&#x20;halt,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;shutdown&#x20;the&#x20;system.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','If&#x20;the&#x20;admin_space_left_action&#x20;parameter&#x20;is&#x20;set&#x20;to&#x20;halt&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;shutdown&#x20;the&#x20;system&#x20;when&#x20;the&#x20;disk&#x20;partition&#x20;containing&#x20;the&#x20;audit&#x20;logs&#x20;becomes&#x20;full.','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root.&#x20;set&#x20;admin_space_left_action&#x20;to&#x20;either&#x20;halt&#x20;or&#x20;single&#x20;in&#x20;/etc/audit/auditd.conf.&#x20;Example:&#x20;admin_space_left_action&#x20;=&#x20;halt.','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.3\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-8\", \"AU-12\", \"SI-5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.7\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"soc_2\": [\"A1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28086,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers,&#x20;or&#x20;files&#x20;in&#x20;/etc/sudoers.d,&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#40;s&#41;&#x20;or&#x20;related&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope&quot;.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;and&#x20;/etc/sudoers.d&#x20;files&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;the&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;-w&#x20;/etc/sudoers.d&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-scope.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.1\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}]'),(28087,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.&#x20;Note:&#x20;This&#x20;setting&#x20;will&#x20;require&#x20;the&#x20;system&#x20;to&#x20;be&#x20;rebooted&#x20;to&#x20;update&#x20;the&#x20;active&#x20;auditd&#x20;configuration&#x20;settings.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line&#x20;-e&#x20;2&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file:&#x20;Example:&#x20;#&#x20;printf&#x20;--&#x20;&quot;-e&#x20;2&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.20\"]}, {\"cis_csc_v8\": [\"3.3\", \"8.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"AU-3\", \"AU-3(1)\", \"MP-2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\", \"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\", \"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\", \"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\", \"CC7.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28088,'Ensure&#x20;the&#x20;running&#x20;and&#x20;on&#x20;disk&#x20;configuration&#x20;is&#x20;the&#x20;same.','The&#x20;Audit&#x20;system&#x20;have&#x20;both&#x20;on&#x20;disk&#x20;and&#x20;running&#x20;configuration.&#x20;It&#x20;is&#x20;possible&#x20;for&#x20;these&#x20;configuration&#x20;settings&#x20;to&#x20;differ.&#x20;Note:&#x20;Due&#x20;to&#x20;the&#x20;limitations&#x20;of&#x20;augenrules&#x20;and&#x20;auditctl,&#x20;it&#x20;is&#x20;not&#x20;absolutely&#x20;guaranteed&#x20;that&#x20;loading&#x20;the&#x20;rule&#x20;sets&#x20;via&#x20;augenrules&#x20;--load&#x20;will&#x20;result&#x20;in&#x20;all&#x20;rules&#x20;being&#x20;loaded&#x20;or&#x20;even&#x20;that&#x20;the&#x20;user&#x20;will&#x20;be&#x20;informed&#x20;if&#x20;there&#x20;was&#x20;a&#x20;problem&#x20;loading&#x20;the&#x20;rules.','Configuration&#x20;differences&#x20;between&#x20;what&#x20;is&#x20;currently&#x20;running&#x20;and&#x20;what&#x20;is&#x20;on&#x20;disk&#x20;could&#x20;cause&#x20;unexpected&#x20;problems&#x20;or&#x20;may&#x20;give&#x20;a&#x20;false&#x20;impression&#x20;of&#x20;compliance&#x20;requirements.','','If&#x20;the&#x20;rules&#x20;are&#x20;not&#x20;aligned&#x20;across&#x20;all&#x20;three&#x20;&#40;&#41;&#x20;areas,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;merge&#x20;and&#x20;load&#x20;all&#x20;rules:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;echo&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.21\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28089,'Ensure&#x20;audit&#x20;tools&#x20;are&#x20;755&#x20;or&#x20;more&#x20;restrictive.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;from&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;chmod&#x20;go-w&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules.','[{\"cis\": [\"4.1.4.8\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28090,'Ensure&#x20;audit&#x20;tools&#x20;are&#x20;owned&#x20;by&#x20;root.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;audit&#x20;tools&#x20;to&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;chown&#x20;root&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules.','[{\"cis\": [\"4.1.4.9\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28091,'Ensure&#x20;audit&#x20;tools&#x20;belong&#x20;to&#x20;group&#x20;root.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;from&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;chmod&#x20;go-w&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;audit&#x20;tools&#x20;to&#x20;root&#x20;user&#x20;and&#x20;group:&#x20;#&#x20;chown&#x20;root:root&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules.','[{\"cis\": [\"4.1.4.10\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28092,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;is&#x20;recommended&#x20;in&#x20;environments&#x20;where&#x20;journald&#x20;does&#x20;not&#x20;meet&#x20;operation&#x20;requirements.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;#&#x20;dnf&#x20;install&#x20;rsyslog.','[{\"cis\": [\"4.2.1.1\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"SI-5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"mitre_techniques\": [\"T1005\", \"T1070\", \"T1070.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28093,'Ensure&#x20;rsyslog&#x20;service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed,&#x20;ensure&#x20;that&#x20;the&#x20;service&#x20;is&#x20;enabled.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;enabled&#x20;to&#x20;start&#x20;on&#x20;boot,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;capture&#x20;logging&#x20;events.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog.','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"SI-5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1211\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28094,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;RSyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','IF&#x20;RSyslog&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;capturing&#x20;logs,&#x20;all&#x20;logs&#x20;of&#x20;the&#x20;system&#x20;should&#x20;be&#x20;sent&#x20;to&#x20;it&#x20;for&#x20;further&#x20;processing.&#x20;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;rsyslog&#x20;is&#x20;the&#x20;chosen&#x20;method&#x20;for&#x20;client&#x20;side&#x20;logging.&#x20;Do&#x20;not&#x20;apply&#x20;this&#x20;recommendation&#x20;if&#x20;journald&#x20;is&#x20;used.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.9\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.5\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"AU-2\", \"AU-4\", \"AU-12\", \"MP-2\", \"SI-5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.5.3\", \"10.5.4\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"10.3.3\"]}, {\"soc_2\": [\"PL1.4\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\", \"T1565\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28095,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;configured.','Rsyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','The&#x20;systems&#x20;global&#x20;umask&#x20;could&#x20;override,&#x20;but&#x20;only&#x20;making&#x20;the&#x20;file&#x20;permissions&#x20;stricter,&#x20;what&#x20;is&#x20;configured&#x20;in&#x20;RSyslog&#x20;with&#x20;the&#x20;FileCreateMode&#x20;directive.&#x20;RSyslog&#x20;also&#x20;has&#x20;its&#x20;own&#x20;$umask&#x20;directive&#x20;that&#x20;can&#x20;alter&#x20;the&#x20;intended&#x20;file&#x20;creation&#x20;mode.&#x20;In&#x20;addition,&#x20;consideration&#x20;should&#x20;be&#x20;given&#x20;to&#x20;how&#x20;FileCreateMode&#x20;is&#x20;used.&#x20;Thus&#x20;it&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;intended&#x20;file&#x20;creation&#x20;mode&#x20;is&#x20;not&#x20;overridden&#x20;with&#x20;less&#x20;restrictive&#x20;settings&#x20;in&#x20;/etc/rsyslog.conf,&#x20;/etc/rsyslog.d&#47;&#42;conf&#x20;files&#x20;and&#x20;that&#x20;FileCreateMode&#x20;is&#x20;set&#x20;before&#x20;any&#x20;file&#x20;is&#x20;created.','Edit&#x20;either&#x20;/etc/rsyslog.conf&#x20;or&#x20;a&#x20;dedicated&#x20;.conf&#x20;file&#x20;in&#x20;/etc/rsyslog.d/&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;$FileCreateMode&#x20;0640&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc_v8\": [\"3.3\", \"8.2\"]}, {\"cis_csc_v7\": [\"5.1\", \"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"AU-2\", \"AU-4\", \"AU-12\", \"MP-2\", \"SI-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\", \"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\", \"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\", \"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28096,'Ensure&#x20;rsyslog&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host.','RSyslog&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;log&#x20;events&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;enabling&#x20;centralized&#x20;log&#x20;management.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Edit&#x20;the&#x20;/etc/rsyslog.conf&#x20;and&#x20;/etc/rsyslog.d&#47;&#42;.conf&#x20;files&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;&#40;where&#x20;loghost.example.com&#x20;is&#x20;the&#x20;name&#x20;of&#x20;your&#x20;central&#x20;log&#x20;host&#41;.&#x20;The&#x20;target&#x20;directive&#x20;may&#x20;either&#x20;be&#x20;a&#x20;fully&#x20;qualified&#x20;domain&#x20;name&#x20;or&#x20;an&#x20;IP&#x20;address.&#x20;*.*&#x20;action&#40;type=&quot;omfwd&quot;&#x20;target=&quot;192.168.2.100&quot;&#x20;port=&quot;514&quot;&#x20;protocol=&quot;tcp&quot;&#x20;action.resumeRetryCount=&quot;100&quot;&#x20;queue.type=&quot;LinkedList&quot;&#x20;queue.size=&quot;1000&quot;&#41;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;rsyslogd&#x20;configuration:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.1.6\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28097,'Ensure&#x20;rsyslog&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;receive&#x20;logs&#x20;from&#x20;a&#x20;remote&#x20;client.','RSyslog&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;acting&#x20;as&#x20;a&#x20;log&#x20;server.&#x20;Clients&#x20;should&#x20;not&#x20;receive&#x20;data&#x20;from&#x20;other&#x20;hosts.','If&#x20;a&#x20;client&#x20;is&#x20;configured&#x20;to&#x20;also&#x20;receive&#x20;data,&#x20;thus&#x20;turning&#x20;it&#x20;into&#x20;a&#x20;server,&#x20;the&#x20;client&#x20;system&#x20;is&#x20;acting&#x20;outside&#x20;it&#039;s&#x20;operational&#x20;boundary.','','Should&#x20;there&#x20;be&#x20;any&#x20;active&#x20;log&#x20;server&#x20;configuration&#x20;found&#x20;in&#x20;the&#x20;auditing&#x20;section,&#x20;modify&#x20;those&#x20;files&#x20;and&#x20;remove&#x20;the&#x20;specific&#x20;lines&#x20;highlighted&#x20;by&#x20;the&#x20;audit.&#x20;Ensure&#x20;none&#x20;of&#x20;the&#x20;following&#x20;entries&#x20;are&#x20;present&#x20;in&#x20;any&#x20;of&#x20;/etc/rsyslog.conf&#x20;or&#x20;/etc/rsyslog.d&#47;&#42;.conf.&#x20;New&#x20;format:&#x20;module&#40;load=&quot;imtcp&quot;&#41;&#x20;input&#40;type=&quot;imtcp&quot;&#x20;port=&quot;514&quot;&#41;&#x20;-OR-&#x20;Old&#x20;format:&#x20;$ModLoad&#x20;imtcp&#x20;$InputTCPServerRun&#x20;-&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.1.7\"]}, {\"cis_csc_v8\": [\"4.8\", \"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"9.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.13.1.3\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\", \"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\", \"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28098,'Ensure&#x20;systemd-journal-remote&#x20;is&#x20;installed.','Journald&#x20;&#40;via&#x20;systemd-journal-remote&#41;&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;log&#x20;events&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;enabling&#x20;centralized&#x20;log&#x20;management.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;systemd-journal-remote:&#x20;#&#x20;dnf&#x20;install&#x20;systemd-journal-remote.','[{\"cis\": [\"4.2.2.1.1\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"SI-5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28099,'Ensure&#x20;systemd-journal-remote&#x20;is&#x20;enabled.','Journald&#x20;&#40;via&#x20;systemd-journal-remote&#41;&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;log&#x20;events&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;enabling&#x20;centralized&#x20;log&#x20;management.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;systemd-journal-remote:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;systemd-journal-upload.service.','[{\"cis\": [\"4.2.2.1.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"CM-7\", \"SI-5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28100,'Ensure&#x20;journald&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;receive&#x20;logs&#x20;from&#x20;a&#x20;remote&#x20;client.','Journald&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;acting&#x20;as&#x20;a&#x20;log&#x20;server.&#x20;Clients&#x20;should&#x20;not&#x20;receive&#x20;data&#x20;from&#x20;other&#x20;hosts.&#x20;NOTE:&#x20;-&#x20;The&#x20;same&#x20;package,&#x20;systemd-journal-remote,&#x20;is&#x20;used&#x20;for&#x20;both&#x20;sending&#x20;logs&#x20;to&#x20;remote&#x20;hosts&#x20;and&#x20;receiving&#x20;incoming&#x20;logs.&#x20;-&#x20;With&#x20;regards&#x20;to&#x20;receiving&#x20;logs,&#x20;there&#x20;are&#x20;two&#x20;services;&#x20;systemd-journal-&#x20;remote.socket&#x20;and&#x20;systemd-journal-remote.service.','If&#x20;a&#x20;client&#x20;is&#x20;configured&#x20;to&#x20;also&#x20;receive&#x20;data,&#x20;thus&#x20;turning&#x20;it&#x20;into&#x20;a&#x20;server,&#x20;the&#x20;client&#x20;system&#x20;is&#x20;acting&#x20;outside&#x20;it&#039;s&#x20;operational&#x20;boundary.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;systemd-journal-remote.socket:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;systemd-journal-remote.socket.','[{\"cis\": [\"4.2.2.1.4\"]}, {\"cis_csc_v8\": [\"4.8\", \"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"9.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.13.1.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\", \"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\", \"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28101,'Ensure&#x20;journald&#x20;service&#x20;is&#x20;enabled.','Ensure&#x20;that&#x20;the&#x20;systemd-journald&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;allow&#x20;capturing&#x20;of&#x20;logging&#x20;events.','If&#x20;the&#x20;systemd-journald&#x20;service&#x20;is&#x20;not&#x20;enabled&#x20;to&#x20;start&#x20;on&#x20;boot,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;capture&#x20;logging&#x20;events.','','By&#x20;default&#x20;the&#x20;systemd-journald&#x20;service&#x20;does&#x20;not&#x20;have&#x20;an&#x20;[Install]&#x20;section&#x20;and&#x20;thus&#x20;cannot&#x20;be&#x20;enabled&#x20;/&#x20;disabled.&#x20;It&#x20;is&#x20;meant&#x20;to&#x20;be&#x20;referenced&#x20;as&#x20;Requires&#x20;or&#x20;Wants&#x20;by&#x20;other&#x20;unit&#x20;files.&#x20;As&#x20;such,&#x20;if&#x20;the&#x20;status&#x20;of&#x20;systemd-journald&#x20;is&#x20;not&#x20;static,&#x20;investigate&#x20;why.','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28102,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald.service.','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.3\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.7\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1053\"]}]'),(28103,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss&#x20;due&#x20;to&#x20;a&#x20;reboot.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald.service.','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28104,'Ensure&#x20;journald&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;should&#x20;be&#x20;kept&#x20;in&#x20;the&#x20;confines&#x20;of&#x20;the&#x20;service&#x20;and&#x20;not&#x20;forwarded&#x20;on&#x20;to&#x20;other&#x20;services.','IF&#x20;journald&#x20;is&#x20;the&#x20;method&#x20;for&#x20;capturing&#x20;logs,&#x20;all&#x20;logs&#x20;of&#x20;the&#x20;system&#x20;should&#x20;be&#x20;handled&#x20;by&#x20;journald&#x20;and&#x20;not&#x20;forwarded&#x20;to&#x20;other&#x20;logging&#x20;mechanisms.&#x20;Note:&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;journald&#x20;is&#x20;the&#x20;chosen&#x20;method&#x20;for&#x20;client&#x20;side&#x20;logging.&#x20;Do&#x20;not&#x20;apply&#x20;this&#x20;recommendation&#x20;if&#x20;rsyslog&#x20;is&#x20;used.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;ensure&#x20;that&#x20;ForwardToSyslog=yes&#x20;is&#x20;removed.&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald.service.','[{\"cis\": [\"4.2.2.5\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.9\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.5\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.5.3\", \"10.5.4\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"10.3.3\"]}, {\"nist_sp_800-53\": [\"AU-7\", \"AU-6(3)\"]}, {\"soc_2\": [\"PL1.4\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\", \"T1565\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(28105,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;cron&#x20;:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;crond.','[{\"cis\": [\"5.1.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28106,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;this&#x20;file&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;this&#x20;file&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab.','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28107,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly.','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28108,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily.','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28109,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly.','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28110,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly.','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28111,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily,&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab&#x20;,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d.','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28112,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;u-x,go-rwx&#x20;/etc/ssh/sshd_config.','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1098\", \"T1098.004\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28113,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;-&#x20;AllowUsers:&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;AllowGroups:&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;-&#x20;DenyUsers:&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;DenyGroups:&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameters&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;OR&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;DenyGroups&#x20;&lt;grouplist&gt;.','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1021\", \"T1021.004\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28114,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;OR&#x20;LogLevel&#x20;INFO.','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"nist_sp_800-53\": [\"AU-2\", \"AU-12\", \"SI-5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(28115,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','UsePAM&#x20;Enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;&#039;yes&#039;&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','If&#x20;UsePAM&#x20;is&#x20;enabled,&#x20;you&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;run&#x20;sshd&#40;8&#41;&#x20;as&#x20;a&#x20;non-root&#x20;user.','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes.','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1021\", \"T1021.004\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1035\"]}]'),(28116,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;ssh.&#x20;The&#x20;default&#x20;is&#x20;no.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root&#x20;via&#x20;sudo&#x20;or&#x20;su.&#x20;This&#x20;in&#x20;turn&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no.','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1078\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28117,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts&#x20;,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.&#x20;This&#x20;option&#x20;only&#x20;applies&#x20;to&#x20;SSH&#x20;Protocol&#x20;Version&#x20;2.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no.','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28118,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no.','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28119,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;ssh&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;ssh&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no.','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28120,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;ssh.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes.','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28121,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no.','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-7\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28122,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;back-doors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','SSH&#x20;tunnels&#x20;are&#x20;widely&#x20;used&#x20;in&#x20;many&#x20;corporate&#x20;environments&#x20;that&#x20;employ&#x20;mainframe&#x20;systems&#x20;as&#x20;their&#x20;application&#x20;backends.&#x20;In&#x20;those&#x20;environments&#x20;the&#x20;applications&#x20;themselves&#x20;may&#x20;have&#x20;very&#x20;limited&#x20;native&#x20;support&#x20;for&#x20;security.&#x20;By&#x20;utilizing&#x20;tunneling,&#x20;compliance&#x20;with&#x20;SOX,&#x20;HIPAA,&#x20;PCI-DSS,&#x20;and&#x20;other&#x20;standards&#x20;can&#x20;be&#x20;achieved&#x20;without&#x20;having&#x20;to&#x20;modify&#x20;the&#x20;applications.','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no.','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1048\", \"T1048.002\", \"T1572\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(28123,'Ensure&#x20;system-wide&#x20;crypto&#x20;policy&#x20;is&#x20;not&#x20;over-ridden.','System-wide&#x20;Crypto&#x20;policy&#x20;can&#x20;be&#x20;over-ridden&#x20;or&#x20;opted&#x20;out&#x20;of&#x20;for&#x20;openSSH.','Over-riding&#x20;or&#x20;opting&#x20;out&#x20;of&#x20;the&#x20;system-wide&#x20;crypto&#x20;policy&#x20;could&#x20;allow&#x20;for&#x20;the&#x20;use&#x20;of&#x20;less&#x20;secure&#x20;Ciphers,&#x20;MACs,&#x20;KexAlgorithms&#x20;and&#x20;GSSAPIKexAlgorithm.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;sed&#x20;-ri&#x20;&quot;s/^s*&#40;CRYPTO_POLICYs*=.*&#41;$/#&#x20;1/&quot;&#x20;/etc/sysconfig/sshd;&#x20;#&#x20;systemctl&#x20;reload&#x20;sshd.','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"nist_sp_800-53\": [\"SC-8\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.10.1.1\"]}]'),(28124,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net.','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_tactics\": [\"TA0001\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1035\"]}]'),(28125,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4.','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"16.13\"]}, {\"nist_sp_800-53\": [\"AU-3\", \"AU-3(1)\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1036\"]}]'),(28126,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxStartups&#x20;10:30:60.','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}]'),(28127,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;set&#x20;to&#x20;10&#x20;or&#x20;less.','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10.','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}]'),(28128,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60.','[{\"cis\": [\"5.2.19\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\", \"T1110.004\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1036\"]}]'),(28129,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','NOTE:&#x20;To&#x20;clarify,&#x20;the&#x20;two&#x20;settings&#x20;described&#x20;below&#x20;are&#x20;only&#x20;meant&#x20;for&#x20;idle&#x20;connections&#x20;from&#x20;a&#x20;protocol&#x20;perspective&#x20;and&#x20;not&#x20;meant&#x20;to&#x20;check&#x20;if&#x20;the&#x20;user&#x20;is&#x20;active&#x20;or&#x20;not.&#x20;An&#x20;idle&#x20;user&#x20;does&#x20;not&#x20;mean&#x20;an&#x20;idle&#x20;connection.&#x20;SSH&#x20;does&#x20;not,&#x20;and&#x20;never&#x20;had,&#x20;intentionally&#x20;the&#x20;capability&#x20;to&#x20;drop&#x20;idle&#x20;users.&#x20;In&#x20;SSH&#x20;versions&#x20;before&#x20;8.2p1&#x20;there&#x20;was&#x20;a&#x20;bug&#x20;that&#x20;caused&#x20;these&#x20;values&#x20;to&#x20;behave&#x20;in&#x20;such&#x20;a&#x20;manner&#x20;that&#x20;they&#x20;were&#x20;abused&#x20;to&#x20;disconnect&#x20;idle&#x20;users.&#x20;This&#x20;bug&#x20;has&#x20;been&#x20;resolved&#x20;in&#x20;8.2p1&#x20;and&#x20;thus&#x20;may&#x20;no&#x20;longer&#x20;be&#x20;abused&#x20;disconnect&#x20;idle&#x20;users.&#x20;The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;SSH&#x20;sessions.&#x20;Taken&#x20;directly&#x20;from&#x20;man&#x20;5&#x20;sshd_config:&#x20;-&#x20;ClientAliveInterval&#x20;Sets&#x20;a&#x20;timeout&#x20;interval&#x20;in&#x20;seconds&#x20;after&#x20;which&#x20;if&#x20;no&#x20;data&#x20;has&#x20;been&#x20;received&#x20;from&#x20;the&#x20;client,&#x20;sshd&#40;8&#41;&#x20;will&#x20;send&#x20;a&#x20;message&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;to&#x20;request&#x20;a&#x20;response&#x20;from&#x20;the&#x20;client.&#x20;The&#x20;default&#x20;is&#x20;0,&#x20;indicating&#x20;that&#x20;these&#x20;messages&#x20;will&#x20;not&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;client.&#x20;-&#x20;ClientAliveCountMax&#x20;Sets&#x20;the&#x20;number&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;which&#x20;may&#x20;be&#x20;sent&#x20;without&#x20;sshd&#40;8&#41;&#x20;receiving&#x20;any&#x20;messages&#x20;back&#x20;from&#x20;the&#x20;client.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x20;reached&#x20;while&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;being&#x20;sent,&#x20;sshd&#x20;will&#x20;disconnect&#x20;the&#x20;client,&#x20;terminating&#x20;the&#x20;session.&#x20;It&#x20;is&#x20;important&#x20;to&#x20;note&#x20;that&#x20;the&#x20;use&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;is&#x20;very&#x20;different&#x20;from&#x20;TCPKeepAlive.&#x20;The&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;and&#x20;therefore&#x20;will&#x20;not&#x20;be&#x20;spoofable.&#x20;The&#x20;TCP&#x20;keepalive&#x20;option&#x20;enabled&#x20;by&#x20;TCPKeepAlive&#x20;is&#x20;spoofable.&#x20;The&#x20;client&#x20;alive&#x20;mechanism&#x20;is&#x20;valuable&#x20;when&#x20;the&#x20;client&#x20;or&#x20;server&#x20;depend&#x20;on&#x20;knowing&#x20;when&#x20;a&#x20;connection&#x20;has&#x20;become&#x20;unresponsive.&#x20;The&#x20;default&#x20;value&#x20;is&#x20;3.&#x20;If&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15,&#x20;and&#x20;ClientAliveCountMax&#x20;is&#x20;left&#x20;at&#x20;the&#x20;default,&#x20;unresponsive&#x20;SSH&#x20;clients&#x20;will&#x20;be&#x20;disconnected&#x20;after&#x20;approximately&#x20;45&#x20;seconds.&#x20;Setting&#x20;a&#x20;zero&#x20;ClientAliveCountMax&#x20;disables&#x20;connection&#x20;termination.','In&#x20;order&#x20;to&#x20;prevent&#x20;resource&#x20;exhaustion,&#x20;appropriate&#x20;values&#x20;should&#x20;be&#x20;set&#x20;for&#x20;both&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax.&#x20;Specifically,&#x20;looking&#x20;at&#x20;the&#x20;source&#x20;code,&#x20;ClientAliveCountMax&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;zero&#x20;in&#x20;order&#x20;to&#x20;utilize&#x20;the&#x20;ability&#x20;of&#x20;SSH&#x20;to&#x20;drop&#x20;idle&#x20;connections.&#x20;If&#x20;connections&#x20;are&#x20;allowed&#x20;to&#x20;stay&#x20;open&#x20;indefinitely,&#x20;this&#x20;can&#x20;potentially&#x20;be&#x20;used&#x20;as&#x20;a&#x20;DDOS&#x20;attack&#x20;or&#x20;simple&#x20;resource&#x20;exhaustion&#x20;could&#x20;occur&#x20;over&#x20;unreliable&#x20;networks.&#x20;The&#x20;example&#x20;set&#x20;here&#x20;is&#x20;a&#x20;45&#x20;second&#x20;timeout.&#x20;Consult&#x20;your&#x20;site&#x20;policy&#x20;for&#x20;network&#x20;timeouts&#x20;and&#x20;apply&#x20;as&#x20;appropriate.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;ClientAliveInterval&#x20;15&#x20;ClientAliveCountMax&#x20;3.','[{\"cis\": [\"5.2.20\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28130,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plug-in&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plug-ins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;and&#x20;any&#x20;entries&#x20;in&#x20;/etc/sudoers.d.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;sudo.&#x20;#&#x20;dnf&#x20;install&#x20;sudo.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(28131,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo&#x20;terminal&#x20;&#40;pseudo-pty&#41;.','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo&#x20;which&#x20;would&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','WARNING:&#x20;Editing&#x20;the&#x20;sudo&#x20;configuration&#x20;incorrectly&#x20;can&#x20;cause&#x20;sudo&#x20;to&#x20;stop&#x20;functioning.&#x20;Always&#x20;use&#x20;visudo&#x20;to&#x20;modify&#x20;sudo&#x20;configuration&#x20;files.','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;with&#x20;visudo&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;&lt;PATH_TO_FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty.','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.003\", \"T1548\", \"T1548.003\"]}, {\"mitre_tactics\": [\"TA0001\", \"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\", \"M1038\"]}]'),(28132,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file.','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands.','WARNING:&#x20;Editing&#x20;the&#x20;sudo&#x20;configuration&#x20;incorrectly&#x20;can&#x20;cause&#x20;sudo&#x20;to&#x20;stop&#x20;functioning.&#x20;Always&#x20;use&#x20;visudo&#x20;to&#x20;modify&#x20;sudo&#x20;configuration&#x20;files.&#x20;Creation&#x20;of&#x20;additional&#x20;log&#x20;files&#x20;can&#x20;cause&#x20;disk&#x20;space&#x20;exhaustion&#x20;if&#x20;not&#x20;correctly&#x20;managed.&#x20;You&#x20;should&#x20;configure&#x20;logrotate&#x20;to&#x20;manage&#x20;the&#x20;sudo&#x20;log&#x20;in&#x20;accordance&#x20;with&#x20;your&#x20;local&#x20;policy.','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;logfile=&quot;&lt;PATH&#x20;TO&#x20;CUSTOM&#x20;LOG&#x20;FILE&gt;&quot;&#x20;Example:&#x20;Defaults&#x20;logfile=&quot;/var/log/sudo.log&quot;.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"nist_sp_800-53\": [\"AU-3\", \"AU-3(1)\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28133,'Ensure&#x20;users&#x20;must&#x20;provide&#x20;password&#x20;for&#x20;escalation.','The&#x20;operating&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;so&#x20;that&#x20;users&#x20;must&#x20;provide&#x20;a&#x20;password&#x20;for&#x20;privilege&#x20;escalation.','Without&#x20;re-authentication,&#x20;users&#x20;may&#x20;access&#x20;resources&#x20;or&#x20;perform&#x20;tasks&#x20;for&#x20;which&#x20;they&#x20;do&#x20;not&#x20;have&#x20;authorization.&#x20;When&#x20;operating&#x20;systems&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;escalate&#x20;a&#x20;functional&#x20;capability,&#x20;it&#x20;is&#x20;critical&#x20;the&#x20;user&#x20;re-authenticate.','This&#x20;will&#x20;prevent&#x20;automated&#x20;processes&#x20;from&#x20;being&#x20;able&#x20;to&#x20;elevate&#x20;privileges.&#x20;To&#x20;include&#x20;Ansible&#x20;and&#x20;AWS&#x20;builds.','Based&#x20;on&#x20;the&#x20;outcome&#x20;of&#x20;the&#x20;audit&#x20;procedure,&#x20;use&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;to&#x20;edit&#x20;the&#x20;relevant&#x20;sudoers&#x20;file.&#x20;Remove&#x20;any&#x20;line&#x20;with&#x20;occurrences&#x20;of&#x20;NOPASSWD&#x20;tags&#x20;in&#x20;the&#x20;file.','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(28134,'Ensure&#x20;re-authentication&#x20;for&#x20;privilege&#x20;escalation&#x20;is&#x20;not&#x20;disabled&#x20;globally.','The&#x20;operating&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;so&#x20;that&#x20;users&#x20;must&#x20;re-authenticate&#x20;for&#x20;privilege&#x20;escalation.','Without&#x20;re-authentication,&#x20;users&#x20;may&#x20;access&#x20;resources&#x20;or&#x20;perform&#x20;tasks&#x20;for&#x20;which&#x20;they&#x20;do&#x20;not&#x20;have&#x20;authorization.&#x20;When&#x20;operating&#x20;systems&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;escalate&#x20;a&#x20;functional&#x20;capability,&#x20;it&#x20;is&#x20;critical&#x20;the&#x20;user&#x20;re-authenticate.','','Configure&#x20;the&#x20;operating&#x20;system&#x20;to&#x20;require&#x20;users&#x20;to&#x20;reauthenticate&#x20;for&#x20;privilege&#x20;escalation.&#x20;Based&#x20;on&#x20;the&#x20;outcome&#x20;of&#x20;the&#x20;audit&#x20;procedure,&#x20;use&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;to&#x20;edit&#x20;the&#x20;relevant&#x20;sudoers&#x20;file.&#x20;Remove&#x20;any&#x20;occurrences&#x20;of&#x20;!authenticate&#x20;tags&#x20;in&#x20;the&#x20;file&#40;s&#41;.','[{\"cis\": [\"5.3.5\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(28135,'Ensure&#x20;sudo&#x20;authentication&#x20;timeout&#x20;is&#x20;configured&#x20;correctly.','sudo&#x20;caches&#x20;used&#x20;credentials&#x20;for&#x20;a&#x20;default&#x20;of&#x20;5&#x20;minutes.&#x20;This&#x20;is&#x20;for&#x20;ease&#x20;of&#x20;use&#x20;when&#x20;there&#x20;are&#x20;multiple&#x20;administrative&#x20;tasks&#x20;to&#x20;perform.&#x20;The&#x20;timeout&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;suit&#x20;local&#x20;security&#x20;policies.','Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;the&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;unauthorized&#x20;privileged&#x20;access&#x20;to&#x20;another&#x20;user.','','If&#x20;the&#x20;currently&#x20;configured&#x20;timeout&#x20;is&#x20;larger&#x20;than&#x20;15&#x20;minutes,&#x20;edit&#x20;the&#x20;file&#x20;listed&#x20;in&#x20;the&#x20;audit&#x20;section&#x20;with&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;modify&#x20;the&#x20;entry&#x20;timestamp_timeout=&#x20;to&#x20;15&#x20;minutes&#x20;or&#x20;less&#x20;as&#x20;per&#x20;your&#x20;site&#x20;policy.&#x20;The&#x20;value&#x20;is&#x20;in&#x20;minutes.&#x20;This&#x20;particular&#x20;entry&#x20;may&#x20;appear&#x20;on&#x20;its&#x20;own,&#x20;or&#x20;on&#x20;the&#x20;same&#x20;line&#x20;as&#x20;env_reset.&#x20;See&#x20;the&#x20;following&#x20;two&#x20;examples:&#x20;Defaults&#x20;env_reset,&#x20;timestamp_timeout=15&#x20;Defaults&#x20;timestamp_timeout=15&#x20;Defaults&#x20;env_reset.','[{\"cis\": [\"5.3.6\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(28136,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;a&#x20;specific&#x20;groups&#x20;to&#x20;execute&#x20;su.&#x20;This&#x20;group&#x20;should&#x20;be&#x20;empty&#x20;to&#x20;reinforce&#x20;the&#x20;use&#x20;of&#x20;sudo&#x20;for&#x20;privileged&#x20;access.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Create&#x20;an&#x20;empty&#x20;group&#x20;that&#x20;will&#x20;be&#x20;specified&#x20;for&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command.&#x20;The&#x20;group&#x20;should&#x20;be&#x20;named&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;#&#x20;groupadd&#x20;sugroup.&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file,&#x20;specifying&#x20;the&#x20;empty&#x20;group:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;group=sugroup.','[{\"cis\": [\"5.3.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1078\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28137,'Ensure&#x20;custom&#x20;authselect&#x20;profile&#x20;is&#x20;used.','A&#x20;custom&#x20;profile&#x20;can&#x20;be&#x20;created&#x20;by&#x20;copying&#x20;and&#x20;customizing&#x20;one&#x20;of&#x20;the&#x20;default&#x20;profiles.&#x20;The&#x20;default&#x20;profiles&#x20;include:&#x20;sssd,&#x20;winbind,&#x20;or&#x20;the&#x20;nis.&#x20;This&#x20;profile&#x20;can&#x20;then&#x20;be&#x20;customized&#x20;to&#x20;follow&#x20;site&#x20;specific&#x20;requirements.&#x20;You&#x20;can&#x20;select&#x20;a&#x20;profile&#x20;for&#x20;the&#x20;authselect&#x20;utility&#x20;for&#x20;a&#x20;specific&#x20;host.&#x20;The&#x20;profile&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;every&#x20;user&#x20;logging&#x20;into&#x20;the&#x20;host.','A&#x20;custom&#x20;profile&#x20;is&#x20;required&#x20;to&#x20;customize&#x20;many&#x20;of&#x20;the&#x20;pam&#x20;options.&#x20;When&#x20;you&#x20;deploy&#x20;a&#x20;profile,&#x20;the&#x20;profile&#x20;is&#x20;applied&#x20;to&#x20;every&#x20;user&#x20;logging&#x20;into&#x20;the&#x20;given&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;custom&#x20;authselect&#x20;profile:&#x20;#&#x20;authselect&#x20;create-profile&#x20;&lt;custom-profile&#x20;name&gt;&#x20;&lt;options&gt;&#x20;Example:&#x20;#&#x20;authselect&#x20;create-profile&#x20;custom-profile&#x20;-b&#x20;sssd&#x20;--symlink-meta&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;select&#x20;a&#x20;custom&#x20;authselect&#x20;profile:&#x20;#&#x20;authselect&#x20;select&#x20;custom/&lt;CUSTOM&#x20;PROFILE&#x20;NAME&gt;&#x20;{with-&lt;OPTIONS&gt;}&#x20;Example:&#x20;#&#x20;authselect&#x20;select&#x20;custom/custom-profile&#x20;with-sudo&#x20;with-faillock&#x20;without-nullok.','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc_v8\": [\"16.2\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"pci_dss_3.2.1\": [\"6.3.2\"]}, {\"pci_dss_4.0\": [\"6.3.1\"]}, {\"iso_27001-2013\": [\"A.9.2.6\"]}]'),(28138,'Ensure&#x20;authselect&#x20;includes&#x20;with-faillock.','The&#x20;pam_faillock.so&#x20;module&#x20;maintains&#x20;a&#x20;list&#x20;of&#x20;failed&#x20;authentication&#x20;attempts&#x20;per&#x20;user&#x20;during&#x20;a&#x20;specified&#x20;interval&#x20;and&#x20;locks&#x20;the&#x20;account&#x20;in&#x20;case&#x20;there&#x20;were&#x20;more&#x20;than&#x20;the&#x20;configured&#x20;number&#x20;of&#x20;consecutive&#x20;failed&#x20;authentications&#x20;&#40;this&#x20;is&#x20;defined&#x20;by&#x20;the&#x20;deny&#x20;parameter&#x20;in&#x20;the&#x20;faillock&#x20;configuration&#41;.&#x20;It&#x20;stores&#x20;the&#x20;failure&#x20;records&#x20;into&#x20;per-user&#x20;files&#x20;in&#x20;the&#x20;tally&#x20;directory.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;include&#x20;the&#x20;with-faillock&#x20;option&#x20;to&#x20;the&#x20;current&#x20;authselect&#x20;profile:&#x20;#&#x20;authselect&#x20;enable-feature&#x20;with-faillock&#x20;#&#x20;authselect&#x20;apply-changes.','[{\"cis\": [\"5.4.2\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.9.2.6\"]}]'),(28139,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;are&#x20;definitions&#x20;of&#x20;the&#x20;pam_pwquality.so&#x20;options.&#x20;-&#x20;try_first_pass&#x20;-&#x20;retrieve&#x20;the&#x20;password&#x20;from&#x20;a&#x20;previous&#x20;stacked&#x20;PAM&#x20;module.&#x20;If&#x20;not&#x20;available,&#x20;then&#x20;prompt&#x20;the&#x20;user&#x20;for&#x20;a&#x20;password.&#x20;-&#x20;retry=3&#x20;-&#x20;Allow&#x20;3&#x20;tries&#x20;before&#x20;sending&#x20;back&#x20;a&#x20;failure.&#x20;-&#x20;minlen=14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more.&#x20;Either&#x20;of&#x20;the&#x20;following&#x20;can&#x20;be&#x20;used&#x20;to&#x20;enforce&#x20;complex&#x20;passwords:&#x20;-&#x20;minclass=4&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;four&#x20;classes&#x20;of&#x20;characters&#x20;for&#x20;the&#x20;new&#x20;password.&#x20;OR&#x20;-&#x20;dcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit.&#x20;-&#x20;ucredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character.&#x20;-&#x20;ocredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character.&#x20;-&#x20;lcredit=-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character.&#x20;-&#x20;The&#x20;settings&#x20;shown&#x20;above&#x20;are&#x20;one&#x20;possible&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minclass&#x20;=&#x20;4&#x20;OR&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1.&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;update&#x20;the&#x20;system-auth&#x20;and&#x20;password-auth&#x20;files:&#x20;#!/usr/bin/env&#x20;bash&#x20;for&#x20;fn&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;file=&quot;/etc/authselect/$&#40;head&#x20;-1&#x20;/etc/authselect/authselect.conf&#x20;|&#x20;grep&#x20;&#039;custom/&#039;&#41;/$fn&quot;&#x20;if&#x20;!&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+requisiteh+pam_pwquality.so&#40;h+[^#&#x0a;&#x0d;]+&#41;?h+.*enforce_for_r&#x20;oot&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+requisites+pam_pwquality.sos+&#41;&#40;.*&#41;$/12&#x20;enforce_for_root/&#039;&#x20;&quot;$file&quot;&#x20;fi&#x20;if&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+requisiteh+pam_pwquality.so&#40;h+[^#&#x0a;&#x0d;]+&#41;?h+retry=&#40;[4-9]|[1-9][0-9]+&#41;&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;/pwquality/s/retry=S+/retry=3/&#039;&#x20;&quot;$file&quot;&#x20;elif&#x20;!&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+requisiteh+pam_pwquality.so&#40;h+[^#&#x0a;&#x0d;]+&#41;?h+retry=d+&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+requisites+pam_pwquality.sos+&#41;&#40;.*&#41;$/12&#x20;retry=3/&#039;&#x20;&quot;$file&quot;&#x20;fi&#x20;done&#x20;authselect&#x20;apply-changes.','[{\"cis\": [\"5.5.1\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.002\", \"T1110.003\", \"T1178.001\", \"T1178.002\", \"T1178.003\", \"T1178.004\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28140,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured.','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;-&#x20;deny=&lt;n&gt;&#x20;-&#x20;Number&#x20;of&#x20;attempts&#x20;before&#x20;the&#x20;account&#x20;is&#x20;locked.&#x20;-&#x20;unlock_time=&lt;n&gt;&#x20;-&#x20;Time&#x20;in&#x20;seconds&#x20;before&#x20;the&#x20;account&#x20;is&#x20;unlocked.&#x20;Note:&#x20;The&#x20;maximum&#x20;configurable&#x20;value&#x20;for&#x20;unlock_time&#x20;is&#x20;604800.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','Use&#x20;of&#x20;unlock_time=0&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;cause&#x20;denial&#x20;of&#x20;service&#x20;to&#x20;legitimate&#x20;users.','Set&#x20;password&#x20;lockouts&#x20;and&#x20;unlock&#x20;times&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.&#x20;deny&#x20;should&#x20;be&#x20;greater&#x20;than&#x20;0&#x20;and&#x20;no&#x20;greater&#x20;than&#x20;5.&#x20;unlock_time&#x20;should&#x20;be&#x20;0&#x20;&#40;never&#41;,&#x20;or&#x20;900&#x20;seconds&#x20;or&#x20;greater.&#x20;Edit&#x20;/etc/security/faillock.conf&#x20;and&#x20;update&#x20;or&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;deny&#x20;=&#x20;5&#x20;unlock_time&#x20;=&#x20;900.','[{\"cis\": [\"5.5.2\"]}, {\"cis_csc_v8\": [\"6.2\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"nist_sp_800-53\": [\"AC-2(1)\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\"]}, {\"hipaa\": [\"164.308(a)(3)(ii)(C)\"]}, {\"pci_dss_3.2.1\": [\"8.1.3\"]}, {\"pci_dss_4.0\": [\"8.2.4\", \"8.2.5\"]}, {\"soc_2\": [\"CC6.2\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.6\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28141,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.&#x20;remember=&lt;5&gt;&#x20;-&#x20;Number&#x20;of&#x20;old&#x20;passwords&#x20;to&#x20;remember.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.&#x20;Note:&#x20;These&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;remembered&#x20;password&#x20;history&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy.&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;pam_pwhistory.so&#x20;and&#x20;pam_unix.so&#x20;lines&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option:&#x20;#!/usr/bin/env&#x20;bash&#x20;{&#x20;file=&quot;/etc/authselect/$&#40;head&#x20;-1&#x20;/etc/authselect/authselect.conf&#x20;|&#x20;grep&#x20;&#039;custom/&#039;&#41;/system-auth&quot;&#x20;if&#x20;!&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_pwhistory.soh+&#40;[^#&#x0a;&#x0d;]+h+&#41;?remember=&#40;[5-9]|[1-9][0-9]+&#41;&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;if&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_pwhistory.soh+&#40;[^#&#x0a;&#x0d;]+h+&#41;?remember=d+&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+&#40;requisite|required|sufficient&#41;s+pam_pwhistory.sos+&#40;[^#&#x0a;&#x0d;]+s+&#41;?&#41;&#40;remember=S+s*&#41;&#40;s+.*&#41;?$/1&#x20;remember=5&#x20;5/&#039;&#x20;$file&#x20;elif&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_pwhistory.soh+&#40;[^#&#x0a;&#x0d;]+h+&#41;?.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;/^s*passwords+&#40;requisite|required|sufficient&#41;s+pam_pwhistory.so/&#x20;s/$/&#x20;remember=5/&#039;&#x20;$file&#x20;else&#x20;sed&#x20;-ri&#x20;&#039;/^s*passwords+&#40;requisite|required|sufficient&#41;s+pam_unix.so/i&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;remember=5&#x20;use_authtok&#039;&#x20;$file&#x20;fi&#x20;fi&#x20;if&#x20;!&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_unix.soh+&#40;[^#&#x0a;&#x0d;]+h+&#41;?remember=&#40;[5-9]|[1-9][0-9]+&#41;&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;if&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_unix.soh+&#40;[^#&#x0a;&#x0d;]+h&#x20;+&#41;?remember=d+&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;s/^s*&#40;passwords+&#40;requisite|required|sufficient&#41;s+pam_unix.sos+&#40;[^#&#x0a;&#x0d;]&#x20;+s+&#41;?&#41;&#40;remember=S+s*&#41;&#40;s+.*&#41;?$/1&#x20;remember=5&#x20;5/&#039;&#x20;$file&#x20;else&#x20;sed&#x20;-ri&#x20;&#039;/^s*passwords+&#40;requisite|required|sufficient&#41;s+pam_unix.so/&#x20;s/$/&#x20;remember=5/&#039;&#x20;$file&#x20;fi&#x20;fi&#x20;authselect&#x20;apply-changes&#x20;}.','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"nist_sp_800-53\": [\"IA-5(1)\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.004\"]}]'),(28142,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;SHA-512&#x20;or&#x20;yescrypt.','A&#x20;cryptographic&#x20;hash&#x20;function&#x20;converts&#x20;an&#x20;arbitrary-length&#x20;input&#x20;into&#x20;a&#x20;fixed&#x20;length&#x20;output.&#x20;Password&#x20;hashing&#x20;performs&#x20;a&#x20;one-way&#x20;transformation&#x20;of&#x20;a&#x20;password,&#x20;turning&#x20;the&#x20;password&#x20;into&#x20;another&#x20;string,&#x20;called&#x20;the&#x20;hashed&#x20;password.','The&#x20;SHA-512&#x20;algorithm&#x20;provides&#x20;stronger&#x20;hashing&#x20;than&#x20;other&#x20;hashing&#x20;algorithms&#x20;used&#x20;for&#x20;password&#x20;hashing&#x20;with&#x20;Linux,&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note:&#x20;These&#x20;changes&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','Set&#x20;password&#x20;hashing&#x20;algorithm&#x20;to&#x20;sha512.&#x20;Edit&#x20;/etc/libuser.conf&#x20;and&#x20;edit&#x20;of&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;crypt_style&#x20;=&#x20;sha512&#x20;Edit&#x20;/etc/login.defs&#x20;and&#x20;edit&#x20;or&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ENCRYPT_METHOD&#x20;SHA512&#x20;Run&#x20;the&#x20;following&#x20;script&#x20;to&#x20;configure&#x20;pam_unix.so&#x20;to&#x20;use&#x20;the&#x20;sha512&#x20;hashing&#x20;algorithm:&#x20;#!/usr/bin/env&#x20;bash&#x20;for&#x20;fn&#x20;in&#x20;system-auth&#x20;password-auth;&#x20;do&#x20;file=&quot;/etc/authselect/$&#40;head&#x20;-1&#x20;/etc/authselect/authselect.conf&#x20;|&#x20;grep&#x20;&#039;custom/&#039;&#41;/$fn&quot;&#x20;if&#x20;!&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_unix.so&#40;h+[^#&#x0a;&#x0d;]+&#41;?&#x20;h+sha512&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;if&#x20;grep&#x20;-Pq&#x20;--&#x20;&#039;^h*passwordh+&#40;requisite|required|sufficient&#41;h+pam_unix.so&#40;h+[^#&#x0a;&#x0d;]+&#41;?&#x20;h+&#40;md5|blowfish|bigcrypt|sha256&#41;&#x08;.*$&#039;&#x20;&quot;$file&quot;;&#x20;then&#x20;sed&#x20;-ri&#x20;&#039;s/&#40;md5|blowfish|bigcrypt|sha256&#41;/sha512/&#039;&#x20;&quot;$file&quot;&#x20;else&#x20;sed&#x20;-ri&#x20;&#039;s/&#40;^s*passwords+&#40;requisite|required|sufficient&#41;s+pam_unix.sos+&#41;&#40;.*&#41;$/1s&#x20;ha512&#x20;3/&#039;&#x20;$file&#x20;fi&#x20;fi&#x20;done&#x20;authselect&#x20;apply-changes&#x20;Note:&#x20;This&#x20;only&#x20;effects&#x20;local&#x20;users&#x20;and&#x20;passwords&#x20;created&#x20;after&#x20;updating&#x20;the&#x20;files&#x20;to&#x20;use&#x20;sha512.&#x20;If&#x20;it&#x20;is&#x20;determined&#x20;that&#x20;the&#x20;password&#x20;algorithm&#x20;being&#x20;used&#x20;is&#x20;not&#x20;SHA-512,&#x20;once&#x20;it&#x20;is&#x20;changed,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;all&#x20;user&#x20;ID&#039;s&#x20;be&#x20;immediately&#x20;expired&#x20;and&#x20;forced&#x20;to&#x20;change&#x20;their&#x20;passwords&#x20;on&#x20;next&#x20;login.','[{\"cis\": [\"5.5.4\"]}, {\"cis_csc_v8\": [\"3.11\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"IA-5(1)\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1110\", \"T1110.002\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}]'),(28143,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;365&#x20;days.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;365&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--maxdays&#x20;365&#x20;&lt;user&gt;.','[{\"cis\": [\"5.6.1.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.001\", \"T1110.002\", \"T1110.003\", \"T1110.004\"]}]'),(28144,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;configured.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/login.defs:&#x20;PASS_MIN_DAYS&#x20;1&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--mindays&#x20;1&#x20;&lt;user&gt;.','[{\"cis\": [\"5.6.1.2\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110.004\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28145,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs:&#x20;PASS_WARN_AGE&#x20;7&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.','[{\"cis\": [\"5.6.1.3\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28146,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;and&#x20;modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.','[{\"cis\": [\"5.6.1.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.002\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28147,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;account&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;account.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;account&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0&#x20;:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root.','[{\"cis\": [\"5.6.4\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"nist_sp_800-53\": [\"CM-1\", \"CM-2\", \"CM-6\", \"CM-7\", \"IA-5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28148,'Ensure&#x20;root&#x20;password&#x20;is&#x20;set.','There&#x20;are&#x20;a&#x20;number&#x20;of&#x20;methods&#x20;to&#x20;access&#x20;the&#x20;root&#x20;account&#x20;directly.&#x20;Without&#x20;a&#x20;password&#x20;set&#x20;any&#x20;user&#x20;would&#x20;be&#x20;able&#x20;to&#x20;gain&#x20;access&#x20;and&#x20;thus&#x20;control&#x20;over&#x20;the&#x20;entire&#x20;system.','Access&#x20;to&#x20;root&#x20;should&#x20;be&#x20;secured&#x20;at&#x20;all&#x20;times.','If&#x20;there&#x20;are&#x20;any&#x20;automated&#x20;processes&#x20;that&#x20;relies&#x20;on&#x20;access&#x20;to&#x20;the&#x20;root&#x20;account&#x20;without&#x20;authentication,&#x20;they&#x20;will&#x20;fail&#x20;after&#x20;remediation.','Set&#x20;the&#x20;root&#x20;password&#x20;with:&#x20;#&#x20;passwd&#x20;root.','[{\"cis\": [\"5.6.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"mitre_techniques\": [\"T1078\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28149,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd.','[{\"cis\": [\"6.1.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28150,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-.','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28151,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/group:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group.','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28152,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-.','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28153,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;mode,&#x20;owner,&#x20;and&#x20;group&#x20;on&#x20;/etc/shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chmod&#x20;0000&#x20;/etc/shadow.','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28154,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;mode,&#x20;owner,&#x20;and&#x20;group&#x20;on&#x20;/etc/shadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chmod&#x20;0000&#x20;/etc/shadow-.','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28155,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;mode,&#x20;owner,&#x20;and&#x20;group&#x20;on&#x20;/etc/gshadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chmod&#x20;0000&#x20;/etc/gshadow.','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28156,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;mode,&#x20;owner,&#x20;and&#x20;group&#x20;on&#x20;/etc/gshadow-:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chmod&#x20;0000&#x20;/etc/gshadow-.','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(28157,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords.','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;the&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;one-way&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;x&#x20;in&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.&#x20;Note:&#x20;-&#x20;All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x20;-&#x20;A&#x20;user&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd&#x20;allows&#x20;the&#x20;account&#x20;to&#x20;be&#x20;logged&#x20;into&#x20;by&#x20;providing&#x20;only&#x20;the&#x20;username.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:&#x20;#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwd&#x20;Investigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc_v8\": [\"3.11\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28158,'Ensure&#x20;/etc/shadow&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;passwd&#x20;-l&#x20;&lt;username&gt;.&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(28159,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.9\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28500,'Ensure&#x20;/tmp&#x20;is&#x20;a&#x20;separate&#x20;partition.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hard&#x20;link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard&#x20;link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;Running&#x20;out&#x20;of&#x20;/tmp&#x20;space&#x20;is&#x20;a&#x20;problem&#x20;regardless&#x20;of&#x20;what&#x20;kind&#x20;of&#x20;filesystem&#x20;lies&#x20;under&#x20;it,&#x20;but&#x20;in&#x20;a&#x20;configuration&#x20;where&#x20;/tmp&#x20;is&#x20;not&#x20;a&#x20;separate&#x20;file&#x20;system&#x20;it&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available,&#x20;as&#x20;the&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;On&#x20;the&#x20;other&#x20;hand,&#x20;a&#x20;RAM-based&#x20;/tmp&#x20;&#40;as&#x20;with&#x20;tmpfs&#41;&#x20;will&#x20;almost&#x20;certainly&#x20;be&#x20;much&#x20;smaller,&#x20;which&#x20;can&#x20;lead&#x20;to&#x20;applications&#x20;filling&#x20;up&#x20;the&#x20;filesystem&#x20;much&#x20;more&#x20;easily.&#x20;Another&#x20;alternative&#x20;is&#x20;to&#x20;create&#x20;a&#x20;dedicated&#x20;partition&#x20;for&#x20;/tmp&#x20;from&#x20;a&#x20;separate&#x20;volume&#x20;or&#x20;disk.&#x20;One&#x20;of&#x20;the&#x20;downsides&#x20;of&#x20;a&#x20;disk-based&#x20;dedicated&#x20;partition&#x20;is&#x20;that&#x20;it&#x20;will&#x20;be&#x20;slower&#x20;than&#x20;tmpfs&#x20;which&#x20;is&#x20;RAM-based.&#x20;/tmp&#x20;utilizing&#x20;tmpfs&#x20;can&#x20;be&#x20;resized&#x20;using&#x20;the&#x20;size={size}&#x20;parameter&#x20;in&#x20;the&#x20;relevant&#x20;entry&#x20;in&#x20;/etc/fstab.','First&#x20;ensure&#x20;that&#x20;systemd&#x20;is&#x20;correctly&#x20;configured&#x20;to&#x20;ensure&#x20;that&#x20;/tmp&#x20;will&#x20;be&#x20;mounted&#x20;at&#x20;boot&#x20;time.&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mount&#x20;For&#x20;specific&#x20;configuration&#x20;requirements&#x20;of&#x20;the&#x20;/tmp&#x20;mount&#x20;for&#x20;your&#x20;environment,&#x20;modify&#x20;/etc/fstab&#x20;or&#x20;tmp.mount.&#x20;Example&#x20;of&#x20;/etc/fstab&#x20;configured&#x20;tmpfs&#x20;file&#x20;system&#x20;with&#x20;specific&#x20;mount&#x20;options:&#x20;tmpfs&#x20;0&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime,size=2G&#x20;0&#x20;Example&#x20;of&#x20;tmp.mount&#x20;configured&#x20;tmpfs&#x20;file&#x20;system&#x20;with&#x20;specific&#x20;mount&#x20;options:&#x20;[Unit]&#x20;Description=Temporary&#x20;Directory&#x20;/tmp&#x20;ConditionPathIsSymbolicLink=!/tmp&#x20;DefaultDependencies=no&#x20;Conflicts=umount.target&#x20;Before=local-fs.target&#x20;umount.target&#x20;After=swap.target&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs.','[{\"cis\": [\"1.1.2.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28501,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28502,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28503,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28504,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follow.&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var&#x20;and&#x20;cause&#x20;unintended&#x20;behavior&#x20;across&#x20;the&#x20;system&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;See&#x20;man&#x20;auditd.conf&#x20;for&#x20;details.&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount&#x20;Configuring&#x20;/var&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behaviour.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;Protection&#x20;from&#x20;exploitation&#x20;An&#x20;example&#x20;of&#x20;exploiting&#x20;/var&#x20;may&#x20;be&#x20;an&#x20;attacker&#x20;establishing&#x20;a&#x20;hard-link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hardlink&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.3.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28505,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var.','','IF&#x20;the&#x20;/var&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var.','[{\"cis\": [\"1.1.3.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28506,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;variable&#x20;files&#x20;such&#x20;as&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var.','','IF&#x20;the&#x20;/var&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var.','[{\"cis\": [\"1.1.3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28507,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.&#x20;Temporary&#x20;file&#x20;residing&#x20;in&#x20;/var/tmp&#x20;is&#x20;to&#x20;be&#x20;preserved&#x20;between&#x20;reboots.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/tmp&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follow.&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var/tmp&#x20;and&#x20;cause&#x20;the&#x20;potential&#x20;disruption&#x20;to&#x20;daemons&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount&#x20;Configuring&#x20;/var/tmp&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;Protection&#x20;from&#x20;exploitation&#x20;An&#x20;example&#x20;of&#x20;exploiting&#x20;/var/tmp&#x20;may&#x20;be&#x20;an&#x20;attacker&#x20;establishing&#x20;a&#x20;hard-link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard-link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.4.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28508,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','IF&#x20;the&#x20;/var/tmp&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;0&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28509,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','IF&#x20;the&#x20;/var/tmp&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;0&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28510,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','IF&#x20;the&#x20;/var/tmp&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;0&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28511,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/log&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follow.&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/log&#x20;directory&#x20;contain&#x20;the&#x20;log&#x20;files&#x20;that&#x20;can&#x20;grow&#x20;quite&#x20;large,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount&#x20;Configuring&#x20;/var/log&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;Protection&#x20;of&#x20;log&#x20;data&#x20;As&#x20;/var/log&#x20;contains&#x20;log&#x20;files,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.5.1\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}]'),(28512,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/log.','','IF&#x20;the&#x20;/var/log&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28513,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;log&#x20;files,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/log.','','IF&#x20;the&#x20;/var/log&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28514,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;log&#x20;files,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/log.','','IF&#x20;the&#x20;/var/log&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28515,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/log/audit&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follow.&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/log/audit&#x20;directory&#x20;contain&#x20;the&#x20;audit.log&#x20;file&#x20;that&#x20;can&#x20;grow&#x20;quite&#x20;large,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var/log/audit&#x20;and&#x20;cause&#x20;auditd&#x20;to&#x20;trigger&#x20;it&#039;s&#x20;space_left_action&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;See&#x20;man&#x20;auditd.conf&#x20;for&#x20;details.&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount&#x20;Configuring&#x20;/var/log/audit&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;Protection&#x20;of&#x20;audit&#x20;data&#x20;As&#x20;/var/log/audit&#x20;contains&#x20;audit&#x20;logs,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6.1\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}]'),(28516,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;audit&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/log/audit.','','IF&#x20;the&#x20;/var/log/audit&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28517,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/log/audit.','','IF&#x20;the&#x20;/var/log/audit&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log/audit&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28518,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;variable&#x20;files&#x20;such&#x20;as&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/log/audit.','','IF&#x20;the&#x20;/var/log/audit&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log/audit&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28519,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/home&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follow.&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/home&#x20;directory&#x20;contains&#x20;user&#x20;generated&#x20;data,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/home&#x20;and&#x20;impact&#x20;all&#x20;local&#x20;users.&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount&#x20;Configuring&#x20;/home&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;/home&#x20;options&#x20;such&#x20;as&#x20;usrquota/grpquota&#x20;may&#x20;be&#x20;considered&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;that&#x20;users&#x20;can&#x20;have&#x20;on&#x20;each&#x20;other&#x20;with&#x20;regards&#x20;to&#x20;disk&#x20;resource&#x20;exhaustion.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;Protection&#x20;of&#x20;user&#x20;data&#x20;As&#x20;/home&#x20;contains&#x20;user&#x20;data,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28520,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/home&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var.','','IF&#x20;the&#x20;/home&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/home&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/home.','[{\"cis\": [\"1.1.7.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28521,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/home&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;user&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/home.','','IF&#x20;the&#x20;/home&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/home&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/home.','[{\"cis\": [\"1.1.7.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28522,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;using&#x20;the&#x20;updated&#x20;options&#x20;from&#x20;/etc/fstab:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm&#x20;Additional&#x20;Information:&#x20;Some&#x20;distributions&#x20;mount&#x20;/dev/shm&#x20;through&#x20;other&#x20;means&#x20;and&#x20;require&#x20;/dev/shm&#x20;to&#x20;be&#x20;added&#x20;to&#x20;/etc/fstab&#x20;even&#x20;though&#x20;it&#x20;is&#x20;already&#x20;being&#x20;mounted&#x20;on&#x20;boot.&#x20;Others&#x20;may&#x20;configure&#x20;/dev/shm&#x20;in&#x20;other&#x20;locations&#x20;and&#x20;may&#x20;override&#x20;/etc/fstab&#x20;configuration.&#x20;Consult&#x20;the&#x20;documentation&#x20;appropriate&#x20;for&#x20;your&#x20;distribution.','[{\"cis\": [\"1.1.8.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28523,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/dev/shm&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm&#x20;NOTE&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;use&#x20;tmpfs&#x20;as&#x20;the&#x20;device/filesystem&#x20;type&#x20;as&#x20;/dev/shm&#x20;is&#x20;used&#x20;as&#x20;shared&#x20;memory&#x20;space&#x20;by&#x20;applications.','[{\"cis\": [\"1.1.8.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28524,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;using&#x20;the&#x20;updated&#x20;options&#x20;from&#x20;/etc/fstab:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm&#x20;Additional&#x20;Information:&#x20;Some&#x20;distributions&#x20;mount&#x20;/dev/shm&#x20;through&#x20;other&#x20;means&#x20;and&#x20;require&#x20;/dev/shm&#x20;to&#x20;be&#x20;added&#x20;to&#x20;/etc/fstab&#x20;even&#x20;though&#x20;it&#x20;is&#x20;already&#x20;being&#x20;mounted&#x20;on&#x20;boot.&#x20;Others&#x20;may&#x20;configure&#x20;/dev/shm&#x20;in&#x20;other&#x20;locations&#x20;and&#x20;may&#x20;override&#x20;/etc/fstab&#x20;configuration.&#x20;Consult&#x20;the&#x20;documentation&#x20;appropriate&#x20;for&#x20;your&#x20;distribution.','[{\"cis\": [\"1.1.8.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28525,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','The&#x20;use&#x20;of&#x20;portable&#x20;hard&#x20;drives&#x20;is&#x20;very&#x20;common&#x20;for&#x20;workstation&#x20;users.&#x20;If&#x20;your&#x20;organization&#x20;allows&#x20;the&#x20;use&#x20;of&#x20;portable&#x20;storage&#x20;or&#x20;media&#x20;on&#x20;workstations&#x20;and&#x20;physical&#x20;access&#x20;controls&#x20;to&#x20;workstations&#x20;is&#x20;considered&#x20;adequate&#x20;there&#x20;is&#x20;little&#x20;value&#x20;add&#x20;in&#x20;turning&#x20;off&#x20;automounting.','If&#x20;there&#x20;are&#x20;no&#x20;other&#x20;packages&#x20;that&#x20;depends&#x20;on&#x20;autofs,&#x20;remove&#x20;the&#x20;package&#x20;with:&#x20;#&#x20;apt&#x20;purge&#x20;autofs&#x20;OR&#x20;if&#x20;there&#x20;are&#x20;dependencies&#x20;on&#x20;the&#x20;autofs&#x20;package:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;mask&#x20;autofs:&#x20;#&#x20;systemctl&#x20;stop&#x20;autofs&#x20;#&#x20;systemctl&#x20;mask&#x20;autofs&#x20;Additional&#x20;Information:&#x20;This&#x20;control&#x20;should&#x20;align&#x20;with&#x20;the&#x20;tolerance&#x20;of&#x20;the&#x20;use&#x20;of&#x20;portable&#x20;drives&#x20;and&#x20;optical&#x20;media&#x20;in&#x20;the&#x20;organization.&#x20;On&#x20;a&#x20;server&#x20;requiring&#x20;an&#x20;admin&#x20;to&#x20;manually&#x20;mount&#x20;media&#x20;can&#x20;be&#x20;part&#x20;of&#x20;defense-in-depth&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unapproved&#x20;software&#x20;or&#x20;information&#x20;being&#x20;introduced&#x20;or&#x20;proprietary&#x20;software&#x20;or&#x20;information&#x20;being&#x20;exfiltrated.&#x20;If&#x20;admins&#x20;commonly&#x20;use&#x20;flash&#x20;drives&#x20;and&#x20;Server&#x20;access&#x20;has&#x20;sufficient&#x20;physical&#x20;controls,&#x20;requiring&#x20;manual&#x20;mounting&#x20;may&#x20;not&#x20;increase&#x20;security.','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc_v7\": [\"8.5\"]}, {\"cis_csc_v8\": [\"10.3\"]}, {\"mitre_techniques\": [\"T1068\", \"T1203\", \"T1211\", \"T1212\"]}, {\"cmmc_v2.0\": [\"MP.L2-3.8.7\"]}, {\"hipaa\": [\"164.310(d)(1)\"]}]'),(28526,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Install&#x20;AIDE&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;install&#x20;aide&#x20;aide-common&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;initialize&#x20;AIDE:&#x20;#&#x20;aideinit&#x20;#&#x20;mv&#x20;/var/lib/aide/aide.db.new&#x20;/var/lib/aide/aide.db&#x20;Additional&#x20;Information:&#x20;The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;AIDE&#x20;because&#x20;it&#x20;alters&#x20;binaries&#x20;to&#x20;speed&#x20;up&#x20;their&#x20;start&#x20;up&#x20;times.&#x20;Run&#x20;prelink&#x20;-ua&#x20;to&#x20;restore&#x20;the&#x20;binaries&#x20;to&#x20;their&#x20;prelinked&#x20;state,&#x20;thus&#x20;avoiding&#x20;false&#x20;positives&#x20;from&#x20;AIDE.','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cis_csc_v8\": [\"3.14\"]}, {\"mitre_techniques\": [\"T1036\", \"T1036.002\", \"T1036.003\", \"T1036.004\", \"T1036.005\", \"T1565\", \"T1565.001\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\"]}, {\"hipaa\": [\"164.312(b)\", \"164.312(c)(1)\", \"164.312(c)(2)\"]}, {\"pci_dss_v3.2.1\": [\"10.2.1\", \"11.5\"]}, {\"pci_dss_v4.0\": [\"10.2.1\", \"10.2.1.1\"]}, {\"nist_sp_800-53\": [\"AC-6(9)\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28527,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;AppArmor&#x20;at&#x20;boot&#x20;time&#41;.','If&#x20;password&#x20;protection&#x20;is&#x20;enabled,&#x20;only&#x20;the&#x20;designated&#x20;superuser&#x20;can&#x20;edit&#x20;a&#x20;Grub&#x20;2&#x20;menu&#x20;item&#x20;by&#x20;pressing&#x20;&quot;e&quot;&#x20;or&#x20;access&#x20;the&#x20;GRUB&#x20;2&#x20;command&#x20;line&#x20;by&#x20;pressing&#x20;&quot;c&quot;&#x20;If&#x20;GRUB&#x20;2&#x20;is&#x20;set&#x20;up&#x20;to&#x20;boot&#x20;automatically&#x20;to&#x20;a&#x20;password-protected&#x20;menu&#x20;entry&#x20;the&#x20;user&#x20;has&#x20;no&#x20;option&#x20;to&#x20;back&#x20;out&#x20;of&#x20;the&#x20;password&#x20;prompt&#x20;to&#x20;select&#x20;another&#x20;menu&#x20;entry.&#x20;Holding&#x20;the&#x20;SHIFT&#x20;key&#x20;will&#x20;not&#x20;display&#x20;the&#x20;menu&#x20;in&#x20;this&#x20;case.&#x20;The&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;correct&#x20;username&#x20;and&#x20;password.&#x20;If&#x20;unable,&#x20;the&#x20;configuration&#x20;files&#x20;will&#x20;have&#x20;to&#x20;be&#x20;edited&#x20;via&#x20;the&#x20;LiveCD&#x20;or&#x20;other&#x20;means&#x20;to&#x20;fix&#x20;the&#x20;problem&#x20;You&#x20;can&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;menu&#x20;entries&#x20;to&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;boot&#x20;without&#x20;entering&#x20;a&#x20;password.&#x20;Password&#x20;will&#x20;still&#x20;be&#x20;required&#x20;to&#x20;edit&#x20;menu&#x20;items.&#x20;More&#x20;Information:&#x20;https://help.ubuntu.com/community/Grub2/Passwords.','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;PBKDF2&#x20;hash&#x20;of&#x20;your&#x20;password&#x20;is&#x20;&lt;encrypted-password&gt;&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;EOF&#x20;The&#x20;superuser/user&#x20;information&#x20;and&#x20;password&#x20;should&#x20;not&#x20;be&#x20;contained&#x20;in&#x20;the&#x20;/etc/grub.d/00_header&#x20;file&#x20;as&#x20;this&#x20;file&#x20;could&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;package&#x20;update.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;requirement&#x20;to&#x20;be&#x20;able&#x20;to&#x20;boot/reboot&#x20;without&#x20;entering&#x20;the&#x20;password,&#x20;edit&#x20;/etc/grub.d/10_linux&#x20;and&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;line&#x20;CLASS=&#x20;Example:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub&#x20;Default&#x20;Value:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.&#x20;Replace&#x20;/boot/grub/grub.cfg&#x20;with&#x20;the&#x20;appropriate&#x20;grub&#x20;configuration&#x20;file&#x20;for&#x20;your&#x20;environment.','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1542\"]}, {\"mitre_tactics\": [\"T1542\"]}, {\"mitre_mitigations\": [\"M1046\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \" 8.3.5\", \" 8.3.6\", \" 8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28528,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg&#x20;#&#x20;chmod&#x20;u-wx,go-rwx&#x20;/boot/grub/grub.cfg&#x20;Additional&#x20;Information:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.&#x20;Replace&#x20;/boot/grub/grub.cfg&#x20;with&#x20;the&#x20;appropriate&#x20;grub&#x20;configuration&#x20;file&#x20;for&#x20;your&#x20;environment.','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1542\"]}, {\"mitre_tactics\": [\"TA0005\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \" AC.L1-3.1.2\", \" AC.L2-3.1.5\", \" AC.L2-3.1.3\", \" MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \" 164.308(a)(3)(ii)(A)\", \" 164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \" 7.1.1\", \" 7.1.2\", \" 7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \" 7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \" AC-6\"]}, {\"soc_2\": [\"CC5.2\", \" CC6.1\"]}]'),(28529,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root.','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \" 8.3.5\", \" 8.3.6\", \" 8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28530,'Ensure&#x20;prelink&#x20;is&#x20;not&#x20;installed.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;Uninstall&#x20;prelink&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;purge&#x20;prelink.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cis_csc_v8\": [\"3.14\"]}, {\"mitre_techniques\": [\"T1055\", \"T1055.009\", \"T1065\", \"T1065.001\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1050\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\"]}, {\"hipaa\": [\"164.312(b)\", \" 164.312(c)(1)\", \" 164.312(c)(2)\"]}, {\"pci_dss_v3.2.1\": [\"10.2.1\", \" 11.5\"]}, {\"pci_dss_v4.0\": [\"10.2.1\", \" 10.2.1.1\"]}, {\"nist_sp_800-53\": [\"AC-6(9)\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28531,'Ensure&#x20;Automatic&#x20;Error&#x20;Reporting&#x20;is&#x20;not&#x20;enabled.','The&#x20;Apport&#x20;Error&#x20;Reporting&#x20;Service&#x20;automatically&#x20;generates&#x20;crash&#x20;reports&#x20;for&#x20;debugging.','Apport&#x20;collects&#x20;potentially&#x20;sensitive&#x20;data,&#x20;such&#x20;as&#x20;core&#x20;dumps,&#x20;stack&#x20;traces,&#x20;and&#x20;log&#x20;files.&#x20;They&#x20;can&#x20;contain&#x20;passwords,&#x20;credit&#x20;card&#x20;numbers,&#x20;serial&#x20;numbers,&#x20;and&#x20;other&#x20;private&#x20;material.','','Edit&#x20;/etc/default/apport&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;enabled&#x20;parameter&#x20;to&#x20;equal&#x20;0:&#x20;enabled=0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;and&#x20;disable&#x20;the&#x20;apport&#x20;service&#x20;#&#x20;systemctl&#x20;stop&#x20;apport.service&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;apport.service&#x20;--&#x20;OR&#x20;-Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;apport&#x20;package:&#x20;#&#x20;apt&#x20;purge&#x20;apport&#x20;Default&#x20;Value:&#x20;enabled=1.','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \" CM.L2-3.4.8\", \" SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \" 1.2.1\", \" 2.2.2\", \" 2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \" 2.2.4\", \" 6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \" CC6.6\"]}]'),(28532,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0&#x20;IF&#x20;systemd-coredump&#x20;is&#x20;installed:&#x20;edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;Storage=none&#x20;ProcessSizeMax=0&#x20;Run&#x20;the&#x20;command:&#x20;systemctl&#x20;daemon-reload','[{\"cis\": [\"1.5.4\"]}, {\"mitre_techniques\": [\"T1005\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28533,'Ensure&#x20;AppArmor&#x20;is&#x20;installed.','AppArmor&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Install&#x20;AppArmor.&#x20;#&#x20;apt&#x20;install&#x20;apparmor.','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \" AC.L1-3.1.2\", \" AC.L2-3.1.5\", \" AC.L2-3.1.3\", \" MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \" 164.308(a)(3)(ii)(A)\", \" 164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \" 7.1.1\", \" 7.1.2\", \" 7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \" 7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \" AC-6\"]}, {\"soc_2\": [\"CC5.2\", \" CC6.1\"]}]'),(28534,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration.','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;bootloader&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;apparmor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28535,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;in&#x20;enforce&#x20;or&#x20;complain&#x20;mode.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applications&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;complain&#x20;mode:&#x20;#&#x20;aa-complain&#x20;/etc/apparmor.d&#47;&#42;&#x20;Note:&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28536,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applications&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Note:&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28537,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;OR&#x20;if&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.7.1\"]}, {\"mitre_techniques\": [\"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28538,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version&#x20;-&#x20;or&#x20;the&#x20;operating&#x20;system&#039;s&#x20;name.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.','[{\"cis\": [\"1.7.2\"]}, {\"mitre_techniques\": [\"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28539,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue','[{\"cis\": [\"1.7.3\"]}, {\"mitre_techniques\": [\"T1018\", \"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(28540,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/motd&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/motd&#41;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;/etc/motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd','[{\"cis\": [\"1.7.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28541,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue&#41;&#x20;Default&#x20;Value:&#x20;Access:&#x20;&#40;0644/-rw-r--r--&#41;&#x20;Uid:&#x20;&#40;&#x20;0/&#x20;root&#41;&#x20;Gid:&#x20;&#40;&#x20;0/&#x20;root&#41;.','[{\"cis\": [\"1.7.5\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28542,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue.net&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue.net&#41;','[{\"cis\": [\"1.7.6\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28543,'Ensure&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;removed.','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;&#40;GDM&#41;&#x20;is&#x20;a&#x20;program&#x20;that&#x20;manages&#x20;graphical&#x20;display&#x20;servers&#x20;and&#x20;handles&#x20;graphical&#x20;user&#x20;logins.','If&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Removing&#x20;the&#x20;GNOME&#x20;Display&#x20;manager&#x20;will&#x20;remove&#x20;the&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;from&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;gdm3:&#x20;#&#x20;apt&#x20;purge&#x20;gdm3.','[{\"cis\": [\"1.8.1\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28544,'Ensure&#x20;XDCMP&#x20;is&#x20;not&#x20;enabled.','X&#x20;Display&#x20;Manager&#x20;Control&#x20;Protocol&#x20;&#40;XDMCP&#41;&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;authenticated&#x20;access&#x20;to&#x20;display&#x20;management&#x20;services&#x20;for&#x20;remote&#x20;displays.','XDMCP&#x20;is&#x20;inherently&#x20;insecure.&#x20;XDMCP&#x20;is&#x20;not&#x20;a&#x20;ciphered&#x20;protocol.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;capture&#x20;keystrokes&#x20;entered&#x20;by&#x20;a&#x20;user&#x20;XDMCP&#x20;is&#x20;vulnerable&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;steal&#x20;the&#x20;credentials&#x20;of&#x20;legitimate&#x20;users&#x20;by&#x20;impersonating&#x20;the&#x20;XDMCP&#x20;server.','','Edit&#x20;the&#x20;file&#x20;/etc/gdm3/custom.conf&#x20;and&#x20;remove&#x20;the&#x20;line:&#x20;Enable=true&#x20;Default&#x20;Value:&#x20;false&#x20;&#40;This&#x20;is&#x20;denoted&#x20;by&#x20;no&#x20;Enabled=&#x20;entry&#x20;in&#x20;the&#x20;file&#x20;/etc/gdm3/custom.conf&#x20;in&#x20;the&#x20;[xdmcp]&#x20;section.','[{\"cis\": [\"1.8.10\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1040\", \"T1056\", \"T1056.001\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1050\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28545,'Ensure&#x20;chrony&#x20;is&#x20;running&#x20;as&#x20;user&#x20;_chrony.','The&#x20;chrony&#x20;package&#x20;is&#x20;installed&#x20;with&#x20;a&#x20;dedicated&#x20;user&#x20;account&#x20;_chrony.&#x20;This&#x20;account&#x20;is&#x20;granted&#x20;the&#x20;access&#x20;required&#x20;by&#x20;the&#x20;chronyd&#x20;service.','The&#x20;chronyd&#x20;service&#x20;should&#x20;run&#x20;with&#x20;only&#x20;the&#x20;required&#x20;privileges.','','Add&#x20;or&#x20;edit&#x20;the&#x20;user&#x20;line&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;or&#x20;a&#x20;file&#x20;ending&#x20;in&#x20;.conf&#x20;in&#x20;/etc/chrony/conf.d/:&#x20;user&#x20;_chrony&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;chrony&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;chrony','[{\"cis\": [\"2.1.2.2\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(28546,'Ensure&#x20;chrony&#x20;is&#x20;enabled&#x20;and&#x20;running.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.','chrony&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;to&#x20;synchronize&#x20;the&#x20;system&#x20;to&#x20;a&#x20;timeserver.&#x20;Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','IF&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;chrony.service:&#x20;#&#x20;systemctl&#x20;unmask&#x20;chrony.service&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;chrony.service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;chrony.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;chrony:&#x20;#&#x20;apt&#x20;purge&#x20;chrony.','[{\"cis\": [\"2.1.2.3\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(28547,'Ensure&#x20;systemd-timesyncd&#x20;is&#x20;enabled&#x20;and&#x20;running.','systemd-timesyncd&#x20;is&#x20;a&#x20;daemon&#x20;that&#x20;has&#x20;been&#x20;added&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.','systemd-timesyncd&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;to&#x20;synchronize&#x20;the&#x20;system&#x20;to&#x20;a&#x20;timeserver.&#x20;Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','IF&#x20;systemd-timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;systemd-timesyncd.service:&#x20;#&#x20;systemctl&#x20;unmask&#x20;systemd-timesyncd.service&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;systemd-timesyncd.service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;systemd-timesyncd.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;systemd-timesyncd:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;systemd-timesyncd.service','[{\"cis\": [\"2.1.3.2\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(28548,'Ensure&#x20;ntp&#x20;access&#x20;control&#x20;is&#x20;configured.','ntp&#x20;Access&#x20;Control&#x20;Commands:&#x20;restrict&#x20;address&#x20;[mask&#x20;mask]&#x20;[ippeerlimit&#x20;int]&#x20;[flag&#x20;...]&#x20;The&#x20;address&#x20;argument&#x20;expressed&#x20;in&#x20;dotted-quad&#x20;form&#x20;is&#x20;the&#x20;address&#x20;of&#x20;a&#x20;host&#x20;or&#x20;network.&#x20;Alternatively,&#x20;the&#x20;address&#x20;argument&#x20;can&#x20;be&#x20;a&#x20;valid&#x20;host&#x20;DNS&#x20;name.&#x20;The&#x20;mask&#x20;argument&#x20;expressed&#x20;in&#x20;dotted-quad&#x20;form&#x20;defaults&#x20;to&#x20;255.255.255.255,&#x20;meaning&#x20;that&#x20;the&#x20;address&#x20;is&#x20;treated&#x20;as&#x20;the&#x20;address&#x20;of&#x20;an&#x20;individual&#x20;host.&#x20;A&#x20;default&#x20;entry&#x20;&#40;address&#x20;0.0.0.0,&#x20;mask&#x20;0.0.0.0&#41;&#x20;is&#x20;always&#x20;included&#x20;and&#x20;is&#x20;always&#x20;the&#x20;first&#x20;entry&#x20;in&#x20;the&#x20;list.&#x20;Note:&#x20;the&#x20;text&#x20;string&#x20;default,&#x20;with&#x20;no&#x20;mask&#x20;option,&#x20;may&#x20;be&#x20;used&#x20;to&#x20;indicate&#x20;the&#x20;default&#x20;entry.&#x20;The&#x20;ippeerlimit&#x20;directive&#x20;limits&#x20;the&#x20;number&#x20;of&#x20;peer&#x20;requests&#x20;for&#x20;each&#x20;IP&#x20;to&#x20;int,&#x20;where&#x20;a&#x20;value&#x20;of&#x20;-1&#x20;means&#x20;&quot;unlimited&quot;,&#x20;the&#x20;current&#x20;default.&#x20;A&#x20;value&#x20;of&#x20;0&#x20;means&#x20;&quot;none&quot;.&#x20;There&#x20;would&#x20;usually&#x20;be&#x20;at&#x20;most&#x20;1&#x20;peering&#x20;request&#x20;per&#x20;IP,&#x20;but&#x20;if&#x20;the&#x20;remote&#x20;peering&#x20;requests&#x20;are&#x20;behind&#x20;a&#x20;proxy&#x20;there&#x20;could&#x20;well&#x20;be&#x20;more&#x20;than&#x20;1&#x20;per&#x20;IP.&#x20;In&#x20;the&#x20;current&#x20;implementation,&#x20;flag&#x20;always&#x20;restricts&#x20;access,&#x20;i.e.,&#x20;an&#x20;entry&#x20;with&#x20;no&#x20;flags&#x20;indicates&#x20;that&#x20;free&#x20;access&#x20;to&#x20;the&#x20;server&#x20;is&#x20;to&#x20;be&#x20;given.&#x20;The&#x20;flags&#x20;are&#x20;not&#x20;orthogonal,&#x20;in&#x20;that&#x20;more&#x20;restrictive&#x20;flags&#x20;will&#x20;often&#x20;make&#x20;less&#x20;restrictive&#x20;ones&#x20;redundant.&#x20;The&#x20;flags&#x20;can&#x20;generally&#x20;be&#x20;classed&#x20;into&#x20;two&#x20;categories,&#x20;those&#x20;which&#x20;restrict&#x20;time&#x20;service&#x20;and&#x20;those&#x20;which&#x20;restrict&#x20;informational&#x20;queries&#x20;and&#x20;attempts&#x20;to&#x20;do&#x20;run-time&#x20;reconfiguration&#x20;of&#x20;the&#x20;server.&#x20;One&#x20;or&#x20;more&#x20;of&#x20;the&#x20;following&#x20;flags&#x20;may&#x20;be&#x20;specified:&#x20;kod&#x20;-&#x20;If&#x20;this&#x20;flag&#x20;is&#x20;set&#x20;when&#x20;an&#x20;access&#x20;violation&#x20;occurs,&#x20;a&#x20;kiss-o&#039;-death&#x20;&#40;KoD&#41;&#x20;packet&#x20;is&#x20;sent.&#x20;KoD&#x20;packets&#x20;are&#x20;rate&#x20;limited&#x20;to&#x20;no&#x20;more&#x20;than&#x20;one&#x20;per&#x20;second.&#x20;If&#x20;another&#x20;KoD&#x20;packet&#x20;occurs&#x20;within&#x20;one&#x20;second&#x20;after&#x20;the&#x20;last&#x20;one,&#x20;the&#x20;packet&#x20;is&#x20;dropped.&#x20;limited&#x20;-&#x20;Deny&#x20;service&#x20;if&#x20;the&#x20;packet&#x20;spacing&#x20;violates&#x20;the&#x20;lower&#x20;limits&#x20;specified&#x20;in&#x20;the&#x20;discard&#x20;command.&#x20;A&#x20;history&#x20;of&#x20;clients&#x20;is&#x20;kept&#x20;using&#x20;the&#x20;monitoring&#x20;capability&#x20;of&#x20;ntpd.&#x20;Thus,&#x20;monitoring&#x20;is&#x20;always&#x20;active&#x20;as&#x20;long&#x20;as&#x20;there&#x20;is&#x20;a&#x20;restriction&#x20;entry&#x20;with&#x20;the&#x20;limited&#x20;flag.&#x20;lowpriotrap&#x20;-&#x20;Declare&#x20;traps&#x20;set&#x20;by&#x20;matching&#x20;hosts&#x20;to&#x20;be&#x20;low&#x20;priority.&#x20;The&#x20;number&#x20;of&#x20;traps&#x20;a&#x20;server&#x20;can&#x20;maintain&#x20;is&#x20;limited&#x20;&#40;the&#x20;current&#x20;limit&#x20;is&#x20;3&#41;.&#x20;Traps&#x20;are&#x20;usually&#x20;assigned&#x20;on&#x20;a&#x20;first&#x20;come,&#x20;first&#x20;served&#x20;basis,&#x20;with&#x20;later&#x20;trap&#x20;requestors&#x20;being&#x20;denied&#x20;service.&#x20;This&#x20;flag&#x20;modifies&#x20;the&#x20;assignment&#x20;algorithm&#x20;by&#x20;allowing&#x20;low&#x20;priority&#x20;traps&#x20;to&#x20;be&#x20;overridden&#x20;by&#x20;later&#x20;requests&#x20;for&#x20;normal&#x20;priority&#x20;traps.&#x20;noepeer&#x20;-&#x20;Deny&#x20;ephemeral&#x20;peer&#x20;requests,&#x20;even&#x20;if&#x20;they&#x20;come&#x20;from&#x20;an&#x20;authenticated&#x20;source.&#x20;Note&#x20;that&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;a&#x20;symmetric&#x20;key&#x20;for&#x20;authentication&#x20;may&#x20;be&#x20;restricted&#x20;to&#x20;one&#x20;or&#x20;more&#x20;IPs&#x20;or&#x20;subnets&#x20;via&#x20;the&#x20;third&#x20;field&#x20;of&#x20;the&#x20;ntp.keys&#x20;file.&#x20;This&#x20;restriction&#x20;is&#x20;not&#x20;enabled&#x20;by&#x20;default,&#x20;to&#x20;maintain&#x20;backward&#x20;compatibility.&#x20;Expect&#x20;noepeer&#x20;to&#x20;become&#x20;the&#x20;default&#x20;in&#x20;ntp-4.4.&#x20;nomodify&#x20;-&#x20;Deny&#x20;ntpq&#x20;and&#x20;ntpdc&#x20;queries&#x20;which&#x20;attempt&#x20;to&#x20;modify&#x20;the&#x20;state&#x20;of&#x20;the&#x20;server&#x20;&#40;i.e.,&#x20;run&#x20;time&#x20;reconfiguration&#41;.&#x20;Queries&#x20;which&#x20;return&#x20;information&#x20;are&#x20;permitted.&#x20;noquery&#x20;-&#x20;Deny&#x20;ntpq&#x20;and&#x20;ntpdc&#x20;queries.&#x20;Time&#x20;service&#x20;is&#x20;not&#x20;affected.&#x20;nopeer&#x20;-&#x20;Deny&#x20;unauthenticated&#x20;packets&#x20;which&#x20;would&#x20;result&#x20;in&#x20;mobilizing&#x20;a&#x20;new&#x20;association.&#x20;This&#x20;includes&#x20;broadcast&#x20;and&#x20;symmetric&#x20;active&#x20;packets&#x20;when&#x20;a&#x20;configured&#x20;association&#x20;does&#x20;not&#x20;exist.&#x20;It&#x20;also&#x20;includes&#x20;pool&#x20;associations,&#x20;so&#x20;if&#x20;you&#x20;want&#x20;to&#x20;use&#x20;servers&#x20;from&#x20;a&#x20;pool&#x20;directive&#x20;and&#x20;also&#x20;want&#x20;to&#x20;use&#x20;nopeer&#x20;by&#x20;default,&#x20;you&#039;ll&#x20;want&#x20;a&#x20;restrict&#x20;source&#x20;...&#x20;line&#x20;as&#x20;well&#x20;that&#x20;does&#x20;not&#x20;include&#x20;the&#x20;nopeer&#x20;directive.&#x20;noserve&#x20;-&#x20;Deny&#x20;all&#x20;packets&#x20;except&#x20;ntpq&#x20;and&#x20;ntpdc&#x20;queries.&#x20;notrap&#x20;-&#x20;Decline&#x20;to&#x20;provide&#x20;mode&#x20;6&#x20;control&#x20;message&#x20;trap&#x20;service&#x20;to&#x20;matching&#x20;hosts.&#x20;The&#x20;trap&#x20;service&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;ntpq&#x20;control&#x20;message&#x20;protocol&#x20;which&#x20;is&#x20;intended&#x20;for&#x20;use&#x20;by&#x20;remote&#x20;event&#x20;logging&#x20;programs.&#x20;notrust&#x20;-&#x20;Deny&#x20;service&#x20;unless&#x20;the&#x20;packet&#x20;is&#x20;cryptographically&#x20;authenticated.&#x20;ntpport&#x20;-&#x20;This&#x20;is&#x20;actually&#x20;a&#x20;match&#x20;algorithm&#x20;modifier,&#x20;rather&#x20;than&#x20;a&#x20;restriction&#x20;flag.&#x20;Its&#x20;presence&#x20;causes&#x20;the&#x20;restriction&#x20;entry&#x20;to&#x20;be&#x20;matched&#x20;only&#x20;if&#x20;the&#x20;source&#x20;port&#x20;in&#x20;the&#x20;packet&#x20;is&#x20;the&#x20;standard&#x20;NTP&#x20;UDP&#x20;port&#x20;&#40;123&#41;.&#x20;Both&#x20;ntpport&#x20;and&#x20;nonntpport&#x20;may&#x20;be&#x20;specified.&#x20;The&#x20;ntpport&#x20;is&#x20;considered&#x20;more&#x20;specific&#x20;and&#x20;is&#x20;sorted&#x20;later&#x20;in&#x20;the&#x20;list.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;accurate.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;ntp&#x20;Default&#x20;Value:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;notrap&#x20;nomodify&#x20;nopeer&#x20;noquery&#x20;limited&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;notrap&#x20;nomodify&#x20;nopeer&#x20;noquery&#x20;limited.','[{\"cis\": [\"2.1.4.1\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(28549,'Ensure&#x20;ntp&#x20;is&#x20;running&#x20;as&#x20;user&#x20;ntp.','The&#x20;ntp&#x20;package&#x20;is&#x20;installed&#x20;with&#x20;a&#x20;dedicated&#x20;user&#x20;account&#x20;ntp.&#x20;This&#x20;account&#x20;is&#x20;granted&#x20;the&#x20;access&#x20;required&#x20;by&#x20;the&#x20;ntpd&#x20;daemon&#x20;Note:&#x20;If&#x20;chrony&#x20;or&#x20;systemd-timesyncd&#x20;are&#x20;used,&#x20;ntp&#x20;should&#x20;be&#x20;removed&#x20;and&#x20;this&#x20;section&#x20;skipped&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system&#x20;Only&#x20;one&#x20;time&#x20;synchronization&#x20;method&#x20;should&#x20;be&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','The&#x20;ntpd&#x20;daemon&#x20;should&#x20;run&#x20;with&#x20;only&#x20;the&#x20;required&#x20;privilege.','','Add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line&#x20;in&#x20;/etc/init.d/ntp:&#x20;RUNASUSER=ntp&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;ntp.servocee:&#x20;#&#x20;systemctl&#x20;restart&#x20;ntp.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;ntp&#x20;Default&#x20;Value:&#x20;user&#x20;ntp.','[{\"cis\": [\"2.1.4.3\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(28550,'Ensure&#x20;ntp&#x20;is&#x20;enabled&#x20;and&#x20;running.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.','ntp&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;to&#x20;synchronize&#x20;the&#x20;system&#x20;to&#x20;a&#x20;timeserver.&#x20;Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','IF&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;ntp.service:&#x20;#&#x20;systemctl&#x20;unmask&#x20;ntp.service&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;ntp.service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;ntp.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp:&#x20;#&#x20;apt&#x20;purge&#x20;ntp.','[{\"cis\": [\"2.1.4.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(28551,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Many&#x20;Linux&#x20;systems&#x20;run&#x20;applications&#x20;which&#x20;require&#x20;a&#x20;Java&#x20;runtime.&#x20;Some&#x20;Linux&#x20;Java&#x20;packages&#x20;have&#x20;a&#x20;dependency&#x20;on&#x20;specific&#x20;X&#x20;Windows&#x20;xorg-x11-fonts.&#x20;One&#x20;workaround&#x20;to&#x20;avoid&#x20;this&#x20;dependency&#x20;is&#x20;to&#x20;use&#x20;the&#x20;&quot;headless&quot;&#x20;Java&#x20;packages&#x20;for&#x20;your&#x20;specific&#x20;Java&#x20;runtime,&#x20;if&#x20;provided&#x20;by&#x20;your&#x20;distribution.','Remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt&#x20;purge&#x20;xserver-xorg*','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28552,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daaemon.service&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;#&#x20;apt&#x20;purge&#x20;avahi-daemon.','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28553,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;cups&#x20;:&#x20;#&#x20;apt&#x20;purge&#x20;cups','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28554,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;isc-dhcp-server:&#x20;#&#x20;apt&#x20;purge&#x20;isc-dhcp-server.','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28555,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;slapd:&#x20;#&#x20;apt&#x20;purge&#x20;slapd','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28556,'Ensure&#x20;NFS&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares&#x20;or&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;these&#x20;services&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs:&#x20;#&#x20;apt&#x20;purge&#x20;nfs-kernel-server.','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28557,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;DNS&#x20;server:&#x20;#&#x20;apt&#x20;purge&#x20;bind9','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28558,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;SFTP&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;vsftpd:&#x20;#&#x20;apt&#x20;purge&#x20;vsftpd&#x20;Additional&#x20;Information:&#x20;Additional&#x20;FTP&#x20;servers&#x20;also&#x20;exist&#x20;and&#x20;should&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28559,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;installed.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;apache:&#x20;#&#x20;apt&#x20;purge&#x20;apache2&#x20;Additional&#x20;Information:&#x20;Several&#x20;httpd&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;apache2&#x20;and&#x20;nginx&#x20;are&#x20;example&#x20;services&#x20;that&#x20;provide&#x20;an&#x20;HTTP&#x20;server.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28560,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;are&#x20;not&#x20;installed.','dovecot-imapd&#x20;and&#x20;dovecot-pop3d&#x20;are&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;dovecot-imapd&#x20;and&#x20;dovecot-pop3d:&#x20;#&#x20;apt&#x20;purge&#x20;dovecot-imapd&#x20;dovecot-pop3d&#x20;Additional&#x20;Information:&#x20;Several&#x20;IMAP/POP3&#x20;servers&#x20;exist&#x20;and&#x20;can&#x20;use&#x20;other&#x20;service&#x20;names.&#x20;courier-imap&#x20;and&#x20;cyrus-imap&#x20;are&#x20;example&#x20;services&#x20;that&#x20;provide&#x20;a&#x20;mail&#x20;server.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;also&#x20;be&#x20;audited.','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28561,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;should&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;samba:&#x20;#&#x20;apt&#x20;purge&#x20;samba.','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28562,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;squid:&#x20;#&#x20;apt&#x20;purge&#x20;squid&#x20;Additional&#x20;Information:&#x20;Several&#x20;HTTP&#x20;proxy&#x20;servers&#x20;exist.&#x20;These&#x20;and&#x20;other&#x20;services&#x20;should&#x20;be&#x20;checked.','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28563,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;installed.','Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;is&#x20;a&#x20;widely&#x20;used&#x20;protocol&#x20;for&#x20;monitoring&#x20;the&#x20;health&#x20;and&#x20;welfare&#x20;of&#x20;network&#x20;equipment,&#x20;computer&#x20;equipment&#x20;and&#x20;devices&#x20;like&#x20;UPSs.&#x20;Net-SNMP&#x20;is&#x20;a&#x20;suite&#x20;of&#x20;applications&#x20;used&#x20;to&#x20;implement&#x20;SNMPv1&#x20;&#40;RFC&#x20;1157&#41;,&#x20;SNMPv2&#x20;&#40;RFCs&#x20;1901-1908&#41;,&#x20;and&#x20;SNMPv3&#x20;&#40;RFCs&#x20;3411-3418&#41;&#x20;using&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6.&#x20;Support&#x20;for&#x20;SNMPv2&#x20;classic&#x20;&#40;a.k.a.&#x20;&quot;SNMPv2&#x20;historic&quot;&#x20;-&#x20;RFCs&#x20;1441-1452&#41;&#x20;was&#x20;dropped&#x20;with&#x20;the&#x20;4.0&#x20;release&#x20;of&#x20;the&#x20;UCD-snmp&#x20;package.&#x20;The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3&#x20;replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2&#x20;with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;required:&#x20;The&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;for&#x20;SNMP&#x20;v3&#x20;only.&#x20;User&#x20;Authentication&#x20;and&#x20;Message&#x20;Encryption&#x20;should&#x20;be&#x20;configured.&#x20;If&#x20;SNMP&#x20;v2&#x20;is&#x20;absolutely&#x20;necessary,&#x20;modify&#x20;the&#x20;community&#x20;strings&#039;&#x20;values.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;snmp:&#x20;#&#x20;apt&#x20;purge&#x20;snmp.','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \" CM.L2-3.4.8\", \" SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \" 1.2.1\", \" 2.2.2\", \" 2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \" 2.2.4\", \" 6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \" CC6.6\"]}]'),(28564,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;clientserver&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nis:&#x20;#&#x20;apt&#x20;purge&#x20;nis.','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \" CM.L2-3.4.8\", \" SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \" 1.2.1\", \" 2.2.2\", \" 2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \" 2.2.4\", \" 6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \" CC6.6\"]}]'),(28565,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.&#x20;Note:&#x20;-&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;postfix&#x20;mail&#x20;server.&#x20;-&#x20;Depending&#x20;on&#x20;your&#x20;environment&#x20;you&#x20;may&#x20;have&#x20;an&#x20;alternative&#x20;MTA&#x20;installed&#x20;such&#x20;as&#x20;exim4.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case&#x20;consult&#x20;the&#x20;documentation&#x20;for&#x20;your&#x20;installed&#x20;MTA&#x20;to&#x20;configure&#x20;the&#x20;recommended&#x20;state.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix.','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1018\", \"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \" CM.L2-3.4.8\", \" SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \" 1.2.1\", \" 2.2.2\", \" 2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \" 2.2.4\", \" 6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \" CC6.6\"]}]'),(28566,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;either&#x20;not&#x20;installed&#x20;or&#x20;masked.','The&#x20;rsync&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsync&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.&#x20;The&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;area&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rsync:&#x20;#&#x20;apt&#x20;purge&#x20;rsync&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;rsync:&#x20;#&#x20;systemctl&#x20;stop&#x20;rsync&#x20;#&#x20;systemctl&#x20;mask&#x20;rsync.','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1105\", \"T1203\", \"T1210\", \"T1543\", \"T1543.002\", \"1570\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \" CM.L2-3.4.8\", \" SC.L2-3.13.6\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \" 1.2.1\", \" 2.2.2\", \" 2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \" 2.2.4\", \" 6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \" CC6.6\"]}]'),(28567,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;clientserver&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;nis:&#x20;#&#x20;apt&#x20;purge&#x20;nis','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28568,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh-client&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcp&#x20;and&#x20;rlogin.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;rsh:&#x20;#&#x20;apt&#x20;purge&#x20;rsh-client','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1040\", \"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28569,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;talk:&#x20;#&#x20;apt&#x20;purge&#x20;talk','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0006\", \"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28570,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;telnet:&#x20;#&#x20;apt&#x20;purge&#x20;telnet','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1040\", \"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0006\", \"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28571,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;the&#x20;LDAP&#x20;client&#x20;will&#x20;prevent&#x20;or&#x20;inhibit&#x20;using&#x20;LDAP&#x20;for&#x20;authentication&#x20;in&#x20;your&#x20;environment.','Uninstall&#x20;ldap-utils:&#x20;#&#x20;apt&#x20;purge&#x20;ldap-utils','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28572,'Ensure&#x20;RPC&#x20;is&#x20;not&#x20;installed.','Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;is&#x20;a&#x20;method&#x20;for&#x20;creating&#x20;low&#x20;level&#x20;client&#x20;server&#x20;applications&#x20;across&#x20;different&#x20;system&#x20;architectures.&#x20;It&#x20;requires&#x20;an&#x20;RPC&#x20;compliant&#x20;client&#x20;listening&#x20;on&#x20;a&#x20;network&#x20;port.&#x20;The&#x20;supporting&#x20;package&#x20;is&#x20;rpcbind.','If&#x20;RPC&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;services&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rpcbind:&#x20;#&#x20;apt&#x20;purge&#x20;rpcbind','[{\"cis\": [\"2.3.6\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28573,'Ensure&#x20;ufw&#x20;is&#x20;installed.','The&#x20;Uncomplicated&#x20;Firewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables&#x20;and&#x20;is&#x20;particularly&#x20;well-suited&#x20;for&#x20;host-based&#x20;firewalls.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x20;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.&#x20;Note:&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x20;UFW&#x20;is&#x20;dependent&#x20;on&#x20;the&#x20;iptables&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;:&#x20;apt&#x20;install&#x20;ufw','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28574,'Ensure&#x20;iptables-persistent&#x20;is&#x20;not&#x20;installed&#x20;with&#x20;ufw.','The&#x20;iptables-persistent&#x20;is&#x20;a&#x20;boot-time&#x20;loader&#x20;for&#x20;netfilter&#x20;rules,&#x20;iptables&#x20;plugin.','Running&#x20;both&#x20;ufw&#x20;and&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-persistent&#x20;package&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;iptables-persistent&#x20;package:&#x20;#&#x20;apt&#x20;purge&#x20;iptables-persistent','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28575,'Ensure&#x20;ufw&#x20;service&#x20;is&#x20;enabled.','UncomplicatedFirewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;and&#x20;available&#x20;graphical&#x20;user&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.&#x20;Notes:&#x20;When&#x20;running&#x20;ufw&#x20;enable&#x20;or&#x20;starting&#x20;ufw&#x20;via&#x20;its&#x20;initscript,&#x20;ufw&#x20;will&#x20;flush&#x20;its&#x20;chains.&#x20;This&#x20;is&#x20;required&#x20;so&#x20;ufw&#x20;can&#x20;maintain&#x20;a&#x20;consistent&#x20;state,&#x20;but&#x20;it&#x20;may&#x20;drop&#x20;existing&#x20;connections&#x20;&#40;eg&#x20;ssh&#41;.&#x20;ufw&#x20;does&#x20;support&#x20;adding&#x20;rules&#x20;before&#x20;enabling&#x20;the&#x20;firewall.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;before&#x20;running&#x20;ufw&#x20;enable.&#x20;#&#x20;ufw&#x20;allow&#x20;proto&#x20;tcp&#x20;from&#x20;any&#x20;to&#x20;any&#x20;port&#x20;22&#x20;The&#x20;rules&#x20;will&#x20;still&#x20;be&#x20;flushed,&#x20;but&#x20;the&#x20;ssh&#x20;port&#x20;will&#x20;be&#x20;open&#x20;after&#x20;enabling&#x20;the&#x20;firewall.&#x20;Please&#x20;note&#x20;that&#x20;once&#x20;ufw&#x20;is&#x20;&#039;enabled&#039;,&#x20;ufw&#x20;will&#x20;not&#x20;flush&#x20;the&#x20;chains&#x20;when&#x20;adding&#x20;or&#x20;removing&#x20;rules&#x20;&#40;but&#x20;will&#x20;when&#x20;modifying&#x20;a&#x20;rule&#x20;or&#x20;changing&#x20;the&#x20;default&#x20;policy&#41;&#x20;By&#x20;default,&#x20;ufw&#x20;will&#x20;prompt&#x20;when&#x20;enabling&#x20;the&#x20;firewall&#x20;while&#x20;running&#x20;under&#x20;ssh.&#x20;This&#x20;can&#x20;be&#x20;disabled&#x20;by&#x20;using&#x20;ufw&#x20;--force&#x20;enable.','The&#x20;ufw&#x20;service&#x20;must&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;for&#x20;ufw&#x20;to&#x20;protect&#x20;the&#x20;system.','Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;the&#x20;ufw&#x20;daemon:&#x20;#&#x20;systemctl&#x20;unmask&#x20;ufw.service&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;the&#x20;ufw&#x20;daemon:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;ufw.service&#x20;active&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;ufw:&#x20;#&#x20;ufw&#x20;enable','[{\"cis\": [\"3.5.1.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28576,'Ensure&#x20;ufw&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ufw&#x20;allow&#x20;in&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;allow&#x20;out&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;127.0.0.0/8&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;::1','[{\"cis\": [\"3.5.1.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28577,'Ensure&#x20;ufw&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;Any&#x20;port&#x20;or&#x20;protocol&#x20;without&#x20;a&#x20;explicit&#x20;allow&#x20;before&#x20;the&#x20;default&#x20;deny&#x20;will&#x20;be&#x20;blocked.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','Any&#x20;port&#x20;and&#x20;protocol&#x20;not&#x20;explicitly&#x20;allowed&#x20;will&#x20;be&#x20;blocked.&#x20;The&#x20;following&#x20;rules&#x20;should&#x20;be&#x20;considered&#x20;before&#x20;applying&#x20;the&#x20;default&#x20;deny.&#x20;ufw&#x20;allow&#x20;git&#x20;ufw&#x20;allow&#x20;in&#x20;http&#x20;ufw&#x20;allow&#x20;out&#x20;http&#x20;&lt;-&#x20;required&#x20;for&#x20;apt&#x20;to&#x20;connect&#x20;to&#x20;repository&#x20;ufw&#x20;allow&#x20;in&#x20;https&#x20;ufw&#x20;allow&#x20;out&#x20;https&#x20;ufw&#x20;allow&#x20;out&#x20;53&#x20;ufw&#x20;logging&#x20;on.','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;deny&#x20;policy:&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;incoming&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;outgoing&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;routed','[{\"cis\": [\"3.5.1.7\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28578,'Ensure&#x20;nftables&#x20;is&#x20;installed.','nftables&#x20;provides&#x20;a&#x20;new&#x20;in-kernel&#x20;packet&#x20;classification&#x20;framework&#x20;that&#x20;is&#x20;based&#x20;on&#x20;a&#x20;network-specific&#x20;Virtual&#x20;Machine&#x20;&#40;VM&#41;&#x20;and&#x20;a&#x20;new&#x20;nft&#x20;userspace&#x20;command&#x20;line&#x20;tool.&#x20;nftables&#x20;reuses&#x20;the&#x20;existing&#x20;Netfilter&#x20;subsystems&#x20;such&#x20;as&#x20;the&#x20;existing&#x20;hook&#x20;infrastructure,&#x20;the&#x20;connection&#x20;tracking&#x20;system,&#x20;NAT,&#x20;userspace&#x20;queuing&#x20;and&#x20;logging&#x20;subsystem.&#x20;Notes:&#x20;nftables&#x20;is&#x20;available&#x20;in&#x20;Linux&#x20;kernel&#x20;3.13&#x20;and&#x20;newer&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;the&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;nftables:&#x20;#&#x20;apt&#x20;install&#x20;nftables','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28579,'Ensure&#x20;a&#x20;nftables&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','Adding&#x20;rules&#x20;to&#x20;a&#x20;running&#x20;nftables&#x20;can&#x20;cause&#x20;loss&#x20;of&#x20;connectivity&#x20;to&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter','[{\"cis\": [\"3.5.2.4\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28580,'Ensure&#x20;nftables&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28581,'Ensure&#x20;nftables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;Default&#x20;Value:&#x20;accept','[{\"cis\": [\"3.5.2.8\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28582,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled.','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables.','[{\"cis\": [\"3.5.2.9\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28583,'Ensure&#x20;iptables&#x20;packages&#x20;are&#x20;installed.','iptables&#x20;is&#x20;a&#x20;utility&#x20;program&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;tables&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall,&#x20;implemented&#x20;as&#x20;different&#x20;Netfilter&#x20;modules,&#x20;and&#x20;the&#x20;chains&#x20;and&#x20;rules&#x20;it&#x20;stores.&#x20;Different&#x20;kernel&#x20;modules&#x20;and&#x20;programs&#x20;are&#x20;used&#x20;for&#x20;different&#x20;protocols;&#x20;iptables&#x20;applies&#x20;to&#x20;IPv4,&#x20;ip6tables&#x20;to&#x20;IPv6,&#x20;arptables&#x20;to&#x20;ARP,&#x20;and&#x20;ebtables&#x20;to&#x20;Ethernet&#x20;frames.','A&#x20;method&#x20;of&#x20;configuring&#x20;and&#x20;maintaining&#x20;firewall&#x20;rules&#x20;is&#x20;necessary&#x20;to&#x20;configure&#x20;a&#x20;Host&#x20;Based&#x20;Firewall.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;and&#x20;iptables-persistent&#x20;#&#x20;apt&#x20;install&#x20;iptables&#x20;iptables-persistent','[{\"cis\": [\"3.5.3.1.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28584,'Ensure&#x20;nftables&#x20;is&#x20;not&#x20;installed&#x20;with&#x20;iptables.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.','Running&#x20;both&#x20;iptables&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:&#x20;#&#x20;apt&#x20;purge&#x20;nftables','[{\"cis\": [\"3.5.3.1.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28585,'Ensure&#x20;ufw&#x20;is&#x20;uninstalled&#x20;or&#x20;disabled&#x20;with&#x20;iptables.','Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;&#x20;is&#x20;a&#x20;program&#x20;for&#x20;managing&#x20;a&#x20;netfilter&#x20;firewall&#x20;designed&#x20;to&#x20;be&#x20;easy&#x20;to&#x20;use.&#x20;Uses&#x20;a&#x20;command-line&#x20;interface&#x20;consisting&#x20;of&#x20;a&#x20;small&#x20;number&#x20;of&#x20;simple&#x20;commands&#x20;Uses&#x20;iptables&#x20;for&#x20;configuration.','Running&#x20;iptables.persistent&#x20;with&#x20;ufw&#x20;enabled&#x20;may&#x20;lead&#x20;to&#x20;conflict&#x20;and&#x20;unexpected&#x20;results.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;either&#x20;remove&#x20;ufw&#x20;or&#x20;stop&#x20;and&#x20;mask&#x20;ufw&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ufw:&#x20;#&#x20;apt&#x20;purge&#x20;ufw&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;ufw:&#x20;#&#x20;ufw&#x20;disable&#x20;#&#x20;systemctl&#x20;stop&#x20;ufw&#x20;#&#x20;systemctl&#x20;mask&#x20;ufw.','[{\"cis\": [\"3.5.3.1.3\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28586,'Ensure&#x20;iptables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP.','[{\"cis\": [\"3.5.3.2.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28587,'Ensure&#x20;iptables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP.','[{\"cis\": [\"3.5.3.2.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28588,'Ensure&#x20;ip6tables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP.','[{\"cis\": [\"3.5.3.3.1\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28589,'Ensure&#x20;ip6tables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP','[{\"cis\": [\"3.5.3.3.2\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.4\", \"1.1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}]'),(28590,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd&#x20;#&#x20;apt&#x20;install&#x20;auditd&#x20;audispd-plugins.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28591,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;active.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd.','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28592,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub2&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;Example:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28593,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient.','In&#x20;the&#x20;kernel-level&#x20;audit&#x20;subsystem,&#x20;a&#x20;socket&#x20;buffer&#x20;queue&#x20;is&#x20;used&#x20;to&#x20;hold&#x20;audit&#x20;events.&#x20;Whenever&#x20;a&#x20;new&#x20;audit&#x20;event&#x20;is&#x20;received,&#x20;it&#x20;is&#x20;logged&#x20;and&#x20;prepared&#x20;to&#x20;be&#x20;added&#x20;to&#x20;this&#x20;queue.&#x20;The&#x20;kernel&#x20;boot&#x20;parameter&#x20;audit_backlog_limit=N,&#x20;with&#x20;N&#x20;representing&#x20;the&#x20;amount&#x20;of&#x20;messages,&#x20;will&#x20;ensure&#x20;that&#x20;a&#x20;queue&#x20;cannot&#x20;grow&#x20;beyond&#x20;a&#x20;certain&#x20;size.&#x20;If&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;logged&#x20;which&#x20;would&#x20;grow&#x20;the&#x20;queue&#x20;beyond&#x20;this&#x20;limit,&#x20;then&#x20;a&#x20;failure&#x20;occurs&#x20;and&#x20;is&#x20;handled&#x20;according&#x20;to&#x20;the&#x20;system&#x20;configuration.','If&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;logged&#x20;which&#x20;would&#x20;grow&#x20;the&#x20;queue&#x20;beyond&#x20;the&#x20;audit_backlog_limit,&#x20;then&#x20;a&#x20;failure&#x20;occurs,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost,&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit_backlog_limit=N&#x20;to&#x20;GRUB_CMDLINE_LINUX.&#x20;The&#x20;recommended&#x20;size&#x20;for&#x20;N&#x20;is&#x20;8192&#x20;or&#x20;larger.&#x20;Example:&#x20;GRUB_CMDLINE_LINUX=&quot;audit_backlog_limit=8192&quot;&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub','[{\"cis\": [\"4.1.1.4\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28594,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;&#x20;Default&#x20;Value:&#x20;max_log_file&#x20;=&#x20;8&#x20;Additional&#x20;Information:&#x20;The&#x20;max_log_file&#x20;parameter&#x20;is&#x20;measured&#x20;in&#x20;megabytes.&#x20;Other&#x20;methods&#x20;of&#x20;log&#x20;rotation&#x20;may&#x20;be&#x20;appropriate&#x20;based&#x20;on&#x20;site&#x20;policy.&#x20;One&#x20;example&#x20;is&#x20;time-based&#x20;rotation&#x20;strategies&#x20;which&#x20;don&#039;t&#x20;have&#x20;native&#x20;support&#x20;in&#x20;auditd&#x20;configurations.&#x20;Manual&#x20;audit&#x20;of&#x20;custom&#x20;configurations&#x20;should&#x20;be&#x20;evaluated&#x20;for&#x20;effectiveness&#x20;and&#x20;completeness.','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1053\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}]'),(28595,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs.','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1053\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}]'),(28596,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.&#x20;The&#x20;admin_space_left_action&#x20;parameter&#x20;tells&#x20;the&#x20;system&#x20;what&#x20;action&#x20;to&#x20;take&#x20;when&#x20;the&#x20;system&#x20;has&#x20;detected&#x20;that&#x20;it&#x20;is&#x20;low&#x20;on&#x20;disk&#x20;space.&#x20;Valid&#x20;values&#x20;are&#x20;ignore,&#x20;syslog,&#x20;suspend,&#x20;single,&#x20;and&#x20;halt.&#x20;ignore,&#x20;the&#x20;audit&#x20;daemon&#x20;does&#x20;nothing&#x20;Syslog,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;issue&#x20;a&#x20;warning&#x20;to&#x20;syslog&#x20;Suspend,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;stop&#x20;writing&#x20;records&#x20;to&#x20;the&#x20;disk&#x20;single,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;put&#x20;the&#x20;computer&#x20;system&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;halt,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;shutdown&#x20;the&#x20;system.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','If&#x20;the&#x20;admin_space_left_action&#x20;parameter&#x20;is&#x20;set&#x20;to&#x20;halt&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;shutdown&#x20;the&#x20;system&#x20;when&#x20;the&#x20;disk&#x20;partition&#x20;containing&#x20;the&#x20;audit&#x20;logs&#x20;becomes&#x20;full.','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;set&#x20;admin_space_left_action&#x20;to&#x20;either&#x20;halt&#x20;or&#x20;single&#x20;in&#x20;/etc/audit/auditd.conf.&#x20;Example:&#x20;admin_space_left_action&#x20;=&#x20;halt.','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28597,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#x20;or&#x20;its&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope.&quot;.&#x20;Note:&#x20;Reloading&#x20;the&#x20;auditd&#x20;config&#x20;to&#x20;set&#x20;active&#x20;settings&#x20;requires&#x20;the&#x20;auditd&#x20;service&#x20;to&#x20;be&#x20;restarted,&#x20;and&#x20;may&#x20;require&#x20;a&#x20;system&#x20;reboot.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;and&#x20;/etc/sudoers.d&#x20;files&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;the&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;-w&#x20;/etc/sudoers.d&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-scope.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;Additional&#x20;Information:&#x20;Potential&#x20;reboot&#x20;required&#x20;If&#x20;the&#x20;auditing&#x20;configuration&#x20;is&#x20;locked&#x20;&#40;-e&#x20;2&#41;,&#x20;then&#x20;augenrules&#x20;will&#x20;not&#x20;warn&#x20;in&#x20;any&#x20;way&#x20;that&#x20;rules&#x20;could&#x20;not&#x20;be&#x20;loaded&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;A&#x20;system&#x20;reboot&#x20;will&#x20;be&#x20;required&#x20;to&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;System&#x20;call&#x20;structure&#x20;For&#x20;performance&#x20;&#40;man&#x20;7&#x20;audit.rules&#41;&#x20;reasons&#x20;it&#x20;is&#x20;preferable&#x20;to&#x20;have&#x20;all&#x20;the&#x20;system&#x20;calls&#x20;on&#x20;one&#x20;line.&#x20;However,&#x20;your&#x20;configuration&#x20;may&#x20;have&#x20;them&#x20;on&#x20;one&#x20;line&#x20;each&#x20;or&#x20;some&#x20;other&#x20;combination.&#x20;This&#x20;is&#x20;important&#x20;to&#x20;understand&#x20;for&#x20;both&#x20;the&#x20;auditing&#x20;and&#x20;remediation&#x20;sections&#x20;as&#x20;the&#x20;examples&#x20;given&#x20;are&#x20;optimized&#x20;for&#x20;performance&#x20;as&#x20;per&#x20;the&#x20;man&#x20;page.','[{\"cis\": [\"4.1.3.1\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28598,'Ensure&#x20;actions&#x20;as&#x20;another&#x20;user&#x20;are&#x20;always&#x20;logged.','sudo&#x20;provides&#x20;users&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;to&#x20;perform&#x20;operations,&#x20;either&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user.','Creating&#x20;an&#x20;audit&#x20;log&#x20;of&#x20;users&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;and&#x20;the&#x20;operation&#40;s&#41;&#x20;they&#x20;performed&#x20;is&#x20;essential&#x20;to&#x20;reporting.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;sudo&#039;s&#x20;logfile&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Create&#x20;audit&#x20;rules&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;elevated&#x20;privileges.&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;auid!=unset&#x20;-S&#x20;execve&#x20;-k&#x20;user_emulation&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;auid!=unset&#x20;-S&#x20;execve&#x20;-k&#x20;user_emulation&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-user_emulation.rules&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x20;&quot;;&#x20;fi&#x20;32&#x20;Bit&#x20;systems&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.&#x20;Additional&#x20;Information:&#x20;Potential&#x20;reboot&#x20;required&#x20;If&#x20;the&#x20;auditing&#x20;configuration&#x20;is&#x20;locked&#x20;&#40;-e&#x20;2&#41;,&#x20;then&#x20;augenrules&#x20;will&#x20;not&#x20;warn&#x20;in&#x20;any&#x20;way&#x20;that&#x20;rules&#x20;could&#x20;not&#x20;be&#x20;loaded&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;A&#x20;system&#x20;reboot&#x20;will&#x20;be&#x20;required&#x20;to&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;System&#x20;call&#x20;structure&#x20;For&#x20;performance&#x20;&#40;man&#x20;7&#x20;audit.rules&#41;&#x20;reasons&#x20;it&#x20;is&#x20;preferable&#x20;to&#x20;have&#x20;all&#x20;the&#x20;system&#x20;calls&#x20;on&#x20;one&#x20;line.&#x20;However,&#x20;your&#x20;configuration&#x20;may&#x20;have&#x20;them&#x20;on&#x20;one&#x20;line&#x20;each&#x20;or&#x20;some&#x20;other&#x20;combination.&#x20;This&#x20;is&#x20;important&#x20;to&#x20;understand&#x20;for&#x20;both&#x20;the&#x20;auditing&#x20;and&#x20;remediation&#x20;sections&#x20;as&#x20;the&#x20;examples&#x20;given&#x20;are&#x20;optimized&#x20;for&#x20;performance&#x20;as&#x20;per&#x20;the&#x20;man&#x20;page.','[{\"cis\": [\"4.1.3.2\"]}, {\"cis_csc_v7\": [\"4.9\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28599,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the;&#x20;adjtimex&#x20;-&#x20;tune&#x20;kernel&#x20;clock&#x20;settimeofday&#x20;-&#x20;set&#x20;time&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures&#x20;stime&#x20;-&#x20;using&#x20;seconds&#x20;since&#x20;1/1/1970&#x20;clock_settime&#x20;-&#x20;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed.&#x20;Further,&#x20;ensure&#x20;to&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;configured&#x20;audit&#x20;log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;a&#x20;unique&#x20;identifier&#x20;such&#x20;as&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','Create&#x20;audit&#x20;rules&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information.&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex,settimeofday,clock_settime&#x20;-k&#x20;timechange&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex,settimeofday,clock_settime&#x20;-k&#x20;timechange&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-time-change.rules&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x20;&quot;;&#x20;fi&#x20;32&#x20;Bit&#x20;systems&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.&#x20;In&#x20;addition,&#x20;add&#x20;stime&#x20;to&#x20;the&#x20;system&#x20;call&#x20;audit.&#x20;Example:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex,settimeofday,clock_settime,stime&#x20;-k&#x20;time-change&#x20;Additional&#x20;Information:&#x20;Potential&#x20;reboot&#x20;required&#x20;If&#x20;the&#x20;auditing&#x20;configuration&#x20;is&#x20;locked&#x20;&#40;-e&#x20;2&#41;,&#x20;then&#x20;augenrules&#x20;will&#x20;not&#x20;warn&#x20;in&#x20;any&#x20;way&#x20;that&#x20;rules&#x20;could&#x20;not&#x20;be&#x20;loaded&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;A&#x20;system&#x20;reboot&#x20;will&#x20;be&#x20;required&#x20;to&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;System&#x20;call&#x20;structure&#x20;For&#x20;performance&#x20;&#40;man&#x20;7&#x20;audit.rules&#41;&#x20;reasons&#x20;it&#x20;is&#x20;preferable&#x20;to&#x20;have&#x20;all&#x20;the&#x20;system&#x20;calls&#x20;on&#x20;one&#x20;line.&#x20;However,&#x20;your&#x20;configuration&#x20;may&#x20;have&#x20;them&#x20;on&#x20;one&#x20;line&#x20;each&#x20;or&#x20;some&#x20;other&#x20;combination.&#x20;This&#x20;is&#x20;important&#x20;to&#x20;understand&#x20;for&#x20;both&#x20;the&#x20;auditing&#x20;and&#x20;remediation&#x20;sections&#x20;as&#x20;the&#x20;examples&#x20;given&#x20;are&#x20;optimized&#x20;for&#x20;performance&#x20;as&#x20;per&#x20;the&#x20;man&#x20;page.','[{\"cis\": [\"4.1.3.4\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28600,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitors&#x20;the&#x20;following&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit:&#x20;sethostname&#x20;-&#x20;set&#x20;the&#x20;systems&#x20;host&#x20;name&#x20;setdomainname&#x20;-&#x20;set&#x20;the&#x20;systems&#x20;domain&#x20;name&#x20;The&#x20;files&#x20;being&#x20;monitored&#x20;are:&#x20;-/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;-&#x20;messages&#x20;displayed&#x20;pre-login&#x20;/etc/hosts&#x20;-&#x20;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses&#x20;-&#x20;/etc/networks&#x20;-&#x20;symbolic&#x20;names&#x20;for&#x20;networks&#x20;-&#x20;/etc/network/&#x20;-&#x20;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;should&#x20;have&#x20;a&#x20;relevant&#x20;tag&#x20;associated&#x20;with&#x20;them.','','Create&#x20;audit&#x20;rules&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment.&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname,setdomainname&#x20;-k&#x20;system-locale&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname,setdomainname&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/networks&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/network/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-system_local.rules&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;32&#x20;Bit&#x20;systems&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.5\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1047\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28601,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;modification&#x20;of&#x20;user&#x20;or&#x20;group&#x20;information,&#x20;including&#x20;that&#x20;of&#x20;passwords&#x20;and&#x20;old&#x20;passwords&#x20;if&#x20;in&#x20;use.&#x20;/etc/group&#x20;-&#x20;system&#x20;groups&#x20;/etc/passwd&#x20;-&#x20;system&#x20;users&#x20;/etc/gshadow&#x20;-&#x20;encrypted&#x20;password&#x20;for&#x20;each&#x20;group&#x20;/etc/shadow&#x20;-&#x20;system&#x20;user&#x20;passwords&#x20;/etc/security/opasswd&#x20;-&#x20;storage&#x20;of&#x20;old&#x20;passwords&#x20;if&#x20;the&#x20;relevant&#x20;PAM&#x20;module&#x20;is&#x20;in&#x20;use&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-identity.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x20;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.8\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28602,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;/var/run/utmp&#x20;-&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;/var/log/wtmp&#x20;-&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;/var/log/btmp&#x20;-&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session.&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;session&#x20;initiation&#x20;information.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-session.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x20;&quot;;&#x20;fi&#x20;Additional&#x20;Information:&#x20;Potential&#x20;reboot&#x20;required&#x20;If&#x20;the&#x20;auditing&#x20;configuration&#x20;is&#x20;locked&#x20;&#40;-e&#x20;2&#41;,&#x20;then&#x20;augenrules&#x20;will&#x20;not&#x20;warn&#x20;in&#x20;any&#x20;way&#x20;that&#x20;rules&#x20;could&#x20;not&#x20;be&#x20;loaded&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;A&#x20;system&#x20;reboot&#x20;will&#x20;be&#x20;required&#x20;to&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;System&#x20;call&#x20;structure&#x20;For&#x20;performance&#x20;&#40;man&#x20;7&#x20;audit.rules&#41;&#x20;reasons&#x20;it&#x20;is&#x20;preferable&#x20;to&#x20;have&#x20;all&#x20;the&#x20;system&#x20;calls&#x20;on&#x20;one&#x20;line.&#x20;However,&#x20;your&#x20;configuration&#x20;may&#x20;have&#x20;them&#x20;on&#x20;one&#x20;line&#x20;each&#x20;or&#x20;some&#x20;other&#x20;combination.&#x20;This&#x20;is&#x20;important&#x20;to&#x20;understand&#x20;for&#x20;both&#x20;the&#x20;auditing&#x20;and&#x20;remediation&#x20;sections&#x20;as&#x20;the&#x20;examples&#x20;given&#x20;are&#x20;optimized&#x20;for&#x20;performance&#x20;as&#x20;per&#x20;the&#x20;man&#x20;page.','[{\"cis\": [\"4.1.3.11\"]}, {\"cis_csc_v7\": [\"4.9\", \"16.13\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28603,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;/var/log/lastlog&#x20;-&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;/var/run/faillock&#x20;-&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/run/faillock&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-login.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x20;&quot;;&#x20;fi.&#x20;Additional&#x20;Information:&#x20;Potential&#x20;reboot&#x20;required&#x20;If&#x20;the&#x20;auditing&#x20;configuration&#x20;is&#x20;locked&#x20;&#40;-e&#x20;2&#41;,&#x20;then&#x20;augenrules&#x20;will&#x20;not&#x20;warn&#x20;in&#x20;any&#x20;way&#x20;that&#x20;rules&#x20;could&#x20;not&#x20;be&#x20;loaded&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;A&#x20;system&#x20;reboot&#x20;will&#x20;be&#x20;required&#x20;to&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;the&#x20;running&#x20;configuration.&#x20;System&#x20;call&#x20;structure&#x20;For&#x20;performance&#x20;&#40;man&#x20;7&#x20;audit.rules&#41;&#x20;reasons&#x20;it&#x20;is&#x20;preferable&#x20;to&#x20;have&#x20;all&#x20;the&#x20;system&#x20;calls&#x20;on&#x20;one&#x20;line.&#x20;However,&#x20;your&#x20;configuration&#x20;may&#x20;have&#x20;them&#x20;on&#x20;one&#x20;line&#x20;each&#x20;or&#x20;some&#x20;other&#x20;combination.&#x20;This&#x20;is&#x20;important&#x20;to&#x20;understand&#x20;for&#x20;both&#x20;the&#x20;auditing&#x20;and&#x20;remediation&#x20;sections&#x20;as&#x20;the&#x20;examples&#x20;given&#x20;are&#x20;optimized&#x20;for&#x20;performance&#x20;as&#x20;per&#x20;the&#x20;man&#x20;page.','[{\"cis\": [\"4.1.3.12\"]}, {\"cis_csc_v7\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28604,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;AppArmor,&#x20;an&#x20;implementation&#x20;of&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/apparmor/&#x20;and&#x20;/etc/apparmor.d/&#x20;directories.&#x20;Note:&#x20;If&#x20;a&#x20;different&#x20;Mandatory&#x20;Access&#x20;Control&#x20;method&#x20;is&#x20;used,&#x20;changes&#x20;to&#x20;the&#x20;corresponding&#x20;directories&#x20;should&#x20;be&#x20;audited.','Rationale:&#x20;Changes&#x20;to&#x20;files&#x20;in&#x20;the&#x20;/etc/apparmor/&#x20;and&#x20;/etc/apparmor.d/&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-MAC-policy.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi','[{\"cis\": [\"4.1.3.14\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28605,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl&#x20;.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.&#x20;Note:&#x20;This&#x20;setting&#x20;will&#x20;require&#x20;the&#x20;system&#x20;to&#x20;be&#x20;rebooted&#x20;to&#x20;update&#x20;the&#x20;active&#x20;auditd&#x20;configuration&#x20;settings.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line&#x20;-e&#x20;2&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file:&#x20;Example:&#x20;#&#x20;printf&#x20;--&#x20;&quot;-e&#x20;2&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x20;&quot;;&#x20;fi&#x20;Additional&#x20;Information:&#x20;NIST&#x20;SP&#x20;800-53&#x20;Rev.&#x20;5:&#x20;AC-3&#x20;AU-3&#x20;AU-3&#40;1&#41;&#x20;MP-2','[{\"cis\": [\"4.1.3.20\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"3.3\", \"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28606,'Ensure&#x20;only&#x20;authorized&#x20;groups&#x20;are&#x20;assigned&#x20;ownership&#x20;of&#x20;audit&#x20;log&#x20;files.','Audit&#x20;log&#x20;files&#x20;contain&#x20;information&#x20;about&#x20;the&#x20;system&#x20;and&#x20;system&#x20;activity.','Access&#x20;to&#x20;audit&#x20;records&#x20;can&#x20;reveal&#x20;system&#x20;and&#x20;configuration&#x20;data&#x20;to&#x20;attackers,&#x20;potentially&#x20;compromising&#x20;its&#x20;confidentiality.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;configure&#x20;the&#x20;audit&#x20;log&#x20;files&#x20;to&#x20;be&#x20;owned&#x20;by&#x20;adm&#x20;group:&#x20;#&#x20;find&#x20;$&#40;dirname&#x20;$&#40;awk&#x20;-F&quot;=&quot;&#x20;&#039;/^s*log_files*=s&#42;&#47;&#x20;{print&#x20;$2}&#039;&#x20;/etc/audit/auditd.conf&#x20;|&#x20;xargs&#41;&#41;&#x20;-type&#x20;f&#x20;&#40;&#x20;!&#x20;-group&#x20;adm&#x20;-a&#x20;!&#x20;-group&#x20;root&#x20;&#41;&#x20;-exec&#x20;chgrp&#x20;adm&#x20;{}&#x20;+&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;configure&#x20;the&#x20;audit&#x20;log&#x20;files&#x20;to&#x20;be&#x20;owned&#x20;by&#x20;the&#x20;adm&#x20;group:&#x20;#&#x20;chgrp&#x20;adm&#x20;/var/log/audit/&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;log_group&#x20;parameter&#x20;in&#x20;the&#x20;audit&#x20;configuration&#x20;file&#x20;to&#x20;log_group&#x20;=&#x20;adm:&#x20;#&#x20;sed&#x20;-ri&#x20;&#039;s/^s*#?s*log_groups*=s*S+&#40;s*#.*&#41;?.*$/log_group&#x20;=&#x20;adm1/&#039;&#x20;/etc/audit/auditd.conf&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;audit&#x20;daemon&#x20;to&#x20;reload&#x20;the&#x20;configuration&#x20;file:&#x20;#&#x20;systemctl&#x20;restart&#x20;auditd','[{\"cis\": [\"4.1.4.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28607,'Ensure&#x20;audit&#x20;configuration&#x20;files&#x20;are&#x20;640&#x20;or&#x20;more&#x20;restrictive.','Audit&#x20;configuration&#x20;files&#x20;control&#x20;auditd&#x20;and&#x20;what&#x20;events&#x20;are&#x20;audited.','Access&#x20;to&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;could&#x20;allow&#x20;unauthorized&#x20;personnel&#x20;to&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events.&#x20;Misconfigured&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events&#x20;or&#x20;impact&#x20;the&#x20;system&#039;s&#x20;performance&#x20;by&#x20;overwhelming&#x20;the&#x20;audit&#x20;log.&#x20;Misconfiguration&#x20;of&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;also&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;to&#x20;establish&#x20;and&#x20;investigate&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;than&#x20;0640&#x20;from&#x20;the&#x20;audit&#x20;configuration&#x20;files:&#x20;#&#x20;find&#x20;/etc/audit/&#x20;-type&#x20;f&#x20;&#40;&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-o&#x20;-name&#x20;&#039;*.rules&#039;&#x20;&#41;&#x20;-exec&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;{}&#x20;+','[{\"cis\": [\"4.1.4.5\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28608,'Ensure&#x20;audit&#x20;configuration&#x20;files&#x20;are&#x20;owned&#x20;by&#x20;root.','Audit&#x20;configuration&#x20;files&#x20;control&#x20;auditd&#x20;and&#x20;what&#x20;events&#x20;are&#x20;audited.','Access&#x20;to&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;could&#x20;allow&#x20;unauthorized&#x20;personnel&#x20;to&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events.&#x20;Misconfigured&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events&#x20;or&#x20;impact&#x20;the&#x20;system&#039;s&#x20;performance&#x20;by&#x20;overwhelming&#x20;the&#x20;audit&#x20;log.&#x20;Misconfiguration&#x20;of&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;also&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;to&#x20;establish&#x20;and&#x20;investigate&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;ownership&#x20;to&#x20;root&#x20;user:&#x20;#&#x20;find&#x20;/etc/audit/&#x20;-type&#x20;f&#x20;&#40;&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-o&#x20;-name&#x20;&#039;*.rules&#039;&#x20;&#41;&#x20;!&#x20;-user&#x20;root&#x20;-exec&#x20;chown&#x20;root&#x20;{}&#x20;+','[{\"cis\": [\"4.1.4.6\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28609,'Ensure&#x20;audit&#x20;configuration&#x20;files&#x20;belong&#x20;to&#x20;group&#x20;root.','Audit&#x20;configuration&#x20;files&#x20;control&#x20;auditd&#x20;and&#x20;what&#x20;events&#x20;are&#x20;audited.','Access&#x20;to&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;could&#x20;allow&#x20;unauthorized&#x20;personnel&#x20;to&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events.&#x20;Misconfigured&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events&#x20;or&#x20;impact&#x20;the&#x20;system&#039;s&#x20;performance&#x20;by&#x20;overwhelming&#x20;the&#x20;audit&#x20;log.&#x20;Misconfiguration&#x20;of&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;also&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;to&#x20;establish&#x20;and&#x20;investigate&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;group&#x20;to&#x20;root:&#x20;#&#x20;find&#x20;/etc/audit/&#x20;-type&#x20;f&#x20;&#40;&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-o&#x20;-name&#x20;&#039;*.rules&#039;&#x20;&#41;&#x20;!&#x20;-group&#x20;root&#x20;-exec&#x20;chgrp&#x20;root&#x20;{}&#x20;+','[{\"cis\": [\"4.1.4.7\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28610,'Ensure&#x20;audit&#x20;tools&#x20;are&#x20;755&#x20;or&#x20;more&#x20;restrictive.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;from&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;chmod&#x20;go-w&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules','[{\"cis\": [\"4.1.4.8\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28611,'Ensure&#x20;audit&#x20;tools&#x20;are&#x20;owned&#x20;by&#x20;root.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;audit&#x20;tools&#x20;to&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;chown&#x20;root&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules','[{\"cis\": [\"4.1.4.9\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28612,'Ensure&#x20;audit&#x20;tools&#x20;belong&#x20;to&#x20;group&#x20;root.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;from&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;chmod&#x20;go-w&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;audit&#x20;tools&#x20;to&#x20;root&#x20;user&#x20;and&#x20;group:&#x20;#&#x20;chown&#x20;root:root&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules','[{\"cis\": [\"4.1.4.10\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28613,'Ensure&#x20;cryptographic&#x20;mechanisms&#x20;are&#x20;used&#x20;to&#x20;protect&#x20;the&#x20;integrity&#x20;of&#x20;audit&#x20;tools.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;the&#x20;integrity&#x20;of&#x20;the&#x20;tools&#x20;used&#x20;for&#x20;auditing&#x20;purposes&#x20;is&#x20;a&#x20;critical&#x20;step&#x20;toward&#x20;ensuring&#x20;the&#x20;integrity&#x20;of&#x20;audit&#x20;information.&#x20;Audit&#x20;information&#x20;includes&#x20;all&#x20;information&#x20;&#40;e.g.,&#x20;audit&#x20;records,&#x20;audit&#x20;settings,&#x20;and&#x20;audit&#x20;reports&#41;&#x20;needed&#x20;to&#x20;successfully&#x20;audit&#x20;information&#x20;system&#x20;activity.&#x20;Attackers&#x20;may&#x20;replace&#x20;the&#x20;audit&#x20;tools&#x20;or&#x20;inject&#x20;code&#x20;into&#x20;the&#x20;existing&#x20;tools&#x20;with&#x20;the&#x20;purpose&#x20;of&#x20;providing&#x20;the&#x20;capability&#x20;to&#x20;hide&#x20;or&#x20;erase&#x20;system&#x20;activity&#x20;from&#x20;the&#x20;audit&#x20;logs.&#x20;Audit&#x20;tools&#x20;should&#x20;be&#x20;cryptographically&#x20;signed&#x20;in&#x20;order&#x20;to&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;identify&#x20;when&#x20;the&#x20;audit&#x20;tools&#x20;have&#x20;been&#x20;modified,&#x20;manipulated,&#x20;or&#x20;replaced.&#x20;An&#x20;example&#x20;is&#x20;a&#x20;checksum&#x20;hash&#x20;of&#x20;the&#x20;file&#x20;or&#x20;files.','','Add&#x20;or&#x20;update&#x20;the&#x20;following&#x20;selection&#x20;lines&#x20;for&#x20;&quot;/etc/aide/aide.conf&quot;&#x20;to&#x20;protect&#x20;the&#x20;integrity&#x20;of&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;Audit&#x20;Tools&#x20;/sbin/auditctl&#x20;p+i+n+u+g+s+b+acl+xattrs+sha512&#x20;/sbin/auditd&#x20;p+i+n+u+g+s+b+acl+xattrs+sha512&#x20;/sbin/ausearch&#x20;p+i+n+u+g+s+b+acl+xattrs+sha512&#x20;/sbin/aureport&#x20;p+i+n+u+g+s+b+acl+xattrs+sha512&#x20;/sbin/autrace&#x20;p+i+n+u+g+s+b+acl+xattrs+sha512&#x20;/sbin/augenrules&#x20;p+i+n+u+g+s+b+acl+xattrs+sha512','[{\"cis\": [\"4.1.4.11\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28614,'Ensure&#x20;systemd-journal-remote&#x20;is&#x20;installed.','Journald&#x20;&#40;via&#x20;systemd-journal-remote&#41;&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;log&#x20;events&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;enabling&#x20;centralised&#x20;log&#x20;management.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;systemd-journal-remote:&#x20;#&#x20;apt&#x20;install&#x20;systemd-journal-remote','[{\"cis\": [\"4.2.1.1.1\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28615,'Ensure&#x20;journald&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;recieve&#x20;logs&#x20;from&#x20;a&#x20;remote&#x20;client.','Journald&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;acting&#x20;as&#x20;a&#x20;log&#x20;server.&#x20;Clients&#x20;should&#x20;not&#x20;receive&#x20;data&#x20;from&#x20;other&#x20;hosts.&#x20;NOTE:&#x20;The&#x20;same&#x20;package,&#x20;systemd-journal-remote,&#x20;is&#x20;used&#x20;for&#x20;both&#x20;sending&#x20;logs&#x20;to&#x20;remote&#x20;hosts&#x20;and&#x20;receiving&#x20;incoming&#x20;logs.&#x20;With&#x20;regards&#x20;to&#x20;receiving&#x20;logs,&#x20;there&#x20;are&#x20;two&#x20;services;&#x20;systemd-journalremote.socket&#x20;and&#x20;systemd-journal-remote.service.','If&#x20;a&#x20;client&#x20;is&#x20;configured&#x20;to&#x20;also&#x20;receive&#x20;data,&#x20;thus&#x20;turning&#x20;it&#x20;into&#x20;a&#x20;server,&#x20;the&#x20;client&#x20;system&#x20;is&#x20;acting&#x20;outside&#x20;it&#039;s&#x20;operational&#x20;boundary.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;systemd-journal-remote.socket:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;systemd-journal-remote.socket','[{\"cis\": [\"4.2.1.1.4\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"9.2\"]}, {\"cis_csc_v8\": [\"4.8\", \"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28616,'Ensure&#x20;journald&#x20;service&#x20;is&#x20;enabled.','Ensure&#x20;that&#x20;the&#x20;systemd-journald&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;allow&#x20;capturing&#x20;of&#x20;logging&#x20;events.','If&#x20;the&#x20;systemd-journald&#x20;service&#x20;is&#x20;not&#x20;enabled&#x20;to&#x20;start&#x20;on&#x20;boot,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;capture&#x20;logging&#x20;events.','','By&#x20;default&#x20;the&#x20;systemd-journald&#x20;service&#x20;does&#x20;not&#x20;have&#x20;an&#x20;[Install]&#x20;section&#x20;and&#x20;thus&#x20;cannot&#x20;be&#x20;enabled&#x20;/&#x20;disabled.&#x20;It&#x20;is&#x20;meant&#x20;to&#x20;be&#x20;referenced&#x20;as&#x20;Requires&#x20;or&#x20;Wants&#x20;by&#x20;other&#x20;unit&#x20;files.&#x20;As&#x20;such,&#x20;if&#x20;the&#x20;status&#x20;of&#x20;systemd-journald&#x20;is&#x20;not&#x20;static,&#x20;investigate&#x20;why.','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28617,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald&#x20;Additional&#x20;Information:&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters.&#x20;It&#x20;is&#x20;possible&#x20;to&#x20;change&#x20;the&#x20;default&#x20;threshold&#x20;of&#x20;512&#x20;bytes&#x20;per&#x20;object&#x20;before&#x20;compression&#x20;is&#x20;used.','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.4\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1053\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}]'),(28618,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss&#x20;due&#x20;to&#x20;a&#x20;reboot.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald&#x20;Additional&#x20;Information:&#x20;The&#x20;main&#x20;configuration&#x20;file&#x20;/etc/systemd/journald.conf&#x20;is&#x20;read&#x20;before&#x20;any&#x20;of&#x20;the&#x20;custom&#x20;*.conf&#x20;files.&#x20;If&#x20;there&#x20;are&#x20;custom&#x20;configs&#x20;present,&#x20;they&#x20;override&#x20;the&#x20;main&#x20;configuration&#x20;parameters.','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28619,'Ensure&#x20;journald&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;should&#x20;be&#x20;kept&#x20;in&#x20;the&#x20;confines&#x20;of&#x20;the&#x20;service&#x20;and&#x20;not&#x20;forwarded&#x20;on&#x20;to&#x20;other&#x20;services.','IF&#x20;journald&#x20;is&#x20;the&#x20;method&#x20;for&#x20;capturing&#x20;logs,&#x20;all&#x20;logs&#x20;of&#x20;the&#x20;system&#x20;should&#x20;be&#x20;handled&#x20;by&#x20;journald&#x20;and&#x20;not&#x20;forwarded&#x20;to&#x20;other&#x20;logging&#x20;mechanisms.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;ensure&#x20;that&#x20;ForwardToSyslog=yes&#x20;is&#x20;removed.&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.5\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.9\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}, {\"pci_dss_3.2.1\": [\"10.5.3\", \"10.5.4\"]}, {\"pci_dss_4.0\": [\"10.3.3\"]}, {\"nist_sp_800-53\": [\"AU-6(3)\"]}, {\"soc_2\": [\"PL1.4\"]}]'),(28620,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;is&#x20;recommended&#x20;in&#x20;environments&#x20;where&#x20;journald&#x20;does&#x20;not&#x20;meet&#x20;operation&#x20;requirements.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;#&#x20;apt&#x20;install&#x20;rsyslog.','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1005\", \"T1070\", \"T1070.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28621,'Ensure&#x20;rsyslog&#x20;service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed,&#x20;ensure&#x20;that&#x20;the&#x20;service&#x20;is&#x20;enabled.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;enabled&#x20;to&#x20;start&#x20;on&#x20;boot,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;capture&#x20;logging&#x20;events.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28622,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;RSyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','IF&#x20;RSyslog&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;capturing&#x20;logs,&#x20;all&#x20;logs&#x20;of&#x20;the&#x20;system&#x20;should&#x20;be&#x20;sent&#x20;to&#x20;it&#x20;for&#x20;further&#x20;processing.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.5\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.9\"]}, {\"pci_dss_3.2.1\": [\"10.5.3\", \"10.5.4\"]}, {\"pci_dss_4.0\": [\"10.3.3\"]}, {\"nist_sp_800-53\": [\"AU-6(3)\"]}, {\"soc_2\": [\"PL1.4\"]}]'),(28623,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;are&#x20;configured.','RSyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','The&#x20;systems&#x20;global&#x20;umask&#x20;could&#x20;override,&#x20;but&#x20;only&#x20;making&#x20;the&#x20;file&#x20;permissions&#x20;stricter,&#x20;what&#x20;is&#x20;configured&#x20;in&#x20;RSyslog&#x20;with&#x20;the&#x20;FileCreateMode&#x20;directive.&#x20;RSyslog&#x20;also&#x20;has&#x20;it&#039;s&#x20;own&#x20;$umask&#x20;directive&#x20;that&#x20;can&#x20;alter&#x20;the&#x20;intended&#x20;file&#x20;creation&#x20;mode.&#x20;In&#x20;addition,&#x20;consideration&#x20;should&#x20;be&#x20;given&#x20;to&#x20;how&#x20;FileCreateMode&#x20;is&#x20;used.&#x20;Thus&#x20;it&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;intended&#x20;file&#x20;creation&#x20;mode&#x20;is&#x20;not&#x20;overridden&#x20;with&#x20;less&#x20;restrictive&#x20;settings&#x20;in&#x20;/etc/rsyslog.conf,&#x20;/etc/rsyslog.d&#47;&#42;conf&#x20;files&#x20;and&#x20;that&#x20;FileCreateMode&#x20;is&#x20;set&#x20;before&#x20;any&#x20;file&#x20;is&#x20;created.','Edit&#x20;either&#x20;/etc/rsyslog.conf&#x20;or&#x20;a&#x20;dedicated&#x20;.conf&#x20;file&#x20;in&#x20;/etc/rsyslog.d/&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;$FileCreateMode&#x20;0640&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc_v7\": [\"5.1\", \"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"3.3\", \"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28624,'Ensure&#x20;rsyslog&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;receive&#x20;logs&#x20;from&#x20;a&#x20;remote&#x20;client.','RSyslog&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;acting&#x20;as&#x20;a&#x20;log&#x20;server.&#x20;Clients&#x20;should&#x20;not&#x20;receive&#x20;data&#x20;from&#x20;other&#x20;hosts.','If&#x20;a&#x20;client&#x20;is&#x20;configured&#x20;to&#x20;also&#x20;receive&#x20;data,&#x20;thus&#x20;turning&#x20;it&#x20;into&#x20;a&#x20;server,&#x20;the&#x20;client&#x20;system&#x20;is&#x20;acting&#x20;outside&#x20;it&#039;s&#x20;operational&#x20;boundary.','','Should&#x20;there&#x20;be&#x20;any&#x20;active&#x20;log&#x20;server&#x20;configuration&#x20;found&#x20;in&#x20;the&#x20;auditing&#x20;section,&#x20;modify&#x20;those&#x20;file&#x20;and&#x20;remove&#x20;the&#x20;specific&#x20;lines&#x20;highlighted&#x20;by&#x20;the&#x20;audit.&#x20;Ensure&#x20;none&#x20;of&#x20;the&#x20;following&#x20;entries&#x20;are&#x20;present&#x20;in&#x20;any&#x20;of&#x20;/etc/rsyslog.conf&#x20;or&#x20;/etc/rsyslog.d&#47;&#42;.conf.&#x20;Old&#x20;format&#x20;$ModLoad&#x20;imtcp&#x20;$InputTCPServerRun&#x20;New&#x20;format&#x20;module&#40;load=&quot;imtcp&quot;&#41;&#x20;input&#40;type=&quot;imtcp&quot;&#x20;port=&quot;514&quot;&#41;&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog','[{\"cis\": [\"4.2.2.7\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"9.2\"]}, {\"cis_csc_v8\": [\"4.8\", \"8.2\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28625,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled&#x20;and&#x20;running.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;cron:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;cron','[{\"cis\": [\"5.1.1\"]}, {\"mitre_techniques\": [\"T1562\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(28626,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28627,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.hourly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28628,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.daily&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily/','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28629,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.weekly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly/','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28630,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.monthly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly/','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28631,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.d&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d/','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28632,'Ensure&#x20;cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;this&#x20;service.&#x20;If&#x20;/etc/cron.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;this&#x20;file&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;Note:&#x20;-&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy&#x20;-&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user&#x20;-&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow:&#x20;#&#x20;chmod&#x20;g-wx,o-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow.','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28633,'Ensure&#x20;at&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;this&#x20;service.&#x20;If&#x20;/etc/cron.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;this&#x20;file&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;Note:&#x20;-&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.&#x20;-&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;-&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;job.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;at&#x20;jobs.&#x20;Using&#x20;the&#x20;at.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;at&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/at.deny:&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/at.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/at.allow:&#x20;#&#x20;chmod&#x20;g-wx,o-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow.','[{\"cis\": [\"5.1.9\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28634,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config.','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1098\", \"T1098.004\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28635,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;-&#x20;AllowUsers:&#x20;&gt;&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;AllowGroups:&#x20;&gt;&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;-&#x20;DenyUsers:&#x20;&gt;&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;DenyGroups:&#x20;&gt;&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;or&#x20;a&#x20;included&#x20;configuration&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;OR&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;DenyGroups&#x20;&lt;grouplist&gt;','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1021\", \"T1021.004\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1018\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28636,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;OR&#x20;LogLevel&#x20;INFO','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}]'),(28637,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','The&#x20;UsePAM&#x20;directive&#x20;enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;&#40;PAM&#41;&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;yes&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;directives&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1021\", \"T1021.004\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1035\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28638,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;SSH.&#x20;The&#x20;default&#x20;is&#x20;prohibit-password.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root.&#x20;This&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}]'),(28639,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28640,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28641,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;SSH&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28642,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;SSH.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28643,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"mitre_techniques\": [\"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(28644,'Ensure&#x20;only&#x20;strong&#x20;Ciphers&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Note:&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;ciphers.&#x20;-&#x20;Ensure&#x20;that&#x20;ciphers&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;-&#x20;The&#x20;only&#x20;&quot;strong&quot;&#x20;ciphers&#x20;currently&#x20;FIPS&#x20;140-2&#x20;compliant&#x20;are:&#x20;&gt;&#x20;aes256-ctr&#x20;&gt;&#x20;aes192-ctr&#x20;&gt;&#x20;aes128-ctr&#x20;-&#x20;Supported&#x20;ciphers&#x20;in&#x20;openSSH&#x20;8.2:&#x20;3des-cbc&#x20;aes128-cbc&#x20;aes192-cbc&#x20;aes256-cbc&#x20;aes128-ctr&#x20;aes192-ctr&#x20;aes256-ctr&#x20;aes128-gcm@openssh.com&#x20;aes256-gcm@openssh.com&#x20;chacha20-poly1305@openssh.com.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.&#x20;-&#x20;The&#x20;Triple&#x20;DES&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;clear&#x20;text&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack.&#x20;-&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plain&#x20;text&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;cipher&#x20;text&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers.&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-&#x20;gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"mitre_techniques\": [\"T1040\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"AC-17(2)\", \"SC-8\", \"SC-8(1)\"]}]'),(28645,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Note:&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;MACs.&#x20;-&#x20;Ensure&#x20;that&#x20;MACs&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;-&#x20;The&#x20;only&#x20;&quot;strong&quot;&#x20;MACs&#x20;currently&#x20;FIPS&#x20;140-2&#x20;approved&#x20;are:&#x20;&gt;&#x20;hmac-sha2-256&#x20;&gt;&#x20;hmac-sha2-512&#x20;-&#x20;The&#x20;Supported&#x20;MACs&#x20;are:&#x20;hmac-md5&#x20;hmac-md5-96&#x20;hmac-sha1&#x20;hmac-sha1-96&#x20;hmac-sha2-256&#x20;hmac-sha2-512&#x20;umac-64@openssh.com&#x20;umac-128@openssh.com&#x20;hmac-md5-etm@openssh.com&#x20;hmac-md5-96-etm@openssh.com&#x20;hmac-sha1-etm@openssh.com&#x20;hmac-sha1-96-etm@openssh.com&#x20;hmac-sha2-256-etm@openssh.com&#x20;hmac-sha2-512-etm@openssh.com&#x20;umac-64-etm@openssh.com&#x20;umac-128-etm@openssh.com.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs.&#x20;Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc_v7\": [\"14.4\", \"16.5\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"mitre_techniques\": [\"T1040\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"AC-17(2)\", \"SC-8\", \"SC-8(1)\"]}]'),(28646,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received.&#x20;Notes:&#x20;-&#x20;Kex&#x20;algorithms&#x20;have&#x20;a&#x20;higher&#x20;preference&#x20;the&#x20;earlier&#x20;they&#x20;appear&#x20;in&#x20;the&#x20;list&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;Key&#x20;exchange&#x20;algorithms&#x20;-&#x20;Ensure&#x20;that&#x20;Key&#x20;exchange&#x20;algorithms&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy&#x20;-&#x20;The&#x20;only&#x20;Key&#x20;Exchange&#x20;Algorithms&#x20;currently&#x20;FIPS&#x20;140-2&#x20;approved&#x20;are:&#x20;&gt;&#x20;ecdh-sha2-nistp256&#x20;&gt;&#x20;ecdh-sha2-nistp384&#x20;&gt;&#x20;ecdh-sha2-nistp521&#x20;&gt;&#x20;diffie-hellman-group-exchange-sha256&#x20;&gt;&#x20;diffie-hellman-group16-sha512&#x20;&gt;&#x20;diffie-hellman-group18-sha512&#x20;&gt;&#x20;diffie-hellman-group14-sha256&#x20;-&#x20;The&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;supported&#x20;by&#x20;OpenSSH&#x20;8.2&#x20;are:&#x20;curve25519-sha256&#x20;curve25519-sha256@libssh.org&#x20;diffie-hellman-group1-sha1&#x20;diffie-hellman-group14-sha1&#x20;diffie-hellman-group14-sha256&#x20;diffie-hellman-group16-sha512&#x20;diffie-hellman-group18-sha512&#x20;diffie-hellman-group-exchange-sha1&#x20;diffie-hellman-group-exchange-sha256&#x20;ecdh-sha2-nistp256&#x20;ecdh-sha2-nistp384&#x20;ecdh-sha2-nistp521&#x20;sntrup4591761x25519-sha512@tinyssh.org.','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"mitre_techniques\": [\"T1040\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"AC-17(2)\", \"SC-8\", \"SC-8(1)\"]}]'),(28647,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;backdoors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','SSH&#x20;tunnels&#x20;are&#x20;widely&#x20;used&#x20;in&#x20;many&#x20;corporate&#x20;environments.&#x20;In&#x20;some&#x20;environments&#x20;the&#x20;applications&#x20;themselves&#x20;may&#x20;have&#x20;very&#x20;limited&#x20;native&#x20;support&#x20;for&#x20;security.&#x20;By&#x20;utilizing&#x20;tunneling,&#x20;compliance&#x20;with&#x20;SOX,&#x20;HIPAA,&#x20;PCI-DSS,&#x20;and&#x20;other&#x20;standards&#x20;can&#x20;be&#x20;achieved&#x20;without&#x20;having&#x20;to&#x20;modify&#x20;the&#x20;applications.','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1048\", \"T1048.002\", \"T1572\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28648,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_tactics\": [\"TA0001\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1035\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28649,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc_v7\": [\"16.13\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1036\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28650,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxStartups&#x20;10:30:60','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28651,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;set&#x20;to&#x20;10&#x20;or&#x20;less.','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10','[{\"cis\": [\"5.2.20\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}]'),(28652,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\", \"T1110.004\", \"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1036\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(28653,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','NOTE:&#x20;To&#x20;clarify,&#x20;the&#x20;two&#x20;settings&#x20;described&#x20;below&#x20;is&#x20;only&#x20;meant&#x20;for&#x20;idle&#x20;connections&#x20;from&#x20;a&#x20;protocol&#x20;perspective&#x20;and&#x20;not&#x20;meant&#x20;to&#x20;check&#x20;if&#x20;the&#x20;user&#x20;is&#x20;active&#x20;or&#x20;not.&#x20;An&#x20;idle&#x20;user&#x20;does&#x20;not&#x20;mean&#x20;an&#x20;idle&#x20;connection.&#x20;SSH&#x20;does&#x20;not&#x20;and&#x20;never&#x20;had,&#x20;intentionally,&#x20;the&#x20;capability&#x20;to&#x20;drop&#x20;idle&#x20;users.&#x20;In&#x20;SSH&#x20;versions&#x20;before&#x20;8.2p1&#x20;there&#x20;was&#x20;a&#x20;bug&#x20;that&#x20;caused&#x20;these&#x20;values&#x20;to&#x20;behave&#x20;in&#x20;such&#x20;a&#x20;manner&#x20;that&#x20;they&#x20;where&#x20;abused&#x20;to&#x20;disconnect&#x20;idle&#x20;users.&#x20;This&#x20;bug&#x20;has&#x20;been&#x20;resolved&#x20;in&#x20;8.2p1&#x20;and&#x20;thus&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;be&#x20;abused&#x20;disconnect&#x20;idle&#x20;users.&#x20;The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;SSH&#x20;sessions.&#x20;Taken&#x20;directly&#x20;from&#x20;man&#x20;5&#x20;sshd_config:&#x20;-&#x20;ClientAliveInterval&#x20;Sets&#x20;a&#x20;timeout&#x20;interval&#x20;in&#x20;seconds&#x20;after&#x20;which&#x20;if&#x20;no&#x20;data&#x20;has&#x20;been&#x20;received&#x20;from&#x20;the&#x20;client,&#x20;sshd&#40;8&#41;&#x20;will&#x20;send&#x20;a&#x20;message&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;to&#x20;request&#x20;a&#x20;response&#x20;from&#x20;the&#x20;client.&#x20;The&#x20;default&#x20;is&#x20;0,&#x20;indicating&#x20;that&#x20;these&#x20;messages&#x20;will&#x20;not&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;client.&#x20;-&#x20;ClientAliveCountMax&#x20;Sets&#x20;the&#x20;number&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;which&#x20;may&#x20;be&#x20;sent&#x20;without&#x20;sshd&#40;8&#41;&#x20;receiving&#x20;any&#x20;messages&#x20;back&#x20;from&#x20;the&#x20;client.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x20;reached&#x20;while&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;being&#x20;sent,&#x20;sshd&#x20;will&#x20;disconnect&#x20;the&#x20;client,&#x20;terminating&#x20;the&#x20;session.&#x20;It&#x20;is&#x20;important&#x20;to&#x20;note&#x20;that&#x20;the&#x20;use&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;is&#x20;very&#x20;different&#x20;from&#x20;TCPKeepAlive.&#x20;The&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;and&#x20;therefore&#x20;will&#x20;not&#x20;be&#x20;spoofable.&#x20;The&#x20;TCP&#x20;keepalive&#x20;option&#x20;enabled&#x20;by&#x20;TCPKeepAlive&#x20;is&#x20;spoofable.&#x20;The&#x20;client&#x20;alive&#x20;mechanism&#x20;is&#x20;valuable&#x20;when&#x20;the&#x20;client&#x20;or&#x20;server&#x20;depend&#x20;on&#x20;knowing&#x20;when&#x20;a&#x20;connection&#x20;has&#x20;become&#x20;unresponsive.&#x20;The&#x20;default&#x20;value&#x20;is&#x20;3.&#x20;If&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15,&#x20;and&#x20;ClientAliveCountMax&#x20;is&#x20;left&#x20;at&#x20;the&#x20;default,&#x20;unresponsive&#x20;SSH&#x20;clients&#x20;will&#x20;be&#x20;disconnected&#x20;after&#x20;approximately&#x20;45&#x20;seconds.&#x20;Setting&#x20;a&#x20;zero&#x20;ClientAliveCountMax&#x20;disables&#x20;connection&#x20;termination.','In&#x20;order&#x20;to&#x20;prevent&#x20;resource&#x20;exhaustion,&#x20;appropriate&#x20;values&#x20;should&#x20;be&#x20;set&#x20;for&#x20;both&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax.&#x20;Specifically,&#x20;looking&#x20;at&#x20;the&#x20;source&#x20;code,&#x20;ClientAliveCountMax&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;zero&#x20;in&#x20;order&#x20;to&#x20;utilize&#x20;the&#x20;ability&#x20;of&#x20;SSH&#x20;to&#x20;drop&#x20;idle&#x20;connections.&#x20;If&#x20;connections&#x20;are&#x20;allowed&#x20;to&#x20;stay&#x20;open&#x20;indefinately,&#x20;this&#x20;can&#x20;potentially&#x20;be&#x20;used&#x20;as&#x20;a&#x20;DDOS&#x20;attack&#x20;or&#x20;simple&#x20;resource&#x20;exhaustion&#x20;could&#x20;occur&#x20;over&#x20;unreliable&#x20;networks.&#x20;The&#x20;example&#x20;set&#x20;here&#x20;is&#x20;a&#x20;45&#x20;second&#x20;timeout.&#x20;Consult&#x20;your&#x20;site&#x20;policy&#x20;for&#x20;network&#x20;timeouts&#x20;and&#x20;apply&#x20;as&#x20;appropriate.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;ClientAliveInterval&#x20;15&#x20;ClientAliveCountMax&#x20;3','[{\"cis\": [\"5.2.22\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(28654,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plug-in&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plug-ins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;and&#x20;any&#x20;entries&#x20;in&#x20;/etc/sudoers.d.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','First&#x20;determine&#x20;is&#x20;LDAP&#x20;functionality&#x20;is&#x20;required.&#x20;If&#x20;so,&#x20;then&#x20;install&#x20;sudo-ldap,&#x20;else&#x20;install&#x20;&#x20;sudo.&#x20;Example:&#x20;#&#x20;apt&#x20;install&#x20;sudo','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}]'),(28655,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo&#x20;terminal&#x20;&#40;pseudo-pty&#41;.','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo&#x20;which&#x20;would&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','WARNING:&#x20;Editing&#x20;the&#x20;sudo&#x20;configuration&#x20;incorrectly&#x20;can&#x20;cause&#x20;sudo&#x20;to&#x20;stop&#x20;functioning.&#x20;Always&#x20;use&#x20;visudo&#x20;to&#x20;modify&#x20;sudo&#x20;configuration&#x20;files.','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;with&#x20;visudo&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}]'),(28656,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file.','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands.','WARNING:&#x20;Editing&#x20;the&#x20;sudo&#x20;configuration&#x20;incorrectly&#x20;can&#x20;cause&#x20;sudo&#x20;to&#x20;stop&#x20;functioning.&#x20;Always&#x20;use&#x20;visudo&#x20;to&#x20;modify&#x20;sudo&#x20;configuration&#x20;files.','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Example:&#x20;Defaults&#x20;logfile=&#039;/var/log/sudo.log&#039;','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}]'),(28657,'Ensure&#x20;users&#x20;must&#x20;provide&#x20;password&#x20;for&#x20;privilege&#x20;escalation.','The&#x20;operating&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;so&#x20;that&#x20;users&#x20;must&#x20;provide&#x20;a&#x20;password&#x20;for&#x20;privilege&#x20;escalation.','Without&#x20;&#40;re-&#41;authentication,&#x20;users&#x20;may&#x20;access&#x20;resources&#x20;or&#x20;perform&#x20;tasks&#x20;for&#x20;which&#x20;they&#x20;do&#x20;not&#x20;have&#x20;authorization.&#x20;When&#x20;operating&#x20;systems&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;escalate&#x20;a&#x20;functional&#x20;capability,&#x20;it&#x20;is&#x20;critical&#x20;the&#x20;user&#x20;&#40;re-&#41;authenticate.','This&#x20;will&#x20;prevent&#x20;automated&#x20;processes&#x20;from&#x20;being&#x20;able&#x20;to&#x20;elevate&#x20;privileges.','Based&#x20;on&#x20;the&#x20;outcome&#x20;of&#x20;the&#x20;audit&#x20;procedure,&#x20;use&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;to&#x20;edit&#x20;the&#x20;relevant&#x20;sudoers&#x20;file.&#x20;Remove&#x20;any&#x20;line&#x20;with&#x20;occurrences&#x20;of&#x20;NOPASSWD&#x20;tags&#x20;in&#x20;the&#x20;file.','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}]'),(28658,'Ensure&#x20;re-authentication&#x20;for&#x20;privilege&#x20;escalation&#x20;is&#x20;not&#x20;disabled&#x20;globally.','The&#x20;operating&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;so&#x20;that&#x20;users&#x20;must&#x20;re-authenticate&#x20;for&#x20;privilege&#x20;escalation.','Without&#x20;re-authentication,&#x20;users&#x20;may&#x20;access&#x20;resources&#x20;or&#x20;perform&#x20;tasks&#x20;for&#x20;which&#x20;they&#x20;do&#x20;not&#x20;have&#x20;authorization.&#x20;When&#x20;operating&#x20;systems&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;escalate&#x20;a&#x20;functional&#x20;capability,&#x20;it&#x20;is&#x20;critical&#x20;the&#x20;user&#x20;re-authenticate.','','Configure&#x20;the&#x20;operating&#x20;system&#x20;to&#x20;require&#x20;users&#x20;to&#x20;reauthenticate&#x20;for&#x20;privilege&#x20;escalation.&#x20;Based&#x20;on&#x20;the&#x20;outcome&#x20;of&#x20;the&#x20;audit&#x20;procedure,&#x20;use&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;to&#x20;edit&#x20;the&#x20;relevant&#x20;sudoers&#x20;file.&#x20;Remove&#x20;any&#x20;occurrences&#x20;of&#x20;!authenticate&#x20;tags&#x20;in&#x20;the&#x20;file&#40;s&#41;.','[{\"cis\": [\"5.3.5\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}]'),(28659,'Ensure&#x20;sudo&#x20;authentication&#x20;timeout&#x20;is&#x20;configured&#x20;correctly.','sudo&#x20;caches&#x20;used&#x20;credentials&#x20;for&#x20;a&#x20;default&#x20;of&#x20;15&#x20;minutes.&#x20;This&#x20;is&#x20;for&#x20;ease&#x20;of&#x20;use&#x20;when&#x20;there&#x20;are&#x20;multiple&#x20;administrative&#x20;tasks&#x20;to&#x20;perform.&#x20;The&#x20;timeout&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;suit&#x20;local&#x20;security&#x20;policies.&#x20;This&#x20;default&#x20;is&#x20;distribution&#x20;specific.&#x20;See&#x20;audit&#x20;section&#x20;for&#x20;further&#x20;information.','Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;the&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;unauthorized&#x20;privileged&#x20;access&#x20;to&#x20;another&#x20;user.','','If&#x20;the&#x20;currently&#x20;configured&#x20;timeout&#x20;is&#x20;larger&#x20;than&#x20;15&#x20;minutes,&#x20;edit&#x20;the&#x20;file&#x20;listed&#x20;in&#x20;the&#x20;audit&#x20;section&#x20;with&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;modify&#x20;the&#x20;entry&#x20;timestamp_timeout=&#x20;to&#x20;15&#x20;minutes&#x20;or&#x20;less&#x20;as&#x20;per&#x20;your&#x20;site&#x20;policy.&#x20;The&#x20;value&#x20;is&#x20;in&#x20;minutes.&#x20;This&#x20;particular&#x20;entry&#x20;may&#x20;appear&#x20;on&#x20;its&#x20;own,&#x20;or&#x20;on&#x20;the&#x20;same&#x20;line&#x20;as&#x20;env_reset.&#x20;See&#x20;the&#x20;following&#x20;two&#x20;examples:&#x20;&#x20;Defaults&#x20;env_reset,&#x20;timestamp_timeout=15&#x20;Defaults&#x20;timestamp_timeout=15&#x20;Defaults&#x20;env_reset','[{\"cis\": [\"5.3.6\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}]'),(28660,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;a&#x20;specific&#x20;groups&#x20;to&#x20;execute&#x20;su.&#x20;This&#x20;group&#x20;should&#x20;be&#x20;empty&#x20;to&#x20;reinforce&#x20;the&#x20;use&#x20;of&#x20;sudo&#x20;for&#x20;privileged&#x20;access.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Create&#x20;an&#x20;empty&#x20;group&#x20;that&#x20;will&#x20;be&#x20;specified&#x20;for&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command.&#x20;The&#x20;group&#x20;should&#x20;be&#x20;named&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;#&#x20;groupadd&#x20;sugroup&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file,&#x20;specifying&#x20;the&#x20;empty&#x20;group:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;group=sugroup','[{\"cis\": [\"5.3.7\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28661,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;Password&#x20;Length:&#x20;&gt;&#x20;minlen&#x20;=&#x20;14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more&#x20;-&#x20;Password&#x20;complexity:&#x20;&gt;&#x20;minclass&#x20;=&#x20;4&#x20;-&#x20;The&#x20;minimum&#x20;number&#x20;of&#x20;required&#x20;classes&#x20;of&#x20;characters&#x20;for&#x20;the&#x20;new&#x20;password&#x20;&#40;digits,&#x20;uppercase,&#x20;lowercase,&#x20;others&#41;&#x20;OR&#x20;&gt;&#x20;dcredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit&#x20;&gt;&#x20;ucredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character&#x20;&gt;&#x20;ocredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character&#x20;&gt;&#x20;lcredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','The&#x20;following&#x20;setting&#x20;is&#x20;a&#x20;recommend&#x20;example&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;#&#x20;apt&#x20;install&#x20;libpam-pwquality&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;Option&#x20;1:&#x20;minclass&#x20;=&#x20;4&#x20;Option&#x20;2:&#x20;dcredit&#x20;=&#x20;-1&#x20;ucredit&#x20;=&#x20;-1&#x20;ocredit&#x20;=&#x20;-1&#x20;lcredit&#x20;=&#x20;-1','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.001\", \"T1110.002\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28662,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured.','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;common&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;All&#x20;configuration&#x20;of&#x20;faillock&#x20;is&#x20;located&#x20;in&#x20;/etc/security/faillock.conf&#x20;and&#x20;well&#x20;commented.&#x20;-&#x20;deny&#x20;-&#x20;Deny&#x20;access&#x20;if&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;authentication&#x20;failures&#x20;for&#x20;this&#x20;user&#x20;during&#x20;the&#x20;recent&#x20;interval&#x20;exceeds&#x20;n&#x20;tries.&#x20;-&#x20;fail_interval&#x20;-&#x20;The&#x20;length&#x20;of&#x20;the&#x20;interval,&#x20;in&#x20;seconds,&#x20;during&#x20;which&#x20;the&#x20;consecutive&#x20;authentication&#x20;failures&#x20;must&#x20;happen&#x20;for&#x20;the&#x20;user&#x20;account&#x20;to&#x20;be&#x20;locked&#x20;out&#x20;-&#x20;unlock_time&#x20;-&#x20;The&#x20;access&#x20;will&#x20;be&#x20;re-enabled&#x20;after&#x20;n&#x20;seconds&#x20;after&#x20;the&#x20;lock&#x20;out.&#x20;The&#x20;value&#x20;0&#x20;has&#x20;the&#x20;same&#x20;meaning&#x20;as&#x20;value&#x20;never&#x20;-&#x20;the&#x20;access&#x20;will&#x20;not&#x20;be&#x20;re-enabled&#x20;without&#x20;resetting&#x20;the&#x20;faillock&#x20;entries&#x20;by&#x20;the&#x20;faillock&#x20;command.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;and&#x20;unlock&#x20;time&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','It&#x20;is&#x20;critical&#x20;to&#x20;test&#x20;and&#x20;validate&#x20;any&#x20;PAM&#x20;changes&#x20;before&#x20;deploying.&#x20;Any&#x20;misconfiguration&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;be&#x20;inaccessible.','NOTE:&#x20;Pay&#x20;special&#x20;attention&#x20;to&#x20;the&#x20;configuration.&#x20;Incorrect&#x20;configuration&#x20;can&#x20;cause&#x20;system&#x20;lock&#x20;outs.&#x20;This&#x20;is&#x20;example&#x20;configuration.&#x20;You&#x20;configuration&#x20;may&#x20;differ&#x20;based&#x20;on&#x20;previous&#x20;changes&#x20;to&#x20;the&#x20;files.&#x20;Common&#x20;auth&#x20;Edit&#x20;/etc/pam.d/common-auth&#x20;and&#x20;ensure&#x20;that&#x20;faillock&#x20;is&#x20;configured.&#x20;Note:&#x20;It&#x20;is&#x20;critical&#x20;to&#x20;understand&#x20;each&#x20;line&#x20;and&#x20;the&#x20;relevant&#x20;arguments&#x20;for&#x20;successful&#x20;implementation.&#x20;The&#x20;order&#x20;of&#x20;these&#x20;entries&#x20;is&#x20;very&#x20;specific.&#x20;The&#x20;pam_faillock.so&#x20;lines&#x20;surround&#x20;the&#x20;pam_unix.so&#x20;line.&#x20;The&#x20;comment&#x20;&quot;Added&#x20;to&#x20;enable&#x20;faillock&quot;&#x20;is&#x20;shown&#x20;to&#x20;highlight&#x20;the&#x20;additional&#x20;lines&#x20;and&#x20;their&#x20;order&#x20;in&#x20;the&#x20;file.&#x20;#&#x20;here&#x20;are&#x20;the&#x20;per-package&#x20;modules&#x20;&#40;the&#x20;&quot;Primary&quot;&#x20;block&#41;&#x20;auth&#x20;required&#x20;pam_faillock.so&#x20;preauth&#x20;#&#x20;Added&#x20;to&#x20;enable&#x20;faillock&#x20;auth&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;nullok&#x20;auth&#x20;[default=die]&#x20;pam_faillock.so&#x20;authfail&#x20;#&#x20;Added&#x20;to&#x20;enable&#x20;faillock&#x20;auth&#x20;sufficient&#x20;pam_faillock.so&#x20;authsucc&#x20;#&#x20;Added&#x20;to&#x20;enable&#x20;faillock&#x20;#&#x20;here&#039;s&#x20;the&#x20;fallback&#x20;if&#x20;no&#x20;module&#x20;succeeds&#x20;auth&#x20;requisite&#x20;pam_deny.so&#x20;#&#x20;prime&#x20;the&#x20;stack&#x20;with&#x20;a&#x20;positive&#x20;return&#x20;value&#x20;if&#x20;there&#x20;isn&#039;t&#x20;one&#x20;already;&#x20;#&#x20;this&#x20;avoids&#x20;us&#x20;returning&#x20;an&#x20;error&#x20;just&#x20;because&#x20;nothing&#x20;sets&#x20;a&#x20;success&#x20;code&#x20;#&#x20;since&#x20;the&#x20;modules&#x20;above&#x20;will&#x20;each&#x20;just&#x20;jump&#x20;around&#x20;auth&#x20;required&#x20;pam_permit.so&#x20;#&#x20;and&#x20;here&#x20;are&#x20;more&#x20;per-package&#x20;modules&#x20;&#40;the&#x20;&quot;Additional&quot;&#x20;block&#41;&#x20;auth&#x20;optional&#x20;pam_cap.so&#x20;#&#x20;end&#x20;of&#x20;pam-auth-update&#x20;config&#x20;Common&#x20;account&#x20;Edit&#x20;/etc/pam.d/common-account&#x20;and&#x20;ensure&#x20;that&#x20;the&#x20;following&#x20;stanza&#x20;is&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file.&#x20;account&#x20;required&#x20;pam_faillock.so&#x20;Fail&#x20;lock&#x20;configuration&#x20;Edit&#x20;/etc/security/faillock.conf&#x20;and&#x20;configure&#x20;it&#x20;per&#x20;your&#x20;site&#x20;policy.&#x20;Example:&#x20;deny&#x20;=&#x20;4&#x20;fail_interval&#x20;=&#x20;900&#x20;unlock&#x20;time&#x20;=&#x20;600','[{\"cis\": [\"5.4.2\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"cis_csc_v8\": [\"6.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\"]}, {\"hipaa\": [\"164.308(a)(3)(ii)(C)\"]}, {\"pci_dss_3.2.1\": [\"8.1.3\"]}, {\"pci_dss_4.0\": [\"8.2.4\", \"8.2.5\"]}, {\"nist_sp_800-53\": [\"AC-2(1)\"]}, {\"soc_2\": [\"CC6.2\", \"CC6.3\"]}]'),(28663,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#039;&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.','','NOTE:&#x20;Pay&#x20;special&#x20;attention&#x20;to&#x20;the&#x20;configuration.&#x20;Incorrect&#x20;configuration&#x20;can&#x20;cause&#x20;system&#x20;lock&#x20;outs.&#x20;This&#x20;is&#x20;example&#x20;configuration.&#x20;You&#x20;configuration&#x20;may&#x20;differ&#x20;based&#x20;on&#x20;previous&#x20;changes&#x20;to&#x20;the&#x20;files.&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember&#x20;option&#x20;and&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;as&#x20;shown:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;obscure&#x20;use_authtok&#x20;try_first_pass&#x20;yescrypt&#x20;remember=5','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.004\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28664,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;up&#x20;to&#x20;date&#x20;with&#x20;the&#x20;latest&#x20;standards.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;to&#x20;yescrypt.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;yescrypt&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;previous&#x20;available&#x20;algorithms,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note:&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','NOTE:&#x20;Pay&#x20;special&#x20;attention&#x20;to&#x20;the&#x20;configuration.&#x20;Incorrect&#x20;configuration&#x20;can&#x20;cause&#x20;system&#x20;lock&#x20;outs.&#x20;This&#x20;is&#x20;example&#x20;configuration.&#x20;You&#x20;configuration&#x20;may&#x20;differ&#x20;based&#x20;on&#x20;previous&#x20;changes&#x20;to&#x20;the&#x20;files.&#x20;PAM:&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;and&#x20;ensure&#x20;that&#x20;no&#x20;hashing&#x20;algorithm&#x20;option&#x20;for&#x20;pam_unix.so&#x20;is&#x20;set:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;obscure&#x20;use_authtok&#x20;try_first_pass&#x20;remember=5.&#x20;Login&#x20;definitions:&#x20;Edit&#x20;/etc/login.defs&#x20;and&#x20;ensure&#x20;that&#x20;ENCRYPT_METHOD&#x20;is&#x20;set&#x20;to&#x20;yescrypt.','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cis_csc_v8\": [\"3.11\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1110\", \"T1110.002\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28665,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;configured.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MIN_DAYS&#x20;1&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;1&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.1\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.004\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28666,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;does&#x20;not&#x20;exceed&#x20;365&#x20;days&#x20;and&#x20;is&#x20;greater&#x20;than&#x20;the&#x20;value&#x20;of&#x20;PASS_MIN_DAYS.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;365&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;365&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.001\", \"T1110.002\", \"T1110.003\", \"T1110.004\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28667,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_WARN_AGE&#x20;7&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.3\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28668,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;','[{\"cis\": [\"5.5.1.4\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.002\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28669,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0&#x20;:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28670,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd','[{\"cis\": [\"6.1.1\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28671,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd-','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28672,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28673,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group-','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28674,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/shadow&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/shadow:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28675,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/shadow-&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/shadow-:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow-','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28676,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/gshadow&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/gshadow:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/gshadow','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28677,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/gshadow-&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadowRun&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/gshadow-:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/gshadow-','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28678,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords.','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;The&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;oneway&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;x&#x20;in&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.&#x20;Note:&#x20;All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x20;A&#x20;user&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd&#x20;allows&#x20;the&#x20;account&#x20;to&#x20;be&#x20;logged&#x20;into&#x20;by&#x20;providing&#x20;only&#x20;the&#x20;username.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:&#x20;#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwd&#x20;Investigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cis_csc_v8\": [\"3.11\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28679,'Ensure&#x20;/etc/shadow&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1027\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(28680,'Ensure&#x20;shadow&#x20;group&#x20;is&#x20;empty.','The&#x20;shadow&#x20;group&#x20;allows&#x20;system&#x20;programs&#x20;which&#x20;require&#x20;access&#x20;the&#x20;ability&#x20;to&#x20;read&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;No&#x20;users&#x20;should&#x20;be&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group.','Any&#x20;users&#x20;assigned&#x20;to&#x20;the&#x20;shadow&#x20;group&#x20;would&#x20;be&#x20;granted&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file.&#x20;If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;passwords&#x20;to&#x20;break&#x20;them.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;additional&#x20;user&#x20;accounts.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;all&#x20;users&#x20;from&#x20;the&#x20;shadow&#x20;group&#x20;#&#x20;sed&#x20;-ri&#x20;&#039;s/&#40;^shadow:[^:]*:[^:]*:&#41;&#40;[^:]+$&#41;/1/&#039;&#x20;/etc/group&#x20;Change&#x20;the&#x20;primary&#x20;group&#x20;of&#x20;any&#x20;users&#x20;with&#x20;shadow&#x20;as&#x20;their&#x20;primary&#x20;group.&#x20;#&#x20;usermod&#x20;-g&#x20;&lt;primary&#x20;group&gt;&#x20;&lt;user&gt;','[{\"cis\": [\"6.2.4\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(28681,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.10\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(29000,'Ensure&#x20;All&#x20;Apple-provided&#x20;Software&#x20;Is&#x20;Current.','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','','1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;what&#x20;packages&#x20;need&#x20;to&#x20;be&#x20;installed:&#x20;sudo&#x20;softwareupdate&#x20;-l.&#x20;2.1.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;all&#x20;the&#x20;packages&#x20;that&#x20;need&#x20;to&#x20;be&#x20;updated:&#x20;sudo&#x20;software&#x20;-i&#x20;-a&#x20;-R.&#x20;2.2.&#x20;In&#x20;Terminal,&#x20;run&#x20;the&#x20;following&#x20;for&#x20;any&#x20;packages&#x20;that&#x20;show&#x20;up&#x20;in&#x20;step&#x20;1:&#x20;sudo&#x20;softwareupdate&#x20;-i&#x20;packagename&#039;','[{\"cis\": [\"1.1\"]}, {\"cis_level\": [\"1\"]}]'),(29001,'Ensure&#x20;Auto&#x20;Update&#x20;Is&#x20;Enabled.','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-bool&#x20;true','[{\"cis\": [\"1.2\"]}, {\"cis_level\": [\"1\"]}]'),(29002,'Ensure&#x20;Download&#x20;New&#x20;Updates&#x20;When&#x20;Available&#x20;is&#x20;Enabled.','In&#x20;the&#x20;GUI&#x20;both&#x20;&quot;Install&#x20;macOS&#x20;updates&quot;&#x20;and&#x20;&quot;Install&#x20;app&#x20;updates&#x20;from&#x20;the&#x20;App&#x20;Store&quot;&#x20;are&#x20;dependent&#x20;on&#x20;whether&#x20;&quot;Download&#x20;new&#x20;updates&#x20;when&#x20;available&quot;&#x20;is&#x20;selected.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;downloaded&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;applied.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticDownload&#x20;-bool&#x20;true','[{\"cis\": [\"1.3\"]}, {\"cis_level\": [\"1\"]}]'),(29003,'Ensure&#x20;Installation&#x20;of&#x20;App&#x20;Update&#x20;Is&#x20;Enabled.','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;admin&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;auto&#x20;update&#x20;feature:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-bool&#x20;TRUE','[{\"cis\": [\"1.4\"]}, {\"cis_level\": [\"1\"]}]'),(29004,'Ensure&#x20;System&#x20;Data&#x20;Files&#x20;and&#x20;Security&#x20;Updates&#x20;Are&#x20;Downloaded&#x20;Automatically&#x20;Is&#x20;Enabled.','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper.&#x20;With&#x20;this&#x20;setting&#x20;in&#x20;place&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;install&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;&amp;&amp;&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true','[{\"cis\": [\"1.5\"]}, {\"cis_level\": [\"1\"]}]'),(29005,'Ensure&#x20;Install&#x20;of&#x20;macOS&#x20;Updates&#x20;Is&#x20;Enabled.','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;so&#x20;the&#x20;admin&#x20;can&#x20;call&#x20;the&#x20;users&#x20;first&#x20;to&#x20;let&#x20;them&#x20;know&#x20;it&#039;s&#x20;ok&#x20;to&#x20;install.&#x20;A&#x20;dependable,&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;to&#x20;enable&#x20;automatic&#x20;checking&#x20;and&#x20;installing&#x20;of&#x20;macOS&#x20;updates:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticallyInstallMacOSUpdates&#x20;-bool&#x20;TRUE','[{\"cis\": [\"1.6\"]}, {\"cis_level\": [\"1\"]}]'),(29006,'Ensure&#x20;Bluetooth&#x20;Is&#x20;Disabled&#x20;If&#x20;No&#x20;Devices&#x20;Are&#x20;Paired.','Bluetooth&#x20;devices&#x20;use&#x20;a&#x20;wireless&#x20;communications&#x20;system&#x20;that&#x20;replaces&#x20;the&#x20;cables&#x20;used&#x20;by&#x20;other&#x20;peripherals&#x20;to&#x20;connect&#x20;to&#x20;a&#x20;system.&#x20;It&#x20;is&#x20;by&#x20;design&#x20;a&#x20;peer-to-peer&#x20;network&#x20;technology&#x20;and&#x20;typically&#x20;lacks&#x20;centralized&#x20;administration&#x20;and&#x20;security&#x20;enforcement&#x20;infrastructure.','Bluetooth&#x20;is&#x20;particularly&#x20;susceptible&#x20;to&#x20;a&#x20;diverse&#x20;set&#x20;of&#x20;security&#x20;vulnerabilities&#x20;involving&#x20;identity&#x20;detection,&#x20;location&#x20;tracking,&#x20;denial&#x20;of&#x20;service,&#x20;unintended&#x20;control&#x20;and&#x20;access&#x20;of&#x20;data&#x20;and&#x20;voice&#x20;channels,&#x20;and&#x20;unauthorized&#x20;device&#x20;control&#x20;and&#x20;data&#x20;access.','','Open&#x20;a&#x20;terminal&#x20;session&#x20;and&#x20;enter&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;bluetooth:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.Bluetooth&#x20;ControllerPowerState&#x20;-int&#x20;0&#x20;&amp;&amp;&#x20;sudo&#x20;killall&#x20;-HUP&#x20;bluetoothd','[{\"cis\": [\"2.1.1\"]}, {\"cis_level\": [\"1\"]}]'),(29007,'Ensure&#x20;Show&#x20;Bluetooth&#x20;Status&#x20;in&#x20;Menu&#x20;Bar&#x20;Is&#x20;Enabled.','By&#x20;showing&#x20;the&#x20;Bluetooth&#x20;status&#x20;in&#x20;the&#x20;menu&#x20;bar,&#x20;a&#x20;small&#x20;Bluetooth&#x20;icon&#x20;is&#x20;placed&#x20;in&#x20;the&#x20;menu&#x20;bar.&#x20;This&#x20;icon&#x20;quickly&#x20;shows&#x20;the&#x20;status&#x20;of&#x20;Bluetooth,&#x20;and&#x20;can&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;quickly&#x20;turn&#x20;Bluetooth&#x20;on&#x20;or&#x20;off.','Enabling&#x20;&quot;Show&#x20;Bluetooth&#x20;status&#x20;in&#x20;menu&#x20;bar&quot;&#x20;is&#x20;a&#x20;security&#x20;awareness&#x20;method&#x20;that&#x20;helps&#x20;understand&#x20;the&#x20;current&#x20;state&#x20;of&#x20;Bluetooth,&#x20;including&#x20;whether&#x20;it&#x20;is&#x20;enabled,&#x20;discoverable,&#x20;what&#x20;paired&#x20;devices&#x20;exist,&#x20;and&#x20;what&#x20;paired&#x20;devices&#x20;are&#x20;currently&#x20;active.','','For&#x20;each&#x20;user,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;Bluetooth&#x20;status&#x20;in&#x20;the&#x20;menu&#x20;bar:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;-currentHost&#x20;write&#x20;com.apple.controlcenter.plist&#x20;Bluetooth&#x20;-int&#x20;18','[{\"cis\": [\"2.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(29008,'Ensure&#x20;&quot;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&quot;&#x20;Is&#x20;Enabled','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','','Run&#x20;the&#x20;following&#x20;commands:&#x20;sudo&#x20;systemsetup&#x20;-setnetworktimeserver&#x20;&lt;timeserver&gt;&#x20;sudo&#x20;systemsetup&#x20;-setusingnetworktime&#x20;on.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;if&#x20;you&#x20;have&#x20;not&#x20;set,&#x20;or&#x20;need&#x20;to&#x20;set,&#x20;a&#x20;new&#x20;time&#x20;zone:&#x20;sudo&#x20;/usr/sbin/systemsetup&#x20;-listtimezones&#x20;sudo&#x20;/usr/sbin/systemsetup&#x20;-settimezone&#x20;&lt;selected&#x20;time&#x20;zone&gt;','[{\"cis\": [\"2.2.1\"]}, {\"cis_level\": [\"1\"]}]'),(29009,'Ensure&#x20;time&#x20;set&#x20;is&#x20;within&#x20;appropriate&#x20;limits.','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;Ensure&#x20;that&#x20;time&#x20;on&#x20;the&#x20;computer&#x20;is&#x20;within&#x20;acceptable&#x20;limits.&#x20;Truly&#x20;accurate&#x20;time&#x20;is&#x20;measured&#x20;within&#x20;milliseconds.&#x20;For&#x20;this&#x20;audit,&#x20;a&#x20;drift&#x20;under&#x20;four&#x20;and&#x20;a&#x20;half&#x20;minutes&#x20;passes&#x20;the&#x20;control&#x20;check.&#x20;Since&#x20;Kerberos&#x20;is&#x20;one&#x20;of&#x20;the&#x20;important&#x20;features&#x20;of&#x20;macOS&#x20;integration&#x20;into&#x20;Directory&#x20;systems&#x20;the&#x20;guidance&#x20;here&#x20;is&#x20;to&#x20;warn&#x20;you&#x20;before&#x20;there&#x20;could&#x20;be&#x20;an&#x20;impact&#x20;to&#x20;operations.&#x20;From&#x20;the&#x20;perspective&#x20;of&#x20;accurate&#x20;time,&#x20;this&#x20;check&#x20;is&#x20;not&#x20;strict,&#x20;so&#x20;it&#x20;may&#x20;be&#x20;too&#x20;great&#x20;for&#x20;your&#x20;organization.&#x20;Your&#x20;organization&#x20;can&#x20;adjust&#x20;to&#x20;a&#x20;smaller&#x20;offset&#x20;value&#x20;as&#x20;needed.&#x20;Note:&#x20;ntpdate&#x20;has&#x20;been&#x20;deprecated&#x20;with&#x20;10.14.&#x20;sntp&#x20;replaces&#x20;that&#x20;command.&#x20;NOTE:&#x20;set&#x20;the&#x20;correct&#x20;network&#x20;time&#x20;server&#x20;in&#x20;the&#x20;rules.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.&#x20;Audit&#x20;check&#x20;is&#x20;for&#x20;more&#x20;than&#x20;4&#x20;minutes&#x20;and&#x20;30&#x20;seconds&#x20;ahead&#x20;or&#x20;behind.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;ensure&#x20;your&#x20;time&#x20;is&#x20;set&#x20;within&#x20;an&#x20;appropriate&#x20;limit:&#x20;sudo&#x20;systemsetup&#x20;-getnetworktimeserver&#x20;-&gt;&#x20;Get&#x20;the&#x20;time&#x20;server&#x20;name&#x20;and&#x20;then&#x20;run:&#x20;sudo&#x20;touch&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;chown&#x20;root:wheel&#x20;/var/db/ntp-kod&#x20;&amp;&amp;&#x20;sudo&#x20;sntp&#x20;-sS&#x20;&lt;YOUR-TIME-SERVER&gt;&#x20;','[{\"cis\": [\"2.2.2\"]}, {\"cis_level\": [\"1\"]}]'),(29010,'Ensure&#x20;an&#x20;Inactivity&#x20;Interval&#x20;of&#x20;20&#x20;Minutes&#x20;Or&#x20;Less&#x20;for&#x20;the&#x20;Screen&#x20;Saver&#x20;Is&#x20;Enabled.','A&#x20;locking&#x20;screensaver&#x20;is&#x20;one&#x20;of&#x20;the&#x20;standard&#x20;security&#x20;controls&#x20;to&#x20;limit&#x20;access&#x20;to&#x20;a&#x20;computer&#x20;and&#x20;the&#x20;current&#x20;user&#039;s&#x20;session&#x20;when&#x20;the&#x20;computer&#x20;is&#x20;temporarily&#x20;unused&#x20;or&#x20;unattended.&#x20;In&#x20;macOS&#x20;the&#x20;screensaver&#x20;starts&#x20;after&#x20;a&#x20;value&#x20;selected&#x20;in&#x20;a&#x20;drop&#x20;down&#x20;menu,&#x20;10&#x20;minutes&#x20;and&#x20;20&#x20;minutes&#x20;are&#x20;both&#x20;options&#x20;and&#x20;either&#x20;is&#x20;acceptable.&#x20;Any&#x20;value&#x20;can&#x20;be&#x20;selected&#x20;through&#x20;the&#x20;command&#x20;line&#x20;or&#x20;script&#x20;but&#x20;a&#x20;number&#x20;that&#x20;is&#x20;not&#x20;reflected&#x20;in&#x20;the&#x20;GUI&#x20;can&#x20;be&#x20;problematic.&#x20;20&#x20;minutes&#x20;is&#x20;the&#x20;default&#x20;for&#x20;new&#x20;accounts.','Setting&#x20;an&#x20;inactivity&#x20;interval&#x20;for&#x20;the&#x20;screensaver&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;a&#x20;system&#x20;left&#x20;unattended&#x20;for&#x20;an&#x20;extensive&#x20;period&#x20;of&#x20;time.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;that&#x20;the&#x20;idle&#x20;time&#x20;of&#x20;the&#x20;screen&#x20;saver&#x20;to&#x20;20&#x20;minutes&#x20;or&#x20;less&#x20;&#40;&le;1200&#41;:&#x20;&#x20;$&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;/usr/bin/defaults&#x20;-currentHost&#x20;write&#x20;com.apple.screensaver&#x20;idleTime&#x20;-int&#x20;&lt;value&#x20;&le;1200&gt;.&#x20;If&#x20;there&#x20;are&#x20;multiple&#x20;users&#x20;out&#x20;of&#x20;compliance&#x20;with&#x20;the&#x20;prescribed&#x20;setting,&#x20;run&#x20;this&#x20;command&#x20;for&#x20;each&#x20;user&#x20;to&#x20;set&#x20;their&#x20;idle&#x20;time:&#x20;&#x20;$&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;/usr/bin/defaults&#x20;-currentHost&#x20;write&#x20;com.apple.screensaver&#x20;idleTime&#x20;-int&#x20;&lt;value&#x20;&le;1200&gt;.&#x20;Note:&#x20;Issues&#x20;arise&#x20;if&#x20;the&#x20;command&#x20;line&#x20;is&#x20;used&#x20;to&#x20;make&#x20;the&#x20;setting&#x20;something&#x20;other&#x20;than&#x20;what&#x20;is&#x20;available&#x20;in&#x20;the&#x20;GUI&#x20;Menu.&#x20;Choose&#x20;either&#x20;1&#x20;&#40;60&#41;,&#x20;2&#x20;&#40;120&#41;,&#x20;5&#x20;&#40;300&#41;,&#x20;10&#x20;&#40;600&#41;,&#x20;or&#x20;20&#x20;&#40;120&#41;&#x20;minutes&#x20;to&#x20;avoid&#x20;any&#x20;issues.&#x20;Profile&#x20;Method:&#x20;1.&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;PayLoadType&#x20;of&#x20;com.apple.screensaver.user&#x20;2.&#x20;Add&#x20;the&#x20;key&#x20;idleTime&#x20;3.&#x20;Set&#x20;the&#x20;key&#x20;to&#x20;&lt;integer&gt;&lt;&le;1200&gt;&lt;/integer&gt;&#x20;','[{\"cis\": [\"2.3.1\"]}, {\"cis_level\": [\"1\"]}]'),(29011,'Ensure&#x20;Screen&#x20;Saver&#x20;Corners&#x20;Are&#x20;Secure.','Hot&#x20;Corners&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;by&#x20;moving&#x20;the&#x20;mouse&#x20;cursor&#x20;to&#x20;a&#x20;corner&#x20;of&#x20;the&#x20;screen.','Setting&#x20;a&#x20;hot&#x20;corner&#x20;to&#x20;disable&#x20;the&#x20;screen&#x20;saver&#x20;poses&#x20;a&#x20;potential&#x20;security&#x20;risk&#x20;since&#x20;an&#x20;unauthorized&#x20;person&#x20;could&#x20;use&#x20;this&#x20;to&#x20;bypass&#x20;the&#x20;login&#x20;screen&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Disable&#x20;Screen&#x20;Saver&#x20;for&#x20;a&#x20;Hot&#x20;Corner:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.dock&#x20;&lt;corner&#x20;that&#x20;is&#x20;set&#x20;to&#x20;&#039;6&#039;&gt;&#x20;-int&#x20;0&#x20;','[{\"cis\": [\"2.3.2\"]}, {\"cis_level\": [\"2\"]}]'),(29012,'Ensure&#x20;Remote&#x20;Apple&#x20;Events&#x20;Is&#x20;Disabled.','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremoteappleevents&#x20;off','[{\"cis\": [\"2.4.1\"]}, {\"cis_level\": [\"1\"]}]'),(29013,'Ensure&#x20;Internet&#x20;Sharing&#x20;Is&#x20;Disabled','Internet&#x20;Sharing&#x20;uses&#x20;the&#x20;open&#x20;source&#x20;natd&#x20;process&#x20;to&#x20;share&#x20;an&#x20;internet&#x20;connection&#x20;with&#x20;other&#x20;computers&#x20;and&#x20;devices&#x20;on&#x20;a&#x20;local&#x20;network.&#x20;This&#x20;allows&#x20;the&#x20;Mac&#x20;to&#x20;function&#x20;as&#x20;a&#x20;router&#x20;and&#x20;share&#x20;the&#x20;connection&#x20;to&#x20;other,&#x20;possibly&#x20;unauthorized,&#x20;devices.','Disabling&#x20;Internet&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Internet&#x20;Sharing:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/SystemConfiguration/com.apple.nat&#x20;NAT&#x20;-dict&#x20;Enabled&#x20;-int&#x20;0','[{\"cis\": [\"2.4.2\"]}, {\"cis_level\": [\"1\"]}]'),(29014,'Ensure&#x20;Screen&#x20;Sharing&#x20;Is&#x20;Disabled.','Screen&#x20;Sharing&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;connect&#x20;to&#x20;another&#x20;computer&#x20;on&#x20;a&#x20;network&#x20;and&#x20;display&#x20;the&#x20;computer&rsquo;s&#x20;screen.&#x20;While&#x20;sharing&#x20;the&#x20;computer&rsquo;s&#x20;screen,&#x20;the&#x20;user&#x20;can&#x20;control&#x20;what&#x20;happens&#x20;on&#x20;that&#x20;computer,&#x20;such&#x20;as&#x20;opening&#x20;documents&#x20;or&#x20;applications,&#x20;opening,&#x20;moving,&#x20;or&#x20;closing&#x20;windows,&#x20;and&#x20;even&#x20;shutting&#x20;down&#x20;the&#x20;computer.','Disabling&#x20;Screen&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;remote&#x20;connections&#x20;being&#x20;made&#x20;without&#x20;the&#x20;user&#x20;of&#x20;the&#x20;console&#x20;knowing&#x20;that&#x20;they&#x20;are&#x20;sharing&#x20;the&#x20;computer.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Screen&#x20;Sharing:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/com.apple.screensharing','[{\"cis\": [\"2.4.3\"]}, {\"cis_level\": [\"1\"]}]'),(29015,'Ensure&#x20;Printer&#x20;Sharing&#x20;Is&#x20;Disabled.','By&#x20;enabling&#x20;Printer&#x20;Sharing&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;cupsctl&#x20;--no-share-printers','[{\"cis\": [\"2.4.4\"]}, {\"cis_level\": [\"1\"]}]'),(29016,'Ensure&#x20;Remote&#x20;Login&#x20;Is&#x20;Disabled.','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.&#x20;macOS&#x20;does&#x20;have&#x20;an&#x20;IP&#x20;based&#x20;firewall&#x20;available&#x20;&#40;pf,&#x20;ipfw&#x20;has&#x20;been&#x20;deprecated&#41;&#x20;that&#x20;is&#x20;not&#x20;enabled&#x20;or&#x20;configured.&#x20;There&#x20;are&#x20;more&#x20;details&#x20;and&#x20;links&#x20;in&#x20;section&#x20;7.5.&#x20;macOS&#x20;no&#x20;longer&#x20;has&#x20;TCP&#x20;Wrappers&#x20;support&#x20;built-in&#x20;and&#x20;does&#x20;not&#x20;have&#x20;strong&#x20;Brute-Force&#x20;password&#x20;guessing&#x20;mitigations,&#x20;or&#x20;frequent&#x20;patching&#x20;of&#x20;openssh&#x20;by&#x20;Apple.&#x20;Most&#x20;macOS&#x20;computers&#x20;are&#x20;mobile&#x20;workstations,&#x20;managing&#x20;IP&#x20;based&#x20;firewall&#x20;rules&#x20;on&#x20;mobile&#x20;devices&#x20;can&#x20;be&#x20;very&#x20;resource&#x20;intensive.&#x20;All&#x20;of&#x20;these&#x20;factors&#x20;can&#x20;be&#x20;parts&#x20;of&#x20;running&#x20;a&#x20;hardened&#x20;SSH&#x20;server.','','Run&#x20;the&#x20;following&#x20;command&#x20;in&#x20;Terminal:&#x20;sudo&#x20;systemsetup&#x20;-setremotelogin&#x20;off','[{\"cis\": [\"2.4.5\"]}, {\"cis_level\": [\"1\"]}]'),(29017,'Ensure&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;Is&#x20;Disabled.','DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;allows&#x20;users&#x20;to&#x20;remotely&#x20;access&#x20;the&#x20;system&#039;s&#x20;optical&#x20;drive.&#x20;While&#x20;Apple&#x20;does&#x20;not&#x20;ship&#x20;Macs&#x20;with&#x20;built-in&#x20;optical&#x20;drives&#x20;any&#x20;longer,&#x20;external&#x20;optical&#x20;drives&#x20;are&#x20;still&#x20;recognized&#x20;when&#x20;they&#x20;are&#x20;connected.&#x20;In&#x20;testing&#x20;the&#x20;sharing&#x20;of&#x20;an&#x20;external&#x20;optical&#x20;drive&#x20;persists&#x20;when&#x20;a&#x20;drive&#x20;is&#x20;reconnected.','Disabling&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;the&#x20;optical&#x20;drive&#x20;as&#x20;a&#x20;vector&#x20;for&#x20;attack&#x20;and&#x20;exposure&#x20;of&#x20;sensitive&#x20;data.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;DVD&#x20;or&#x20;CD&#x20;sharing:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/com.apple.ODSAgent&#x20;','[{\"cis\": [\"2.4.6\"]}, {\"cis_level\": [\"1\"]}]'),(29018,'Ensure&#x20;Bluetooth&#x20;Sharing&#x20;Is&#x20;Disabled.','Bluetooth&#x20;Sharing&#x20;allows&#x20;files&#x20;to&#x20;be&#x20;exchanged&#x20;with&#x20;Bluetooth&#x20;enabled&#x20;devices.','Disabling&#x20;Bluetooth&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;Bluetooth&#x20;to&#x20;remotely&#x20;attack&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Bluetooth&#x20;Sharing&#x20;is&#x20;disabled:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;/usr/bin/defaults&#x20;-currentHost&#x20;write&#x20;com.apple.Bluetooth&#x20;PrefKeyServicesEnabled&#x20;-bool&#x20;false','[{\"cis\": [\"2.4.7\"]}, {\"cis_level\": [\"1\"]}]'),(29019,'Ensure&#x20;File&#x20;Sharing&#x20;Is&#x20;Disabled.','Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;,&#x20;Common&#x20;Internet&#x20;File&#x20;System&#x20;&#40;CIFS&#41;&#x20;When&#x20;Windows&#x20;&#40;or&#x20;possibly&#x20;Linux&#41;&#x20;computers&#x20;need&#x20;to&#x20;access&#x20;file&#x20;shared&#x20;on&#x20;a&#x20;Mac,&#x20;SMB/CIFS&#x20;file&#x20;sharing&#x20;is&#x20;commonly&#x20;used.&#x20;Apple&#x20;warns&#x20;that&#x20;SMB&#x20;sharing&#x20;stores&#x20;passwords&#x20;is&#x20;a&#x20;less&#x20;secure&#x20;fashion&#x20;than&#x20;AFP&#x20;sharing&#x20;and&#x20;anyone&#x20;with&#x20;system&#x20;access&#x20;can&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account.&#x20;When&#x20;sharing&#x20;with&#x20;SMB,&#x20;each&#x20;user&#x20;that&#x20;will&#x20;access&#x20;the&#x20;Mac&#x20;must&#x20;have&#x20;SMB&#x20;enabled.','By&#x20;disabling&#x20;file&#x20;sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;SMB&#x20;file&#x20;sharing:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/com.apple.smbd&#x20;','[{\"cis\": [\"2.4.8\"]}, {\"cis_level\": [\"1\"]}]'),(29020,'Ensure&#x20;Remote&#x20;Management&#x20;Is&#x20;Disabled.','Remote&#x20;Management&#x20;is&#x20;the&#x20;client&#x20;portion&#x20;of&#x20;Apple&#x20;Remote&#x20;Desktop&#x20;&#40;ARD&#41;.&#x20;Remote&#x20;Management&#x20;can&#x20;be&#x20;used&#x20;by&#x20;remote&#x20;administrators&#x20;to&#x20;view&#x20;the&#x20;current&#x20;screen,&#x20;install&#x20;software,&#x20;report&#x20;on,&#x20;and&#x20;generally&#x20;manage&#x20;client&#x20;Macs.&#x20;The&#x20;screen&#x20;sharing&#x20;options&#x20;in&#x20;Remote&#x20;Management&#x20;are&#x20;identical&#x20;to&#x20;those&#x20;in&#x20;the&#x20;Screen&#x20;Sharing&#x20;section.&#x20;In&#x20;fact,&#x20;only&#x20;one&#x20;of&#x20;the&#x20;two&#x20;can&#x20;be&#x20;configured.&#x20;If&#x20;Remote&#x20;Management&#x20;is&#x20;used,&#x20;refer&#x20;to&#x20;the&#x20;Screen&#x20;Sharing&#x20;section&#x20;above&#x20;on&#x20;issues&#x20;regard&#x20;screen&#x20;sharing.&#x20;Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;a&#x20;Directory&#x20;is&#x20;in&#x20;place&#x20;to&#x20;manage&#x20;the&#x20;accounts&#x20;with&#x20;access.&#x20;Computers&#x20;will&#x20;be&#x20;available&#x20;on&#x20;port&#x20;5900&#x20;on&#x20;a&#x20;macOS&#x20;System&#x20;and&#x20;could&#x20;accept&#x20;connections&#x20;from&#x20;untrusted&#x20;hosts&#x20;depending&#x20;on&#x20;the&#x20;configuration,&#x20;definitely&#x20;a&#x20;concern&#x20;for&#x20;mobile&#x20;systems.','Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;on&#x20;trusted&#x20;networks&#x20;with&#x20;strong&#x20;user&#x20;controls&#x20;present&#x20;in&#x20;a&#x20;Directory&#x20;system.&#x20;Mobile&#x20;devices&#x20;without&#x20;strict&#x20;controls&#x20;are&#x20;vulnerable&#x20;to&#x20;exploit&#x20;and&#x20;monitoring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Remote&#x20;Management:&#x20;sudo&#x20;/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart&#x20;-deactivate&#x20;-stop','[{\"cis\": [\"2.4.9\"]}, {\"cis_level\": [\"1\"]}]'),(29021,'Ensure&#x20;Content&#x20;Caching&#x20;Is&#x20;Disabled.','Starting&#x20;with&#x20;10.13&#x20;&#40;macOS&#x20;High&#x20;Sierra&#41;&#x20;Apple&#x20;introduced&#x20;a&#x20;service&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;deploy&#x20;data&#x20;from&#x20;Apple,&#x20;including&#x20;software&#x20;updates,&#x20;where&#x20;there&#x20;are&#x20;bandwidth&#x20;constraints&#x20;to&#x20;the&#x20;Internet&#x20;and&#x20;fewer&#x20;constraints&#x20;and&#x20;greater&#x20;bandwidth&#x20;on&#x20;the&#x20;local&#x20;subnet.&#x20;This&#x20;capability&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;for&#x20;organizations&#x20;that&#x20;have&#x20;throttled&#x20;and&#x20;possibly&#x20;metered&#x20;Internet&#x20;connections.&#x20;In&#x20;heterogeneous&#x20;enterprise&#x20;networks&#x20;with&#x20;multiple&#x20;subnets&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;capability&#x20;would&#x20;be&#x20;determined&#x20;on&#x20;how&#x20;many&#x20;Macs&#x20;were&#x20;on&#x20;each&#x20;subnet&#x20;at&#x20;the&#x20;time&#x20;new&#x20;large&#x20;updates&#x20;were&#x20;made&#x20;available&#x20;upstream.&#x20;This&#x20;capability&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;mac&#x20;OS&#x20;clients&#x20;as&#x20;P2P&#x20;nodes&#x20;for&#x20;updated&#x20;Apple&#x20;content.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;business&#x20;requirement&#x20;to&#x20;manage&#x20;operational&#x20;Internet&#x20;connectivity&#x20;bandwidth&#x20;user&#x20;endpoints&#x20;should&#x20;not&#x20;store&#x20;content&#x20;and&#x20;act&#x20;as&#x20;a&#x20;cluster&#x20;to&#x20;provision&#x20;data.','The&#x20;main&#x20;use&#x20;case&#x20;for&#x20;Mac&#x20;computers&#x20;is&#x20;as&#x20;mobile&#x20;user&#x20;endpoints.&#x20;P2P&#x20;sharing&#x20;services&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;laptops&#x20;that&#x20;are&#x20;using&#x20;untrusted&#x20;networks.&#x20;Content&#x20;Caching&#x20;can&#x20;allow&#x20;a&#x20;computer&#x20;to&#x20;be&#x20;a&#x20;server&#x20;for&#x20;local&#x20;nodes&#x20;on&#x20;an&#x20;untrusted&#x20;network.&#x20;While&#x20;there&#x20;are&#x20;certainly&#x20;logical&#x20;controls&#x20;that&#x20;could&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;risk&#x20;they&#x20;add&#x20;to&#x20;the&#x20;management&#x20;complexity,&#x20;since&#x20;the&#x20;value&#x20;of&#x20;the&#x20;service&#x20;is&#x20;in&#x20;specific&#x20;use&#x20;cases&#x20;organizations&#x20;with&#x20;the&#x20;use&#x20;case&#x20;described&#x20;above&#x20;can&#x20;accept&#x20;risk&#x20;as&#x20;necessary.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Content&#x20;Caching::&#x20;sudo&#x20;AssetCacheManagerUtil&#x20;deactivate','[{\"cis\": [\"2.4.10\"]}, {\"cis_level\": [\"2\"]}]'),(29022,'Ensure&#x20;AirDrop&#x20;Is&#x20;Disabled.','AirDrop&#x20;is&#x20;Apple&#039;s&#x20;built-in&#x20;on&#x20;demand&#x20;ad&#x20;hoc&#x20;file&#x20;exchange&#x20;system&#x20;that&#x20;is&#x20;compatible&#x20;with&#x20;both&#x20;macOS&#x20;and&#x20;iOS.&#x20;It&#x20;uses&#x20;Bluetooth&#x20;LE&#x20;for&#x20;discovery&#x20;that&#x20;limits&#x20;connectivity&#x20;to&#x20;Mac&#x20;or&#x20;iOS&#x20;users&#x20;that&#x20;are&#x20;in&#x20;close&#x20;proximity.&#x20;Depending&#x20;on&#x20;the&#x20;setting&#x20;it&#x20;allows&#x20;everyone&#x20;or&#x20;only&#x20;Contacts&#x20;to&#x20;share&#x20;files&#x20;when&#x20;they&#x20;are&#x20;nearby&#x20;to&#x20;each&#x20;other.&#x20;In&#x20;many&#x20;ways&#x20;this&#x20;technology&#x20;is&#x20;far&#x20;superior&#x20;to&#x20;the&#x20;alternatives.&#x20;The&#x20;file&#x20;transfer&#x20;is&#x20;done&#x20;over&#x20;a&#x20;TLS&#x20;encrypted&#x20;session,&#x20;does&#x20;not&#x20;require&#x20;any&#x20;open&#x20;ports&#x20;that&#x20;are&#x20;required&#x20;for&#x20;file&#x20;sharing,&#x20;does&#x20;not&#x20;leave&#x20;file&#x20;copies&#x20;on&#x20;email&#x20;servers&#x20;or&#x20;within&#x20;cloud&#x20;storage,&#x20;and&#x20;allows&#x20;for&#x20;the&#x20;service&#x20;to&#x20;be&#x20;mitigated&#x20;so&#x20;that&#x20;only&#x20;people&#x20;already&#x20;trusted&#x20;and&#x20;added&#x20;to&#x20;contacts&#x20;can&#x20;interact&#x20;with&#x20;you.&#x20;While&#x20;there&#x20;are&#x20;positives&#x20;to&#x20;AirDrop,&#x20;there&#x20;are&#x20;privacy&#x20;concerns&#x20;that&#x20;could&#x20;expose&#x20;personal&#x20;information.&#x20;For&#x20;that&#x20;reason,&#x20;AirDrop&#x20;should&#x20;be&#x20;disabled,&#x20;and&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;needed&#x20;and&#x20;disabled&#x20;afterwards.','AirDrop&#x20;can&#x20;allow&#x20;malicious&#x20;files&#x20;to&#x20;be&#x20;downloaded&#x20;from&#x20;unknown&#x20;sources.&#x20;Contacts&#x20;Only&#x20;limits&#x20;may&#x20;expose&#x20;personal&#x20;information&#x20;to&#x20;devices&#x20;in&#x20;the&#x20;same&#x20;area.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;AirDrop:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.NetworkBrowser&#x20;DisableAirDrop&#x20;-bool&#x20;true','[{\"cis\": [\"2.4.11\"]}, {\"cis_level\": [\"1\"]}]'),(29023,'Ensure&#x20;Media&#x20;Sharing&#x20;Is&#x20;Disabled.','Starting&#x20;with&#x20;macOS&#x20;10.15&#x20;Apple&#x20;has&#x20;provided&#x20;a&#x20;control&#x20;to&#x20;allow&#x20;a&#x20;user&#x20;to&#x20;share&#x20;Apple&#x20;downloaded&#x20;content&#x20;on&#x20;all&#x20;Apple&#x20;devices&#x20;that&#x20;are&#x20;signed&#x20;in&#x20;with&#x20;the&#x20;same&#x20;Apple&#x20;ID.&#x20;This&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;share&#x20;downloaded&#x20;Movies,&#x20;Music&#x20;or&#x20;TV&#x20;shows&#x20;with&#x20;other&#x20;controlled&#x20;macOS,&#x20;iOS&#x20;and&#x20;iPadOS&#x20;devices&#x20;as&#x20;well&#x20;as&#x20;photos&#x20;with&#x20;Apple&#x20;TVs.&#x20;With&#x20;this&#x20;capability&#x20;guest&#x20;users&#x20;can&#x20;also&#x20;use&#x20;media&#x20;downloaded&#x20;on&#x20;the&#x20;computer.&#x20;The&#x20;recommended&#x20;best&#x20;practice&#x20;is&#x20;not&#x20;to&#x20;use&#x20;the&#x20;computer&#x20;as&#x20;a&#x20;server&#x20;but&#x20;to&#x20;utilize&#x20;Apple&#039;s&#x20;cloud&#x20;storage&#x20;to&#x20;download&#x20;and&#x20;use&#x20;content&#x20;stored&#x20;there&#x20;if&#x20;content&#x20;stored&#x20;with&#x20;Apple&#x20;is&#x20;used&#x20;on&#x20;multiple&#x20;devices.','Disabling&#x20;Media&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Media&#x20;Sharing:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;defaults&#x20;write&#x20;com.apple.amp.mediasharingd&#x20;home-sharing-enabled&#x20;-int&#x20;0','[{\"cis\": [\"2.4.12\"]}, {\"cis_level\": [\"2\"]}]'),(29024,'Ensure&#x20;FileVault&#x20;Is&#x20;Enabled.','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.&#x20;FileVault&#x20;may&#x20;also&#x20;be&#x20;enabled&#x20;using&#x20;command&#x20;line&#x20;using&#x20;the&#x20;fdesetup&#x20;command.&#x20;To&#x20;use&#x20;this&#x20;functionality,&#x20;consult&#x20;the&#x20;Der&#x20;Flounder&#x20;blog&#x20;for&#x20;more&#x20;details&#x20;&#40;see&#x20;references&#41;.','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;FileVault:&#x20;1.&#x20;Open&#x20;System&#x20;Preferences&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;FileVault&#x20;4.&#x20;Select&#x20;Turn&#x20;on&#x20;FileVault','[{\"cis\": [\"2.5.1.1\"]}, {\"cis_level\": [\"1\"]}]'),(29025,'Ensure&#x20;Gatekeeper&#x20;is&#x20;Enabled.','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;allowlisting&#x20;control&#x20;that&#x20;restricts&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;Gatekeeper&#x20;to&#x20;allow&#x20;applications&#x20;from&#x20;App&#x20;Store&#x20;and&#x20;identified&#x20;developers:&#x20;sudo&#x20;/usr/sbin/spctl&#x20;--master-enable','[{\"cis\": [\"2.5.2.1\"]}, {\"cis_level\": [\"1\"]}]'),(29026,'Ensure&#x20;Firewall&#x20;Is&#x20;Enabled.','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;from&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;firewall:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-int&#x20;&lt;value&gt;&#x20;For&#x20;the&#x20;&lt;value&gt;,&#x20;use&#x20;either&#x20;1,&#x20;specific&#x20;services,&#x20;or&#x20;2,&#x20;essential&#x20;services&#x20;only.','[{\"cis\": [\"2.5.2.2\"]}, {\"cis_level\": [\"1\"]}]'),(29027,'Ensure&#x20;Firewall&#x20;Stealth&#x20;Mode&#x20;Is&#x20;Enabled.','While&#x20;in&#x20;Stealth&#x20;mode&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;stealth&#x20;mode:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on','[{\"cis\": [\"2.5.2.3\"]}, {\"cis_level\": [\"1\"]}]'),(29028,'Ensure&#x20;Location&#x20;Services&#x20;Is&#x20;Enabled.','macOS&#x20;uses&#x20;location&#x20;information&#x20;gathered&#x20;through&#x20;local&#x20;Wi-Fi&#x20;networks&#x20;to&#x20;enable&#x20;applications&#x20;to&#x20;supply&#x20;relevant&#x20;information&#x20;to&#x20;users.&#x20;With&#x20;the&#x20;operating&#x20;system&#x20;verifying&#x20;the&#x20;location,&#x20;users&#x20;do&#x20;not&#x20;need&#x20;to&#x20;change&#x20;the&#x20;time&#x20;or&#x20;the&#x20;time&#x20;zone.&#x20;The&#x20;computer&#x20;will&#x20;change&#x20;them&#x20;based&#x20;on&#x20;the&#x20;user&#039;s&#x20;location.&#x20;They&#x20;do&#x20;not&#x20;need&#x20;to&#x20;specify&#x20;their&#x20;location&#x20;for&#x20;weather&#x20;or&#x20;travel&#x20;times&#x20;and&#x20;even&#x20;get&#x20;alerts&#x20;on&#x20;travel&#x20;times&#x20;to&#x20;meetings&#x20;and&#x20;appointment&#x20;where&#x20;location&#x20;information&#x20;is&#x20;supplied.&#x20;Location&#x20;Services&#x20;simplify&#x20;some&#x20;processes,&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;asset&#x20;management&#x20;and&#x20;time&#x20;and&#x20;log&#x20;management,&#x20;with&#x20;mobile&#x20;computers.&#x20;There&#x20;are&#x20;some&#x20;use&#x20;cases&#x20;where&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;computer&#x20;not&#x20;be&#x20;able&#x20;to&#x20;report&#x20;its&#x20;exact&#x20;location.&#x20;While&#x20;the&#x20;general&#x20;use&#x20;case&#x20;is&#x20;to&#x20;enable&#x20;Location&#x20;Services,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;if&#x20;the&#x20;physical&#x20;location&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;the&#x20;user&#x20;should&#x20;not&#x20;be&#x20;public&#x20;knowledge.','Location&#x20;Services&#x20;are&#x20;helpful&#x20;in&#x20;most&#x20;use&#x20;cases&#x20;and&#x20;can&#x20;simplify&#x20;log&#x20;and&#x20;time&#x20;management&#x20;where&#x20;computers&#x20;change&#x20;time&#x20;zones.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;Location&#x20;Services:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.locationd.plist','[{\"cis\": [\"2.5.3\"]}, {\"cis_level\": [\"2\"]}]'),(29029,'Ensure&#x20;Sending&#x20;Diagnostic&#x20;and&#x20;Usage&#x20;Data&#x20;to&#x20;Apple&#x20;Is&#x20;Disabled.','Apple&#x20;provides&#x20;a&#x20;mechanism&#x20;to&#x20;send&#x20;diagnostic&#x20;and&#x20;analytics&#x20;data&#x20;back&#x20;to&#x20;Apple&#x20;to&#x20;help&#x20;them&#x20;improve&#x20;the&#x20;platform.&#x20;Information&#x20;sent&#x20;to&#x20;Apple&#x20;may&#x20;contain&#x20;internal&#x20;organizational&#x20;information&#x20;that&#x20;should&#x20;be&#x20;controlled&#x20;and&#x20;not&#x20;available&#x20;for&#x20;processing&#x20;by&#x20;Apple.&#x20;Turn&#x20;off&#x20;all&#x20;Analytics&#x20;and&#x20;Improvements&#x20;sharing.&#x20;Share&#x20;Mac&#x20;Analytics&#x20;&#40;Share&#x20;with&#x20;App&#x20;Developers&#x20;dependent&#x20;on&#x20;Mac&#x20;Analytic&#x20;sharing&#41;&#x20;-&#x20;Includes&#x20;diagnostics,&#x20;usage&#x20;and&#x20;location&#x20;data.&#x20;Share&#x20;iCloud&#x20;Analytics&#x20;-&#x20;Includes&#x20;iCloud&#x20;data&#x20;and&#x20;usage&#x20;information.','Organizations&#x20;should&#x20;have&#x20;knowledge&#x20;of&#x20;what&#x20;is&#x20;shared&#x20;with&#x20;the&#x20;vendor&#x20;and&#x20;the&#x20;setting&#x20;automatically&#x20;forwards&#x20;information&#x20;to&#x20;Apple.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;diagnostic&#x20;data&#x20;being&#x20;sent&#x20;to&#x20;Apple:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Application&#x20;Support/CrashReporter/DiagnosticMessagesHistory.plist&#x20;AutoSubmit&#x20;-bool&#x20;false,&#x20;sudo&#x20;/bin/chmod&#x20;644&#x20;/Library/Application&#x20;Support/CrashReporter/DiagnosticMessagesHistory.plist,&#x20;sudo&#x20;/usr/sbin/chgrp&#x20;admin&#x20;/Library/Application&#x20;Support/CrashReporter/DiagnosticMessagesHistory.plist','[{\"cis\": [\"2.5.5\"]}, {\"cis_level\": [\"2\"]}]'),(29030,'Ensure&#x20;Backup&#x20;Up&#x20;Automatically&#x20;is&#x20;Enabled.','Backup&#x20;solutions&#x20;are&#x20;only&#x20;effective&#x20;if&#x20;the&#x20;backups&#x20;run&#x20;on&#x20;a&#x20;regular&#x20;basis.&#x20;The&#x20;time&#x20;to&#x20;check&#x20;for&#x20;backups&#x20;is&#x20;before&#x20;the&#x20;hard&#x20;drive&#x20;fails&#x20;or&#x20;the&#x20;computer&#x20;goes&#x20;missing.&#x20;In&#x20;order&#x20;to&#x20;simplify&#x20;the&#x20;user&#x20;experience&#x20;so&#x20;that&#x20;backups&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;occur&#x20;Time&#x20;Machine&#x20;should&#x20;be&#x20;on&#x20;and&#x20;set&#x20;to&#x20;Back&#x20;Up&#x20;Automatically&#x20;whenever&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;available.&#x20;Operational&#x20;staff&#x20;should&#x20;ensure&#x20;that&#x20;backups&#x20;complete&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;the&#x20;backups&#x20;are&#x20;tested&#x20;to&#x20;ensure&#x20;that&#x20;file&#x20;restoration&#x20;from&#x20;backup&#x20;is&#x20;possible&#x20;when&#x20;needed.&#x20;Backup&#x20;dates&#x20;are&#x20;available&#x20;even&#x20;when&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;not&#x20;available&#x20;in&#x20;the&#x20;Time&#x20;Machine&#x20;plist.&#x20;SnapshotDates&#x20;=&#x20;&#40;&#x20;&quot;2012-08-20&#x20;12:10:22&#x20;+0000&quot;,&#x20;&quot;2013-02-03&#x20;23:43:22&#x20;+0000&quot;,&#x20;&quot;2014-02-19&#x20;21:37:21&#x20;+0000&quot;,&#x20;&quot;2015-02-22&#x20;13:07:25&#x20;+0000&quot;,&#x20;&quot;2016-08-20&#x20;14:07:14&#x20;+0000&quot;&#x20;When&#x20;the&#x20;backup&#x20;volume&#x20;is&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;more&#x20;extensive&#x20;information&#x20;is&#x20;available&#x20;through&#x20;tmutil.&#x20;See&#x20;man&#x20;tmutil','Backups&#x20;should&#x20;automatically&#x20;run&#x20;whenever&#x20;the&#x20;backup&#x20;drive&#x20;is&#x20;available.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;automatic&#x20;backups&#x20;if&#x20;Time&#x20;Machine&#x20;is&#x20;enabled:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.TimeMachine.plist&#x20;AutoBackup&#x20;-bool&#x20;true','[{\"cis\": [\"2.7.1\"]}, {\"cis_level\": [\"2\"]}]'),(29031,'Ensure&#x20;Wake&#x20;for&#x20;Network&#x20;Access&#x20;Is&#x20;Disabled.','This&#x20;feature&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;This&#x20;macOS&#x20;feature&#x20;is&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&rsquo;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;iTunes&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;any&#x20;unmanaged&#x20;network&#x20;or&#x20;where&#x20;untrusted&#x20;devices&#x20;exist&#x20;that&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','','Perform&#x20;the&#x20;following&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access&#x20;or&#x20;Power&#x20;Nap:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access:&#x20;sudo&#x20;pmset&#x20;-a&#x20;womp&#x20;0&#x20;','[{\"cis\": [\"2.8\"]}, {\"cis_level\": [\"1\"]}]'),(29032,'Ensure&#x20;Power&#x20;Nap&#x20;Is&#x20;Disabled.','This&#x20;feature&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;This&#x20;macOS&#x20;feature&#x20;is&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;Power&#x20;Nap&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;stay&#x20;in&#x20;low&#x20;power&#x20;mode,&#x20;especially&#x20;while&#x20;on&#x20;battery&#x20;power&#x20;and&#x20;periodically&#x20;connect&#x20;to&#x20;previously&#x20;named&#x20;networks&#x20;with&#x20;stored&#x20;credentials&#x20;for&#x20;user&#x20;applications&#x20;to&#x20;phone&#x20;home&#x20;and&#x20;get&#x20;updates.&#x20;This&#x20;capability&#x20;requires&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;the&#x20;use&#x20;of&#x20;previously&#x20;joined&#x20;networks&#x20;to&#x20;be&#x20;risk&#x20;accepted&#x20;based&#x20;on&#x20;the&#x20;SSID&#x20;without&#x20;user&#x20;input.&#x20;This&#x20;control&#x20;has&#x20;been&#x20;updated&#x20;to&#x20;check&#x20;the&#x20;status&#x20;on&#x20;both&#x20;battery&#x20;and&#x20;AC&#x20;Power.&#x20;The&#x20;presence&#x20;of&#x20;an&#x20;electrical&#x20;outlet&#x20;does&#x20;not&#x20;completely&#x20;correlate&#x20;with&#x20;logical&#x20;and&#x20;physical&#x20;security&#x20;of&#x20;the&#x20;device&#x20;or&#x20;available&#x20;networks.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.&#x20;The&#x20;use&#x20;of&#x20;Power&#x20;Nap&#x20;adds&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;compromised&#x20;physical&#x20;and&#x20;logical&#x20;security.&#x20;The&#x20;user&#x20;should&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;FileVault&#x20;and&#x20;have&#x20;the&#x20;applications&#x20;download&#x20;what&#x20;is&#x20;required&#x20;when&#x20;the&#x20;computer&#x20;is&#x20;actively&#x20;used.&#x20;The&#x20;control&#x20;to&#x20;prevent&#x20;computer&#x20;sleep&#x20;has&#x20;been&#x20;retired&#x20;for&#x20;this&#x20;version&#x20;of&#x20;the&#x20;Benchmark.&#x20;Forcing&#x20;the&#x20;computer&#x20;to&#x20;stay&#x20;on&#x20;and&#x20;use&#x20;energy&#x20;in&#x20;case&#x20;a&#x20;management&#x20;push&#x20;is&#x20;needed&#x20;is&#x20;contrary&#x20;to&#x20;most&#x20;current&#x20;management&#x20;processes.&#x20;Only&#x20;keep&#x20;computers&#x20;unslept&#x20;if&#x20;after&#x20;hours&#x20;pushes&#x20;are&#x20;required&#x20;on&#x20;closed&#x20;LANs.','','Perform&#x20;the&#x20;following&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access&#x20;or&#x20;Power&#x20;Nap:&#x20;sudo&#x20;pmset&#x20;-a&#x20;powernap&#x20;0','[{\"cis\": [\"2.9\"]}, {\"cis_level\": [\"1\"]}]'),(29033,'Ensure&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;terminal.app&#x20;is&#x20;Enabled.','Secure&#x20;Keyboard&#x20;Entry&#x20;prevents&#x20;other&#x20;applications&#x20;on&#x20;the&#x20;system&#x20;and/or&#x20;network&#x20;from&#x20;detecting&#x20;and&#x20;recording&#x20;what&#x20;is&#x20;typed&#x20;into&#x20;Terminal.','Enabling&#x20;Secure&#x20;Keyboard&#x20;Entry&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;a&#x20;key&#x20;logger&#x20;from&#x20;detecting&#x20;what&#x20;is&#x20;entered&#x20;in&#x20;Terminal.','','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;secure&#x20;keyboard&#x20;entries&#x20;in&#x20;Terminal:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;/usr/bin/defaults&#x20;write&#x20;-app&#x20;Terminal&#x20;SecureKeyboardEntry&#x20;-bool&#x20;true','[{\"cis\": [\"2.10\"]}, {\"cis_level\": [\"1\"]}]'),(29034,'Ensure&#x20;EFI&#x20;Version&#x20;Is&#x20;Valid&#x20;and&#x20;Checked&#x20;Regularly.','In&#x20;order&#x20;to&#x20;mitigate&#x20;firmware&#x20;attacks&#x20;Apple&#x20;has&#x20;created&#x20;an&#x20;automated&#x20;Firmware&#x20;check&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;EFI&#x20;version&#x20;running&#x20;is&#x20;a&#x20;known&#x20;good&#x20;version&#x20;from&#x20;Apple.&#x20;There&#x20;is&#x20;also&#x20;an&#x20;automated&#x20;process&#x20;to&#x20;check&#x20;it&#x20;every&#x20;seven&#x20;days.','If&#x20;the&#x20;Firmware&#x20;of&#x20;a&#x20;computer&#x20;has&#x20;been&#x20;compromised&#x20;the&#x20;Operating&#x20;System&#x20;that&#x20;the&#x20;Firmware&#x20;loads&#x20;cannot&#x20;be&#x20;trusted&#x20;either.','','If&#x20;EFI&#x20;does&#x20;not&#x20;pass&#x20;the&#x20;integrity&#x20;check&#x20;you&#x20;may&#x20;send&#x20;a&#x20;report&#x20;to&#x20;Apple.&#x20;Backing&#x20;up&#x20;files&#x20;and&#x20;clean&#x20;installing&#x20;a&#x20;known&#x20;good&#x20;Operating&#x20;System&#x20;and&#x20;Firmware&#x20;is&#x20;recommended.','[{\"cis\": [\"2.11\"]}, {\"cis_level\": [\"1\"]}]'),(29035,'Ensure&#x20;Security&#x20;Auditing&#x20;Is&#x20;Enabled.','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;load&#x20;auditd:&#x20;sudo&#x20;launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist','[{\"cis\": [\"3.1\"]}, {\"cis_level\": [\"1\"]}]'),(29036,'Ensure&#x20;install.log&#x20;Is&#x20;Retained&#x20;for&#x20;365&#x20;or&#x20;More&#x20;Days&#x20;and&#x20;No&#x20;Maximum&#x20;Size.','macOS&#x20;writes&#x20;information&#x20;pertaining&#x20;to&#x20;system-related&#x20;events&#x20;to&#x20;the&#x20;file&#x20;/var/log/install.log&#x20;and&#x20;has&#x20;a&#x20;configurable&#x20;retention&#x20;policy&#x20;for&#x20;this&#x20;file.&#x20;The&#x20;default&#x20;logging&#x20;setting&#x20;limits&#x20;the&#x20;file&#x20;size&#x20;of&#x20;the&#x20;logs&#x20;and&#x20;the&#x20;maximum&#x20;size&#x20;for&#x20;all&#x20;logs.&#x20;The&#x20;default&#x20;allows&#x20;for&#x20;an&#x20;errant&#x20;application&#x20;to&#x20;fill&#x20;the&#x20;log&#x20;files&#x20;and&#x20;does&#x20;not&#x20;enforce&#x20;sufficient&#x20;log&#x20;retention.&#x20;The&#x20;Benchmark&#x20;recommends&#x20;a&#x20;value&#x20;based&#x20;on&#x20;standard&#x20;use&#x20;cases.&#x20;The&#x20;value&#x20;should&#x20;align&#x20;with&#x20;local&#x20;requirements&#x20;within&#x20;the&#x20;organization.&#x20;The&#x20;default&#x20;value&#x20;has&#x20;an&#x20;&quot;all_max&quot;&#x20;file&#x20;limitation,&#x20;no&#x20;reference&#x20;to&#x20;a&#x20;minimum&#x20;retention&#x20;and&#x20;a&#x20;less&#x20;precise&#x20;rotation&#x20;argument.&#x20;The&#x20;all_max&#x20;flag&#x20;control&#x20;will&#x20;remove&#x20;old&#x20;log&#x20;entries&#x20;based&#x20;only&#x20;on&#x20;the&#x20;size&#x20;of&#x20;the&#x20;log&#x20;files.&#x20;Log&#x20;size&#x20;can&#x20;vary&#x20;widely&#x20;depending&#x20;on&#x20;how&#x20;verbose&#x20;installing&#x20;applications&#x20;are&#x20;in&#x20;their&#x20;log&#x20;entries.&#x20;The&#x20;decision&#x20;here&#x20;is&#x20;to&#x20;ensure&#x20;that&#x20;logs&#x20;go&#x20;back&#x20;a&#x20;year&#x20;and&#x20;depending&#x20;on&#x20;the&#x20;applications&#x20;a&#x20;size&#x20;restriction&#x20;could&#x20;compromise&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;a&#x20;full&#x20;year.&#x20;While&#x20;this&#x20;Benchmark&#x20;is&#x20;not&#x20;scoring&#x20;for&#x20;a&#x20;rotation&#x20;flag&#x20;the&#x20;default&#x20;rotation&#x20;is&#x20;sequential&#x20;rather&#x20;than&#x20;using&#x20;a&#x20;timestamp.&#x20;Auditors&#x20;may&#x20;prefer&#x20;timestamps&#x20;in&#x20;order&#x20;to&#x20;simply&#x20;review&#x20;specific&#x20;dates&#x20;where&#x20;event&#x20;information&#x20;is&#x20;desired.&#x20;Please&#x20;review&#x20;the&#x20;File&#x20;Rotation&#x20;section&#x20;in&#x20;the&#x20;man&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;man&#x20;asl.conf&#x20;-&#x20;The&#x20;maximum&#x20;file&#x20;size&#x20;limitation&#x20;string&#x20;should&#x20;be&#x20;removed&#x20;&quot;all_max=&quot;&#x20;-&#x20;An&#x20;organization&#x20;appropriate&#x20;retention&#x20;should&#x20;be&#x20;added&#x20;&quot;ttl=&quot;&#x20;-&#x20;The&#x20;rotation&#x20;should&#x20;be&#x20;set&#x20;with&#x20;timestamps&#x20;&quot;rotate=utc&quot;&#x20;or&#x20;&quot;rotate=local&quot;','Archiving&#x20;and&#x20;retaining&#x20;install.log&#x20;for&#x20;at&#x20;least&#x20;a&#x20;year&#x20;is&#x20;beneficial&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;incident&#x20;as&#x20;it&#x20;will&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;view&#x20;the&#x20;various&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;along&#x20;with&#x20;the&#x20;date&#x20;and&#x20;time&#x20;they&#x20;occurred.','','Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;install&#x20;logs&#x20;are&#x20;retained&#x20;for&#x20;at&#x20;least&#x20;365&#x20;days:&#x20;Edit&#x20;the&#x20;/etc/asl/com.apple.install&#x20;file&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;ttl&#x20;value&#x20;to&#x20;365&#x20;or&#x20;greater&#x20;on&#x20;the&#x20;file&#x20;line.&#x20;Also,&#x20;remove&#x20;the&#x20;all_max=&#x20;setting&#x20;and&#x20;value&#x20;from&#x20;the&#x20;file&#x20;line.','[{\"cis\": [\"3.3\"]}, {\"cis_level\": [\"1\"]}]'),(29037,'Ensure&#x20;Access&#x20;to&#x20;Audit&#x20;Records&#x20;Is&#x20;Controlled.','The&#x20;audit&#x20;system&#x20;on&#x20;macOS&#x20;writes&#x20;important&#x20;operational&#x20;and&#x20;security&#x20;information&#x20;that&#x20;can&#x20;be&#x20;both&#x20;useful&#x20;for&#x20;an&#x20;attacker&#x20;and&#x20;a&#x20;place&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;attempt&#x20;to&#x20;obfuscate&#x20;unwanted&#x20;changes&#x20;that&#x20;were&#x20;recorded.&#x20;As&#x20;part&#x20;of&#x20;defense-in-depth&#x20;the&#x20;/etc/security/audit_control&#x20;configuration&#x20;and&#x20;the&#x20;files&#x20;in&#x20;/var/audit&#x20;should&#x20;be&#x20;owned&#x20;only&#x20;by&#x20;root&#x20;with&#x20;group&#x20;wheel&#x20;with&#x20;read-only&#x20;rights&#x20;and&#x20;no&#x20;other&#x20;access&#x20;allowed.&#x20;macOS&#x20;ACLs&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;these&#x20;files.','Audit&#x20;records&#x20;should&#x20;never&#x20;be&#x20;changed&#x20;except&#x20;by&#x20;the&#x20;system&#x20;daemon&#x20;posting&#x20;events.&#x20;Records&#x20;may&#x20;be&#x20;viewed&#x20;or&#x20;extracts&#x20;manipulated,&#x20;but&#x20;the&#x20;authoritative&#x20;files&#x20;should&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes.','','Run&#x20;the&#x20;following&#x20;to&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;root&#x20;user&#x20;and&#x20;wheel&#x20;group:&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/etc/security/audit_control,&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-rw&#x20;/etc/security/audit_control,&#x20;sudo&#x20;chown&#x20;-R&#x20;root:wheel&#x20;/var/audit/,&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-rw&#x20;/var/audit/&#x20;Note:&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;do&#x20;a&#x20;thorough&#x20;verification&#x20;process&#x20;on&#x20;why&#x20;the&#x20;audit&#x20;logs&#x20;have&#x20;been&#x20;changed&#x20;before&#x20;following&#x20;the&#x20;remediation&#x20;steps.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;different&#x20;access&#x20;controls&#x20;on&#x20;the&#x20;audit&#x20;logs,&#x20;and&#x20;the&#x20;changes&#x20;cannot&#x20;be&#x20;traced,&#x20;a&#x20;new&#x20;install&#x20;may&#x20;be&#x20;prudent.&#x20;Check&#x20;for&#x20;signs&#x20;of&#x20;file&#x20;tampering&#x20;as&#x20;well&#x20;as&#x20;unapproved&#x20;OS&#x20;changes.','[{\"cis\": [\"3.5\"]}, {\"cis_level\": [\"1\"]}]'),(29038,'Ensure&#x20;Firewall&#x20;Logging&#x20;Is&#x20;Enabled&#x20;and&#x20;Configured.','The&#x20;socketfilter&#x20;firewall&#x20;is&#x20;what&#x20;is&#x20;used&#x20;when&#x20;the&#x20;firewall&#x20;is&#x20;turned&#x20;on&#x20;in&#x20;the&#x20;Security&#x20;Preference&#x20;Pane.&#x20;In&#x20;order&#x20;to&#x20;appropriately&#x20;monitor&#x20;what&#x20;access&#x20;is&#x20;allowed&#x20;and&#x20;denied&#x20;logging&#x20;must&#x20;be&#x20;enabled.&#x20;The&#x20;logging&#x20;level&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&quot;detailed&quot;&#x20;to&#x20;be&#x20;useful&#x20;in&#x20;monitoring&#x20;connection&#x20;attempts&#x20;that&#x20;the&#x20;firewall&#x20;detects.&#x20;Throttled&#x20;login&#x20;is&#x20;not&#x20;sufficient&#x20;for&#x20;examine&#x20;firewall&#x20;connection&#x20;attempts.','In&#x20;order&#x20;to&#x20;troubleshoot&#x20;the&#x20;successes&#x20;and&#x20;failures&#x20;of&#x20;a&#x20;firewall,&#x20;detailed&#x20;logging&#x20;should&#x20;be&#x20;enabled.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;logging&#x20;of&#x20;the&#x20;firewall:&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setloggingmode&#x20;on.&#x20;&#x20;sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setloggingopt&#x20;detail.','[{\"cis\": [\"3.6\"]}, {\"cis_level\": [\"1\"]}]'),(29039,'Ensure&#x20;Bonjour&#x20;Advertising&#x20;Services&#x20;Is&#x20;Disabled.','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-&#x20;configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;stop&#x20;the&#x20;computer&#x20;from&#x20;sending&#x20;out&#x20;service&#x20;discovery&#x20;messages&#x20;when&#x20;looking&#x20;for&#x20;services&#x20;on&#x20;an&#x20;internal&#x20;subnet,&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;looking&#x20;for&#x20;a&#x20;printer&#x20;or&#x20;server&#x20;and&#x20;using&#x20;service&#x20;discovery.&#x20;To&#x20;block&#x20;all&#x20;Bonjour&#x20;traffic&#x20;except&#x20;to&#x20;approved&#x20;devices&#x20;the&#x20;pf&#x20;or&#x20;other&#x20;firewall&#x20;would&#x20;be&#x20;needed.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Bonjour&#x20;Advertising&#x20;services:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements&#x20;-bool&#x20;true','[{\"cis\": [\"4.1\"]}, {\"cis_level\": [\"2\"]}]'),(29040,'Ensure&#x20;HTTP&#x20;Server&#x20;Is&#x20;Disabled.','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable,&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache&#x20;however&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end-user&#x20;computer.&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;http&#x20;server&#x20;services:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/org.apache.httpd','[{\"cis\": [\"4.4\"]}, {\"cis_level\": [\"1\"]}]'),(29041,'Ensure&#x20;NFS&#x20;Server&#x20;Is&#x20;Disabled.','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable,&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end-user&#x20;computer.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;nfsd&#x20;fileserver&#x20;services:&#x20;sudo&#x20;launchctl&#x20;disable&#x20;system/com.apple.nfsd.&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing:&#x20;&#x20;sudo&#x20;rm&#x20;/etc/exports','[{\"cis\": [\"4.5\"]}, {\"cis_level\": [\"1\"]}]'),(29042,'Ensure&#x20;System&#x20;Integrity&#x20;Protection&#x20;Status&#x20;&#40;SIPS&#41;&#x20;Is&#x20;Enabled.','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;System&#x20;Integrity&#x20;Protection:&#x20;1.&#x20;Reboot&#x20;into&#x20;the&#x20;Recovery&#x20;Partition&#x20;&#40;reboot&#x20;and&#x20;hold&#x20;down&#x20;Command&#x20;&#40;⌘&#41;&#x20;+&#x20;R&#41;&#x20;2.&#x20;Select&#x20;Utilities&#x20;3.&#x20;Select&#x20;Terminal&#x20;4.&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;sudo&#x20;/usr/bin/csrutil&#x20;enable&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;5.&#x20;Reboot&#x20;the&#x20;computer','[{\"cis\": [\"5.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(29043,'Ensure&#x20;Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;Is&#x20;Enabled.','Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;was&#x20;first&#x20;released&#x20;in&#x20;macOS&#x20;10.12,&#x20;the&#x20;daemon&#x20;and&#x20;service&#x20;block&#x20;attempts&#x20;to&#x20;run&#x20;unsigned&#x20;code.&#x20;AMFI&#x20;uses&#x20;lanchd,&#x20;code&#x20;signatures,&#x20;certificates,&#x20;entitlements,&#x20;and&#x20;provisioning&#x20;profiles&#x20;to&#x20;create&#x20;a&#x20;filtered&#x20;entitlement&#x20;dictionary&#x20;for&#x20;an&#x20;app.&#x20;AMFI&#x20;is&#x20;the&#x20;macOS&#x20;kernel&#x20;module&#x20;that&#x20;enforces&#x20;code-signing&#x20;and&#x20;library&#x20;validation.','Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;&#40;AMFI&#41;&#x20;validates&#x20;that&#x20;application&#x20;code&#x20;is&#x20;validated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;service:&#x20;sudo&#x20;/usr/sbin/nvram&#x20;boot-args=&quot;&quot;','[{\"cis\": [\"5.1.3\"]}, {\"cis_level\": [\"1\"]}]'),(29044,'Ensure&#x20;Library&#x20;Validation&#x20;Is&#x20;Enabled.','Library&#x20;Validation&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;macOS&#x20;10.10&#x20;Yosemite.&#x20;Library&#x20;Validation&#x20;protects&#x20;processes&#x20;from&#x20;loading&#x20;arbitrary&#x20;libraries.&#x20;This&#x20;stops&#x20;root&#x20;from&#x20;loading&#x20;arbitrary&#x20;libraries&#x20;into&#x20;any&#x20;process&#x20;&#40;depending&#x20;on&#x20;SIP&#x20;status&#41;,and&#x20;keeps&#x20;root&#x20;from&#x20;becoming&#x20;more&#x20;powerful.&#x20;Security&#x20;is&#x20;strengthened,&#x20;because&#x20;some&#x20;user&#x20;processes&#x20;can&#x20;no&#x20;longer&#x20;be&#x20;fooled&#x20;to&#x20;run&#x20;additional&#x20;code&#x20;without&#x20;root&#039;s&#x20;explicit&#x20;request,&#x20;which&#x20;may&#x20;grant&#x20;access&#x20;to&#x20;daemons&#x20;that&#x20;depend&#x20;on&#x20;Library&#x20;Validation&#x20;for&#x20;secure&#x20;validation&#x20;of&#x20;code&#x20;identity.','Running&#x20;without&#x20;Library&#x20;Validation&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;Library&#x20;Validation.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;library&#x20;validation:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.security.libraryvalidation.plist&#x20;DisableLibraryValidation&#x20;-bool&#x20;false','[{\"cis\": [\"5.1.4\"]}, {\"cis_level\": [\"1\"]}]'),(29045,'Ensure&#x20;Sealed&#x20;System&#x20;Volume&#x20;&#40;SSV&#41;&#x20;Is&#x20;Enabled.','Sealed&#x20;System&#x20;Volume&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;macOS&#x20;11.0&#x20;Big&#x20;Sur.&#x20;During&#x20;system&#x20;installation,&#x20;a&#x20;SHA-256&#x20;cryptographic&#x20;hash&#x20;is&#x20;calculated&#x20;for&#x20;all&#x20;immutable&#x20;system&#x20;files&#x20;and&#x20;stored&#x20;in&#x20;a&#x20;Merkle&#x20;tree&#x20;which&#x20;itself&#x20;is&#x20;hashed&#x20;as&#x20;the&#x20;Seal.&#x20;Both&#x20;are&#x20;stored&#x20;in&#x20;the&#x20;metadata&#x20;of&#x20;the&#x20;snapshot&#x20;created&#x20;of&#x20;the&#x20;System&#x20;volume.&#x20;The&#x20;seal&#x20;is&#x20;verified&#x20;by&#x20;the&#x20;boot&#x20;loader&#x20;at&#x20;startup.&#x20;macOS&#x20;will&#x20;not&#x20;boot&#x20;if&#x20;system&#x20;files&#x20;have&#x20;been&#x20;tampered&#x20;with.&#x20;If&#x20;validation&#x20;fails,&#x20;the&#x20;user&#x20;will&#x20;be&#x20;instructed&#x20;to&#x20;reinstall&#x20;the&#x20;operating&#x20;system.&#x20;During&#x20;read&#x20;operations&#x20;for&#x20;files&#x20;located&#x20;in&#x20;the&#x20;Sealed&#x20;System&#x20;Volume,&#x20;a&#x20;hash&#x20;is&#x20;calculated&#x20;and&#x20;compared&#x20;to&#x20;the&#x20;value&#x20;stored&#x20;in&#x20;the&#x20;Merkle&#x20;tree.','Running&#x20;without&#x20;Sealed&#x20;System&#x20;Volume&#x20;on&#x20;a&#x20;production&#x20;system&#x20;could&#x20;run&#x20;the&#x20;risk&#x20;of&#x20;Apple&#x20;software,&#x20;that&#x20;integrates&#x20;directly&#x20;with&#x20;macOS,&#x20;being&#x20;modified.','','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;System&#x20;Integrity&#x20;Protection:&#x20;1.&#x20;Reboot&#x20;into&#x20;the&#x20;Recovery&#x20;Partition&#x20;&#40;reboot&#x20;and&#x20;hold&#x20;down&#x20;Command&#x20;&#40;⌘&#41;&#x20;+&#x20;R&#41;&#x20;2.&#x20;Select&#x20;an&#x20;administrator&#039;s&#x20;account&#x20;and&#x20;enter&#x20;that&#x20;account&#039;s&#x20;password&#x20;3.&#x20;Select&#x20;Utilities&#x20;4.&#x20;Select&#x20;Terminal&#x20;5.&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;sudo&#x20;/usr/bin/csrutil&#x20;enable&#x20;authenticated-root&#x20;6.&#x20;Reboot&#x20;the&#x20;computer.','[{\"cis\": [\"5.1.5\"]}, {\"cis_level\": [\"1\"]}]'),(29046,'Ensure&#x20;Appropriate&#x20;Permissions&#x20;Are&#x20;Enabled&#x20;for&#x20;System&#x20;Wide&#x20;Applications.','Applications&#x20;in&#x20;the&#x20;System&#x20;Applications&#x20;Directory&#x20;&#40;/Applications&#41;&#x20;should&#x20;be&#x20;world&#x20;executable&#x20;since&#x20;that&#x20;is&#x20;their&#x20;reason&#x20;to&#x20;be&#x20;on&#x20;the&#x20;system.&#x20;They&#x20;should&#x20;not&#x20;be&#x20;world-writable&#x20;and&#x20;allow&#x20;any&#x20;process&#x20;or&#x20;user&#x20;to&#x20;alter&#x20;them&#x20;for&#x20;other&#x20;processes&#x20;or&#x20;users&#x20;to&#x20;then&#x20;execute&#x20;modified&#x20;versions.','Unauthorized&#x20;modifications&#x20;of&#x20;applications&#x20;could&#x20;lead&#x20;to&#x20;the&#x20;execution&#x20;of&#x20;malicious&#x20;code.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;permissions&#x20;for&#x20;each&#x20;application&#x20;that&#x20;does&#x20;not&#x20;meet&#x20;the&#x20;requirements:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Applications/&lt;applicationname&gt;','[{\"cis\": [\"5.1.6\"]}, {\"cis_level\": [\"1\"]}]'),(29047,'Ensure&#x20;No&#x20;World&#x20;Writable&#x20;Files&#x20;Exist&#x20;in&#x20;the&#x20;System&#x20;Folder.','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/System/Volumes/Data/SystemDirectory&#x20;and&#x20;have&#x20;inappropriate&#x20;world-writable&#x20;permissions.','Folders&#x20;in&#x20;/System/Volumes/Data/System&#x20;should&#x20;not&#x20;be&#x20;world-writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;&quot;Drop&#x20;Box&quot;&#x20;folder&#x20;that&#x20;is&#x20;part&#x20;of&#x20;Apple&#039;s&#x20;default&#x20;user&#x20;template.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/System&#x20;folder:&#x20;sudo&#x20;chmod&#x20;-R&#x20;o-w&#x20;/Path/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.7\"]}, {\"cis_level\": [\"1\"]}]'),(29048,'Ensure&#x20;No&#x20;World&#x20;Writable&#x20;Files&#x20;Exist&#x20;in&#x20;the&#x20;Library&#x20;Folder.','Software&#x20;sometimes&#x20;insists&#x20;on&#x20;being&#x20;installed&#x20;in&#x20;the&#x20;/Library&#x20;Directory&#x20;and&#x20;have&#x20;inappropriate&#x20;world-writable&#x20;permissions.','Folders&#x20;in&#x20;/System/Volumes/Data/Library&#x20;should&#x20;not&#x20;be&#x20;world-writable.&#x20;The&#x20;audit&#x20;check&#x20;excludes&#x20;the&#x20;/System/Volumes/Data/Library/Caches&#x20;and&#x20;/System/Volumes/Data/Library/Preferences/Audio/Data&#x20;folders&#x20;where&#x20;the&#x20;sticky&#x20;bit&#x20;is&#x20;set.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;permissions&#x20;so&#x20;that&#x20;folders&#x20;are&#x20;not&#x20;world&#x20;writable&#x20;in&#x20;the&#x20;/System/Volumes/Data/Library&#x20;folder:&#x20;sudo&#x20;/bin/chmod&#x20;-R&#x20;o-w&#x20;/System/Volumes/Data/Library/&lt;baddirectory&gt;','[{\"cis\": [\"5.1.8\"]}, {\"cis_level\": [\"2\"]}]'),(29049,'Ensure&#x20;the&#x20;Sudo&#x20;Timeout&#x20;Period&#x20;Is&#x20;Set&#x20;to&#x20;Zero.','The&#x20;sudo&#x20;command&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;run&#x20;programs&#x20;as&#x20;the&#x20;root&#x20;user.&#x20;Working&#x20;as&#x20;the&#x20;root&#x20;user&#x20;allows&#x20;the&#x20;user&#x20;an&#x20;extremely&#x20;high&#x20;level&#x20;of&#x20;configurability&#x20;within&#x20;the&#x20;system.&#x20;This&#x20;control&#x20;along&#x20;with&#x20;the&#x20;control&#x20;to&#x20;use&#x20;a&#x20;separate&#x20;timestamp&#x20;for&#x20;each&#x20;tty&#x20;limits&#x20;the&#x20;window&#x20;where&#x20;an&#x20;unauthorized&#x20;user,&#x20;process&#x20;or&#x20;attacker&#x20;could&#x20;utilize&#x20;legitimate&#x20;credentials&#x20;that&#x20;are&#x20;valid&#x20;for&#x20;longer&#x20;than&#x20;required.','The&#x20;sudo&#x20;command&#x20;stays&#x20;logged&#x20;in&#x20;as&#x20;the&#x20;root&#x20;user&#x20;for&#x20;five&#x20;minutes&#x20;before&#x20;timing&#x20;out&#x20;and&#x20;re-requesting&#x20;a&#x20;password.&#x20;This&#x20;five-minute&#x20;window&#x20;should&#x20;be&#x20;eliminated&#x20;since&#x20;it&#x20;leaves&#x20;the&#x20;system&#x20;extremely&#x20;vulnerable.&#x20;This&#x20;is&#x20;especially&#x20;true&#x20;if&#x20;an&#x20;exploit&#x20;were&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;since&#x20;they&#x20;would&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;as&#x20;a&#x20;root&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;sudo&#x20;visudo.&#x20;Add&#x20;the&#x20;line&#x20;&#039;Defaults&#x20;timestamp_timeout=0&#039;&#x20;in&#x20;the&#x20;Override&#x20;built-in&#x20;defaults&#x20;section.&#x20;','[{\"cis\": [\"5.3\"]}, {\"cis_level\": [\"1\"]}]'),(29050,'Ensure&#x20;a&#x20;Separate&#x20;Timestamp&#x20;Is&#x20;Enabled&#x20;for&#x20;Each&#x20;User/tty&#x20;Combo.','Using&#x20;tty&#x20;tickets&#x20;ensures&#x20;that&#x20;a&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;sudo&#x20;password&#x20;in&#x20;each&#x20;Terminal&#x20;session.&#x20;With&#x20;sudo&#x20;versions&#x20;1.8&#x20;and&#x20;higher,&#x20;introduced&#x20;in&#x20;10.12,&#x20;the&#x20;default&#x20;value&#x20;is&#x20;to&#x20;have&#x20;tty&#x20;tickets&#x20;for&#x20;each&#x20;interface&#x20;so&#x20;that&#x20;root&#x20;access&#x20;is&#x20;limited&#x20;to&#x20;a&#x20;specific&#x20;terminal.&#x20;The&#x20;default&#x20;configuration&#x20;can&#x20;be&#x20;overwritten&#x20;or&#x20;not&#x20;configured&#x20;correctly&#x20;on&#x20;earlier&#x20;versions&#x20;of&#x20;macOS.','In&#x20;combination&#x20;with&#x20;removing&#x20;the&#x20;sudo&#x20;timeout&#x20;grace&#x20;period,&#x20;a&#x20;further&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;background&#x20;process&#x20;using&#x20;elevated&#x20;rights&#x20;when&#x20;a&#x20;user&#x20;elevates&#x20;to&#x20;root&#x20;in&#x20;an&#x20;explicit&#x20;context&#x20;or&#x20;tty.&#x20;Additional&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;privilege&#x20;escalation&#x20;of&#x20;background&#x20;processes.','','Edit&#x20;the&#x20;/etc/sudoers&#x20;file&#x20;with&#x20;visudo&#x20;and&#x20;remove&#x20;!tty_tickets&#x20;from&#x20;any&#x20;Defaults&#x20;line.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;Default&#x20;line&#x20;of&#x20;timestamp_type=&#x20;with&#x20;a&#x20;value&#x20;other&#x20;than&#x20;tty,&#x20;change&#x20;the&#x20;value&#x20;to&#x20;tty&#x20;If&#x20;there&#x20;is&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/sudoers.d/&#x20;folder&#x20;that&#x20;contains&#x20;Defaults&#x20;!tty_tickets,&#x20;edit&#x20;the&#x20;file&#x20;and&#x20;remove&#x20;!tty_tickets&#x20;from&#x20;any&#x20;Defaults&#x20;line.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;file&#x20;/etc/sudoers.d/&#x20;folder&#x20;that&#x20;contains&#x20;a&#x20;Default&#x20;line&#x20;of&#x20;timestamp_type=&#x20;with&#x20;a&#x20;value&#x20;other&#x20;than&#x20;tty,&#x20;change&#x20;the&#x20;value&#x20;to&#x20;tty.','[{\"cis\": [\"5.4\"]}, {\"cis_level\": [\"1\"]}]'),(29051,'Ensure&#x20;the&#x20;&quot;root&quot;&#x20;Account&#x20;Is&#x20;Disabled','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;Linux&#x20;distros&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;use&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;root&#x20;user:&#x20;sudo&#x20;/usr/sbin/dsenableroot&#x20;-d','[{\"cis\": [\"5.6\"]}, {\"cis_level\": [\"1\"]}]'),(29052,'Ensure&#x20;Automatic&#x20;Login&#x20;Is&#x20;Disabled.','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen.&#x20;Instead,&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;automatic&#x20;login:&#x20;sudo&#x20;defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser','[{\"cis\": [\"5.7\"]}, {\"cis_level\": [\"1\"]}]'),(29053,'Require&#x20;an&#x20;administrator&#x20;password&#x20;to&#x20;access&#x20;system-wide&#x20;preferences.','System&#x20;Preferences&#x20;controls&#x20;system&#x20;and&#x20;user&#x20;settings&#x20;on&#x20;a&#x20;macOS&#x20;Computer.&#x20;System&#x20;Preferences&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;tailor&#x20;their&#x20;experience&#x20;on&#x20;the&#x20;computer&#x20;as&#x20;well&#x20;as&#x20;allowing&#x20;the&#x20;System&#x20;Administrator&#x20;to&#x20;configure&#x20;global&#x20;security&#x20;settings.&#x20;Some&#x20;of&#x20;the&#x20;settings&#x20;should&#x20;only&#x20;be&#x20;altered&#x20;by&#x20;the&#x20;person&#x20;responsible&#x20;for&#x20;the&#x20;computer.','By&#x20;requiring&#x20;a&#x20;password&#x20;to&#x20;unlock&#x20;system-wide&#x20;System&#x20;Preferences&#x20;the&#x20;risk&#x20;is&#x20;mitigated&#x20;of&#x20;a&#x20;user&#x20;changing&#x20;configurations&#x20;that&#x20;affect&#x20;the&#x20;entire&#x20;system&#x20;and&#x20;requires&#x20;an&#x20;admin&#x20;user&#x20;to&#x20;re-authenticate&#x20;to&#x20;make&#x20;changes.','','The&#x20;authorizationdb&#x20;settings&#x20;cannot&#x20;be&#x20;written&#x20;to&#x20;directly,&#x20;so&#x20;the&#x20;plist&#x20;must&#x20;be&#x20;exported&#x20;out&#x20;to&#x20;temporary&#x20;file.&#x20;Changes&#x20;can&#x20;be&#x20;made&#x20;to&#x20;the&#x20;temporary&#x20;plist,&#x20;then&#x20;imported&#x20;back&#x20;into&#x20;the&#x20;authorizationdb&#x20;settings.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;that&#x20;an&#x20;administrator&#x20;password&#x20;is&#x20;required&#x20;to&#x20;access&#x20;system-wide&#x20;preferences:&#x20;$&#x20;sudo&#x20;security&#x20;authorizationdb&#x20;read&#x20;system.preferences&#x20;&gt;&#x20;/tmp/system.preferences.plist&#x20;$&#x20;sudo&#x20;defaults&#x20;write&#x20;/tmp/system.preferences.plist&#x20;shared&#x20;-bool&#x20;false&#x20;$&#x20;sudo&#x20;security&#x20;authorizationdb&#x20;write&#x20;system.preferences&#x20;&lt;&#x20;/tmp/system.preferences.plist','[{\"cis\": [\"5.10\"]}, {\"cis_level\": [\"1\"]}]'),(29054,'Ensure&#x20;an&#x20;administrator&#x20;account&#x20;cannot&#x20;login&#x20;to&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session.','macOS&#x20;has&#x20;a&#x20;privilege&#x20;that&#x20;can&#x20;be&#x20;granted&#x20;to&#x20;any&#x20;user&#x20;that&#x20;will&#x20;allow&#x20;that&#x20;user&#x20;to&#x20;unlock&#x20;active&#x20;user&#039;s&#x20;sessions.','Disabling&#x20;the&#x20;admins&#x20;and/or&#x20;user&#039;s&#x20;ability&#x20;to&#x20;log&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;potentially&#x20;sensitive&#x20;and/or&#x20;personal&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;a&#x20;user&#x20;logging&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and/or&#x20;locked&#x20;session:&#x20;sudo&#x20;security&#x20;authorizationdb&#x20;write&#x20;system.login.screensaver&#x20;use-login-window-ui','[{\"cis\": [\"5.11\"]}, {\"cis_level\": [\"1\"]}]'),(29055,'Ensure&#x20;a&#x20;Custom&#x20;Message&#x20;for&#x20;the&#x20;Login&#x20;Screen&#x20;Is&#x20;Enabled.','An&#x20;access&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only,&#x20;and&#x20;that&#x20;the&#x20;use&#x20;of&#x20;the&#x20;system&#x20;may&#x20;be&#x20;monitored.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;a&#x20;custom&#x20;login&#x20;screen&#x20;message:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;LoginwindowText&#x20;&quot;&lt;custom.message&gt;&quot;','[{\"cis\": [\"5.12\"]}, {\"cis_level\": [\"1\"]}]'),(29056,'Ensure&#x20;a&#x20;Login&#x20;Window&#x20;Banner&#x20;Exists.','A&#x20;Login&#x20;window&#x20;banner&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only.&#x20;It&#x20;enforces&#x20;an&#x20;acknowledgment&#x20;by&#x20;the&#x20;user&#x20;that&#x20;they&#x20;have&#x20;been&#x20;informed&#x20;of&#x20;the&#x20;use&#x20;policy&#x20;in&#x20;the&#x20;banner&#x20;if&#x20;required.&#x20;The&#x20;system&#x20;recognizes&#x20;either&#x20;the&#x20;.txt&#x20;and&#x20;the&#x20;.rtf&#x20;formats.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','','Edit&#x20;&#40;or&#x20;create&#41;&#x20;a&#x20;PolicyBanner.txt&#x20;or&#x20;PolicyBanner.rtf&#x20;file,&#x20;in&#x20;the&#x20;/Library/Security/&#x20;folder,&#x20;to&#x20;include&#x20;the&#x20;required&#x20;login&#x20;window&#x20;banner&#x20;text.','[{\"cis\": [\"5.13\"]}, {\"cis_level\": [\"2\"]}]'),(29057,'Ensure&#x20;Fast&#x20;User&#x20;Switching&#x20;Is&#x20;Disabled.','Fast&#x20;user&#x20;switching&#x20;allows&#x20;a&#x20;person&#x20;to&#x20;quickly&#x20;log&#x20;in&#x20;to&#x20;the&#x20;computer&#x20;with&#x20;a&#x20;different&#x20;account.&#x20;While&#x20;only&#x20;a&#x20;minimal&#x20;security&#x20;risk,&#x20;when&#x20;a&#x20;second&#x20;user&#x20;is&#x20;logged&#x20;in,&#x20;that&#x20;user&#x20;might&#x20;be&#x20;able&#x20;to&#x20;see&#x20;what&#x20;processes&#x20;the&#x20;first&#x20;user&#x20;is&#x20;using,&#x20;or&#x20;possibly&#x20;gain&#x20;other&#x20;information&#x20;about&#x20;the&#x20;first&#x20;user.&#x20;In&#x20;a&#x20;large&#x20;directory&#x20;environment&#x20;where&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;limit&#x20;log&#x20;in&#x20;access&#x20;many&#x20;valid&#x20;users&#x20;can&#x20;login&#x20;to&#x20;other&#x20;user&#039;s&#x20;assigned&#x20;computers.','Fast&#x20;user&#x20;switching&#x20;allows&#x20;multiple&#x20;users&#x20;to&#x20;run&#x20;applications&#x20;simultaneously&#x20;at&#x20;console.&#x20;There&#x20;can&#x20;be&#x20;information&#x20;disclosed&#x20;about&#x20;processes&#x20;running&#x20;under&#x20;a&#x20;different&#x20;user.&#x20;Without&#x20;a&#x20;specific&#x20;configuration&#x20;to&#x20;save&#x20;data&#x20;and&#x20;log&#x20;out&#x20;users&#x20;can&#x20;have&#x20;unsaved&#x20;data&#x20;running&#x20;in&#x20;a&#x20;background&#x20;session&#x20;that&#x20;is&#x20;not&#x20;obvious.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;fast&#x20;user&#x20;switching&#x20;off:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/.GlobalPreferences&#x20;MultipleSessionEnabled&#x20;-bool&#x20;false','[{\"cis\": [\"5.15\"]}, {\"cis_level\": [\"2\"]}]'),(29058,'Ensure&#x20;Login&#x20;Window&#x20;Displays&#x20;as&#x20;Name&#x20;and&#x20;Password&#x20;Is&#x20;Enabled.','The&#x20;login&#x20;window&#x20;prompts&#x20;a&#x20;user&#x20;for&#x20;his/her&#x20;credentials,&#x20;verifies&#x20;their&#x20;authorization&#x20;level&#x20;and&#x20;then&#x20;allows&#x20;or&#x20;denies&#x20;the&#x20;user&#x20;access&#x20;to&#x20;the&#x20;system.','Prompting&#x20;the&#x20;user&#x20;to&#x20;enter&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;makes&#x20;it&#x20;twice&#x20;as&#x20;hard&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;since&#x20;they&#x20;must&#x20;discover&#x20;two&#x20;attributes.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;login&#x20;window&#x20;to&#x20;display&#x20;name&#x20;and&#x20;password:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;SHOWFULLNAME&#x20;-bool&#x20;true','[{\"cis\": [\"6.1.1\"]}, {\"cis_level\": [\"1\"]}]'),(29059,'Ensure&#x20;Show&#x20;Password&#x20;Hints&#x20;Is&#x20;Disabled.','Password&#x20;hints&#x20;are&#x20;user-created&#x20;text&#x20;displayed&#x20;when&#x20;an&#x20;incorrect&#x20;password&#x20;is&#x20;used&#x20;for&#x20;an&#x20;account.','Password&#x20;hints&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;systems&#x20;by&#x20;providing&#x20;information&#x20;to&#x20;anyone&#x20;that&#x20;the&#x20;user&#x20;provided&#x20;to&#x20;assist&#x20;in&#x20;remembering&#x20;the&#x20;password.&#x20;This&#x20;info&#x20;could&#x20;include&#x20;the&#x20;password&#x20;itself&#x20;or&#x20;other&#x20;information&#x20;that&#x20;might&#x20;be&#x20;readily&#x20;discerned&#x20;with&#x20;basic&#x20;knowledge&#x20;of&#x20;the&#x20;end&#x20;user.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;password&#x20;hints:&#x20;sudo&#x20;defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;RetriesUntilHint&#x20;-int&#x20;0','[{\"cis\": [\"6.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(29060,'Ensure&#x20;Guest&#x20;Account&#x20;Is&#x20;Disabled.','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system.&#x20;All&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;created&#x20;by&#x20;the&#x20;guest&#x20;user&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;guest&#x20;account:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-bool&#x20;false','[{\"cis\": [\"6.1.3\"]}, {\"cis_level\": [\"1\"]}]'),(29061,'Ensure&#x20;Guest&#x20;Access&#x20;to&#x20;Shared&#x20;Folders&#x20;Is&#x20;Disabled.','Allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;enables&#x20;users&#x20;to&#x20;access&#x20;selected&#x20;shared&#x20;folders&#x20;and&#x20;their&#x20;contents&#x20;from&#x20;different&#x20;computers&#x20;on&#x20;a&#x20;network.','Not&#x20;allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;use&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;verify&#x20;that&#x20;shared&#x20;folders&#x20;are&#x20;not&#x20;accessible&#x20;to&#x20;guest&#x20;users:&#x20;sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/SystemConfiguration/com.apple.smb.server&#x20;AllowGuestAccess&#x20;-bool&#x20;false','[{\"cis\": [\"6.1.4\"]}, {\"cis_level\": [\"1\"]}]'),(29062,'Ensure&#x20;the&#x20;Guest&#x20;Home&#x20;Folder&#x20;Does&#x20;Not&#x20;Exist.','In&#x20;the&#x20;previous&#x20;two&#x20;controls&#x20;the&#x20;guest&#x20;account&#x20;login&#x20;has&#x20;been&#x20;disabled&#x20;and&#x20;sharing&#x20;to&#x20;guests&#x20;has&#x20;been&#x20;disabled&#x20;as&#x20;well.&#x20;There&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folder&#039;s&#x20;continued&#x20;existence,&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;Guest&#x20;user&#x20;home&#x20;folder:&#x20;sudo&#x20;/bin/rm&#x20;-R&#x20;/Users/Guest','[{\"cis\": [\"6.1.5\"]}, {\"cis_level\": [\"1\"]}]'),(29063,'Ensure&#x20;Show&#x20;All&#x20;Filename&#x20;Extensions&#x20;Setting&#x20;is&#x20;Enabled.','A&#x20;filename&#x20;extension&#x20;is&#x20;a&#x20;suffix&#x20;added&#x20;to&#x20;a&#x20;base&#x20;filename&#x20;that&#x20;indicates&#x20;the&#x20;base&#x20;filename&#039;s&#x20;file&#x20;format.','Visible&#x20;filename&#x20;extensions&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;identify&#x20;the&#x20;file&#x20;type&#x20;and&#x20;the&#x20;application&#x20;it&#x20;is&#x20;associated&#x20;with&#x20;which&#x20;leads&#x20;to&#x20;quick&#x20;identification&#x20;of&#x20;misrepresented&#x20;malicious&#x20;files.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;displaying&#x20;of&#x20;file&#x20;extensions:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;/usr/bin/defaults&#x20;write&#x20;/Users/&lt;username&gt;/Library/Preferences/.GlobalPreferences.plist&#x20;AppleShowAllExtensions&#x20;-bool&#x20;true','[{\"cis\": [\"6.2\"]}, {\"cis_level\": [\"1\"]}]'),(29064,'Ensure&#x20;Automatic&#x20;Opening&#x20;of&#x20;Safe&#x20;Files&#x20;in&#x20;Safari&#x20;Is&#x20;Disabled.','Safari&#x20;will&#x20;automatically&#x20;run&#x20;or&#x20;execute&#x20;what&#x20;it&#x20;considers&#x20;safe&#x20;files.&#x20;This&#x20;can&#x20;include&#x20;installers&#x20;and&#x20;other&#x20;files&#x20;that&#x20;execute&#x20;on&#x20;the&#x20;operating&#x20;system.&#x20;Safari&#x20;bases&#x20;file&#x20;safety&#x20;by&#x20;using&#x20;a&#x20;list&#x20;of&#x20;filetypes&#x20;maintained&#x20;by&#x20;Apple.&#x20;The&#x20;list&#x20;of&#x20;files&#x20;include&#x20;text,&#x20;image,&#x20;video&#x20;and&#x20;archive&#x20;formats&#x20;that&#x20;would&#x20;be&#x20;run&#x20;in&#x20;the&#x20;context&#x20;of&#x20;the&#x20;OS&#x20;rather&#x20;than&#x20;the&#x20;browser.','Hackers&#x20;have&#x20;taken&#x20;advantage&#x20;of&#x20;this&#x20;setting&#x20;via&#x20;drive-by&#x20;attacks.&#x20;These&#x20;attacks&#x20;occur&#x20;when&#x20;a&#x20;user&#x20;visits&#x20;a&#x20;legitimate&#x20;website&#x20;that&#x20;has&#x20;been&#x20;corrupted.&#x20;The&#x20;user&#x20;unknowingly&#x20;downloads&#x20;a&#x20;malicious&#x20;file&#x20;either&#x20;by&#x20;closing&#x20;an&#x20;infected&#x20;pop-up&#x20;or&#x20;hovering&#x20;over&#x20;a&#x20;malicious&#x20;banner.&#x20;An&#x20;attacker&#x20;can&#x20;create&#x20;a&#x20;malicious&#x20;file&#x20;that&#x20;will&#x20;fall&#x20;within&#x20;Safari&#039;s&#x20;safe&#x20;file&#x20;list&#x20;that&#x20;will&#x20;download&#x20;and&#x20;execute&#x20;without&#x20;user&#x20;input.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;safe&#x20;files&#x20;from&#x20;not&#x20;opening&#x20;in&#x20;Safari:&#x20;sudo&#x20;-u&#x20;&lt;username&gt;&#x20;/usr/bin/defaults&#x20;write&#x20;/Users/&lt;username&gt;/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari&#x20;AutoOpenSafeDownloads&#x20;-bool&#x20;false','[{\"cis\": [\"6.3\"]}, {\"cis_level\": [\"1\"]}]'),(29500,'Ensure&#x20;/tmp&#x20;is&#x20;a&#x20;separate&#x20;partition.','The&#x20;/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.','Making&#x20;/tmp&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;the&#x20;noexec&#x20;option&#x20;on&#x20;the&#x20;mount,&#x20;making&#x20;/tmp&#x20;useless&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;install&#x20;executable&#x20;code.&#x20;It&#x20;would&#x20;also&#x20;prevent&#x20;an&#x20;attacker&#x20;from&#x20;establishing&#x20;a&#x20;hard&#x20;link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard&#x20;link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;either&#x20;mounting&#x20;tmpfs&#x20;to&#x20;/tmp,&#x20;or&#x20;creating&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/tmp.','Since&#x20;the&#x20;/tmp&#x20;directory&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;world-writable,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion&#x20;if&#x20;it&#x20;is&#x20;not&#x20;bound&#x20;to&#x20;a&#x20;separate&#x20;partition.&#x20;Running&#x20;out&#x20;of&#x20;/tmp&#x20;space&#x20;is&#x20;a&#x20;problem&#x20;regardless&#x20;of&#x20;what&#x20;kind&#x20;of&#x20;filesystem&#x20;lies&#x20;under&#x20;it,&#x20;but&#x20;in&#x20;a&#x20;configuration&#x20;where&#x20;/tmp&#x20;is&#x20;not&#x20;a&#x20;separate&#x20;file&#x20;system&#x20;it&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available,&#x20;as&#x20;the&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;On&#x20;the&#x20;other&#x20;hand,&#x20;a&#x20;RAM-based&#x20;/tmp&#x20;&#40;as&#x20;with&#x20;tmpfs&#41;&#x20;will&#x20;almost&#x20;certainly&#x20;be&#x20;much&#x20;smaller,&#x20;which&#x20;can&#x20;lead&#x20;to&#x20;applications&#x20;filling&#x20;up&#x20;the&#x20;filesystem&#x20;much&#x20;more&#x20;easily.&#x20;Another&#x20;alternative&#x20;is&#x20;to&#x20;create&#x20;a&#x20;dedicated&#x20;partition&#x20;for&#x20;/tmp&#x20;from&#x20;a&#x20;separate&#x20;volume&#x20;or&#x20;disk.&#x20;One&#x20;of&#x20;the&#x20;downsides&#x20;of&#x20;a&#x20;disk-based&#x20;dedicated&#x20;partition&#x20;is&#x20;that&#x20;it&#x20;will&#x20;be&#x20;slower&#x20;than&#x20;tmpfs&#x20;which&#x20;is&#x20;RAM-based.&#x20;/tmp&#x20;utilizing&#x20;tmpfs&#x20;can&#x20;be&#x20;resized&#x20;using&#x20;the&#x20;size={size}&#x20;parameter&#x20;in&#x20;the&#x20;relevant&#x20;entry&#x20;in&#x20;/etc/fstab.','First&#x20;ensure&#x20;that&#x20;systemd&#x20;is&#x20;correctly&#x20;configured&#x20;to&#x20;ensure&#x20;that&#x20;/tmp&#x20;will&#x20;be&#x20;mounted&#x20;at&#x20;boot&#x20;time.&#x20;#&#x20;systemctl&#x20;unmask&#x20;tmp.mount.&#x20;For&#x20;specific&#x20;configuration&#x20;requirements&#x20;of&#x20;the&#x20;/tmp&#x20;mount&#x20;for&#x20;your&#x20;environment,&#x20;modify&#x20;/etc/fstab&#x20;or&#x20;tmp.mount.&#x20;Example&#x20;of&#x20;/etc/fstab&#x20;configured&#x20;tmpfs&#x20;file&#x20;system&#x20;with&#x20;specific&#x20;mount&#x20;options:&#x20;tmpfs&#x20;/tmp&#x20;tmpfs&#x20;defaults,rw,nosuid,nodev,noexec,relatime,size=2G&#x20;0&#x20;0.&#x20;Example&#x20;of&#x20;tmp.mount&#x20;configured&#x20;tmpfs&#x20;file&#x20;system&#x20;with&#x20;specific&#x20;mount&#x20;options:&#x20;[Unit]&#x20;Description=Temporary&#x20;Directory&#x20;/tmp&#x20;ConditionPathIsSymbolicLink=!/tmp&#x20;DefaultDependencies=no&#x20;Conflicts=umount.target&#x20;Before=local-fs.target&#x20;umount.target&#x20;After=swap.target&#x20;[Mount]&#x20;What=tmpfs&#x20;Where=/tmp&#x20;Type=tmpfs.','[{\"cis\": [\"1.1.2.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29501,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29502,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29503,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/tmp.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/tmp.','[{\"cis\": [\"1.1.2.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29504,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var.','The&#x20;/var&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;daemons&#x20;and&#x20;other&#x20;system&#x20;services&#x20;to&#x20;temporarily&#x20;store&#x20;dynamic&#x20;data.&#x20;Some&#x20;directories&#x20;created&#x20;by&#x20;these&#x20;processes&#x20;may&#x20;be&#x20;world-writable.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follow.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var&#x20;and&#x20;cause&#x20;unintended&#x20;behavior&#x20;across&#x20;the&#x20;system&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;See&#x20;man&#x20;auditd.conf&#x20;for&#x20;details.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behaviour.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;from&#x20;exploitation:&#x20;An&#x20;example&#x20;of&#x20;exploiting&#x20;/var&#x20;may&#x20;be&#x20;an&#x20;attacker&#x20;establishing&#x20;a&#x20;hard-link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard-link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.3.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0006\"]}]'),(29505,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var.','','IF&#x20;the&#x20;/var&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var.','[{\"cis\": [\"1.1.3.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(29506,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;variable&#x20;files&#x20;such&#x20;as&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var.','','IF&#x20;the&#x20;/var&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var.','[{\"cis\": [\"1.1.3.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(29507,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/tmp.','The&#x20;/var/tmp&#x20;directory&#x20;is&#x20;a&#x20;world-writable&#x20;directory&#x20;used&#x20;for&#x20;temporary&#x20;storage&#x20;by&#x20;all&#x20;users&#x20;and&#x20;some&#x20;applications.&#x20;Temporary&#x20;files&#x20;residing&#x20;in&#x20;/var/tmp&#x20;are&#x20;to&#x20;be&#x20;preserved&#x20;between&#x20;reboots.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/tmp&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/tmp&#x20;directory&#x20;may&#x20;contain&#x20;world-writable&#x20;files&#x20;and&#x20;directories,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var/tmp&#x20;and&#x20;cause&#x20;the&#x20;potential&#x20;disruption&#x20;to&#x20;daemons&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var/tmp&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;from&#x20;exploitation:&#x20;An&#x20;example&#x20;of&#x20;exploiting&#x20;/var/tmp&#x20;may&#x20;be&#x20;an&#x20;attacker&#x20;establishing&#x20;a&#x20;hard-link&#x20;to&#x20;a&#x20;system&#x20;setuid&#x20;program&#x20;and&#x20;wait&#x20;for&#x20;it&#x20;to&#x20;be&#x20;updated.&#x20;Once&#x20;the&#x20;program&#x20;was&#x20;updated,&#x20;the&#x20;hard-link&#x20;would&#x20;be&#x20;broken&#x20;and&#x20;the&#x20;attacker&#x20;would&#x20;have&#x20;his&#x20;own&#x20;copy&#x20;of&#x20;the&#x20;program.&#x20;If&#x20;the&#x20;program&#x20;happened&#x20;to&#x20;have&#x20;a&#x20;security&#x20;vulnerability,&#x20;the&#x20;attacker&#x20;could&#x20;continue&#x20;to&#x20;exploit&#x20;the&#x20;known&#x20;flaw.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/tmp.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.4.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29508,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/tmp.','','IF&#x20;the&#x20;/var/tmp&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29509,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;temporary&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/tmp.','','IF&#x20;the&#x20;/var/tmp&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29510,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/tmp&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/tmp&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/tmp.','','IF&#x20;the&#x20;/var/tmp&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/tmp&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/tmp&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/tmp&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/tmp.','[{\"cis\": [\"1.1.4.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29511,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log.','The&#x20;/var/log&#x20;directory&#x20;is&#x20;used&#x20;by&#x20;system&#x20;services&#x20;to&#x20;store&#x20;log&#x20;data.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/log&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/log&#x20;directory&#x20;contains&#x20;log&#x20;files&#x20;which&#x20;can&#x20;grow&#x20;quite&#x20;large,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var/log&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;of&#x20;log&#x20;data:&#x20;As&#x20;/var/log&#x20;contains&#x20;log&#x20;files,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log&#x20;.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.5.1\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29512,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/log.','','IF&#x20;the&#x20;/var/log&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29513,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;log&#x20;files,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/log.','','IF&#x20;the&#x20;/var/log&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29514,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/log&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/log&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;log&#x20;files,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/log.','','IF&#x20;the&#x20;/var/log&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log.','[{\"cis\": [\"1.1.5.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29515,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/var/log/audit.','The&#x20;auditing&#x20;daemon,&#x20;auditd,&#x20;stores&#x20;log&#x20;data&#x20;in&#x20;the&#x20;/var/log/audit&#x20;directory.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/var/log/audit&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/var/log/audit&#x20;directory&#x20;contains&#x20;the&#x20;audit.log&#x20;file&#x20;which&#x20;can&#x20;grow&#x20;quite&#x20;large,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/var/log/audit&#x20;and&#x20;cause&#x20;auditd&#x20;to&#x20;trigger&#x20;it&#039;s&#x20;space_left_action&#x20;as&#x20;the&#x20;disk&#x20;is&#x20;full.&#x20;See&#x20;man&#x20;auditd.conf&#x20;for&#x20;details.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/var/log/audit&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;of&#x20;audit&#x20;data:&#x20;As&#x20;/var/log/audit&#x20;contains&#x20;audit&#x20;logs,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/var/log/audit.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.6.1\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29516,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;audit&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;run&#x20;executable&#x20;binaries&#x20;from&#x20;/var/log/audit.','','IF&#x20;the&#x20;/var/log/audit&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29517,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/var/log/audit.','','IF&#x20;the&#x20;/var/log/audit&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log/audit&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29518,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/var/log/audit&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/var/log/audit&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;variable&#x20;files&#x20;such&#x20;as&#x20;logs,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/var/log/audit.','','IF&#x20;the&#x20;/var/log/audit&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/var/log/audit&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/var/log/audit&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0&#x20;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/var/log/audit&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/var/log/audit.','[{\"cis\": [\"1.1.6.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29519,'Ensure&#x20;separate&#x20;partition&#x20;exists&#x20;for&#x20;/home.','The&#x20;/home&#x20;directory&#x20;is&#x20;used&#x20;to&#x20;support&#x20;disk&#x20;storage&#x20;needs&#x20;of&#x20;local&#x20;users.','The&#x20;reasoning&#x20;for&#x20;mounting&#x20;/home&#x20;on&#x20;a&#x20;separate&#x20;partition&#x20;is&#x20;as&#x20;follows.&#x20;-&#x20;Protection&#x20;from&#x20;resource&#x20;exhaustion:&#x20;The&#x20;default&#x20;installation&#x20;only&#x20;creates&#x20;a&#x20;single&#x20;/&#x20;partition.&#x20;Since&#x20;the&#x20;/home&#x20;directory&#x20;contains&#x20;user&#x20;generated&#x20;data,&#x20;there&#x20;is&#x20;a&#x20;risk&#x20;of&#x20;resource&#x20;exhaustion.&#x20;It&#x20;will&#x20;essentially&#x20;have&#x20;the&#x20;whole&#x20;disk&#x20;available&#x20;to&#x20;fill&#x20;up&#x20;and&#x20;impact&#x20;the&#x20;system&#x20;as&#x20;a&#x20;whole.&#x20;In&#x20;addition,&#x20;other&#x20;operations&#x20;on&#x20;the&#x20;system&#x20;could&#x20;fill&#x20;up&#x20;the&#x20;disk&#x20;unrelated&#x20;to&#x20;/home&#x20;and&#x20;impact&#x20;all&#x20;local&#x20;users.&#x20;-&#x20;Fine&#x20;grained&#x20;control&#x20;over&#x20;the&#x20;mount:&#x20;Configuring&#x20;/home&#x20;as&#x20;its&#x20;own&#x20;file&#x20;system&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;set&#x20;additional&#x20;mount&#x20;options&#x20;such&#x20;as&#x20;noexec/nosuid/nodev.&#x20;These&#x20;options&#x20;limits&#x20;an&#x20;attackers&#x20;ability&#x20;to&#x20;create&#x20;exploits&#x20;on&#x20;the&#x20;system.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;/home&#x20;options&#x20;such&#x20;as&#x20;usrquota/grpquota&#x20;may&#x20;be&#x20;considered&#x20;to&#x20;limit&#x20;the&#x20;impact&#x20;that&#x20;users&#x20;can&#x20;have&#x20;on&#x20;each&#x20;other&#x20;with&#x20;regards&#x20;to&#x20;disk&#x20;resource&#x20;exhaustion.&#x20;Other&#x20;options&#x20;allow&#x20;for&#x20;specific&#x20;behavior.&#x20;See&#x20;man&#x20;mount&#x20;for&#x20;exact&#x20;details&#x20;regarding&#x20;filesystem-independent&#x20;and&#x20;filesystem-specific&#x20;options.&#x20;-&#x20;Protection&#x20;of&#x20;user&#x20;data:&#x20;As&#x20;/home&#x20;contains&#x20;user&#x20;data,&#x20;care&#x20;should&#x20;be&#x20;taken&#x20;to&#x20;ensure&#x20;the&#x20;security&#x20;and&#x20;integrity&#x20;of&#x20;the&#x20;data&#x20;and&#x20;mount&#x20;point.','Resizing&#x20;filesystems&#x20;is&#x20;a&#x20;common&#x20;activity&#x20;in&#x20;cloud-hosted&#x20;servers.&#x20;Separate&#x20;filesystem&#x20;partitions&#x20;may&#x20;prevent&#x20;successful&#x20;resizing,&#x20;or&#x20;may&#x20;require&#x20;the&#x20;installation&#x20;of&#x20;additional&#x20;tools&#x20;solely&#x20;for&#x20;the&#x20;purpose&#x20;of&#x20;resizing&#x20;operations.&#x20;The&#x20;use&#x20;of&#x20;these&#x20;additional&#x20;tools&#x20;may&#x20;introduce&#x20;their&#x20;own&#x20;security&#x20;considerations.','For&#x20;new&#x20;installations,&#x20;during&#x20;installation&#x20;create&#x20;a&#x20;custom&#x20;partition&#x20;setup&#x20;and&#x20;specify&#x20;a&#x20;separate&#x20;partition&#x20;for&#x20;/home.&#x20;For&#x20;systems&#x20;that&#x20;were&#x20;previously&#x20;installed,&#x20;create&#x20;a&#x20;new&#x20;partition&#x20;and&#x20;configure&#x20;/etc/fstab&#x20;as&#x20;appropriate.','[{\"cis\": [\"1.1.7.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(29520,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/home&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;a&#x20;block&#x20;or&#x20;character&#x20;special&#x20;devices&#x20;in&#x20;/home.','','IF&#x20;the&#x20;/home&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/home&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/home.','[{\"cis\": [\"1.1.7.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29521,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/home&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Since&#x20;the&#x20;/home&#x20;filesystem&#x20;is&#x20;only&#x20;intended&#x20;for&#x20;user&#x20;file&#x20;storage,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;create&#x20;setuid&#x20;files&#x20;in&#x20;/home.','','IF&#x20;the&#x20;/home&#x20;partition&#x20;exists,&#x20;edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/home&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/home&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,relatime&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/home&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/home.','[{\"cis\": [\"1.1.7.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29522,'Ensure&#x20;nodev&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nodev&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;special&#x20;devices.','Since&#x20;the&#x20;/dev/shm&#x20;filesystem&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;support&#x20;devices,&#x20;set&#x20;this&#x20;option&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;cannot&#x20;attempt&#x20;to&#x20;create&#x20;special&#x20;devices&#x20;in&#x20;/dev/shm&#x20;partitions.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nodev&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;using&#x20;the&#x20;updated&#x20;options&#x20;from&#x20;/etc/fstab:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm.','[{\"cis\": [\"1.1.8.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1200\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(29523,'Ensure&#x20;noexec&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;noexec&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;executable&#x20;binaries.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;executing&#x20;programs&#x20;from&#x20;shared&#x20;memory.&#x20;This&#x20;deters&#x20;users&#x20;from&#x20;introducing&#x20;potentially&#x20;malicious&#x20;software&#x20;on&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;noexec&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;Example:&#x20;&lt;device&gt;&#x20;/dev/shm&#x20;&lt;fstype&gt;&#x20;defaults,rw,nosuid,nodev,noexec,relatime&#x20;0&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;with&#x20;the&#x20;configured&#x20;options:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm.&#x20;NOTE&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;use&#x20;tmpfs&#x20;as&#x20;the&#x20;device/filesystem&#x20;type&#x20;as&#x20;/dev/shm&#x20;is&#x20;used&#x20;as&#x20;shared&#x20;memory&#x20;space&#x20;by&#x20;applications.','[{\"cis\": [\"1.1.8.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1204\", \"T1204.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29524,'Ensure&#x20;nosuid&#x20;option&#x20;set&#x20;on&#x20;/dev/shm&#x20;partition.','The&#x20;nosuid&#x20;mount&#x20;option&#x20;specifies&#x20;that&#x20;the&#x20;filesystem&#x20;cannot&#x20;contain&#x20;setuid&#x20;files.','Setting&#x20;this&#x20;option&#x20;on&#x20;a&#x20;file&#x20;system&#x20;prevents&#x20;users&#x20;from&#x20;introducing&#x20;privileged&#x20;programs&#x20;onto&#x20;the&#x20;system&#x20;and&#x20;allowing&#x20;non-root&#x20;users&#x20;to&#x20;execute&#x20;them.','','Edit&#x20;the&#x20;/etc/fstab&#x20;file&#x20;and&#x20;add&#x20;nosuid&#x20;to&#x20;the&#x20;fourth&#x20;field&#x20;&#40;mounting&#x20;options&#41;&#x20;for&#x20;the&#x20;/dev/shm&#x20;partition.&#x20;See&#x20;the&#x20;fstab&#40;5&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remount&#x20;/dev/shm&#x20;using&#x20;the&#x20;updated&#x20;options&#x20;from&#x20;/etc/fstab:&#x20;#&#x20;mount&#x20;-o&#x20;remount&#x20;/dev/shm.','[{\"cis\": [\"1.1.8.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1038\"]}]'),(29525,'Disable&#x20;Automounting.','autofs&#x20;allows&#x20;automatic&#x20;mounting&#x20;of&#x20;devices,&#x20;typically&#x20;including&#x20;CD/DVDs&#x20;and&#x20;USB&#x20;drives.','With&#x20;automounting&#x20;enabled&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;could&#x20;attach&#x20;a&#x20;USB&#x20;drive&#x20;or&#x20;disc&#x20;and&#x20;have&#x20;its&#x20;contents&#x20;available&#x20;in&#x20;system&#x20;even&#x20;if&#x20;they&#x20;lacked&#x20;permissions&#x20;to&#x20;mount&#x20;it&#x20;themselves.','The&#x20;use&#x20;of&#x20;portable&#x20;hard&#x20;drives&#x20;is&#x20;very&#x20;common&#x20;for&#x20;workstation&#x20;users.&#x20;If&#x20;your&#x20;organization&#x20;allows&#x20;the&#x20;use&#x20;of&#x20;portable&#x20;storage&#x20;or&#x20;media&#x20;on&#x20;workstations&#x20;and&#x20;physical&#x20;access&#x20;controls&#x20;to&#x20;workstations&#x20;is&#x20;considered&#x20;adequate&#x20;there&#x20;is&#x20;little&#x20;value&#x20;add&#x20;in&#x20;turning&#x20;off&#x20;automounting.','If&#x20;there&#x20;are&#x20;no&#x20;other&#x20;packages&#x20;that&#x20;depends&#x20;on&#x20;autofs,&#x20;remove&#x20;the&#x20;package&#x20;with:&#x20;#&#x20;apt&#x20;purge&#x20;autofs&#x20;OR&#x20;if&#x20;there&#x20;are&#x20;dependencies&#x20;on&#x20;the&#x20;autofs&#x20;package:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;mask&#x20;autofs:&#x20;#&#x20;systemctl&#x20;stop&#x20;autofs&#x20;#&#x20;systemctl&#x20;mask&#x20;autofs.','[{\"cis\": [\"1.1.9\"]}, {\"cis_csc_v8\": [\"10.3\"]}, {\"cis_csc_v7\": [\"8.5\"]}, {\"cmmc_v2.0\": [\"MP.L2-3.8.7\"]}, {\"hipaa\": [\"164.310(d)(1)\"]}, {\"iso_27001-2013\": [\"A.12.2.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1203\", \"T1211\", \"T1212\"]}]'),(29526,'Ensure&#x20;AIDE&#x20;is&#x20;installed.','AIDE&#x20;takes&#x20;a&#x20;snapshot&#x20;of&#x20;filesystem&#x20;state&#x20;including&#x20;modification&#x20;times,&#x20;permissions,&#x20;and&#x20;file&#x20;hashes&#x20;which&#x20;can&#x20;then&#x20;be&#x20;used&#x20;to&#x20;compare&#x20;against&#x20;the&#x20;current&#x20;state&#x20;of&#x20;the&#x20;filesystem&#x20;to&#x20;detect&#x20;modifications&#x20;to&#x20;the&#x20;system.','By&#x20;monitoring&#x20;the&#x20;filesystem&#x20;state&#x20;compromised&#x20;files&#x20;can&#x20;be&#x20;detected&#x20;to&#x20;prevent&#x20;or&#x20;limit&#x20;the&#x20;exposure&#x20;of&#x20;accidental&#x20;or&#x20;malicious&#x20;misconfigurations&#x20;or&#x20;modified&#x20;binaries.','','Install&#x20;AIDE&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;install&#x20;aide&#x20;aide-common&#x20;Configure&#x20;AIDE&#x20;as&#x20;appropriate&#x20;for&#x20;your&#x20;environment.&#x20;Consult&#x20;the&#x20;AIDE&#x20;documentation&#x20;for&#x20;options.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;initialize&#x20;AIDE:&#x20;#&#x20;aideinit&#x20;#&#x20;mv&#x20;/var/lib/aide/aide.db.new&#x20;/var/lib/aide/aide.db.','[{\"cis\": [\"1.3.1\"]}, {\"cis_csc_v8\": [\"3.14\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\"]}, {\"hipaa\": [\"164.312(b)\", \"164.312(c)(1)\", \"164.312(c)(2)\"]}, {\"pci_dss_3.2.1\": [\"10.2.1\", \"11.5\"]}, {\"pci_dss_4.0\": [\"10.2.1\", \"10.2.1.1\"]}, {\"nist_sp_800-53\": [\"AC-6(9)\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1036\", \"T1036.002\", \"T1036.003\", \"T1036.004\", \"T1036.005\", \"T1565\", \"T1565.001\"]}]'),(29527,'Ensure&#x20;filesystem&#x20;integrity&#x20;is&#x20;regularly&#x20;checked.','Periodic&#x20;checking&#x20;of&#x20;the&#x20;filesystem&#x20;integrity&#x20;is&#x20;needed&#x20;to&#x20;detect&#x20;changes&#x20;to&#x20;the&#x20;filesystem.','Periodic&#x20;file&#x20;checking&#x20;allows&#x20;the&#x20;system&#x20;administrator&#x20;to&#x20;determine&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;if&#x20;critical&#x20;files&#x20;have&#x20;been&#x20;changed&#x20;in&#x20;an&#x20;unauthorized&#x20;fashion.','','If&#x20;cron&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;#&#x20;crontab&#x20;-u&#x20;root&#x20;-e&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;crontab:&#x20;0&#x20;5&#x20;*&#x20;*&#x20;*&#x20;/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check&#x20;OR&#x20;If&#x20;aidecheck.service&#x20;and&#x20;aidecheck.timer&#x20;will&#x20;be&#x20;used&#x20;to&#x20;schedule&#x20;and&#x20;run&#x20;aide&#x20;check:&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.service&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;[Unit]&#x20;Description=Aide&#x20;Check&#x20;[Service]&#x20;Type=simple&#x20;ExecStart=/usr/bin/aide.wrapper&#x20;--config&#x20;/etc/aide/aide.conf&#x20;--check&#x20;[Install]&#x20;WantedBy=multi-user.target.&#x20;Create&#x20;or&#x20;edit&#x20;the&#x20;file&#x20;/etc/systemd/system/aidecheck.timer&#x20;and&#x20;add&#x20;the&#x20;following&#x20;lines:&#x20;[Unit]&#x20;Description=Aide&#x20;check&#x20;every&#x20;day&#x20;at&#x20;5AM&#x20;[Timer]&#x20;OnCalendar=*-*-*&#x20;05:00:00&#x20;Unit=aidecheck.service&#x20;[Install]&#x20;WantedBy=multi-user.target.&#x20;Run&#x20;the&#x20;following&#x20;commands:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/systemd/system/aidecheck.*&#x20;#&#x20;chmod&#x20;0644&#x20;/etc/systemd/system/aidecheck.*&#x20;#&#x20;systemctl&#x20;daemon-reload&#x20;#&#x20;systemctl&#x20;enable&#x20;aidecheck.service&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;aidecheck.timer.','[{\"cis\": [\"1.3.2\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1036\", \"T1036.002\", \"T1036.003\", \"T1036.004\", \"T1036.005\", \"T1565\", \"T1565.001\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29528,'Ensure&#x20;bootloader&#x20;password&#x20;is&#x20;set.','Setting&#x20;the&#x20;boot&#x20;loader&#x20;password&#x20;will&#x20;require&#x20;that&#x20;anyone&#x20;rebooting&#x20;the&#x20;system&#x20;must&#x20;enter&#x20;a&#x20;password&#x20;before&#x20;being&#x20;able&#x20;to&#x20;set&#x20;command&#x20;line&#x20;boot&#x20;parameters.','Requiring&#x20;a&#x20;boot&#x20;password&#x20;upon&#x20;execution&#x20;of&#x20;the&#x20;boot&#x20;loader&#x20;will&#x20;prevent&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;entering&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;the&#x20;boot&#x20;partition.&#x20;This&#x20;prevents&#x20;users&#x20;from&#x20;weakening&#x20;security&#x20;&#40;e.g.&#x20;turning&#x20;off&#x20;AppArmor&#x20;at&#x20;boot&#x20;time&#41;.','If&#x20;password&#x20;protection&#x20;is&#x20;enabled,&#x20;only&#x20;the&#x20;designated&#x20;superuser&#x20;can&#x20;edit&#x20;a&#x20;Grub&#x20;2&#x20;menu&#x20;item&#x20;by&#x20;pressing&#x20;&#039;e&#039;&#x20;or&#x20;access&#x20;the&#x20;GRUB&#x20;2&#x20;command&#x20;line&#x20;by&#x20;pressing&#x20;&#039;c&#039;&#x20;If&#x20;GRUB&#x20;2&#x20;is&#x20;set&#x20;up&#x20;to&#x20;boot&#x20;automatically&#x20;to&#x20;a&#x20;password-protected&#x20;menu&#x20;entry&#x20;the&#x20;user&#x20;has&#x20;no&#x20;option&#x20;to&#x20;back&#x20;out&#x20;of&#x20;the&#x20;password&#x20;prompt&#x20;to&#x20;select&#x20;another&#x20;menu&#x20;entry.&#x20;Holding&#x20;the&#x20;SHIFT&#x20;key&#x20;will&#x20;not&#x20;display&#x20;the&#x20;menu&#x20;in&#x20;this&#x20;case.&#x20;The&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;correct&#x20;username&#x20;and&#x20;password.&#x20;If&#x20;unable,&#x20;the&#x20;configuration&#x20;files&#x20;will&#x20;have&#x20;to&#x20;be&#x20;edited&#x20;via&#x20;the&#x20;LiveCD&#x20;or&#x20;other&#x20;means&#x20;to&#x20;fix&#x20;the&#x20;problem&#x20;You&#x20;can&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;menu&#x20;entries&#x20;to&#x20;allow&#x20;the&#x20;system&#x20;to&#x20;boot&#x20;without&#x20;entering&#x20;a&#x20;password.&#x20;Password&#x20;will&#x20;still&#x20;be&#x20;required&#x20;to&#x20;edit&#x20;menu&#x20;items.&#x20;More&#x20;Information:&#x20;https://help.ubuntu.com/community/Grub2/Passwords.','Create&#x20;an&#x20;encrypted&#x20;password&#x20;with&#x20;grub-mkpasswd-pbkdf2:&#x20;#&#x20;grub-mkpasswd-pbkdf2&#x20;Enter&#x20;password:&#x20;&lt;password&gt;&#x20;Reenter&#x20;password:&#x20;&lt;password&gt;&#x20;PBKDF2&#x20;hash&#x20;of&#x20;your&#x20;password&#x20;is&#x20;&lt;encrypted-password&gt;.&#x20;Add&#x20;the&#x20;following&#x20;into&#x20;a&#x20;custom&#x20;/etc/grub.d&#x20;configuration&#x20;file:&#x20;cat&#x20;&lt;&lt;EOF&#x20;set&#x20;superusers=&quot;&lt;username&gt;&quot;&#x20;password_pbkdf2&#x20;&lt;username&gt;&#x20;&lt;encrypted-password&gt;&#x20;EOF.&#x20;The&#x20;superuser/user&#x20;information&#x20;and&#x20;password&#x20;should&#x20;not&#x20;be&#x20;contained&#x20;in&#x20;the&#x20;/etc/grub.d/00_header&#x20;file&#x20;as&#x20;this&#x20;file&#x20;could&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;package&#x20;update.&#x20;If&#x20;there&#x20;is&#x20;a&#x20;requirement&#x20;to&#x20;be&#x20;able&#x20;to&#x20;boot/reboot&#x20;without&#x20;entering&#x20;the&#x20;password,&#x20;edit&#x20;/etc/grub.d/10_linux&#x20;and&#x20;add&#x20;--unrestricted&#x20;to&#x20;the&#x20;line&#x20;CLASS=&#x20;Example:&#x20;CLASS=&quot;--class&#x20;gnu-linux&#x20;--class&#x20;gnu&#x20;--class&#x20;os&#x20;--unrestricted&quot;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"1.4.1\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1542\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1046\"]}]'),(29529,'Ensure&#x20;permissions&#x20;on&#x20;bootloader&#x20;config&#x20;are&#x20;configured.','The&#x20;grub&#x20;configuration&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;boot&#x20;settings&#x20;and&#x20;passwords&#x20;for&#x20;unlocking&#x20;boot&#x20;options.','Setting&#x20;the&#x20;permissions&#x20;to&#x20;read&#x20;and&#x20;write&#x20;for&#x20;root&#x20;only&#x20;prevents&#x20;non-root&#x20;users&#x20;from&#x20;seeing&#x20;the&#x20;boot&#x20;parameters&#x20;or&#x20;changing&#x20;them.&#x20;Non-root&#x20;users&#x20;who&#x20;read&#x20;the&#x20;boot&#x20;parameters&#x20;may&#x20;be&#x20;able&#x20;to&#x20;identify&#x20;weaknesses&#x20;in&#x20;security&#x20;upon&#x20;boot&#x20;and&#x20;be&#x20;able&#x20;to&#x20;exploit&#x20;them.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;your&#x20;grub&#x20;configuration:&#x20;#&#x20;chown&#x20;root:root&#x20;/boot/grub/grub.cfg&#x20;#&#x20;chmod&#x20;u-wx,go-rwx&#x20;/boot/grub/grub.cfg.','[{\"cis\": [\"1.4.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1542\"]}, {\"mitre_tactics\": [\"TA0005\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29530,'Ensure&#x20;authentication&#x20;required&#x20;for&#x20;single&#x20;user&#x20;mode.','Single&#x20;user&#x20;mode&#x20;is&#x20;used&#x20;for&#x20;recovery&#x20;when&#x20;the&#x20;system&#x20;detects&#x20;an&#x20;issue&#x20;during&#x20;boot&#x20;or&#x20;by&#x20;manual&#x20;selection&#x20;from&#x20;the&#x20;bootloader.','Requiring&#x20;authentication&#x20;in&#x20;single&#x20;user&#x20;mode&#x20;prevents&#x20;an&#x20;unauthorized&#x20;user&#x20;from&#x20;rebooting&#x20;the&#x20;system&#x20;into&#x20;single&#x20;user&#x20;to&#x20;gain&#x20;root&#x20;privileges&#x20;without&#x20;credentials.','','Run&#x20;the&#x20;following&#x20;command&#x20;and&#x20;follow&#x20;the&#x20;prompts&#x20;to&#x20;set&#x20;a&#x20;password&#x20;for&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;passwd&#x20;root.','[{\"cis\": [\"1.4.3\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29531,'Ensure&#x20;prelink&#x20;is&#x20;not&#x20;installed.','prelink&#x20;is&#x20;a&#x20;program&#x20;that&#x20;modifies&#x20;ELF&#x20;shared&#x20;libraries&#x20;and&#x20;ELF&#x20;dynamically&#x20;linked&#x20;binaries&#x20;in&#x20;such&#x20;a&#x20;way&#x20;that&#x20;the&#x20;time&#x20;needed&#x20;for&#x20;the&#x20;dynamic&#x20;linker&#x20;to&#x20;perform&#x20;relocations&#x20;at&#x20;startup&#x20;significantly&#x20;decreases.','The&#x20;prelinking&#x20;feature&#x20;can&#x20;interfere&#x20;with&#x20;the&#x20;operation&#x20;of&#x20;AIDE,&#x20;because&#x20;it&#x20;changes&#x20;binaries.&#x20;Prelinking&#x20;can&#x20;also&#x20;increase&#x20;the&#x20;vulnerability&#x20;of&#x20;the&#x20;system&#x20;if&#x20;a&#x20;malicious&#x20;user&#x20;is&#x20;able&#x20;to&#x20;compromise&#x20;a&#x20;common&#x20;library&#x20;such&#x20;as&#x20;libc.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restore&#x20;binaries&#x20;to&#x20;normal:&#x20;#&#x20;prelink&#x20;-ua&#x20;.&#x20;Uninstall&#x20;prelink&#x20;using&#x20;the&#x20;appropriate&#x20;package&#x20;manager&#x20;or&#x20;manual&#x20;installation:&#x20;#&#x20;apt&#x20;purge&#x20;prelink.','[{\"cis\": [\"1.5.2\"]}, {\"cis_csc_v8\": [\"3.14\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\"]}, {\"hipaa\": [\"164.312(b)\", \"164.312(c)(1)\", \"164.312(c)(2)\"]}, {\"pci_dss_3.2.1\": [\"10.2.1\", \"11.5\"]}, {\"pci_dss_4.0\": [\"10.2.1\", \"10.2.1.1\"]}, {\"nist_sp_800-53\": [\"AC-6(9)\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1055\", \"T1055.009\", \"T1065\", \"T1065.001\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1050\"]}]'),(29532,'Ensure&#x20;Automatic&#x20;Error&#x20;Reporting&#x20;is&#x20;not&#x20;enabled.','The&#x20;Apport&#x20;Error&#x20;Reporting&#x20;Service&#x20;automatically&#x20;generates&#x20;crash&#x20;reports&#x20;for&#x20;debugging.','Apport&#x20;collects&#x20;potentially&#x20;sensitive&#x20;data,&#x20;such&#x20;as&#x20;core&#x20;dumps,&#x20;stack&#x20;traces,&#x20;and&#x20;log&#x20;files.&#x20;They&#x20;can&#x20;contain&#x20;passwords,&#x20;credit&#x20;card&#x20;numbers,&#x20;serial&#x20;numbers,&#x20;and&#x20;other&#x20;private&#x20;material.','','Edit&#x20;/etc/default/apport&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;the&#x20;enabled&#x20;parameter&#x20;to&#x20;equal&#x20;0:&#x20;enabled=0&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;and&#x20;disable&#x20;the&#x20;apport&#x20;service&#x20;#&#x20;systemctl&#x20;stop&#x20;apport.service&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;apport.service&#x20;--&#x20;OR&#x20;--&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;apport&#x20;package:&#x20;#&#x20;apt&#x20;purge&#x20;apport.','[{\"cis\": [\"1.5.3\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}]'),(29533,'Ensure&#x20;core&#x20;dumps&#x20;are&#x20;restricted.','A&#x20;core&#x20;dump&#x20;is&#x20;the&#x20;memory&#x20;of&#x20;an&#x20;executable&#x20;program.&#x20;It&#x20;is&#x20;generally&#x20;used&#x20;to&#x20;determine&#x20;why&#x20;a&#x20;program&#x20;aborted.&#x20;It&#x20;can&#x20;also&#x20;be&#x20;used&#x20;to&#x20;glean&#x20;confidential&#x20;information&#x20;from&#x20;a&#x20;core&#x20;file.&#x20;The&#x20;system&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;a&#x20;soft&#x20;limit&#x20;for&#x20;core&#x20;dumps,&#x20;but&#x20;this&#x20;can&#x20;be&#x20;overridden&#x20;by&#x20;the&#x20;user.','Setting&#x20;a&#x20;hard&#x20;limit&#x20;on&#x20;core&#x20;dumps&#x20;prevents&#x20;users&#x20;from&#x20;overriding&#x20;the&#x20;soft&#x20;variable.&#x20;If&#x20;core&#x20;dumps&#x20;are&#x20;required,&#x20;consider&#x20;setting&#x20;limits&#x20;for&#x20;user&#x20;groups&#x20;&#40;see&#x20;limits.conf&#40;5&#41;&#x20;&#41;.&#x20;In&#x20;addition,&#x20;setting&#x20;the&#x20;fs.suid_dumpable&#x20;variable&#x20;to&#x20;0&#x20;will&#x20;prevent&#x20;setuid&#x20;programs&#x20;from&#x20;dumping&#x20;core.','','Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;/etc/security/limits.conf&#x20;or&#x20;a&#x20;/etc/security/limits.d&#47;&#42;&#x20;file:&#x20;*&#x20;hard&#x20;core&#x20;0.&#x20;Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/sysctl.conf&#x20;or&#x20;a&#x20;/etc/sysctl.d&#47;&#42;&#x20;file:&#x20;fs.suid_dumpable&#x20;=&#x20;0.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;active&#x20;kernel&#x20;parameter:&#x20;#&#x20;sysctl&#x20;-w&#x20;fs.suid_dumpable=0.&#x20;IF&#x20;systemd-coredump&#x20;is&#x20;installed:&#x20;edit&#x20;/etc/systemd/coredump.conf&#x20;and&#x20;add/modify&#x20;the&#x20;following&#x20;lines:&#x20;Storage=none&#x20;ProcessSizeMax=0.&#x20;Run&#x20;the&#x20;command:&#x20;systemctl&#x20;daemon-reload.','[{\"cis\": [\"1.5.4\"]}, {\"mitre_techniques\": [\"T1005\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29534,'Ensure&#x20;AppArmor&#x20;is&#x20;installed.','AppArmor&#x20;provides&#x20;Mandatory&#x20;Access&#x20;Controls.','Without&#x20;a&#x20;Mandatory&#x20;Access&#x20;Control&#x20;system&#x20;installed&#x20;only&#x20;the&#x20;default&#x20;Discretionary&#x20;Access&#x20;Control&#x20;system&#x20;will&#x20;be&#x20;available.','','Install&#x20;AppArmor.&#x20;#&#x20;apt&#x20;install&#x20;apparmor&#x20;apparmor-utils.','[{\"cis\": [\"1.6.1.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(29535,'Ensure&#x20;AppArmor&#x20;is&#x20;enabled&#x20;in&#x20;the&#x20;bootloader&#x20;configuration.','Configure&#x20;AppArmor&#x20;to&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;and&#x20;verify&#x20;that&#x20;it&#x20;has&#x20;not&#x20;been&#x20;overwritten&#x20;by&#x20;the&#x20;bootloader&#x20;boot&#x20;parameters.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;grub&#x20;bootloader,&#x20;if&#x20;LILO&#x20;or&#x20;another&#x20;bootloader&#x20;is&#x20;in&#x20;use&#x20;in&#x20;your&#x20;environment&#x20;enact&#x20;equivalent&#x20;settings.','AppArmor&#x20;must&#x20;be&#x20;enabled&#x20;at&#x20;boot&#x20;time&#x20;in&#x20;your&#x20;bootloader&#x20;configuration&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;controls&#x20;it&#x20;provides&#x20;are&#x20;not&#x20;overridden.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;the&#x20;apparmor=1&#x20;and&#x20;security=apparmor&#x20;parameters&#x20;to&#x20;the&#x20;GRUB_CMDLINE_LINUX=&#x20;line&#x20;GRUB_CMDLINE_LINUX=&quot;apparmor=1&#x20;security=apparmor&quot;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"1.6.1.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(29536,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;in&#x20;enforce&#x20;or&#x20;complain&#x20;mode.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applications&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;complain&#x20;mode:&#x20;#&#x20;aa-complain&#x20;/etc/apparmor.d&#47;&#42;&#x20;Note:&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.1.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29537,'Ensure&#x20;all&#x20;AppArmor&#x20;Profiles&#x20;are&#x20;enforcing.','AppArmor&#x20;profiles&#x20;define&#x20;what&#x20;resources&#x20;applications&#x20;are&#x20;able&#x20;to&#x20;access.','Security&#x20;configuration&#x20;requirements&#x20;vary&#x20;from&#x20;site&#x20;to&#x20;site.&#x20;Some&#x20;sites&#x20;may&#x20;mandate&#x20;a&#x20;policy&#x20;that&#x20;is&#x20;stricter&#x20;than&#x20;the&#x20;default&#x20;policy,&#x20;which&#x20;is&#x20;perfectly&#x20;acceptable.&#x20;This&#x20;item&#x20;is&#x20;intended&#x20;to&#x20;ensure&#x20;that&#x20;any&#x20;policies&#x20;that&#x20;exist&#x20;on&#x20;the&#x20;system&#x20;are&#x20;activated.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;all&#x20;profiles&#x20;to&#x20;enforce&#x20;mode:&#x20;#&#x20;aa-enforce&#x20;/etc/apparmor.d&#47;&#42;&#x20;Note:&#x20;Any&#x20;unconfined&#x20;processes&#x20;may&#x20;need&#x20;to&#x20;have&#x20;a&#x20;profile&#x20;created&#x20;or&#x20;activated&#x20;for&#x20;them&#x20;and&#x20;then&#x20;be&#x20;restarted.','[{\"cis\": [\"1.6.1.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1068\", \"T1565\", \"T1565.001\", \"T1565.003\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29538,'Ensure&#x20;message&#x20;of&#x20;the&#x20;day&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;.&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/motd&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;OR&#x20;If&#x20;the&#x20;motd&#x20;is&#x20;not&#x20;used,&#x20;this&#x20;file&#x20;can&#x20;be&#x20;removed.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd.','[{\"cis\": [\"1.7.1\"]}, {\"mitre_techniques\": [\"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29539,'Ensure&#x20;local&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;&#x20;uname&#x20;-a&#x20;.&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;,&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.','[{\"cis\": [\"1.7.2\"]}, {\"mitre_techniques\": [\"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29540,'Ensure&#x20;remote&#x20;login&#x20;warning&#x20;banner&#x20;is&#x20;configured&#x20;properly.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.&#x20;Unix-based&#x20;systems&#x20;have&#x20;typically&#x20;displayed&#x20;information&#x20;about&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;patch&#x20;level&#x20;upon&#x20;logging&#x20;in&#x20;to&#x20;the&#x20;system.&#x20;This&#x20;information&#x20;can&#x20;be&#x20;useful&#x20;to&#x20;developers&#x20;who&#x20;are&#x20;developing&#x20;software&#x20;for&#x20;a&#x20;particular&#x20;OS&#x20;platform.&#x20;If&#x20;mingetty&#40;8&#41;&#x20;supports&#x20;the&#x20;following&#x20;options,&#x20;they&#x20;display&#x20;operating&#x20;system&#x20;information:&#x20;m&#x20;-&#x20;machine&#x20;architecture&#x20;&#x0d;&#x20;-&#x20;operating&#x20;system&#x20;release&#x20;s&#x20;-&#x20;operating&#x20;system&#x20;name&#x20;v&#x20;-&#x20;operating&#x20;system&#x20;version.','Warning&#x20;messages&#x20;inform&#x20;users&#x20;who&#x20;are&#x20;attempting&#x20;to&#x20;login&#x20;to&#x20;the&#x20;system&#x20;of&#x20;their&#x20;legal&#x20;status&#x20;regarding&#x20;the&#x20;system&#x20;and&#x20;must&#x20;include&#x20;the&#x20;name&#x20;of&#x20;the&#x20;organization&#x20;that&#x20;owns&#x20;the&#x20;system&#x20;and&#x20;any&#x20;monitoring&#x20;policies&#x20;that&#x20;are&#x20;in&#x20;place.&#x20;Displaying&#x20;OS&#x20;and&#x20;patch&#x20;level&#x20;information&#x20;in&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;providing&#x20;detailed&#x20;system&#x20;information&#x20;to&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;exploits&#x20;of&#x20;a&#x20;system.&#x20;Authorized&#x20;users&#x20;can&#x20;easily&#x20;get&#x20;this&#x20;information&#x20;by&#x20;running&#x20;the&#x20;&quot;uname&#x20;-a&quot;&#x20;command&#x20;once&#x20;they&#x20;have&#x20;logged&#x20;in.','','Edit&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;with&#x20;the&#x20;appropriate&#x20;contents&#x20;according&#x20;to&#x20;your&#x20;site&#x20;policy,&#x20;remove&#x20;any&#x20;instances&#x20;of&#x20;m&#x20;,&#x20;&#x0d;&#x20;,&#x20;s&#x20;,&#x20;or&#x20;v&#x20;or&#x20;references&#x20;to&#x20;the&#x20;OS&#x20;platform:&#x20;#&#x20;echo&#x20;&quot;Authorized&#x20;uses&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;&gt;&#x20;/etc/issue.net.','[{\"cis\": [\"1.7.3\"]}, {\"mitre_techniques\": [\"T1018\", \"T1082\", \"T1592\", \"T1592.004\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29541,'Ensure&#x20;permissions&#x20;on&#x20;/etc/motd&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/motd&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;after&#x20;login&#x20;and&#x20;function&#x20;as&#x20;a&#x20;message&#x20;of&#x20;the&#x20;day&#x20;for&#x20;authenticated&#x20;users.','If&#x20;the&#x20;/etc/motd&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/motd:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/motd&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/motd&#41;&#x20;OR&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;/etc/motd&#x20;file:&#x20;#&#x20;rm&#x20;/etc/motd.','[{\"cis\": [\"1.7.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29542,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;local&#x20;terminals.','If&#x20;the&#x20;/etc/issue&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue&#41;.','[{\"cis\": [\"1.7.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29543,'Ensure&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;are&#x20;configured.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;are&#x20;displayed&#x20;to&#x20;users&#x20;prior&#x20;to&#x20;login&#x20;for&#x20;remote&#x20;connections&#x20;from&#x20;configured&#x20;services.','If&#x20;the&#x20;/etc/issue.net&#x20;file&#x20;does&#x20;not&#x20;have&#x20;the&#x20;correct&#x20;ownership&#x20;it&#x20;could&#x20;be&#x20;modified&#x20;by&#x20;unauthorized&#x20;users&#x20;with&#x20;incorrect&#x20;or&#x20;misleading&#x20;information.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;/etc/issue.net&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue.net&#41;&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;$&#40;readlink&#x20;-e&#x20;/etc/issue.net&#41;.','[{\"cis\": [\"1.7.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29544,'Ensure&#x20;GNOME&#x20;Display&#x20;Manager&#x20;is&#x20;removed.','The&#x20;GNOME&#x20;Display&#x20;Manager&#x20;&#40;GDM&#41;&#x20;is&#x20;a&#x20;program&#x20;that&#x20;manages&#x20;graphical&#x20;display&#x20;servers&#x20;and&#x20;handles&#x20;graphical&#x20;user&#x20;logins.','If&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Removing&#x20;the&#x20;GNOME&#x20;Display&#x20;manager&#x20;will&#x20;remove&#x20;the&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;from&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;uninstall&#x20;gdm3:&#x20;#&#x20;apt&#x20;purge&#x20;gdm3.','[{\"cis\": [\"1.8.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0002\"]}]'),(29545,'Ensure&#x20;XDCMP&#x20;is&#x20;not&#x20;enabled.','X&#x20;Display&#x20;Manager&#x20;Control&#x20;Protocol&#x20;&#40;XDMCP&#41;&#x20;is&#x20;designed&#x20;to&#x20;provide&#x20;authenticated&#x20;access&#x20;to&#x20;display&#x20;management&#x20;services&#x20;for&#x20;remote&#x20;displays.','XDMCP&#x20;is&#x20;inherently&#x20;insecure.&#x20;XDMCP&#x20;is&#x20;not&#x20;a&#x20;ciphered&#x20;protocol.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;capture&#x20;keystrokes&#x20;entered&#x20;by&#x20;a&#x20;user&#x20;XDMCP&#x20;is&#x20;vulnerable&#x20;to&#x20;man-in-the-middle&#x20;attacks.&#x20;This&#x20;may&#x20;allow&#x20;an&#x20;attacker&#x20;to&#x20;steal&#x20;the&#x20;credentials&#x20;of&#x20;legitimate&#x20;users&#x20;by&#x20;impersonating&#x20;the&#x20;XDMCP&#x20;server.','','Edit&#x20;the&#x20;file&#x20;/etc/gdm3/custom.conf&#x20;and&#x20;remove&#x20;the&#x20;line:&#x20;Enable=true.','[{\"cis\": [\"1.8.10\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1040\", \"T1056\", \"T1056.001\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1050\"]}]'),(29546,'Ensure&#x20;updates,&#x20;patches,&#x20;and&#x20;additional&#x20;security&#x20;software&#x20;are&#x20;installed.','Periodically&#x20;patches&#x20;are&#x20;released&#x20;for&#x20;included&#x20;software&#x20;either&#x20;due&#x20;to&#x20;security&#x20;flaws&#x20;or&#x20;to&#x20;include&#x20;additional&#x20;functionality.','Newer&#x20;patches&#x20;may&#x20;contain&#x20;security&#x20;enhancements&#x20;that&#x20;would&#x20;not&#x20;be&#x20;available&#x20;through&#x20;the&#x20;latest&#x20;full&#x20;update.&#x20;As&#x20;a&#x20;result,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;latest&#x20;software&#x20;patches&#x20;be&#x20;used&#x20;to&#x20;take&#x20;advantage&#x20;of&#x20;the&#x20;latest&#x20;functionality.&#x20;As&#x20;with&#x20;any&#x20;software&#x20;installation,&#x20;organizations&#x20;need&#x20;to&#x20;determine&#x20;if&#x20;a&#x20;given&#x20;update&#x20;meets&#x20;their&#x20;requirements&#x20;and&#x20;verify&#x20;the&#x20;compatibility&#x20;and&#x20;supportability&#x20;of&#x20;any&#x20;additional&#x20;software&#x20;against&#x20;the&#x20;update&#x20;revision&#x20;that&#x20;is&#x20;selected.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;all&#x20;packages&#x20;following&#x20;local&#x20;site&#x20;policy&#x20;guidance&#x20;on&#x20;applying&#x20;updates&#x20;and&#x20;patches:&#x20;#&#x20;apt&#x20;upgrade&#x20;OR&#x20;#&#x20;apt&#x20;dist-upgrade.','[{\"cis\": [\"1.9\"]}, {\"cis_csc_v8\": [\"7.3\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"pci_dss_3.2.1\": [\"6.2\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"soc_2\": [\"CC7.1\"]}]'),(29547,'Ensure&#x20;chrony&#x20;is&#x20;running&#x20;as&#x20;user&#x20;_chrony.','The&#x20;chrony&#x20;package&#x20;is&#x20;installed&#x20;with&#x20;a&#x20;dedicated&#x20;user&#x20;account&#x20;_chrony.&#x20;This&#x20;account&#x20;is&#x20;granted&#x20;the&#x20;access&#x20;required&#x20;by&#x20;the&#x20;chronyd&#x20;service.','The&#x20;chronyd&#x20;service&#x20;should&#x20;run&#x20;with&#x20;only&#x20;the&#x20;required&#x20;privileges.','','Add&#x20;or&#x20;edit&#x20;the&#x20;user&#x20;line&#x20;to&#x20;/etc/chrony/chrony.conf&#x20;or&#x20;a&#x20;file&#x20;ending&#x20;in&#x20;.conf&#x20;in&#x20;/etc/chrony/conf.d/:&#x20;user&#x20;_chrony&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;chrony&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;chrony.','[{\"cis\": [\"2.1.2.2\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}]'),(29548,'Ensure&#x20;chrony&#x20;is&#x20;enabled&#x20;and&#x20;running.','chrony&#x20;is&#x20;a&#x20;daemon&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.','chrony&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;to&#x20;synchronize&#x20;the&#x20;system&#x20;to&#x20;a&#x20;timeserver.&#x20;Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','IF&#x20;chrony&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;chrony.service:&#x20;#&#x20;systemctl&#x20;unmask&#x20;chrony.service.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;chrony.service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;chrony.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;chrony:&#x20;#&#x20;apt&#x20;purge&#x20;chrony.','[{\"cis\": [\"2.1.2.3\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}]'),(29549,'Ensure&#x20;systemd-timesyncd&#x20;configured&#x20;with&#x20;authorized&#x20;timeserver.','-&#x20;NTP=&#x20;&gt;&#x20;A&#x20;space-separated&#x20;list&#x20;of&#x20;NTP&#x20;server&#x20;host&#x20;names&#x20;or&#x20;IP&#x20;addresses.&#x20;During&#x20;runtime&#x20;this&#x20;list&#x20;is&#x20;combined&#x20;with&#x20;any&#x20;per-interface&#x20;NTP&#x20;servers&#x20;acquired&#x20;from&#x20;systemd-networkd.service&#40;8&#41;.&#x20;systemd-timesyncd&#x20;will&#x20;contact&#x20;all&#x20;configured&#x20;system&#x20;or&#x20;per-interface&#x20;servers&#x20;in&#x20;turn,&#x20;until&#x20;one&#x20;responds.&#x20;When&#x20;the&#x20;empty&#x20;string&#x20;is&#x20;assigned,&#x20;the&#x20;list&#x20;of&#x20;NTP&#x20;servers&#x20;is&#x20;reset,&#x20;and&#x20;all&#x20;prior&#x20;assignments&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;This&#x20;setting&#x20;defaults&#x20;to&#x20;an&#x20;empty&#x20;list.&#x20;-&#x20;FallbackNTP=&#x20;&gt;&#x20;A&#x20;space-separated&#x20;list&#x20;of&#x20;NTP&#x20;server&#x20;host&#x20;names&#x20;or&#x20;IP&#x20;addresses&#x20;to&#x20;be&#x20;used&#x20;as&#x20;the&#x20;fallback&#x20;NTP&#x20;servers.&#x20;Any&#x20;per-interface&#x20;NTP&#x20;servers&#x20;obtained&#x20;from&#x20;systemd-networkd.service&#40;8&#41;&#x20;take&#x20;precedence&#x20;over&#x20;this&#x20;setting,&#x20;as&#x20;do&#x20;any&#x20;servers&#x20;set&#x20;via&#x20;NTP=&#x20;above.&#x20;This&#x20;setting&#x20;is&#x20;hence&#x20;only&#x20;relevant&#x20;if&#x20;no&#x20;other&#x20;NTP&#x20;server&#x20;information&#x20;is&#x20;known.&#x20;When&#x20;the&#x20;empty&#x20;string&#x20;is&#x20;assigned,&#x20;the&#x20;list&#x20;of&#x20;NTP&#x20;servers&#x20;is&#x20;reset,&#x20;and&#x20;all&#x20;prior&#x20;assignments&#x20;will&#x20;have&#x20;no&#x20;effect.&#x20;If&#x20;this&#x20;option&#x20;is&#x20;not&#x20;given,&#x20;a&#x20;compiled-in&#x20;list&#x20;of&#x20;NTP&#x20;servers&#x20;is&#x20;used.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;/etc/systemd/timesyncd.conf.d&#x20;ending&#x20;in&#x20;.conf&#x20;and&#x20;add&#x20;the&#x20;NTP=&#x20;and/or&#x20;FallbackNTP=&#x20;lines&#x20;to&#x20;the&#x20;[Time]&#x20;section:&#x20;Example:&#x20;[Time]&#x20;NTP=time.nist.gov&#x20;#&#x20;Uses&#x20;the&#x20;generic&#x20;name&#x20;for&#x20;NIST&#039;s&#x20;time&#x20;servers&#x20;-AND/OR-&#x20;FallbackNTP=time-a-g.nist.gov&#x20;time-b-g.nist.gov&#x20;time-c-g.nist.gov&#x20;#&#x20;Space&#x20;separated&#x20;list&#x20;of&#x20;NIST&#x20;time&#x20;servers&#x20;Note:&#x20;Servers&#x20;added&#x20;to&#x20;these&#x20;line&#40;s&#41;&#x20;should&#x20;follow&#x20;local&#x20;site&#x20;policy.&#x20;NIST&#x20;servers&#x20;are&#x20;for&#x20;example.&#x20;The&#x20;timesyncd.conf.d&#x20;directory&#x20;may&#x20;need&#x20;to&#x20;be&#x20;created.&#x20;Example&#x20;script:&#x20;The&#x20;following&#x20;example&#x20;script&#x20;will&#x20;create&#x20;the&#x20;systemd-timesyncd&#x20;drop-in&#x20;configuration&#x20;snippet:&#x20;#!/usr/bin/env&#x20;bash&#x20;ntp_ts=&quot;time.nist.gov&quot;&#x20;ntp_fb=&quot;time-a-g.nist.gov&#x20;time-b-g.nist.gov&#x20;time-c-g.nist.gov&quot;&#x20;disfile=&quot;/etc/systemd/timesyncd.conf.d/50-timesyncd.conf&quot;&#x20;if&#x20;!&#x20;find&#x20;/etc/systemd&#x20;-type&#x20;f&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-exec&#x20;grep&#x20;-Ph&#x20;&#039;^h*NTP=H+&#039;&#x20;{}&#x20;+;&#x20;then&#x20;[&#x20;!&#x20;-d&#x20;/etc/systemd/timesyncd.conf.d&#x20;]&#x20;&amp;&amp;&#x20;mkdir&#x20;/etc/systemd/timesyncd.conf.d&#x20;!&#x20;grep&#x20;-Pqs&#x20;&#039;^h*[Time]&#039;&#x20;&quot;$disfile&quot;&#x20;&amp;&amp;&#x20;echo&#x20;&quot;[Time]&quot;&#x20;&gt;&gt;&#x20;&quot;$disfile&quot;&#x20;echo&#x20;&quot;NTP=$ntp_ts&quot;&#x20;&gt;&gt;&#x20;&quot;$disfile&quot;&#x20;fi&#x20;if&#x20;!&#x20;find&#x20;/etc/systemd&#x20;-type&#x20;f&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-exec&#x20;grep&#x20;-Ph&#x20;&#039;^h*FallbackNTP=H+&#039;&#x20;{}&#x20;+;&#x20;then&#x20;[&#x20;!&#x20;-d&#x20;/etc/systemd/timesyncd.conf.d&#x20;]&#x20;&amp;&amp;&#x20;mkdir&#x20;/etc/systemd/timesyncd.conf.d&#x20;!&#x20;grep&#x20;-Pqs&#x20;&#039;^h*[Time]&#039;&#x20;&quot;$disfile&quot;&#x20;&amp;&amp;&#x20;echo&#x20;&quot;[Time]&quot;&#x20;&gt;&gt;&#x20;&quot;$disfile&quot;&#x20;echo&#x20;&quot;FallbackNTP=$ntp_fb&quot;&#x20;&gt;&gt;&#x20;&quot;$disfile&quot;&#x20;fi&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;reload&#x20;the&#x20;systemd-timesyncd&#x20;configuration:&#x20;#&#x20;systemctl&#x20;try-reload-or-restart&#x20;systemd-timesyncd&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;systemd-timesyncd:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;systemd-timesyncd.','[{\"cis\": [\"2.1.3.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29550,'Ensure&#x20;systemd-timesyncd&#x20;is&#x20;enabled&#x20;and&#x20;running.','systemd-timesyncd&#x20;is&#x20;a&#x20;daemon&#x20;that&#x20;has&#x20;been&#x20;added&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.','systemd-timesyncd&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;to&#x20;synchronize&#x20;the&#x20;system&#x20;to&#x20;a&#x20;timeserver.&#x20;Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','IF&#x20;systemd-timesyncd&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;systemd-timesyncd.service:&#x20;#&#x20;systemctl&#x20;unmask&#x20;systemd-timesyncd.service.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;systemd-timesyncd.service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;systemd-timesyncd.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;systemd-timesyncd:&#x20;#&#x20;systemctl&#x20;--now&#x20;mask&#x20;systemd-timesyncd.service.','[{\"cis\": [\"2.1.3.2\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}]'),(29551,'Ensure&#x20;ntp&#x20;access&#x20;control&#x20;is&#x20;configured.','ntp&#x20;Access&#x20;Control&#x20;Commands:&#x20;restrict&#x20;address&#x20;[mask&#x20;mask]&#x20;[ippeerlimit&#x20;int]&#x20;[flag&#x20;...].&#x20;The&#x20;address&#x20;argument&#x20;expressed&#x20;in&#x20;dotted-quad&#x20;form&#x20;is&#x20;the&#x20;address&#x20;of&#x20;a&#x20;host&#x20;or&#x20;network.&#x20;Alternatively,&#x20;the&#x20;address&#x20;argument&#x20;can&#x20;be&#x20;a&#x20;valid&#x20;host&#x20;DNS&#x20;name.&#x20;The&#x20;mask&#x20;argument&#x20;expressed&#x20;in&#x20;dotted-quad&#x20;form&#x20;defaults&#x20;to&#x20;255.255.255.255,&#x20;meaning&#x20;that&#x20;the&#x20;address&#x20;is&#x20;treated&#x20;as&#x20;the&#x20;address&#x20;of&#x20;an&#x20;individual&#x20;host.&#x20;A&#x20;default&#x20;entry&#x20;&#40;address&#x20;0.0.0.0,&#x20;mask&#x20;0.0.0.0&#41;&#x20;is&#x20;always&#x20;included&#x20;and&#x20;is&#x20;always&#x20;the&#x20;first&#x20;entry&#x20;in&#x20;the&#x20;list.&#x20;Note:&#x20;the&#x20;text&#x20;string&#x20;default,&#x20;with&#x20;no&#x20;mask&#x20;option,&#x20;may&#x20;be&#x20;used&#x20;to&#x20;indicate&#x20;the&#x20;default&#x20;entry.&#x20;The&#x20;ippeerlimit&#x20;directive&#x20;limits&#x20;the&#x20;number&#x20;of&#x20;peer&#x20;requests&#x20;for&#x20;each&#x20;IP&#x20;to&#x20;int,&#x20;where&#x20;a&#x20;value&#x20;of&#x20;-1&#x20;means&#x20;&quot;unlimited&quot;,&#x20;the&#x20;current&#x20;default.&#x20;A&#x20;value&#x20;of&#x20;0&#x20;means&#x20;&quot;none&quot;.&#x20;There&#x20;would&#x20;usually&#x20;be&#x20;at&#x20;most&#x20;1&#x20;peering&#x20;request&#x20;per&#x20;IP,&#x20;but&#x20;if&#x20;the&#x20;remote&#x20;peering&#x20;requests&#x20;are&#x20;behind&#x20;a&#x20;proxy&#x20;there&#x20;could&#x20;well&#x20;be&#x20;more&#x20;than&#x20;1&#x20;per&#x20;IP.&#x20;In&#x20;the&#x20;current&#x20;implementation,&#x20;flag&#x20;always&#x20;restricts&#x20;access,&#x20;i.e.,&#x20;an&#x20;entry&#x20;with&#x20;no&#x20;flags&#x20;indicates&#x20;that&#x20;free&#x20;access&#x20;to&#x20;the&#x20;server&#x20;is&#x20;to&#x20;be&#x20;given.&#x20;The&#x20;flags&#x20;are&#x20;not&#x20;orthogonal,&#x20;in&#x20;that&#x20;more&#x20;restrictive&#x20;flags&#x20;will&#x20;often&#x20;make&#x20;less&#x20;restrictive&#x20;ones&#x20;redundant.&#x20;The&#x20;flags&#x20;can&#x20;generally&#x20;be&#x20;classed&#x20;into&#x20;two&#x20;categories,&#x20;those&#x20;which&#x20;restrict&#x20;time&#x20;service&#x20;and&#x20;those&#x20;which&#x20;restrict&#x20;informational&#x20;queries&#x20;and&#x20;attempts&#x20;to&#x20;do&#x20;run-time&#x20;reconfiguration&#x20;of&#x20;the&#x20;server.&#x20;One&#x20;or&#x20;more&#x20;of&#x20;the&#x20;following&#x20;flags&#x20;may&#x20;be&#x20;specified:&#x20;-&#x20;kod&#x20;-&#x20;If&#x20;this&#x20;flag&#x20;is&#x20;set&#x20;when&#x20;an&#x20;access&#x20;violation&#x20;occurs,&#x20;a&#x20;kiss-of-death&#x20;&#40;KoD&#41;&#x20;packet&#x20;is&#x20;sent.&#x20;KoD&#x20;packets&#x20;are&#x20;rate&#x20;limited&#x20;to&#x20;no&#x20;more&#x20;than&#x20;one&#x20;per&#x20;second.&#x20;If&#x20;another&#x20;KoD&#x20;packet&#x20;occurs&#x20;within&#x20;one&#x20;second&#x20;after&#x20;the&#x20;last&#x20;one,&#x20;the&#x20;packet&#x20;is&#x20;dropped.&#x20;-&#x20;limited&#x20;-&#x20;Deny&#x20;service&#x20;if&#x20;the&#x20;packet&#x20;spacing&#x20;violates&#x20;the&#x20;lower&#x20;limits&#x20;specified&#x20;in&#x20;the&#x20;discard&#x20;command.&#x20;A&#x20;history&#x20;of&#x20;clients&#x20;is&#x20;kept&#x20;using&#x20;the&#x20;monitoring&#x20;capability&#x20;of&#x20;ntpd.&#x20;Thus,&#x20;monitoring&#x20;is&#x20;always&#x20;active&#x20;as&#x20;long&#x20;as&#x20;there&#x20;is&#x20;a&#x20;restriction&#x20;entry&#x20;with&#x20;the&#x20;limited&#x20;flag.&#x20;-&#x20;lowpriotrap&#x20;-&#x20;Declare&#x20;traps&#x20;set&#x20;by&#x20;matching&#x20;hosts&#x20;to&#x20;be&#x20;low&#x20;priority.&#x20;The&#x20;number&#x20;of&#x20;traps&#x20;a&#x20;server&#x20;can&#x20;maintain&#x20;is&#x20;limited&#x20;&#40;the&#x20;current&#x20;limit&#x20;is&#x20;3&#41;.&#x20;Traps&#x20;are&#x20;usually&#x20;assigned&#x20;on&#x20;a&#x20;first&#x20;come,&#x20;first&#x20;served&#x20;basis,&#x20;with&#x20;later&#x20;trap&#x20;requestors&#x20;being&#x20;denied&#x20;service.&#x20;This&#x20;flag&#x20;modifies&#x20;the&#x20;assignment&#x20;algorithm&#x20;by&#x20;allowing&#x20;low&#x20;priority&#x20;traps&#x20;to&#x20;be&#x20;overridden&#x20;by&#x20;later&#x20;requests&#x20;for&#x20;normal&#x20;priority&#x20;traps.&#x20;-&#x20;noepeer&#x20;-&#x20;Deny&#x20;ephemeral&#x20;peer&#x20;requests,&#x20;even&#x20;if&#x20;they&#x20;come&#x20;from&#x20;an&#x20;authenticated&#x20;source.&#x20;Note&#x20;that&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;a&#x20;symmetric&#x20;key&#x20;for&#x20;authentication&#x20;may&#x20;be&#x20;restricted&#x20;to&#x20;one&#x20;or&#x20;more&#x20;IPs&#x20;or&#x20;subnets&#x20;via&#x20;the&#x20;third&#x20;field&#x20;of&#x20;the&#x20;ntp.keys&#x20;file.&#x20;This&#x20;restriction&#x20;is&#x20;not&#x20;enabled&#x20;by&#x20;default,&#x20;to&#x20;maintain&#x20;backward&#x20;compatibility.&#x20;Expect&#x20;noepeer&#x20;to&#x20;become&#x20;the&#x20;default&#x20;in&#x20;ntp-4.4.&#x20;-&#x20;nomodify&#x20;-&#x20;Deny&#x20;ntpq&#x20;and&#x20;ntpdc&#x20;queries&#x20;which&#x20;attempt&#x20;to&#x20;modify&#x20;the&#x20;state&#x20;of&#x20;the&#x20;server&#x20;&#40;i.e.,&#x20;run&#x20;time&#x20;reconfiguration&#41;.&#x20;Queries&#x20;which&#x20;return&#x20;information&#x20;are&#x20;permitted.&#x20;-&#x20;noquery&#x20;-&#x20;Deny&#x20;ntpq&#x20;and&#x20;ntpdc&#x20;queries.&#x20;Time&#x20;service&#x20;is&#x20;not&#x20;affected.&#x20;-&#x20;nopeer&#x20;-&#x20;Deny&#x20;unauthenticated&#x20;packets&#x20;which&#x20;would&#x20;result&#x20;in&#x20;mobilizing&#x20;a&#x20;new&#x20;association.&#x20;This&#x20;includes&#x20;broadcast&#x20;and&#x20;symmetric&#x20;active&#x20;packets&#x20;when&#x20;a&#x20;configured&#x20;association&#x20;does&#x20;not&#x20;exist.&#x20;It&#x20;also&#x20;includes&#x20;pool&#x20;associations,&#x20;so&#x20;if&#x20;you&#x20;want&#x20;to&#x20;use&#x20;servers&#x20;from&#x20;a&#x20;pool&#x20;directive&#x20;and&#x20;also&#x20;want&#x20;to&#x20;use&#x20;nopeer&#x20;by&#x20;default,&#x20;you&#039;ll&#x20;want&#x20;a&#x20;restrict&#x20;source&#x20;...&#x20;line&#x20;as&#x20;well&#x20;that&#x20;does&#x20;not&#x20;include&#x20;the&#x20;nopeer&#x20;directive.&#x20;-&#x20;noserve&#x20;-&#x20;Deny&#x20;all&#x20;packets&#x20;except&#x20;ntpq&#x20;and&#x20;ntpdc&#x20;queries.&#x20;-&#x20;notrap&#x20;-&#x20;Decline&#x20;to&#x20;provide&#x20;mode&#x20;6&#x20;control&#x20;message&#x20;trap&#x20;service&#x20;to&#x20;matching&#x20;hosts.&#x20;The&#x20;trap&#x20;service&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;ntpq&#x20;control&#x20;message&#x20;protocol&#x20;which&#x20;is&#x20;intended&#x20;for&#x20;use&#x20;by&#x20;remote&#x20;event&#x20;logging&#x20;programs.&#x20;-&#x20;notrust&#x20;-&#x20;Deny&#x20;service&#x20;unless&#x20;the&#x20;packet&#x20;is&#x20;cryptographically&#x20;authenticated.&#x20;-&#x20;ntpport&#x20;-&#x20;This&#x20;is&#x20;actually&#x20;a&#x20;match&#x20;algorithm&#x20;modifier,&#x20;rather&#x20;than&#x20;a&#x20;restriction&#x20;flag.&#x20;Its&#x20;presence&#x20;causes&#x20;the&#x20;restriction&#x20;entry&#x20;to&#x20;be&#x20;matched&#x20;only&#x20;if&#x20;the&#x20;source&#x20;port&#x20;in&#x20;the&#x20;packet&#x20;is&#x20;the&#x20;standard&#x20;NTP&#x20;UDP&#x20;port&#x20;&#40;123&#41;.&#x20;Both&#x20;ntpport&#x20;and&#x20;non-ntpport&#x20;may&#x20;be&#x20;specified.&#x20;The&#x20;ntpport&#x20;is&#x20;considered&#x20;more&#x20;specific&#x20;and&#x20;is&#x20;sorted&#x20;later&#x20;in&#x20;the&#x20;list.','If&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;proper&#x20;configuration&#x20;is&#x20;vital&#x20;to&#x20;ensuring&#x20;time&#x20;synchronization&#x20;is&#x20;accurate.','','Add&#x20;or&#x20;edit&#x20;restrict&#x20;lines&#x20;in&#x20;/etc/ntp.conf&#x20;to&#x20;match&#x20;the&#x20;following:&#x20;restrict&#x20;-4&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;restrict&#x20;-6&#x20;default&#x20;kod&#x20;nomodify&#x20;notrap&#x20;nopeer&#x20;noquery&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;ntp.','[{\"cis\": [\"2.1.4.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}]'),(29552,'Ensure&#x20;ntp&#x20;is&#x20;configured&#x20;with&#x20;authorized&#x20;timeserver.','The&#x20;various&#x20;modes&#x20;are&#x20;determined&#x20;by&#x20;the&#x20;command&#x20;keyword&#x20;and&#x20;the&#x20;type&#x20;of&#x20;the&#x20;required&#x20;IP&#x20;address.&#x20;Addresses&#x20;are&#x20;classed&#x20;by&#x20;type&#x20;as&#x20;&#40;s&#41;&#x20;a&#x20;remote&#x20;server&#x20;or&#x20;peer&#x20;&#40;IPv4&#x20;class&#x20;A,&#x20;B&#x20;and&#x20;C&#41;,&#x20;&#40;b&#41;&#x20;the&#x20;broadcast&#x20;address&#x20;of&#x20;a&#x20;local&#x20;interface,&#x20;&#40;m&#41;&#x20;a&#x20;multicast&#x20;address&#x20;&#40;IPv4&#x20;class&#x20;D&#41;,&#x20;or&#x20;&#40;r&#41;&#x20;a&#x20;reference&#x20;clock&#x20;address&#x20;&#40;127.127.x.x&#41;.&#x20;Note:&#x20;That&#x20;only&#x20;those&#x20;options&#x20;applicable&#x20;to&#x20;each&#x20;command&#x20;are&#x20;listed&#x20;below.&#x20;Use&#x20;of&#x20;options&#x20;not&#x20;listed&#x20;may&#x20;not&#x20;be&#x20;caught&#x20;as&#x20;an&#x20;error,&#x20;but&#x20;may&#x20;result&#x20;in&#x20;some&#x20;weird&#x20;and&#x20;even&#x20;destructive&#x20;behavior.&#x20;If&#x20;the&#x20;Basic&#x20;Socket&#x20;Interface&#x20;Extensions&#x20;for&#x20;IPv6&#x20;&#40;RFC-2553&#41;&#x20;is&#x20;detected,&#x20;support&#x20;for&#x20;the&#x20;IPv6&#x20;address&#x20;family&#x20;is&#x20;generated&#x20;in&#x20;addition&#x20;to&#x20;the&#x20;default&#x20;support&#x20;of&#x20;the&#x20;IPv4&#x20;address&#x20;family.&#x20;In&#x20;a&#x20;few&#x20;cases,&#x20;including&#x20;the&#x20;reslist&#x20;billboard&#x20;generated&#x20;by&#x20;ntpq&#x20;or&#x20;ntpdc,&#x20;IPv6&#x20;addresses&#x20;are&#x20;automatically&#x20;generated.&#x20;IPv6&#x20;addresses&#x20;can&#x20;be&#x20;identified&#x20;by&#x20;the&#x20;presence&#x20;of&#x20;colons&#x20;&quot;:&quot;&#x20;in&#x20;the&#x20;address&#x20;field.&#x20;IPv6&#x20;addresses&#x20;can&#x20;be&#x20;used&#x20;almost&#x20;everywhere&#x20;where&#x20;IPv4&#x20;addresses&#x20;can&#x20;be&#x20;used,&#x20;with&#x20;the&#x20;exception&#x20;of&#x20;reference&#x20;clock&#x20;addresses,&#x20;which&#x20;are&#x20;always&#x20;IPv4.&#x20;Note:&#x20;In&#x20;contexts&#x20;where&#x20;a&#x20;host&#x20;name&#x20;is&#x20;expected,&#x20;a&#x20;-4&#x20;qualifier&#x20;preceding&#x20;the&#x20;host&#x20;name&#x20;forces&#x20;DNS&#x20;resolution&#x20;to&#x20;the&#x20;IPv4&#x20;namespace,&#x20;while&#x20;a&#x20;-6&#x20;qualifier&#x20;forces&#x20;DNS&#x20;resolution&#x20;to&#x20;the&#x20;IPv6&#x20;namespace.&#x20;See&#x20;IPv6&#x20;references&#x20;for&#x20;the&#x20;equivalent&#x20;classes&#x20;for&#x20;that&#x20;address&#x20;family.&#x20;-&#x20;pool&#x20;-&#x20;For&#x20;type&#x20;s&#x20;addresses,&#x20;this&#x20;command&#x20;mobilizes&#x20;a&#x20;persistent&#x20;client&#x20;mode&#x20;association&#x20;with&#x20;a&#x20;number&#x20;of&#x20;remote&#x20;servers.&#x20;In&#x20;this&#x20;mode&#x20;the&#x20;local&#x20;clock&#x20;can&#x20;synchronized&#x20;to&#x20;the&#x20;remote&#x20;server,&#x20;but&#x20;the&#x20;remote&#x20;server&#x20;can&#x20;never&#x20;be&#x20;synchronized&#x20;to&#x20;the&#x20;local&#x20;clock.&#x20;-&#x20;server&#x20;-&#x20;For&#x20;type&#x20;s&#x20;and&#x20;r&#x20;addresses,&#x20;this&#x20;command&#x20;mobilizes&#x20;a&#x20;persistent&#x20;client&#x20;mode&#x20;association&#x20;with&#x20;the&#x20;specified&#x20;remote&#x20;server&#x20;or&#x20;local&#x20;radio&#x20;clock.&#x20;In&#x20;this&#x20;mode&#x20;the&#x20;local&#x20;clock&#x20;can&#x20;synchronized&#x20;to&#x20;the&#x20;remote&#x20;server,&#x20;but&#x20;the&#x20;remote&#x20;server&#x20;can&#x20;never&#x20;be&#x20;synchronized&#x20;to&#x20;the&#x20;local&#x20;clock.&#x20;This&#x20;command&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;type&#x20;b&#x20;or&#x20;m&#x20;addresses.','Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','Edit&#x20;/etc/ntp.conf&#x20;and&#x20;add&#x20;or&#x20;edit&#x20;server&#x20;or&#x20;pool&#x20;lines&#x20;as&#x20;appropriate&#x20;according&#x20;to&#x20;local&#x20;site&#x20;policy:&#x20;&lt;[server|pool]&gt;&#x20;&lt;[remote-server|remote-pool]&gt;&#x20;Examples:&#x20;pool&#x20;mode:&#x20;pool&#x20;time.nist.gov&#x20;iburst.&#x20;server&#x20;mode:&#x20;server&#x20;time-a-g.nist.gov&#x20;iburst&#x20;server&#x20;132.163.97.3&#x20;iburst&#x20;server&#x20;time-d-b.nist.gov&#x20;iburst&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;load&#x20;the&#x20;updated&#x20;time&#x20;sources&#x20;into&#x20;ntp&#x20;running&#x20;config:&#x20;#&#x20;systemctl&#x20;restart&#x20;ntp&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;ntp.','[{\"cis\": [\"2.1.4.2\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1498\", \"T1498.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29553,'Ensure&#x20;ntp&#x20;is&#x20;running&#x20;as&#x20;user&#x20;ntp.','The&#x20;ntp&#x20;package&#x20;is&#x20;installed&#x20;with&#x20;a&#x20;dedicated&#x20;user&#x20;account&#x20;ntp.&#x20;This&#x20;account&#x20;is&#x20;granted&#x20;the&#x20;access&#x20;required&#x20;by&#x20;the&#x20;ntpd&#x20;daemon.&#x20;Note:&#x20;-&#x20;If&#x20;chrony&#x20;or&#x20;systemd-timesyncd&#x20;are&#x20;used,&#x20;ntp&#x20;should&#x20;be&#x20;removed&#x20;and&#x20;this&#x20;section&#x20;skipped.&#x20;-&#x20;This&#x20;recommendation&#x20;only&#x20;applies&#x20;if&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;Only&#x20;one&#x20;time&#x20;synchronization&#x20;method&#x20;should&#x20;be&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system.','The&#x20;ntpd&#x20;daemon&#x20;should&#x20;run&#x20;with&#x20;only&#x20;the&#x20;required&#x20;privilege.','','Add&#x20;or&#x20;edit&#x20;the&#x20;following&#x20;line&#x20;in&#x20;/etc/init.d/ntp:&#x20;RUNASUSER=ntp.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;ntp.service:&#x20;#&#x20;systemctl&#x20;restart&#x20;ntp.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp&#x20;from&#x20;the&#x20;system:&#x20;#&#x20;apt&#x20;purge&#x20;ntp.','[{\"cis\": [\"2.1.4.3\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}]'),(29554,'Ensure&#x20;ntp&#x20;is&#x20;enabled&#x20;and&#x20;running.','ntp&#x20;is&#x20;a&#x20;daemon&#x20;for&#x20;synchronizing&#x20;the&#x20;system&#x20;clock&#x20;across&#x20;the&#x20;network.','ntp&#x20;needs&#x20;to&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;to&#x20;synchronize&#x20;the&#x20;system&#x20;to&#x20;a&#x20;timeserver.&#x20;Time&#x20;synchronization&#x20;is&#x20;important&#x20;to&#x20;support&#x20;time&#x20;sensitive&#x20;security&#x20;mechanisms&#x20;and&#x20;to&#x20;ensure&#x20;log&#x20;files&#x20;have&#x20;consistent&#x20;time&#x20;records&#x20;across&#x20;the&#x20;enterprise&#x20;to&#x20;aid&#x20;in&#x20;forensic&#x20;investigations.','','IF&#x20;ntp&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;commands:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;ntp.service:&#x20;#&#x20;systemctl&#x20;unmask&#x20;ntp.service&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;ntp.service:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;ntp.service&#x20;OR&#x20;If&#x20;another&#x20;time&#x20;synchronization&#x20;service&#x20;is&#x20;in&#x20;use&#x20;on&#x20;the&#x20;system,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ntp:&#x20;#&#x20;apt&#x20;purge&#x20;ntp.','[{\"cis\": [\"2.1.4.4\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"pci_dss_3.2.1\": [\"10.4\"]}, {\"pci_dss_4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}]'),(29555,'Ensure&#x20;X&#x20;Window&#x20;System&#x20;is&#x20;not&#x20;installed.','The&#x20;X&#x20;Window&#x20;System&#x20;provides&#x20;a&#x20;Graphical&#x20;User&#x20;Interface&#x20;&#40;GUI&#41;&#x20;where&#x20;users&#x20;can&#x20;have&#x20;multiple&#x20;windows&#x20;in&#x20;which&#x20;to&#x20;run&#x20;programs&#x20;and&#x20;various&#x20;add&#x20;on.&#x20;The&#x20;X&#x20;Windows&#x20;system&#x20;is&#x20;typically&#x20;used&#x20;on&#x20;workstations&#x20;where&#x20;users&#x20;login,&#x20;but&#x20;not&#x20;on&#x20;servers&#x20;where&#x20;users&#x20;typically&#x20;do&#x20;not&#x20;login.','Unless&#x20;your&#x20;organization&#x20;specifically&#x20;requires&#x20;graphical&#x20;login&#x20;access&#x20;via&#x20;X&#x20;Windows,&#x20;remove&#x20;it&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Many&#x20;Linux&#x20;systems&#x20;run&#x20;applications&#x20;which&#x20;require&#x20;a&#x20;Java&#x20;runtime.&#x20;Some&#x20;Linux&#x20;Java&#x20;packages&#x20;have&#x20;a&#x20;dependency&#x20;on&#x20;specific&#x20;X&#x20;Windows&#x20;xorg-x11-fonts.&#x20;One&#x20;workaround&#x20;to&#x20;avoid&#x20;this&#x20;dependency&#x20;is&#x20;to&#x20;use&#x20;the&#x20;&quot;headless&quot;&#x20;Java&#x20;packages&#x20;for&#x20;your&#x20;specific&#x20;Java&#x20;runtime,&#x20;if&#x20;provided&#x20;by&#x20;your&#x20;distribution.','Remove&#x20;the&#x20;X&#x20;Windows&#x20;System&#x20;packages:&#x20;apt&#x20;purge&#x20;xserver-xorg*.','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29556,'Ensure&#x20;Avahi&#x20;Server&#x20;is&#x20;not&#x20;installed.','Avahi&#x20;is&#x20;a&#x20;free&#x20;zeroconf&#x20;implementation,&#x20;including&#x20;a&#x20;system&#x20;for&#x20;multicast&#x20;DNS/DNS-SD&#x20;service&#x20;discovery.&#x20;Avahi&#x20;allows&#x20;programs&#x20;to&#x20;publish&#x20;and&#x20;discover&#x20;services&#x20;and&#x20;hosts&#x20;running&#x20;on&#x20;a&#x20;local&#x20;network&#x20;with&#x20;no&#x20;specific&#x20;configuration.&#x20;For&#x20;example,&#x20;a&#x20;user&#x20;can&#x20;plug&#x20;a&#x20;computer&#x20;into&#x20;a&#x20;network&#x20;and&#x20;Avahi&#x20;automatically&#x20;finds&#x20;printers&#x20;to&#x20;print&#x20;to,&#x20;files&#x20;to&#x20;look&#x20;at&#x20;and&#x20;people&#x20;to&#x20;talk&#x20;to,&#x20;as&#x20;well&#x20;as&#x20;network&#x20;services&#x20;running&#x20;on&#x20;the&#x20;machine.','Automatic&#x20;discovery&#x20;of&#x20;network&#x20;services&#x20;is&#x20;not&#x20;normally&#x20;required&#x20;for&#x20;system&#x20;functionality.&#x20;It&#x20;is&#x20;recommended&#x20;to&#x20;remove&#x20;this&#x20;package&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;avahi-daemon:&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daaemon.service&#x20;#&#x20;systemctl&#x20;stop&#x20;avahi-daemon.socket&#x20;#&#x20;apt&#x20;purge&#x20;avahi-daemon.','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29557,'Ensure&#x20;CUPS&#x20;is&#x20;not&#x20;installed.','The&#x20;Common&#x20;Unix&#x20;Print&#x20;System&#x20;&#40;CUPS&#41;&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;print&#x20;to&#x20;both&#x20;local&#x20;and&#x20;network&#x20;printers.&#x20;A&#x20;system&#x20;running&#x20;CUPS&#x20;can&#x20;also&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;remote&#x20;systems&#x20;and&#x20;print&#x20;them&#x20;to&#x20;local&#x20;printers.&#x20;It&#x20;also&#x20;provides&#x20;a&#x20;web&#x20;based&#x20;remote&#x20;administration&#x20;capability.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;need&#x20;to&#x20;print&#x20;jobs&#x20;or&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;systems,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;CUPS&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;CUPS&#x20;will&#x20;prevent&#x20;printing&#x20;from&#x20;the&#x20;system,&#x20;a&#x20;common&#x20;task&#x20;for&#x20;workstation&#x20;systems.','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;cups:&#x20;#&#x20;apt&#x20;purge&#x20;cups.','[{\"cis\": [\"2.2.3\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29558,'Ensure&#x20;DHCP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Dynamic&#x20;Host&#x20;Configuration&#x20;Protocol&#x20;&#40;DHCP&#41;&#x20;is&#x20;a&#x20;service&#x20;that&#x20;allows&#x20;machines&#x20;to&#x20;be&#x20;dynamically&#x20;assigned&#x20;IP&#x20;addresses.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;set&#x20;up&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DHCP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;isc-dhcp-server:&#x20;#&#x20;apt&#x20;purge&#x20;isc-dhcp-server.','[{\"cis\": [\"2.2.4\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29559,'Ensure&#x20;LDAP&#x20;server&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;slapd:&#x20;#&#x20;apt&#x20;purge&#x20;slapd.','[{\"cis\": [\"2.2.5\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29560,'Ensure&#x20;NFS&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;File&#x20;System&#x20;&#40;NFS&#41;&#x20;is&#x20;one&#x20;of&#x20;the&#x20;first&#x20;and&#x20;most&#x20;widely&#x20;distributed&#x20;file&#x20;systems&#x20;in&#x20;the&#x20;UNIX&#x20;environment.&#x20;It&#x20;provides&#x20;the&#x20;ability&#x20;for&#x20;systems&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;of&#x20;other&#x20;servers&#x20;through&#x20;the&#x20;network.','If&#x20;the&#x20;system&#x20;does&#x20;not&#x20;export&#x20;NFS&#x20;shares,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;nfs-kernel-server&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nfs:&#x20;#&#x20;apt&#x20;purge&#x20;nfs-kernel-server.','[{\"cis\": [\"2.2.6\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}]'),(29561,'Ensure&#x20;DNS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Domain&#x20;Name&#x20;System&#x20;&#40;DNS&#41;&#x20;is&#x20;a&#x20;hierarchical&#x20;naming&#x20;system&#x20;that&#x20;maps&#x20;names&#x20;to&#x20;IP&#x20;addresses&#x20;for&#x20;computers,&#x20;services&#x20;and&#x20;other&#x20;resources&#x20;connected&#x20;to&#x20;a&#x20;network.','Unless&#x20;a&#x20;system&#x20;is&#x20;specifically&#x20;designated&#x20;to&#x20;act&#x20;as&#x20;a&#x20;DNS&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;DNS&#x20;server:&#x20;#&#x20;apt&#x20;purge&#x20;bind9.','[{\"cis\": [\"2.2.7\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29562,'Ensure&#x20;FTP&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;File&#x20;Transfer&#x20;Protocol&#x20;&#40;FTP&#41;&#x20;provides&#x20;networked&#x20;computers&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;transfer&#x20;files.','FTP&#x20;does&#x20;not&#x20;protect&#x20;the&#x20;confidentiality&#x20;of&#x20;data&#x20;or&#x20;authentication&#x20;credentials.&#x20;It&#x20;is&#x20;recommended&#x20;SFTP&#x20;be&#x20;used&#x20;if&#x20;file&#x20;transfer&#x20;is&#x20;required.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;FTP&#x20;server&#x20;&#40;for&#x20;example,&#x20;to&#x20;allow&#x20;anonymous&#x20;downloads&#41;,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;vsftpd:&#x20;#&#x20;apt&#x20;purge&#x20;vsftpd.','[{\"cis\": [\"2.2.8\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29563,'Ensure&#x20;HTTP&#x20;server&#x20;is&#x20;not&#x20;installed.','HTTP&#x20;or&#x20;web&#x20;servers&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;host&#x20;web&#x20;site&#x20;content.','Unless&#x20;there&#x20;is&#x20;a&#x20;need&#x20;to&#x20;run&#x20;the&#x20;system&#x20;as&#x20;a&#x20;web&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;apache:&#x20;#&#x20;apt&#x20;purge&#x20;apache2.','[{\"cis\": [\"2.2.9\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29564,'Ensure&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;are&#x20;not&#x20;installed.','dovecot-imapd&#x20;and&#x20;dovecot-pop3d&#x20;are&#x20;an&#x20;open&#x20;source&#x20;IMAP&#x20;and&#x20;POP3&#x20;server&#x20;for&#x20;Linux&#x20;based&#x20;systems.','Unless&#x20;POP3&#x20;and/or&#x20;IMAP&#x20;servers&#x20;are&#x20;to&#x20;be&#x20;provided&#x20;by&#x20;this&#x20;system,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;package&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;dovecot-imapd&#x20;and&#x20;dovecot-pop3d:&#x20;#&#x20;apt&#x20;purge&#x20;dovecot-imapd&#x20;dovecot-pop3d.','[{\"cis\": [\"2.2.10\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29565,'Ensure&#x20;Samba&#x20;is&#x20;not&#x20;installed.','The&#x20;Samba&#x20;daemon&#x20;allows&#x20;system&#x20;administrators&#x20;to&#x20;configure&#x20;their&#x20;Linux&#x20;systems&#x20;to&#x20;share&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;with&#x20;Windows&#x20;desktops.&#x20;Samba&#x20;will&#x20;advertise&#x20;the&#x20;file&#x20;systems&#x20;and&#x20;directories&#x20;via&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol.&#x20;Windows&#x20;desktop&#x20;users&#x20;will&#x20;be&#x20;able&#x20;to&#x20;mount&#x20;these&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;as&#x20;letter&#x20;drives&#x20;on&#x20;their&#x20;systems.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;mount&#x20;directories&#x20;and&#x20;file&#x20;systems&#x20;to&#x20;Windows&#x20;systems,&#x20;then&#x20;this&#x20;service&#x20;should&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;samba:&#x20;#&#x20;apt&#x20;purge&#x20;samba.','[{\"cis\": [\"2.2.11\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1005\", \"T1039\", \"T1083\", \"T1135\", \"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}]'),(29566,'Ensure&#x20;HTTP&#x20;Proxy&#x20;Server&#x20;is&#x20;not&#x20;installed.','Squid&#x20;is&#x20;a&#x20;standard&#x20;proxy&#x20;server&#x20;used&#x20;in&#x20;many&#x20;distributions&#x20;and&#x20;environments.','If&#x20;there&#x20;is&#x20;no&#x20;need&#x20;for&#x20;a&#x20;proxy&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;squid&#x20;proxy&#x20;be&#x20;deleted&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;squid:&#x20;#&#x20;apt&#x20;purge&#x20;squid.','[{\"cis\": [\"2.2.12\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29567,'Ensure&#x20;SNMP&#x20;Server&#x20;is&#x20;not&#x20;installed.','Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;is&#x20;a&#x20;widely&#x20;used&#x20;protocol&#x20;for&#x20;monitoring&#x20;the&#x20;health&#x20;and&#x20;welfare&#x20;of&#x20;network&#x20;equipment,&#x20;computer&#x20;equipment&#x20;and&#x20;devices&#x20;like&#x20;UPSs.&#x20;Net-SNMP&#x20;is&#x20;a&#x20;suite&#x20;of&#x20;applications&#x20;used&#x20;to&#x20;implement&#x20;SNMPv1&#x20;&#40;RFC&#x20;1157&#41;,&#x20;SNMPv2&#x20;&#40;RFCs&#x20;1901-1908&#41;,&#x20;and&#x20;SNMPv3&#x20;&#40;RFCs&#x20;3411-3418&#41;&#x20;using&#x20;both&#x20;IPv4&#x20;and&#x20;IPv6.&#x20;Support&#x20;for&#x20;SNMPv2&#x20;classic&#x20;&#40;a.k.a.&#x20;&quot;SNMPv2&#x20;historic&quot;&#x20;-&#x20;RFCs&#x20;1441-1452&#41;&#x20;was&#x20;dropped&#x20;with&#x20;the&#x20;4.0&#x20;release&#x20;of&#x20;the&#x20;UCD-snmp&#x20;package.&#x20;The&#x20;Simple&#x20;Network&#x20;Management&#x20;Protocol&#x20;&#40;SNMP&#41;&#x20;server&#x20;is&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;SNMP&#x20;commands&#x20;from&#x20;an&#x20;SNMP&#x20;management&#x20;system,&#x20;execute&#x20;the&#x20;commands&#x20;or&#x20;collect&#x20;the&#x20;information&#x20;and&#x20;then&#x20;send&#x20;results&#x20;back&#x20;to&#x20;the&#x20;requesting&#x20;system.','The&#x20;SNMP&#x20;server&#x20;can&#x20;communicate&#x20;using&#x20;SNMPv1,&#x20;which&#x20;transmits&#x20;data&#x20;in&#x20;the&#x20;clear&#x20;and&#x20;does&#x20;not&#x20;require&#x20;authentication&#x20;to&#x20;execute&#x20;commands.&#x20;SNMPv3&#x20;replaces&#x20;the&#x20;simple/clear&#x20;text&#x20;password&#x20;sharing&#x20;used&#x20;in&#x20;SNMPv2&#x20;with&#x20;more&#x20;securely&#x20;encoded&#x20;parameters.&#x20;If&#x20;the&#x20;the&#x20;SNMP&#x20;service&#x20;is&#x20;not&#x20;required,&#x20;the&#x20;net-snmp&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.&#x20;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;required:&#x20;-&#x20;The&#x20;server&#x20;should&#x20;be&#x20;configured&#x20;for&#x20;SNMP&#x20;v3&#x20;only.&#x20;User&#x20;Authentication&#x20;and&#x20;Message&#x20;Encryption&#x20;should&#x20;be&#x20;configured.&#x20;-&#x20;If&#x20;SNMP&#x20;v2&#x20;is&#x20;absolutely&#x20;necessary,&#x20;modify&#x20;the&#x20;community&#x20;strings&#039;&#x20;values.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;snmp:&#x20;#&#x20;apt&#x20;purge&#x20;snmp.','[{\"cis\": [\"2.2.13\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29568,'Ensure&#x20;NIS&#x20;Server&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;&#40;formally&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#41;&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;for&#x20;distributing&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;server&#x20;is&#x20;a&#x20;collection&#x20;of&#x20;programs&#x20;that&#x20;allow&#x20;for&#x20;the&#x20;distribution&#x20;of&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed&#x20;and&#x20;other,&#x20;more&#x20;secure&#x20;services&#x20;be&#x20;used.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nis:&#x20;#&#x20;apt&#x20;purge&#x20;nis.','[{\"cis\": [\"2.2.14\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1210\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29569,'Ensure&#x20;mail&#x20;transfer&#x20;agent&#x20;is&#x20;configured&#x20;for&#x20;local-only&#x20;mode.','Mail&#x20;Transfer&#x20;Agents&#x20;&#40;MTA&#41;,&#x20;such&#x20;as&#x20;sendmail&#x20;and&#x20;Postfix,&#x20;are&#x20;used&#x20;to&#x20;listen&#x20;for&#x20;incoming&#x20;mail&#x20;and&#x20;transfer&#x20;the&#x20;messages&#x20;to&#x20;the&#x20;appropriate&#x20;user&#x20;or&#x20;mail&#x20;server.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;not&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;MTA&#x20;be&#x20;configured&#x20;to&#x20;only&#x20;process&#x20;local&#x20;mail.','The&#x20;software&#x20;for&#x20;all&#x20;Mail&#x20;Transfer&#x20;Agents&#x20;is&#x20;complex&#x20;and&#x20;most&#x20;have&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;While&#x20;it&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;system&#x20;can&#x20;process&#x20;local&#x20;mail&#x20;messages,&#x20;it&#x20;is&#x20;not&#x20;necessary&#x20;to&#x20;have&#x20;the&#x20;MTA&#039;s&#x20;daemon&#x20;listening&#x20;on&#x20;a&#x20;port&#x20;unless&#x20;the&#x20;server&#x20;is&#x20;intended&#x20;to&#x20;be&#x20;a&#x20;mail&#x20;server&#x20;that&#x20;receives&#x20;and&#x20;processes&#x20;mail&#x20;from&#x20;other&#x20;systems.&#x20;Note:&#x20;This&#x20;recommendation&#x20;is&#x20;designed&#x20;around&#x20;the&#x20;postfix&#x20;mail&#x20;server.&#x20;Depending&#x20;on&#x20;your&#x20;environment&#x20;you&#x20;may&#x20;have&#x20;an&#x20;alternative&#x20;MTA&#x20;installed&#x20;such&#x20;as&#x20;exim4.&#x20;If&#x20;this&#x20;is&#x20;the&#x20;case&#x20;consult&#x20;the&#x20;documentation&#x20;for&#x20;your&#x20;installed&#x20;MTA&#x20;to&#x20;configure&#x20;the&#x20;recommended&#x20;state.','','Edit&#x20;/etc/postfix/main.cf&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;RECEIVING&#x20;MAIL&#x20;section.&#x20;If&#x20;the&#x20;line&#x20;already&#x20;exists,&#x20;change&#x20;it&#x20;to&#x20;look&#x20;like&#x20;the&#x20;line&#x20;below:&#x20;inet_interfaces&#x20;=&#x20;loopback-only.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;postfix:&#x20;#&#x20;systemctl&#x20;restart&#x20;postfix.','[{\"cis\": [\"2.2.15\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1018\", \"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29570,'Ensure&#x20;rsync&#x20;service&#x20;is&#x20;either&#x20;not&#x20;installed&#x20;or&#x20;masked.','The&#x20;rsync&#x20;service&#x20;can&#x20;be&#x20;used&#x20;to&#x20;synchronize&#x20;files&#x20;between&#x20;systems&#x20;over&#x20;network&#x20;links.','The&#x20;rsync&#x20;service&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.&#x20;The&#x20;rsync&#x20;package&#x20;should&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;attack&#x20;area&#x20;of&#x20;the&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rsync:&#x20;#&#x20;apt&#x20;purge&#x20;rsync&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;stop&#x20;and&#x20;mask&#x20;rsync:&#x20;#&#x20;systemctl&#x20;stop&#x20;rsync&#x20;#&#x20;systemctl&#x20;mask&#x20;rsync.','[{\"cis\": [\"2.2.16\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1105\", \"T1203\", \"T1210\", \"T1543\", \"T1543.002\", \"T1570\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29571,'Ensure&#x20;NIS&#x20;Client&#x20;is&#x20;not&#x20;installed.','The&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;,&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages,&#x20;is&#x20;a&#x20;client-server&#x20;directory&#x20;service&#x20;protocol&#x20;used&#x20;to&#x20;distribute&#x20;system&#x20;configuration&#x20;files.&#x20;The&#x20;NIS&#x20;client&#x20;was&#x20;used&#x20;to&#x20;bind&#x20;a&#x20;machine&#x20;to&#x20;an&#x20;NIS&#x20;server&#x20;and&#x20;receive&#x20;the&#x20;distributed&#x20;configuration&#x20;files.','The&#x20;NIS&#x20;service&#x20;is&#x20;inherently&#x20;an&#x20;insecure&#x20;system&#x20;that&#x20;has&#x20;been&#x20;vulnerable&#x20;to&#x20;DOS&#x20;attacks,&#x20;buffer&#x20;overflows&#x20;and&#x20;has&#x20;poor&#x20;authentication&#x20;for&#x20;querying&#x20;NIS&#x20;maps.&#x20;NIS&#x20;generally&#x20;has&#x20;been&#x20;replaced&#x20;by&#x20;such&#x20;protocols&#x20;as&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;service&#x20;be&#x20;removed.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;nis:&#x20;#&#x20;apt&#x20;purge&#x20;nis.','[{\"cis\": [\"2.3.1\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29572,'Ensure&#x20;rsh&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;rsh-client&#x20;package&#x20;contains&#x20;the&#x20;client&#x20;commands&#x20;for&#x20;the&#x20;rsh&#x20;services.','These&#x20;legacy&#x20;clients&#x20;contain&#x20;numerous&#x20;security&#x20;exposures&#x20;and&#x20;have&#x20;been&#x20;replaced&#x20;with&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;package.&#x20;Even&#x20;if&#x20;the&#x20;server&#x20;is&#x20;removed,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;ensure&#x20;the&#x20;clients&#x20;are&#x20;also&#x20;removed&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;inadvertently&#x20;attempting&#x20;to&#x20;use&#x20;these&#x20;commands&#x20;and&#x20;therefore&#x20;exposing&#x20;their&#x20;credentials.&#x20;Note&#x20;that&#x20;removing&#x20;the&#x20;rsh&#x20;package&#x20;removes&#x20;the&#x20;clients&#x20;for&#x20;rsh,&#x20;rcp&#x20;and&#x20;rlogin.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;rsh:&#x20;#&#x20;apt&#x20;purge&#x20;rsh-client.','[{\"cis\": [\"2.3.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1040\", \"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}]'),(29573,'Ensure&#x20;talk&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;talk&#x20;software&#x20;makes&#x20;it&#x20;possible&#x20;for&#x20;users&#x20;to&#x20;send&#x20;and&#x20;receive&#x20;messages&#x20;across&#x20;systems&#x20;through&#x20;a&#x20;terminal&#x20;session.&#x20;The&#x20;talk&#x20;client,&#x20;which&#x20;allows&#x20;initialization&#x20;of&#x20;talk&#x20;sessions,&#x20;is&#x20;installed&#x20;by&#x20;default.','The&#x20;software&#x20;presents&#x20;a&#x20;security&#x20;risk&#x20;as&#x20;it&#x20;uses&#x20;unencrypted&#x20;protocols&#x20;for&#x20;communication.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;talk:&#x20;#&#x20;apt&#x20;purge&#x20;talk.','[{\"cis\": [\"2.3.3\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0006\", \"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}]'),(29574,'Ensure&#x20;telnet&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;telnet&#x20;package&#x20;contains&#x20;the&#x20;telnet&#x20;client,&#x20;which&#x20;allows&#x20;users&#x20;to&#x20;start&#x20;connections&#x20;to&#x20;other&#x20;systems&#x20;via&#x20;the&#x20;telnet&#x20;protocol.','The&#x20;telnet&#x20;protocol&#x20;is&#x20;insecure&#x20;and&#x20;unencrypted.&#x20;The&#x20;use&#x20;of&#x20;an&#x20;unencrypted&#x20;transmission&#x20;medium&#x20;could&#x20;allow&#x20;an&#x20;unauthorized&#x20;user&#x20;to&#x20;steal&#x20;credentials.&#x20;The&#x20;ssh&#x20;package&#x20;provides&#x20;an&#x20;encrypted&#x20;session&#x20;and&#x20;stronger&#x20;security&#x20;and&#x20;is&#x20;included&#x20;in&#x20;most&#x20;Linux&#x20;distributions.','Many&#x20;insecure&#x20;service&#x20;clients&#x20;are&#x20;used&#x20;as&#x20;troubleshooting&#x20;tools&#x20;and&#x20;in&#x20;testing&#x20;environments.&#x20;Uninstalling&#x20;them&#x20;can&#x20;inhibit&#x20;capability&#x20;to&#x20;test&#x20;and&#x20;troubleshoot.&#x20;If&#x20;they&#x20;are&#x20;required&#x20;it&#x20;is&#x20;advisable&#x20;to&#x20;remove&#x20;the&#x20;clients&#x20;after&#x20;use&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;intentional&#x20;misuse.','Uninstall&#x20;telnet:&#x20;#&#x20;apt&#x20;purge&#x20;telnet.','[{\"cis\": [\"2.3.4\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1040\", \"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0006\", \"TA0008\"]}, {\"mitre_mitigations\": [\"M1041\", \"M1042\"]}]'),(29575,'Ensure&#x20;LDAP&#x20;client&#x20;is&#x20;not&#x20;installed.','The&#x20;Lightweight&#x20;Directory&#x20;Access&#x20;Protocol&#x20;&#40;LDAP&#41;&#x20;was&#x20;introduced&#x20;as&#x20;a&#x20;replacement&#x20;for&#x20;NIS/YP.&#x20;It&#x20;is&#x20;a&#x20;service&#x20;that&#x20;provides&#x20;a&#x20;method&#x20;for&#x20;looking&#x20;up&#x20;information&#x20;from&#x20;a&#x20;central&#x20;database.','If&#x20;the&#x20;system&#x20;will&#x20;not&#x20;need&#x20;to&#x20;act&#x20;as&#x20;an&#x20;LDAP&#x20;client,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;software&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;potential&#x20;attack&#x20;surface.','Removing&#x20;the&#x20;LDAP&#x20;client&#x20;will&#x20;prevent&#x20;or&#x20;inhibit&#x20;using&#x20;LDAP&#x20;for&#x20;authentication&#x20;in&#x20;your&#x20;environment.','Uninstall&#x20;ldap-utils:&#x20;#&#x20;apt&#x20;purge&#x20;ldap-utils.','[{\"cis\": [\"2.3.5\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29576,'Ensure&#x20;RPC&#x20;is&#x20;not&#x20;installed.','Remote&#x20;Procedure&#x20;Call&#x20;&#40;RPC&#41;&#x20;is&#x20;a&#x20;method&#x20;for&#x20;creating&#x20;low&#x20;level&#x20;client&#x20;server&#x20;applications&#x20;across&#x20;different&#x20;system&#x20;architectures.&#x20;It&#x20;requires&#x20;an&#x20;RPC&#x20;compliant&#x20;client&#x20;listening&#x20;on&#x20;a&#x20;network&#x20;port.&#x20;The&#x20;supporting&#x20;package&#x20;is&#x20;rpcbind.','If&#x20;RPC&#x20;is&#x20;not&#x20;required,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;services&#x20;be&#x20;removed&#x20;to&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surface.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;rpcbind:&#x20;#&#x20;apt&#x20;purge&#x20;rpcbind.','[{\"cis\": [\"2.3.6\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1203\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29577,'Ensure&#x20;ufw&#x20;is&#x20;installed.','The&#x20;Uncomplicated&#x20;Firewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables&#x20;and&#x20;is&#x20;particularly&#x20;well-suited&#x20;for&#x20;host-based&#x20;firewalls.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.','A&#x20;firewall&#x20;utility&#x20;is&#x20;required&#x20;to&#x20;configure&#x20;the&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;via&#x20;the&#x20;iptables&#x20;or&#x20;nftables&#x20;back-end.&#x20;The&#x20;Linux&#x20;kernel&#039;s&#x20;netfilter&#x20;framework&#x20;host-based&#x20;firewall&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.&#x20;Note:&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x20;UFW&#x20;is&#x20;dependent&#x20;on&#x20;the&#x20;iptables&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;:&#x20;#&#x20;apt&#x20;install&#x20;ufw.','[{\"cis\": [\"3.5.1.1\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29578,'Ensure&#x20;iptables-persistent&#x20;is&#x20;not&#x20;installed&#x20;with&#x20;ufw.','The&#x20;iptables-persistent&#x20;is&#x20;a&#x20;boot-time&#x20;loader&#x20;for&#x20;netfilter&#x20;rules,&#x20;iptables&#x20;plugin.','Running&#x20;both&#x20;ufw&#x20;and&#x20;the&#x20;services&#x20;included&#x20;in&#x20;the&#x20;iptables-persistent&#x20;package&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;iptables-persistent&#x20;package:&#x20;#&#x20;apt&#x20;purge&#x20;iptables-persistent.','[{\"cis\": [\"3.5.1.2\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29579,'Ensure&#x20;ufw&#x20;service&#x20;is&#x20;enabled.','UncomplicatedFirewall&#x20;&#40;ufw&#41;&#x20;is&#x20;a&#x20;frontend&#x20;for&#x20;iptables.&#x20;ufw&#x20;provides&#x20;a&#x20;framework&#x20;for&#x20;managing&#x20;netfilter,&#x20;as&#x20;well&#x20;as&#x20;a&#x20;command-line&#x20;and&#x20;available&#x20;graphical&#x20;user&#x20;interface&#x20;for&#x20;manipulating&#x20;the&#x20;firewall.&#x20;Notes:&#x20;-&#x20;When&#x20;running&#x20;ufw&#x20;enable&#x20;or&#x20;starting&#x20;ufw&#x20;via&#x20;its&#x20;initscript,&#x20;ufw&#x20;will&#x20;flush&#x20;its&#x20;chains.&#x20;This&#x20;is&#x20;required&#x20;so&#x20;ufw&#x20;can&#x20;maintain&#x20;a&#x20;consistent&#x20;state,&#x20;but&#x20;it&#x20;may&#x20;drop&#x20;existing&#x20;connections&#x20;&#40;eg&#x20;ssh&#41;.&#x20;ufw&#x20;does&#x20;support&#x20;adding&#x20;rules&#x20;before&#x20;enabling&#x20;the&#x20;firewall.&#x20;-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;before&#x20;running&#x20;ufw&#x20;enable.&#x20;#&#x20;ufw&#x20;allow&#x20;proto&#x20;tcp&#x20;from&#x20;any&#x20;to&#x20;any&#x20;port&#x20;22.&#x20;-&#x20;The&#x20;rules&#x20;will&#x20;still&#x20;be&#x20;flushed,&#x20;but&#x20;the&#x20;ssh&#x20;port&#x20;will&#x20;be&#x20;open&#x20;after&#x20;enabling&#x20;the&#x20;firewall.&#x20;Please&#x20;note&#x20;that&#x20;once&#x20;ufw&#x20;is&#x20;&#039;enabled&#039;,&#x20;ufw&#x20;will&#x20;not&#x20;flush&#x20;the&#x20;chains&#x20;when&#x20;adding&#x20;or&#x20;removing&#x20;rules&#x20;&#40;but&#x20;will&#x20;when&#x20;modifying&#x20;a&#x20;rule&#x20;or&#x20;changing&#x20;the&#x20;default&#x20;policy&#41;.&#x20;-&#x20;By&#x20;default,&#x20;ufw&#x20;will&#x20;prompt&#x20;when&#x20;enabling&#x20;the&#x20;firewall&#x20;while&#x20;running&#x20;under&#x20;ssh.&#x20;This&#x20;can&#x20;be&#x20;disabled&#x20;by&#x20;using&#x20;ufw&#x20;--force&#x20;enable.','The&#x20;ufw&#x20;service&#x20;must&#x20;be&#x20;enabled&#x20;and&#x20;running&#x20;in&#x20;order&#x20;for&#x20;ufw&#x20;to&#x20;protect&#x20;the&#x20;system.','Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;unmask&#x20;the&#x20;ufw&#x20;daemon:&#x20;#&#x20;systemctl&#x20;unmask&#x20;ufw.service.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;the&#x20;ufw&#x20;daemon:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;ufw.service&#x20;active&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;ufw:&#x20;#&#x20;ufw&#x20;enable.','[{\"cis\": [\"3.5.1.3\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29580,'Ensure&#x20;ufw&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#x20;for&#x20;IPv4&#x20;and&#x20;::1/128&#x20;for&#x20;IPv6&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ufw&#x20;allow&#x20;in&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;allow&#x20;out&#x20;on&#x20;lo&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;127.0.0.0/8&#x20;#&#x20;ufw&#x20;deny&#x20;in&#x20;from&#x20;::1.','[{\"cis\": [\"3.5.1.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29581,'Ensure&#x20;ufw&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;Any&#x20;port&#x20;or&#x20;protocol&#x20;without&#x20;a&#x20;explicit&#x20;allow&#x20;before&#x20;the&#x20;default&#x20;deny&#x20;will&#x20;be&#x20;blocked.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','Any&#x20;port&#x20;and&#x20;protocol&#x20;not&#x20;explicitly&#x20;allowed&#x20;will&#x20;be&#x20;blocked.&#x20;The&#x20;following&#x20;rules&#x20;should&#x20;be&#x20;considered&#x20;before&#x20;applying&#x20;the&#x20;default&#x20;deny.&#x20;ufw&#x20;allow&#x20;git,&#x20;ufw&#x20;allow&#x20;in&#x20;http,&#x20;ufw&#x20;allow&#x20;out&#x20;http&#x20;&lt;-&#x20;required&#x20;for&#x20;apt&#x20;to&#x20;connect&#x20;to&#x20;repository,&#x20;ufw&#x20;allow&#x20;in&#x20;https,&#x20;ufw&#x20;allow&#x20;out&#x20;https,&#x20;ufw&#x20;allow&#x20;out&#x20;53,&#x20;ufw&#x20;logging&#x20;on.','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;deny&#x20;policy:&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;incoming&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;outgoing&#x20;#&#x20;ufw&#x20;default&#x20;deny&#x20;routed.','[{\"cis\": [\"3.5.1.7\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29582,'Ensure&#x20;nftables&#x20;is&#x20;installed.','nftables&#x20;provides&#x20;a&#x20;new&#x20;in-kernel&#x20;packet&#x20;classification&#x20;framework&#x20;that&#x20;is&#x20;based&#x20;on&#x20;a&#x20;network-specific&#x20;Virtual&#x20;Machine&#x20;&#40;VM&#41;&#x20;and&#x20;a&#x20;new&#x20;nft&#x20;userspace&#x20;command&#x20;line&#x20;tool.&#x20;nftables&#x20;reuses&#x20;the&#x20;existing&#x20;Netfilter&#x20;subsystems&#x20;such&#x20;as&#x20;the&#x20;existing&#x20;hook&#x20;infrastructure,&#x20;the&#x20;connection&#x20;tracking&#x20;system,&#x20;NAT,&#x20;userspace&#x20;queuing&#x20;and&#x20;logging&#x20;subsystem.&#x20;Notes:&#x20;-&#x20;nftables&#x20;is&#x20;available&#x20;in&#x20;Linux&#x20;kernel&#x20;3.13&#x20;and&#x20;newer.&#x20;-&#x20;Only&#x20;one&#x20;firewall&#x20;utility&#x20;should&#x20;be&#x20;installed&#x20;and&#x20;configured.&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;the&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;that&#x20;can&#x20;protect&#x20;against&#x20;threats&#x20;originating&#x20;from&#x20;within&#x20;a&#x20;corporate&#x20;network&#x20;to&#x20;include&#x20;malicious&#x20;mobile&#x20;code&#x20;and&#x20;poorly&#x20;configured&#x20;software&#x20;on&#x20;a&#x20;host.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;nftables:&#x20;#&#x20;apt&#x20;install&#x20;nftables.','[{\"cis\": [\"3.5.2.1\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29583,'Ensure&#x20;ufw&#x20;is&#x20;uninstalled&#x20;or&#x20;disabled&#x20;with&#x20;nftables.','Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;&#x20;is&#x20;a&#x20;program&#x20;for&#x20;managing&#x20;a&#x20;netfilter&#x20;firewall&#x20;designed&#x20;to&#x20;be&#x20;easy&#x20;to&#x20;use.','Running&#x20;both&#x20;the&#x20;nftables&#x20;service&#x20;and&#x20;ufw&#x20;may&#x20;lead&#x20;to&#x20;conflict&#x20;and&#x20;unexpected&#x20;results.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;either&#x20;remove&#x20;ufw&#x20;or&#x20;disable&#x20;ufw.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ufw:&#x20;#&#x20;apt&#x20;purge&#x20;ufw.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;ufw:&#x20;#&#x20;ufw&#x20;disable.','[{\"cis\": [\"3.5.2.2\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29584,'Ensure&#x20;iptables&#x20;are&#x20;flushed&#x20;with&#x20;nftables.','nftables&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;iptables,&#x20;ip6tables,&#x20;ebtables&#x20;and&#x20;arptables.','It&#x20;is&#x20;possible&#x20;to&#x20;mix&#x20;iptables&#x20;and&#x20;nftables.&#x20;However,&#x20;this&#x20;increases&#x20;complexity&#x20;and&#x20;also&#x20;the&#x20;chance&#x20;to&#x20;introduce&#x20;errors.&#x20;For&#x20;simplicity&#x20;flush&#x20;out&#x20;all&#x20;iptables&#x20;rules,&#x20;and&#x20;ensure&#x20;it&#x20;is&#x20;not&#x20;loaded.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;flush&#x20;iptables:&#x20;For&#x20;iptables:&#x20;#&#x20;iptables&#x20;-F&#x20;For&#x20;ip6tables:&#x20;#&#x20;ip6tables&#x20;-F.','[{\"cis\": [\"3.5.2.3\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29585,'Ensure&#x20;a&#x20;nftables&#x20;table&#x20;exists.','Tables&#x20;hold&#x20;chains.&#x20;Each&#x20;table&#x20;only&#x20;has&#x20;one&#x20;address&#x20;family&#x20;and&#x20;only&#x20;applies&#x20;to&#x20;packets&#x20;of&#x20;this&#x20;family.&#x20;Tables&#x20;can&#x20;have&#x20;one&#x20;of&#x20;five&#x20;families.','nftables&#x20;doesn&#039;t&#x20;have&#x20;any&#x20;default&#x20;tables.&#x20;Without&#x20;a&#x20;table&#x20;being&#x20;build,&#x20;nftables&#x20;will&#x20;not&#x20;filter&#x20;network&#x20;traffic.','Adding&#x20;rules&#x20;to&#x20;a&#x20;running&#x20;nftables&#x20;can&#x20;cause&#x20;loss&#x20;of&#x20;connectivity&#x20;to&#x20;the&#x20;system.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;a&#x20;table&#x20;in&#x20;nftables:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;table&#x20;inet&#x20;filter.','[{\"cis\": [\"3.5.2.4\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29586,'Ensure&#x20;nftables&#x20;base&#x20;chains&#x20;exist.','Chains&#x20;are&#x20;containers&#x20;for&#x20;rules.&#x20;They&#x20;exist&#x20;in&#x20;two&#x20;kinds,&#x20;base&#x20;chains&#x20;and&#x20;regular&#x20;chains.&#x20;A&#x20;base&#x20;chain&#x20;is&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;packets&#x20;from&#x20;the&#x20;networking&#x20;stack,&#x20;a&#x20;regular&#x20;chain&#x20;may&#x20;be&#x20;used&#x20;as&#x20;jump&#x20;target&#x20;and&#x20;is&#x20;used&#x20;for&#x20;better&#x20;rule&#x20;organization.','If&#x20;a&#x20;base&#x20;chain&#x20;doesn&#039;t&#x20;exist&#x20;with&#x20;a&#x20;hook&#x20;for&#x20;input,&#x20;forward,&#x20;and&#x20;delete,&#x20;packets&#x20;that&#x20;would&#x20;flow&#x20;through&#x20;those&#x20;chains&#x20;will&#x20;not&#x20;be&#x20;touched&#x20;by&#x20;nftables.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;the&#x20;base&#x20;chains:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;&lt;table&#x20;name&gt;&#x20;&lt;base&#x20;chain&#x20;name&gt;&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;&lt;&#40;input|forward|output&#41;&gt;&#x20;priority&#x20;0&#x20;;&#x20;}.&#x20;Example:&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;input&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;forward&#x20;priority&#x20;0&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;create&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;type&#x20;filter&#x20;hook&#x20;output&#x20;priority&#x20;0&#x20;;&#x20;}.','[{\"cis\": [\"3.5.2.5\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29587,'Ensure&#x20;nftables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;iif&#x20;lo&#x20;accept&#x20;#&#x20;nft&#x20;create&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip&#x20;saddr&#x20;127.0.0.0/8&#x20;counter&#x20;drop.&#x20;IF&#x20;IPv6&#x20;is&#x20;enabled&#x20;on&#x20;the&#x20;system:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;implement&#x20;the&#x20;IPv6&#x20;loopback&#x20;rule:&#x20;#&#x20;nft&#x20;add&#x20;rule&#x20;inet&#x20;filter&#x20;input&#x20;ip6&#x20;saddr&#x20;::1&#x20;counter&#x20;drop.','[{\"cis\": [\"3.5.2.6\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29588,'Ensure&#x20;nftables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','Base&#x20;chain&#x20;policy&#x20;is&#x20;the&#x20;default&#x20;verdict&#x20;that&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;packets&#x20;reaching&#x20;the&#x20;end&#x20;of&#x20;the&#x20;chain.','There&#x20;are&#x20;two&#x20;policies:&#x20;accept&#x20;&#40;Default&#41;&#x20;and&#x20;drop.&#x20;If&#x20;the&#x20;policy&#x20;is&#x20;set&#x20;to&#x20;accept,&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied&#x20;and&#x20;the&#x20;packet&#x20;will&#x20;continue&#x20;transversing&#x20;the&#x20;network&#x20;stack.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.&#x20;Note:&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.','If&#x20;configuring&#x20;nftables&#x20;over&#x20;ssh,&#x20;creating&#x20;a&#x20;base&#x20;chain&#x20;with&#x20;a&#x20;policy&#x20;of&#x20;drop&#x20;will&#x20;cause&#x20;loss&#x20;of&#x20;connectivity.&#x20;Ensure&#x20;that&#x20;a&#x20;rule&#x20;allowing&#x20;ssh&#x20;has&#x20;been&#x20;added&#x20;to&#x20;the&#x20;base&#x20;chain&#x20;prior&#x20;to&#x20;setting&#x20;the&#x20;base&#x20;chain&#039;s&#x20;policy&#x20;to&#x20;drop.','Run&#x20;the&#x20;following&#x20;command&#x20;for&#x20;the&#x20;base&#x20;chains&#x20;with&#x20;the&#x20;input,&#x20;forward,&#x20;and&#x20;output&#x20;hooks&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;nft&#x20;chain&#x20;&lt;table&#x20;family&gt;&#x20;&lt;table&#x20;name&gt;&#x20;&lt;chain&#x20;name&gt;&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}.&#x20;Example:&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;input&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;forward&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}&#x20;#&#x20;nft&#x20;chain&#x20;inet&#x20;filter&#x20;output&#x20;{&#x20;policy&#x20;drop&#x20;;&#x20;}.','[{\"cis\": [\"3.5.2.8\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29589,'Ensure&#x20;nftables&#x20;service&#x20;is&#x20;enabled.','The&#x20;nftables&#x20;service&#x20;allows&#x20;for&#x20;the&#x20;loading&#x20;of&#x20;nftables&#x20;rulesets&#x20;during&#x20;boot,&#x20;or&#x20;starting&#x20;on&#x20;the&#x20;nftables&#x20;service.','The&#x20;nftables&#x20;service&#x20;restores&#x20;the&#x20;nftables&#x20;rules&#x20;from&#x20;the&#x20;rules&#x20;files&#x20;referenced&#x20;in&#x20;the&#x20;/etc/nftables.conf&#x20;file&#x20;during&#x20;boot&#x20;or&#x20;the&#x20;starting&#x20;of&#x20;the&#x20;nftables&#x20;service.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;nftables&#x20;service:&#x20;#&#x20;systemctl&#x20;enable&#x20;nftables.','[{\"cis\": [\"3.5.2.9\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29590,'Ensure&#x20;iptables&#x20;packages&#x20;are&#x20;installed.','iptables&#x20;is&#x20;a&#x20;utility&#x20;program&#x20;that&#x20;allows&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;configure&#x20;the&#x20;tables&#x20;provided&#x20;by&#x20;the&#x20;Linux&#x20;kernel&#x20;firewall,&#x20;implemented&#x20;as&#x20;different&#x20;Netfilter&#x20;modules,&#x20;and&#x20;the&#x20;chains&#x20;and&#x20;rules&#x20;it&#x20;stores.&#x20;Different&#x20;kernel&#x20;modules&#x20;and&#x20;programs&#x20;are&#x20;used&#x20;for&#x20;different&#x20;protocols;&#x20;iptables&#x20;applies&#x20;to&#x20;IPv4,&#x20;ip6tables&#x20;to&#x20;IPv6,&#x20;arptables&#x20;to&#x20;ARP,&#x20;and&#x20;ebtables&#x20;to&#x20;Ethernet&#x20;frames.','A&#x20;method&#x20;of&#x20;configuring&#x20;and&#x20;maintaining&#x20;firewall&#x20;rules&#x20;is&#x20;necessary&#x20;to&#x20;configure&#x20;a&#x20;Host&#x20;Based&#x20;Firewall.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;iptables&#x20;and&#x20;iptables-persistent&#x20;#&#x20;apt&#x20;install&#x20;iptables&#x20;iptables-persistent.','[{\"cis\": [\"3.5.3.1.1\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29591,'Ensure&#x20;nftables&#x20;is&#x20;not&#x20;installed&#x20;with&#x20;iptables.','nftables&#x20;is&#x20;a&#x20;subsystem&#x20;of&#x20;the&#x20;Linux&#x20;kernel&#x20;providing&#x20;filtering&#x20;and&#x20;classification&#x20;of&#x20;network&#x20;packets/datagrams/frames&#x20;and&#x20;is&#x20;the&#x20;successor&#x20;to&#x20;iptables.','Running&#x20;both&#x20;iptables&#x20;and&#x20;nftables&#x20;may&#x20;lead&#x20;to&#x20;conflict.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;nftables:&#x20;#&#x20;apt&#x20;purge&#x20;nftables.','[{\"cis\": [\"3.5.3.1.2\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}]'),(29592,'Ensure&#x20;ufw&#x20;is&#x20;uninstalled&#x20;or&#x20;disabled&#x20;with&#x20;iptables.','Uncomplicated&#x20;Firewall&#x20;&#40;UFW&#41;&#x20;is&#x20;a&#x20;program&#x20;for&#x20;managing&#x20;a&#x20;netfilter&#x20;firewall&#x20;designed&#x20;to&#x20;be&#x20;easy&#x20;to&#x20;use.&#x20;-&#x20;Uses&#x20;a&#x20;command-line&#x20;interface&#x20;consisting&#x20;of&#x20;a&#x20;small&#x20;number&#x20;of&#x20;simple&#x20;commands.&#x20;-&#x20;Uses&#x20;iptables&#x20;for&#x20;configuration.','Running&#x20;iptables.persistent&#x20;with&#x20;ufw&#x20;enabled&#x20;may&#x20;lead&#x20;to&#x20;conflict&#x20;and&#x20;unexpected&#x20;results.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;either&#x20;remove&#x20;ufw&#x20;or&#x20;stop&#x20;and&#x20;mask&#x20;ufw&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;ufw:&#x20;#&#x20;apt&#x20;purge&#x20;ufw&#x20;OR&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;disable&#x20;ufw:&#x20;#&#x20;ufw&#x20;disable&#x20;#&#x20;systemctl&#x20;stop&#x20;ufw&#x20;#&#x20;systemctl&#x20;mask&#x20;ufw.','[{\"cis\": [\"3.5.3.1.3\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}]'),(29593,'Ensure&#x20;iptables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Notes:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;iptables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;iptables&#x20;-P&#x20;FORWARD&#x20;DROP.','[{\"cis\": [\"3.5.3.2.1\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29594,'Ensure&#x20;iptables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;.&#x20;Notes:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;127.0.0.0/8&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;iptables&#x20;-A&#x20;INPUT&#x20;-s&#x20;127.0.0.0/8&#x20;-j&#x20;DROP.','[{\"cis\": [\"3.5.3.2.2\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29595,'Ensure&#x20;ip6tables&#x20;default&#x20;deny&#x20;firewall&#x20;policy.','A&#x20;default&#x20;deny&#x20;all&#x20;policy&#x20;on&#x20;connections&#x20;ensures&#x20;that&#x20;any&#x20;unconfigured&#x20;network&#x20;usage&#x20;will&#x20;be&#x20;rejected.&#x20;Note:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','With&#x20;a&#x20;default&#x20;accept&#x20;policy&#x20;the&#x20;firewall&#x20;will&#x20;accept&#x20;any&#x20;packet&#x20;that&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;be&#x20;denied.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;white&#x20;list&#x20;acceptable&#x20;usage&#x20;than&#x20;to&#x20;black&#x20;list&#x20;unacceptable&#x20;usage.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;a&#x20;default&#x20;DROP&#x20;policy:&#x20;#&#x20;ip6tables&#x20;-P&#x20;INPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;OUTPUT&#x20;DROP&#x20;#&#x20;ip6tables&#x20;-P&#x20;FORWARD&#x20;DROP.','[{\"cis\": [\"3.5.3.3.1\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29596,'Ensure&#x20;ip6tables&#x20;loopback&#x20;traffic&#x20;is&#x20;configured.','Configure&#x20;the&#x20;loopback&#x20;interface&#x20;to&#x20;accept&#x20;traffic.&#x20;Configure&#x20;all&#x20;other&#x20;interfaces&#x20;to&#x20;deny&#x20;traffic&#x20;to&#x20;the&#x20;loopback&#x20;network&#x20;&#40;::1&#41;.&#x20;Note:&#x20;-&#x20;Changing&#x20;firewall&#x20;settings&#x20;while&#x20;connected&#x20;over&#x20;network&#x20;can&#x20;result&#x20;in&#x20;being&#x20;locked&#x20;out&#x20;of&#x20;the&#x20;system.&#x20;-&#x20;Remediation&#x20;will&#x20;only&#x20;affect&#x20;the&#x20;active&#x20;system&#x20;firewall,&#x20;be&#x20;sure&#x20;to&#x20;configure&#x20;the&#x20;default&#x20;policy&#x20;in&#x20;your&#x20;firewall&#x20;management&#x20;to&#x20;apply&#x20;on&#x20;boot&#x20;as&#x20;well.','Loopback&#x20;traffic&#x20;is&#x20;generated&#x20;between&#x20;processes&#x20;on&#x20;machine&#x20;and&#x20;is&#x20;typically&#x20;critical&#x20;to&#x20;operation&#x20;of&#x20;the&#x20;system.&#x20;The&#x20;loopback&#x20;interface&#x20;is&#x20;the&#x20;only&#x20;place&#x20;that&#x20;loopback&#x20;network&#x20;&#40;::1&#41;&#x20;traffic&#x20;should&#x20;be&#x20;seen,&#x20;all&#x20;other&#x20;interfaces&#x20;should&#x20;ignore&#x20;traffic&#x20;on&#x20;this&#x20;network&#x20;as&#x20;an&#x20;anti-spoofing&#x20;measure.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;implement&#x20;the&#x20;loopback&#x20;rules:&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-i&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;OUTPUT&#x20;-o&#x20;lo&#x20;-j&#x20;ACCEPT&#x20;#&#x20;ip6tables&#x20;-A&#x20;INPUT&#x20;-s&#x20;::1&#x20;-j&#x20;DROP.','[{\"cis\": [\"3.5.3.3.2\"]}, {\"cis_csc_v8\": [\"4.4\", \"4.5\"]}, {\"cis_csc_v7\": [\"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.20\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.4\", \"1.3.1\", \"1.4\"]}, {\"pci_dss_4.0\": [\"1.2.1\", \"1.4.1\"]}, {\"nist_sp_800-53\": [\"SC-7(5)\"]}, {\"soc_2\": [\"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.004\"]}, {\"mitre_tactics\": [\"TA0011\"]}, {\"mitre_mitigations\": [\"M1031\", \"M1037\"]}]'),(29597,'Ensure&#x20;auditd&#x20;is&#x20;installed.','auditd&#x20;is&#x20;the&#x20;userspace&#x20;component&#x20;to&#x20;the&#x20;Linux&#x20;Auditing&#x20;System.&#x20;It&#039;s&#x20;responsible&#x20;for&#x20;writing&#x20;audit&#x20;records&#x20;to&#x20;the&#x20;disk.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;Install&#x20;auditd:&#x20;#&#x20;apt&#x20;install&#x20;auditd&#x20;audispd-plugins.','[{\"cis\": [\"4.1.1.1\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29598,'Ensure&#x20;auditd&#x20;service&#x20;is&#x20;enabled&#x20;and&#x20;active.','Turn&#x20;on&#x20;the&#x20;auditd&#x20;daemon&#x20;to&#x20;record&#x20;system&#x20;events.','The&#x20;capturing&#x20;of&#x20;system&#x20;events&#x20;provides&#x20;system&#x20;administrators&#x20;with&#x20;information&#x20;to&#x20;allow&#x20;them&#x20;to&#x20;determine&#x20;if&#x20;unauthorized&#x20;access&#x20;to&#x20;their&#x20;system&#x20;is&#x20;occurring.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;auditd:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;auditd.','[{\"cis\": [\"4.1.1.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29599,'Ensure&#x20;auditing&#x20;for&#x20;processes&#x20;that&#x20;start&#x20;prior&#x20;to&#x20;auditd&#x20;is&#x20;enabled.','Configure&#x20;grub2&#x20;so&#x20;that&#x20;processes&#x20;that&#x20;are&#x20;capable&#x20;of&#x20;being&#x20;audited&#x20;can&#x20;be&#x20;audited&#x20;even&#x20;if&#x20;they&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;startup.','Audit&#x20;events&#x20;need&#x20;to&#x20;be&#x20;captured&#x20;on&#x20;processes&#x20;that&#x20;start&#x20;up&#x20;prior&#x20;to&#x20;auditd&#x20;,&#x20;so&#x20;that&#x20;potential&#x20;malicious&#x20;activity&#x20;cannot&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit=1&#x20;to&#x20;GRUB_CMDLINE_LINUX:&#x20;Example:&#x20;GRUB_CMDLINE_LINUX=&quot;audit=1&quot;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"4.1.1.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29600,'Ensure&#x20;audit_backlog_limit&#x20;is&#x20;sufficient.','In&#x20;the&#x20;kernel-level&#x20;audit&#x20;subsystem,&#x20;a&#x20;socket&#x20;buffer&#x20;queue&#x20;is&#x20;used&#x20;to&#x20;hold&#x20;audit&#x20;events.&#x20;Whenever&#x20;a&#x20;new&#x20;audit&#x20;event&#x20;is&#x20;received,&#x20;it&#x20;is&#x20;logged&#x20;and&#x20;prepared&#x20;to&#x20;be&#x20;added&#x20;to&#x20;this&#x20;queue.&#x20;The&#x20;kernel&#x20;boot&#x20;parameter&#x20;audit_backlog_limit=N,&#x20;with&#x20;N&#x20;representing&#x20;the&#x20;amount&#x20;of&#x20;messages,&#x20;will&#x20;ensure&#x20;that&#x20;a&#x20;queue&#x20;cannot&#x20;grow&#x20;beyond&#x20;a&#x20;certain&#x20;size.&#x20;If&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;logged&#x20;which&#x20;would&#x20;grow&#x20;the&#x20;queue&#x20;beyond&#x20;this&#x20;limit,&#x20;then&#x20;a&#x20;failure&#x20;occurs&#x20;and&#x20;is&#x20;handled&#x20;according&#x20;to&#x20;the&#x20;system&#x20;configuration.','If&#x20;an&#x20;audit&#x20;event&#x20;is&#x20;logged&#x20;which&#x20;would&#x20;grow&#x20;the&#x20;queue&#x20;beyond&#x20;the&#x20;audit_backlog_limit,&#x20;then&#x20;a&#x20;failure&#x20;occurs,&#x20;auditd&#x20;records&#x20;will&#x20;be&#x20;lost,&#x20;and&#x20;potential&#x20;malicious&#x20;activity&#x20;could&#x20;go&#x20;undetected.','','Edit&#x20;/etc/default/grub&#x20;and&#x20;add&#x20;audit_backlog_limit=N&#x20;to&#x20;GRUB_CMDLINE_LINUX.&#x20;The&#x20;recommended&#x20;size&#x20;for&#x20;N&#x20;is&#x20;8192&#x20;or&#x20;larger.&#x20;Example:&#x20;GRUB_CMDLINE_LINUX=&quot;audit_backlog_limit=8192&quot;.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;update&#x20;the&#x20;grub2&#x20;configuration:&#x20;#&#x20;update-grub.','[{\"cis\": [\"4.1.1.4\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29601,'Ensure&#x20;audit&#x20;log&#x20;storage&#x20;size&#x20;is&#x20;configured.','Configure&#x20;the&#x20;maximum&#x20;size&#x20;of&#x20;the&#x20;audit&#x20;log&#x20;file.&#x20;Once&#x20;the&#x20;log&#x20;reaches&#x20;the&#x20;maximum&#x20;size,&#x20;it&#x20;will&#x20;be&#x20;rotated&#x20;and&#x20;a&#x20;new&#x20;log&#x20;file&#x20;will&#x20;be&#x20;started.','It&#x20;is&#x20;important&#x20;that&#x20;an&#x20;appropriate&#x20;size&#x20;is&#x20;determined&#x20;for&#x20;log&#x20;files&#x20;so&#x20;that&#x20;they&#x20;do&#x20;not&#x20;impact&#x20;the&#x20;system&#x20;and&#x20;audit&#x20;data&#x20;is&#x20;not&#x20;lost.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf&#x20;in&#x20;accordance&#x20;with&#x20;site&#x20;policy:&#x20;max_log_file&#x20;=&#x20;&lt;MB&gt;.','[{\"cis\": [\"4.1.2.1\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1053\"]}]'),(29602,'Ensure&#x20;audit&#x20;logs&#x20;are&#x20;not&#x20;automatically&#x20;deleted.','The&#x20;max_log_file_action&#x20;setting&#x20;determines&#x20;how&#x20;to&#x20;handle&#x20;the&#x20;audit&#x20;log&#x20;file&#x20;reaching&#x20;the&#x20;max&#x20;file&#x20;size.&#x20;A&#x20;value&#x20;of&#x20;keep_logs&#x20;will&#x20;rotate&#x20;the&#x20;logs&#x20;but&#x20;never&#x20;delete&#x20;old&#x20;logs.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;benefits&#x20;of&#x20;maintaining&#x20;a&#x20;long&#x20;audit&#x20;history&#x20;exceed&#x20;the&#x20;cost&#x20;of&#x20;storing&#x20;the&#x20;audit&#x20;history.','','Set&#x20;the&#x20;following&#x20;parameter&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;max_log_file_action&#x20;=&#x20;keep_logs.','[{\"cis\": [\"4.1.2.2\"]}, {\"cis_csc_v8\": [\"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"pci_dss_3.2.1\": [\"10.7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1053\"]}]'),(29603,'Ensure&#x20;system&#x20;is&#x20;disabled&#x20;when&#x20;audit&#x20;logs&#x20;are&#x20;full.','The&#x20;auditd&#x20;daemon&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;halt&#x20;the&#x20;system&#x20;when&#x20;the&#x20;audit&#x20;logs&#x20;are&#x20;full.&#x20;The&#x20;admin_space_left_action&#x20;parameter&#x20;tells&#x20;the&#x20;system&#x20;what&#x20;action&#x20;to&#x20;take&#x20;when&#x20;the&#x20;system&#x20;has&#x20;detected&#x20;that&#x20;it&#x20;is&#x20;low&#x20;on&#x20;disk&#x20;space.&#x20;Valid&#x20;values&#x20;are&#x20;ignore,&#x20;syslog,&#x20;suspend,&#x20;single,&#x20;and&#x20;halt.&#x20;-&#x20;ignore,&#x20;the&#x20;audit&#x20;daemon&#x20;does&#x20;nothing.&#x20;-&#x20;Syslog,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;issue&#x20;a&#x20;warning&#x20;to&#x20;syslog.&#x20;-&#x20;Suspend,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;stop&#x20;writing&#x20;records&#x20;to&#x20;the&#x20;disk.&#x20;-&#x20;single,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;put&#x20;the&#x20;computer&#x20;system&#x20;in&#x20;single&#x20;user&#x20;mode.&#x20;-&#x20;halt,&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;shutdown&#x20;the&#x20;system.','In&#x20;high&#x20;security&#x20;contexts,&#x20;the&#x20;risk&#x20;of&#x20;detecting&#x20;unauthorized&#x20;access&#x20;or&#x20;nonrepudiation&#x20;exceeds&#x20;the&#x20;benefit&#x20;of&#x20;the&#x20;system&#039;s&#x20;availability.','If&#x20;the&#x20;admin_space_left_action&#x20;parameter&#x20;is&#x20;set&#x20;to&#x20;halt&#x20;the&#x20;audit&#x20;daemon&#x20;will&#x20;shutdown&#x20;the&#x20;system&#x20;when&#x20;the&#x20;disk&#x20;partition&#x20;containing&#x20;the&#x20;audit&#x20;logs&#x20;becomes&#x20;full.','Set&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;/etc/audit/auditd.conf:&#x20;space_left_action&#x20;=&#x20;email&#x20;action_mail_acct&#x20;=&#x20;root&#x20;set&#x20;admin_space_left_action&#x20;to&#x20;either&#x20;halt&#x20;or&#x20;single&#x20;in&#x20;/etc/audit/auditd.conf.&#x20;Example:&#x20;admin_space_left_action&#x20;=&#x20;halt.','[{\"cis\": [\"4.1.2.3\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.3\"]}, {\"cis_csc_v7\": [\"6.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.7\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29604,'Ensure&#x20;changes&#x20;to&#x20;system&#x20;administration&#x20;scope&#x20;&#40;sudoers&#41;&#x20;is&#x20;collected.','Monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;If&#x20;the&#x20;system&#x20;has&#x20;been&#x20;properly&#x20;configured&#x20;to&#x20;force&#x20;system&#x20;administrators&#x20;to&#x20;log&#x20;in&#x20;as&#x20;themselves&#x20;first&#x20;and&#x20;then&#x20;use&#x20;the&#x20;sudo&#x20;command&#x20;to&#x20;execute&#x20;privileged&#x20;commands,&#x20;it&#x20;is&#x20;possible&#x20;to&#x20;monitor&#x20;changes&#x20;in&#x20;scope.&#x20;The&#x20;file&#x20;/etc/sudoers,&#x20;or&#x20;files&#x20;in&#x20;/etc/sudoers.d,&#x20;will&#x20;be&#x20;written&#x20;to&#x20;when&#x20;the&#x20;file&#40;s&#41;&#x20;or&#x20;related&#x20;attributes&#x20;have&#x20;changed.&#x20;The&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;scope&quot;.','Changes&#x20;in&#x20;the&#x20;/etc/sudoers&#x20;and&#x20;/etc/sudoers.d&#x20;files&#x20;can&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;has&#x20;been&#x20;made&#x20;to&#x20;the&#x20;scope&#x20;of&#x20;system&#x20;administrator&#x20;activity.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;scope&#x20;changes&#x20;for&#x20;system&#x20;administrators.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/sudoers&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;-w&#x20;/etc/sudoers.d&#x20;-p&#x20;wa&#x20;-k&#x20;scope&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-scope.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;fi.','[{\"cis\": [\"4.1.3.1\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}]'),(29605,'Ensure&#x20;actions&#x20;as&#x20;another&#x20;user&#x20;are&#x20;always&#x20;logged.','sudo&#x20;provides&#x20;users&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;to&#x20;perform&#x20;operations,&#x20;either&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user.','Creating&#x20;an&#x20;audit&#x20;log&#x20;of&#x20;users&#x20;with&#x20;temporary&#x20;elevated&#x20;privileges&#x20;and&#x20;the&#x20;operation&#40;s&#41;&#x20;they&#x20;performed&#x20;is&#x20;essential&#x20;to&#x20;reporting.&#x20;Administrators&#x20;will&#x20;want&#x20;to&#x20;correlate&#x20;the&#x20;events&#x20;written&#x20;to&#x20;the&#x20;audit&#x20;trail&#x20;with&#x20;the&#x20;records&#x20;written&#x20;to&#x20;sudo&#039;s&#x20;logfile&#x20;to&#x20;verify&#x20;if&#x20;unauthorized&#x20;commands&#x20;have&#x20;been&#x20;executed.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;elevated&#x20;privileges.&#x20;-&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;auid!=unset&#x20;-S&#x20;execve&#x20;-k&#x20;user_emulation&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-C&#x20;euid!=uid&#x20;-F&#x20;auid!=unset&#x20;-S&#x20;execve&#x20;-k&#x20;user_emulation&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-user_emulation.rules&#x20;-&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.2\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"4.9\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.9.4.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}]'),(29606,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information&#x20;are&#x20;collected.','Capture&#x20;events&#x20;where&#x20;the&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;has&#x20;been&#x20;modified.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;are&#x20;set&#x20;to&#x20;determine&#x20;if&#x20;the;&#x20;-&#x20;adjtimex:&#x20;tune&#x20;kernel&#x20;clock.&#x20;-&#x20;settimeofday:&#x20;set&#x20;time&#x20;using&#x20;timeval&#x20;and&#x20;timezone&#x20;structures.&#x20;-&#x20;stime:&#x20;using&#x20;seconds&#x20;since&#x20;1/1/1970.&#x20;-&#x20;clock_settime:&#x20;allows&#x20;for&#x20;the&#x20;setting&#x20;of&#x20;several&#x20;internal&#x20;clocks&#x20;and&#x20;timers&#x20;system&#x20;calls&#x20;have&#x20;been&#x20;executed.&#x20;Further,&#x20;ensure&#x20;to&#x20;write&#x20;an&#x20;audit&#x20;record&#x20;to&#x20;the&#x20;configured&#x20;audit&#x20;log&#x20;file&#x20;upon&#x20;exit,&#x20;tagging&#x20;the&#x20;records&#x20;with&#x20;a&#x20;unique&#x20;identifier&#x20;such&#x20;as&#x20;&quot;time-change&quot;.','Unexpected&#x20;changes&#x20;in&#x20;system&#x20;date&#x20;and/or&#x20;time&#x20;could&#x20;be&#x20;a&#x20;sign&#x20;of&#x20;malicious&#x20;activity&#x20;on&#x20;the&#x20;system.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;date&#x20;and&#x20;time&#x20;information.&#x20;-&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;adjtimex,settimeofday,clock_settime&#x20;-k&#x20;time-change&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex,settimeofday,clock_settime&#x20;-k&#x20;time-change&#x20;-w&#x20;/etc/localtime&#x20;-p&#x20;wa&#x20;-k&#x20;time-change&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-time-change.rules&#x20;-&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;.Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.&#x20;In&#x20;addition,&#x20;add&#x20;stime&#x20;to&#x20;the&#x20;system&#x20;call&#x20;audit.&#x20;Example:&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;adjtimex,settimeofday,clock_settime,stime&#x20;-k&#x20;time-change.','[{\"cis\": [\"4.1.3.4\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29607,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment&#x20;are&#x20;collected.','Record&#x20;changes&#x20;to&#x20;network&#x20;environment&#x20;files&#x20;or&#x20;system&#x20;calls.&#x20;The&#x20;below&#x20;parameters&#x20;monitors&#x20;the&#x20;following&#x20;system&#x20;calls,&#x20;and&#x20;write&#x20;an&#x20;audit&#x20;event&#x20;on&#x20;system&#x20;call&#x20;exit:&#x20;-&#x20;sethostname:&#x20;set&#x20;the&#x20;systems&#x20;host&#x20;name.&#x20;-&#x20;setdomainname:&#x20;set&#x20;the&#x20;systems&#x20;domain&#x20;name.&#x20;The&#x20;files&#x20;being&#x20;monitored&#x20;are:&#x20;&gt;&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;-&#x20;messages&#x20;displayed&#x20;pre-login.&#x20;&gt;&#x20;/etc/hosts&#x20;-&#x20;file&#x20;containing&#x20;host&#x20;names&#x20;and&#x20;associated&#x20;IP&#x20;addresses.&#x20;&gt;&#x20;/etc/networks&#x20;-&#x20;symbolic&#x20;names&#x20;for&#x20;networks.&#x20;&gt;&#x20;/etc/network/&#x20;-&#x20;directory&#x20;containing&#x20;network&#x20;interface&#x20;scripts&#x20;and&#x20;configurations&#x20;files.','Monitoring&#x20;sethostname&#x20;and&#x20;setdomainname&#x20;will&#x20;identify&#x20;potential&#x20;unauthorized&#x20;changes&#x20;to&#x20;host&#x20;and&#x20;domainname&#x20;of&#x20;a&#x20;system.&#x20;The&#x20;changing&#x20;of&#x20;these&#x20;names&#x20;could&#x20;potentially&#x20;break&#x20;security&#x20;parameters&#x20;that&#x20;are&#x20;set&#x20;based&#x20;on&#x20;those&#x20;names.&#x20;The&#x20;/etc/hosts&#x20;file&#x20;is&#x20;monitored&#x20;for&#x20;changes&#x20;that&#x20;can&#x20;indicate&#x20;an&#x20;unauthorized&#x20;intruder&#x20;is&#x20;trying&#x20;to&#x20;change&#x20;machine&#x20;associations&#x20;with&#x20;IP&#x20;addresses&#x20;and&#x20;trick&#x20;users&#x20;and&#x20;processes&#x20;into&#x20;connecting&#x20;to&#x20;unintended&#x20;machines.&#x20;Monitoring&#x20;/etc/issue&#x20;and&#x20;/etc/issue.net&#x20;is&#x20;important,&#x20;as&#x20;intruders&#x20;could&#x20;put&#x20;disinformation&#x20;into&#x20;those&#x20;files&#x20;and&#x20;trick&#x20;users&#x20;into&#x20;providing&#x20;information&#x20;to&#x20;the&#x20;intruder.&#x20;Monitoring&#x20;/etc/network&#x20;is&#x20;important&#x20;as&#x20;it&#x20;can&#x20;show&#x20;if&#x20;network&#x20;interfaces&#x20;or&#x20;scripts&#x20;are&#x20;being&#x20;modified&#x20;in&#x20;a&#x20;way&#x20;that&#x20;can&#x20;lead&#x20;to&#x20;the&#x20;machine&#x20;becoming&#x20;unavailable&#x20;or&#x20;compromised.&#x20;All&#x20;audit&#x20;records&#x20;should&#x20;have&#x20;a&#x20;relevant&#x20;tag&#x20;associated&#x20;with&#x20;them.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;network&#x20;environment.&#x20;-&#x20;64&#x20;Bit&#x20;systems:&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;sethostname,setdomainname&#x20;-k&#x20;system-locale&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;sethostname,setdomainname&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/issue.net&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/hosts&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/networks&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;-w&#x20;/etc/network/&#x20;-p&#x20;wa&#x20;-k&#x20;system-locale&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-system_local.rules&#x20;-&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.5\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1047\"]}]'),(29608,'Ensure&#x20;unsuccessful&#x20;file&#x20;access&#x20;attempts&#x20;are&#x20;collected.','Monitor&#x20;for&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;access&#x20;files.&#x20;The&#x20;following&#x20;parameters&#x20;are&#x20;associated&#x20;with&#x20;system&#x20;calls&#x20;that&#x20;control&#x20;files:&#x20;-&#x20;creation&#x20;-&#x20;creat.&#x20;-&#x20;opening&#x20;-&#x20;open,&#x20;openat.&#x20;-&#x20;truncation&#x20;-&#x20;truncate,&#x20;ftruncate.&#x20;An&#x20;audit&#x20;log&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;if&#x20;all&#x20;of&#x20;the&#x20;following&#x20;criteria&#x20;is&#x20;met&#x20;for&#x20;the&#x20;user&#x20;when&#x20;trying&#x20;to&#x20;access&#x20;a&#x20;file:&#x20;-&#x20;a&#x20;non-privileged&#x20;user&#x20;&#40;auid&gt;=UID_MIN&#41;.&#x20;-&#x20;is&#x20;not&#x20;a&#x20;Daemon&#x20;event&#x20;&#40;auid=4294967295/unset/-1&#41;.&#x20;-&#x20;if&#x20;the&#x20;system&#x20;call&#x20;returned&#x20;EACCES&#x20;&#40;permission&#x20;denied&#41;&#x20;or&#x20;EPERM&#x20;&#40;some&#x20;other&#x20;permanent&#x20;error&#x20;associated&#x20;with&#x20;the&#x20;specific&#x20;system&#x20;call&#41;.','Failed&#x20;attempts&#x20;to&#x20;open,&#x20;create&#x20;or&#x20;truncate&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;an&#x20;individual&#x20;or&#x20;process&#x20;is&#x20;trying&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;unsuccessful&#x20;file&#x20;access&#x20;attempts.&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat,open,openat,truncate,ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;creat,open,openat,truncate,ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat,open,openat,truncate,ftruncate&#x20;-F&#x20;exit=-EACCES&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;access&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;creat,open,openat,truncate,ftruncate&#x20;-F&#x20;exit=-EPERM&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;access&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-access.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:&#x20;Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.7\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"14.9\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29609,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information&#x20;are&#x20;collected.','Record&#x20;events&#x20;affecting&#x20;the&#x20;modification&#x20;of&#x20;user&#x20;or&#x20;group&#x20;information,&#x20;including&#x20;that&#x20;of&#x20;passwords&#x20;and&#x20;old&#x20;passwords&#x20;if&#x20;in&#x20;use.&#x20;-&#x20;/etc/group:&#x20;system&#x20;groups.&#x20;-&#x20;/etc/passwd:&#x20;system&#x20;users.&#x20;-&#x20;/etc/gshadow:&#x20;encrypted&#x20;password&#x20;for&#x20;each&#x20;group.&#x20;-&#x20;/etc/shadow:&#x20;system&#x20;user&#x20;passwords.&#x20;-&#x20;/etc/security/opasswd:&#x20;storage&#x20;of&#x20;old&#x20;passwords&#x20;if&#x20;the&#x20;relevant&#x20;PAM&#x20;module&#x20;is&#x20;in&#x20;use.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;will&#x20;watch&#x20;the&#x20;files&#x20;to&#x20;see&#x20;if&#x20;they&#x20;have&#x20;been&#x20;opened&#x20;for&#x20;write&#x20;or&#x20;have&#x20;had&#x20;attribute&#x20;changes&#x20;&#40;e.g.&#x20;permissions&#41;&#x20;and&#x20;tag&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;identity&quot;&#x20;in&#x20;the&#x20;audit&#x20;log&#x20;file.','Unexpected&#x20;changes&#x20;to&#x20;these&#x20;files&#x20;could&#x20;be&#x20;an&#x20;indication&#x20;that&#x20;the&#x20;system&#x20;has&#x20;been&#x20;compromised&#x20;and&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;hide&#x20;their&#x20;activities&#x20;or&#x20;compromise&#x20;additional&#x20;accounts.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;user/group&#x20;information.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/group&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/passwd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/gshadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/shadow&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;-w&#x20;/etc/security/opasswd&#x20;-p&#x20;wa&#x20;-k&#x20;identity&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-identity.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.8\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"4.8\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}]'),(29610,'Ensure&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;changes&#x20;to&#x20;file&#x20;permissions,&#x20;attributes,&#x20;ownership&#x20;and&#x20;group.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;for&#x20;system&#x20;calls&#x20;that&#x20;affect&#x20;file&#x20;permissions&#x20;and&#x20;attributes.&#x20;The&#x20;following&#x20;commands&#x20;and&#x20;system&#x20;calls&#x20;effect&#x20;the&#x20;permissions,&#x20;ownership&#x20;and&#x20;various&#x20;attributes&#x20;of&#x20;files:&#x20;chmod,&#x20;fchmod,&#x20;fchmodat,&#x20;chown,&#x20;fchown,&#x20;fchownat,&#x20;lchown,&#x20;setxattr,&#x20;lsetxattr,&#x20;fsetxattr,&#x20;removexattr,&#x20;lremovexattr,&#x20;fremovexattr.&#x20;In&#x20;all&#x20;cases,&#x20;an&#x20;audit&#x20;record&#x20;will&#x20;only&#x20;be&#x20;written&#x20;for&#x20;non-system&#x20;user&#x20;ids&#x20;and&#x20;will&#x20;ignore&#x20;Daemon&#x20;events.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;perm_mod&quot;.','Monitoring&#x20;for&#x20;changes&#x20;in&#x20;file&#x20;attributes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;activity&#x20;that&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;or&#x20;policy&#x20;violation.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;discretionary&#x20;access&#x20;control&#x20;permission&#x20;modification&#x20;events.&#x20;64&#x20;Bit&#x20;systems:&#x20;Example:&#x20;#{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chmod,fchmod,fchmodat&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;chown,fchown,lchown,fchownat&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;chmod,fchmod,fchmodat&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;lchown,fchown,chown,fchownat&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=perm_mod&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=perm_mod&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-perm_mod.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:&#x20;Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.&#x20;32&#x20;Bit&#x20;systems&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.9\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29611,'Ensure&#x20;successful&#x20;file&#x20;system&#x20;mounts&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;the&#x20;mount&#x20;system&#x20;call.&#x20;The&#x20;mount&#x20;&#40;and&#x20;umount&#x20;&#41;&#x20;system&#x20;call&#x20;controls&#x20;the&#x20;mounting&#x20;and&#x20;unmounting&#x20;of&#x20;file&#x20;systems.&#x20;The&#x20;parameters&#x20;below&#x20;configure&#x20;the&#x20;system&#x20;to&#x20;create&#x20;an&#x20;audit&#x20;record&#x20;when&#x20;the&#x20;mount&#x20;system&#x20;call&#x20;is&#x20;used&#x20;by&#x20;a&#x20;non-privileged&#x20;user.','It&#x20;is&#x20;highly&#x20;unusual&#x20;for&#x20;a&#x20;non&#x20;privileged&#x20;user&#x20;to&#x20;mount&#x20;file&#x20;systems&#x20;to&#x20;the&#x20;system.&#x20;While&#x20;tracking&#x20;mount&#x20;commands&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;evidence&#x20;that&#x20;external&#x20;media&#x20;may&#x20;have&#x20;been&#x20;mounted&#x20;&#40;based&#x20;on&#x20;a&#x20;review&#x20;of&#x20;the&#x20;source&#x20;of&#x20;the&#x20;mount&#x20;and&#x20;confirming&#x20;it&#039;s&#x20;an&#x20;external&#x20;media&#x20;type&#41;,&#x20;it&#x20;does&#x20;not&#x20;conclusively&#x20;indicate&#x20;that&#x20;data&#x20;was&#x20;exported&#x20;to&#x20;the&#x20;media.&#x20;System&#x20;administrators&#x20;who&#x20;wish&#x20;to&#x20;determine&#x20;if&#x20;data&#x20;were&#x20;exported,&#x20;would&#x20;also&#x20;have&#x20;to&#x20;track&#x20;successful&#x20;open,&#x20;creat&#x20;and&#x20;truncate&#x20;system&#x20;calls&#x20;requiring&#x20;write&#x20;access&#x20;to&#x20;a&#x20;file&#x20;under&#x20;the&#x20;mount&#x20;point&#x20;of&#x20;the&#x20;external&#x20;media&#x20;file&#x20;system.&#x20;This&#x20;could&#x20;give&#x20;a&#x20;fair&#x20;indication&#x20;that&#x20;a&#x20;write&#x20;occurred.&#x20;The&#x20;only&#x20;way&#x20;to&#x20;truly&#x20;prove&#x20;it,&#x20;would&#x20;be&#x20;to&#x20;track&#x20;successful&#x20;writes&#x20;to&#x20;the&#x20;external&#x20;media.&#x20;Tracking&#x20;write&#x20;system&#x20;calls&#x20;could&#x20;quickly&#x20;fill&#x20;up&#x20;the&#x20;audit&#x20;log&#x20;and&#x20;is&#x20;not&#x20;recommended.&#x20;Recommendations&#x20;on&#x20;configuration&#x20;options&#x20;to&#x20;track&#x20;data&#x20;export&#x20;to&#x20;media&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;document.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;successful&#x20;file&#x20;system&#x20;mounts.&#x20;-&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=$UID_MIN&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;mounts&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;mount&#x20;-F&#x20;auid&gt;=$UID_MIN&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;mounts&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-mounts.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:&#x20;Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;}&#x20;-&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.10\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"CM-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0010\"]}, {\"mitre_mitigations\": [\"M1034\"]}]'),(29612,'Ensure&#x20;session&#x20;initiation&#x20;information&#x20;is&#x20;collected.','Monitor&#x20;session&#x20;initiation&#x20;events.&#x20;The&#x20;parameters&#x20;in&#x20;this&#x20;section&#x20;track&#x20;changes&#x20;to&#x20;the&#x20;files&#x20;associated&#x20;with&#x20;session&#x20;events.&#x20;-&#x20;/var/run/utmp:&#x20;tracks&#x20;all&#x20;currently&#x20;logged&#x20;in&#x20;users.&#x20;-&#x20;/var/log/wtmp:&#x20;file&#x20;tracks&#x20;logins,&#x20;logouts,&#x20;shutdown,&#x20;and&#x20;reboot&#x20;events.&#x20;-&#x20;/var/log/btmp:&#x20;keeps&#x20;track&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;and&#x20;can&#x20;be&#x20;read&#x20;by&#x20;entering&#x20;the&#x20;command&#x20;/usr/bin/last&#x20;-f&#x20;/var/log/btmp.&#x20;All&#x20;audit&#x20;records&#x20;will&#x20;be&#x20;tagged&#x20;with&#x20;the&#x20;identifier&#x20;&quot;session&quot;.','Monitoring&#x20;these&#x20;files&#x20;for&#x20;changes&#x20;could&#x20;alert&#x20;a&#x20;system&#x20;administrator&#x20;to&#x20;logins&#x20;occurring&#x20;at&#x20;unusual&#x20;hours,&#x20;which&#x20;could&#x20;indicate&#x20;intruder&#x20;activity&#x20;&#40;i.e.&#x20;a&#x20;user&#x20;logging&#x20;in&#x20;at&#x20;a&#x20;time&#x20;when&#x20;they&#x20;do&#x20;not&#x20;normally&#x20;log&#x20;in&#41;.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;session&#x20;initiation&#x20;information.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/var/run/utmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/wtmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;-w&#x20;/var/log/btmp&#x20;-p&#x20;wa&#x20;-k&#x20;session&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-session.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.11\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"4.9\", \"16.13\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3\", \"AU-3(1)\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.9.4.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0001\"]}]'),(29613,'Ensure&#x20;login&#x20;and&#x20;logout&#x20;events&#x20;are&#x20;collected.','Monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;The&#x20;parameters&#x20;below&#x20;track&#x20;changes&#x20;to&#x20;files&#x20;associated&#x20;with&#x20;login/logout&#x20;events.&#x20;-&#x20;/var/log/lastlog:&#x20;maintain&#x20;records&#x20;of&#x20;the&#x20;last&#x20;time&#x20;a&#x20;user&#x20;successfully&#x20;logged&#x20;in.&#x20;-&#x20;/var/run/faillock:&#x20;directory&#x20;maintains&#x20;records&#x20;of&#x20;login&#x20;failures&#x20;via&#x20;the&#x20;pam_faillock&#x20;module.','Monitoring&#x20;login/logout&#x20;events&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;information&#x20;associated&#x20;with&#x20;brute&#x20;force&#x20;attacks&#x20;against&#x20;user&#x20;logins.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;login&#x20;and&#x20;logout&#x20;events.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/var/log/lastlog&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;-w&#x20;/var/run/faillock&#x20;-p&#x20;wa&#x20;-k&#x20;logins&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-login.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.12\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"4.9\", \"16.11\", \"16.13\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3\", \"AU-3(1)\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.9.4.2\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0001\"]}]'),(29614,'Ensure&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users&#x20;are&#x20;collected.','Monitor&#x20;the&#x20;use&#x20;of&#x20;system&#x20;calls&#x20;associated&#x20;with&#x20;the&#x20;deletion&#x20;or&#x20;renaming&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes.&#x20;This&#x20;configuration&#x20;statement&#x20;sets&#x20;up&#x20;monitoring&#x20;for:&#x20;-&#x20;unlink:&#x20;remove&#x20;a&#x20;file.&#x20;-&#x20;unlinkat:&#x20;remove&#x20;a&#x20;file&#x20;attribute.&#x20;-&#x20;rename:&#x20;rename&#x20;a&#x20;file.&#x20;-&#x20;renameat:&#x20;rename&#x20;a&#x20;file&#x20;attribute&#x20;system&#x20;calls&#x20;and&#x20;tags&#x20;them&#x20;with&#x20;the&#x20;identifier&#x20;&quot;delete&quot;.','Monitoring&#x20;these&#x20;calls&#x20;from&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;a&#x20;system&#x20;administrator&#x20;with&#x20;evidence&#x20;that&#x20;inappropriate&#x20;removal&#x20;of&#x20;files&#x20;and&#x20;file&#x20;attributes&#x20;associated&#x20;with&#x20;protected&#x20;files&#x20;is&#x20;occurring.&#x20;While&#x20;this&#x20;audit&#x20;option&#x20;will&#x20;look&#x20;at&#x20;all&#x20;events,&#x20;system&#x20;administrators&#x20;will&#x20;want&#x20;to&#x20;look&#x20;for&#x20;specific&#x20;privileged&#x20;files&#x20;that&#x20;are&#x20;being&#x20;deleted&#x20;or&#x20;altered.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;file&#x20;deletion&#x20;events&#x20;by&#x20;users.&#x20;-&#x20;64&#x20;Bit&#x20;systems:&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;rename,unlink,unlinkat,renameat&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=delete&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b32&#x20;-S&#x20;rename,unlink,unlinkat,renameat&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-F&#x20;key=delete&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-delete.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:&#x20;Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;-&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.13\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29615,'Ensure&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;system&#039;s&#x20;Mandatory&#x20;Access&#x20;Controls&#x20;are&#x20;collected.','Monitor&#x20;AppArmor,&#x20;an&#x20;implementation&#x20;of&#x20;mandatory&#x20;access&#x20;controls.&#x20;The&#x20;parameters&#x20;below&#x20;monitor&#x20;any&#x20;write&#x20;access&#x20;&#40;potential&#x20;additional,&#x20;deletion&#x20;or&#x20;modification&#x20;of&#x20;files&#x20;in&#x20;the&#x20;directory&#41;&#x20;or&#x20;attribute&#x20;changes&#x20;to&#x20;the&#x20;/etc/apparmor/&#x20;and&#x20;/etc/apparmor.d/&#x20;directories.&#x20;Note:&#x20;If&#x20;a&#x20;different&#x20;Mandatory&#x20;Access&#x20;Control&#x20;method&#x20;is&#x20;used,&#x20;changes&#x20;to&#x20;the&#x20;corresponding&#x20;directories&#x20;should&#x20;be&#x20;audited.','Changes&#x20;to&#x20;files&#x20;in&#x20;the&#x20;/etc/apparmor/&#x20;and&#x20;/etc/apparmor.d/&#x20;directories&#x20;could&#x20;indicate&#x20;that&#x20;an&#x20;unauthorized&#x20;user&#x20;is&#x20;attempting&#x20;to&#x20;modify&#x20;access&#x20;controls&#x20;and&#x20;change&#x20;security&#x20;contexts,&#x20;leading&#x20;to&#x20;a&#x20;compromise&#x20;of&#x20;the&#x20;system.','','Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;events&#x20;that&#x20;modify&#x20;the&#x20;systems&#x20;Mandatory&#x20;Access&#x20;Controls.&#x20;Example:&#x20;#&#x20;printf&#x20;&quot;&#x20;-w&#x20;/etc/apparmor/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;-w&#x20;/etc/apparmor.d/&#x20;-p&#x20;wa&#x20;-k&#x20;MAC-policy&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-MAC-policy.rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.14\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"5.5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.1.2\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29616,'Ensure&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;chcon&#x20;command&#x20;are&#x20;recorded.','The&#x20;operating&#x20;system&#x20;must&#x20;generate&#x20;audit&#x20;records&#x20;for&#x20;successful/unsuccessful&#x20;uses&#x20;of&#x20;the&#x20;chcon&#x20;command.','The&#x20;chcon&#x20;command&#x20;is&#x20;used&#x20;to&#x20;change&#x20;file&#x20;security&#x20;context.&#x20;Without&#x20;generating&#x20;audit&#x20;records&#x20;that&#x20;are&#x20;specific&#x20;to&#x20;the&#x20;security&#x20;and&#x20;mission&#x20;needs&#x20;of&#x20;the&#x20;organization,&#x20;it&#x20;would&#x20;be&#x20;difficult&#x20;to&#x20;establish,&#x20;correlate,&#x20;and&#x20;investigate&#x20;the&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident&#x20;or&#x20;identify&#x20;those&#x20;responsible&#x20;for&#x20;one.&#x20;Audit&#x20;records&#x20;can&#x20;be&#x20;generated&#x20;from&#x20;various&#x20;components&#x20;within&#x20;the&#x20;information&#x20;system&#x20;&#40;e.g.,&#x20;module&#x20;or&#x20;policy&#x20;filter&#41;.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;chcon&#x20;command.&#x20;-&#x20;64&#x20;Bit&#x20;systems:&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;path=/usr/bin/chcon&#x20;-F&#x20;perm=x&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;perm_chng&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-perm_chng.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;-&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;.Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.15\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}]'),(29617,'Ensure&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;setfacl&#x20;command&#x20;are&#x20;recorded.','The&#x20;operating&#x20;system&#x20;must&#x20;generate&#x20;audit&#x20;records&#x20;for&#x20;successful/unsuccessful&#x20;uses&#x20;of&#x20;the&#x20;setfacl&#x20;command.','This&#x20;utility&#x20;sets&#x20;Access&#x20;Control&#x20;Lists&#x20;&#40;ACLs&#41;&#x20;of&#x20;files&#x20;and&#x20;directories.&#x20;Without&#x20;generating&#x20;audit&#x20;records&#x20;that&#x20;are&#x20;specific&#x20;to&#x20;the&#x20;security&#x20;and&#x20;mission&#x20;needs&#x20;of&#x20;the&#x20;organization,&#x20;it&#x20;would&#x20;be&#x20;difficult&#x20;to&#x20;establish,&#x20;correlate,&#x20;and&#x20;investigate&#x20;the&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident&#x20;or&#x20;identify&#x20;those&#x20;responsible&#x20;for&#x20;one.&#x20;Audit&#x20;records&#x20;can&#x20;be&#x20;generated&#x20;from&#x20;various&#x20;components&#x20;within&#x20;the&#x20;information&#x20;system&#x20;&#40;e.g.,&#x20;module&#x20;or&#x20;policy&#x20;filter&#41;.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;setfacl&#x20;command.&#x20;-&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;path=/usr/bin/setfacl&#x20;-F&#x20;perm=x&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;perm_chng&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-perm_chng.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.16\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}]'),(29618,'Ensure&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;chacl&#x20;command&#x20;are&#x20;recorded.','The&#x20;operating&#x20;system&#x20;must&#x20;generate&#x20;audit&#x20;records&#x20;for&#x20;successful/unsuccessful&#x20;uses&#x20;of&#x20;the&#x20;chacl&#x20;command.&#x20;chacl&#x20;is&#x20;an&#x20;IRIX-compatibility&#x20;command,&#x20;and&#x20;is&#x20;maintained&#x20;for&#x20;those&#x20;users&#x20;who&#x20;are&#x20;familiar&#x20;with&#x20;its&#x20;use&#x20;from&#x20;either&#x20;XFS&#x20;or&#x20;IRIX.','chacl&#x20;changes&#x20;the&#x20;ACL&#40;s&#41;&#x20;for&#x20;a&#x20;file&#x20;or&#x20;directory.&#x20;Without&#x20;generating&#x20;audit&#x20;records&#x20;that&#x20;are&#x20;specific&#x20;to&#x20;the&#x20;security&#x20;and&#x20;mission&#x20;needs&#x20;of&#x20;the&#x20;organization,&#x20;it&#x20;would&#x20;be&#x20;difficult&#x20;to&#x20;establish,&#x20;correlate,&#x20;and&#x20;investigate&#x20;the&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident&#x20;or&#x20;identify&#x20;those&#x20;responsible&#x20;for&#x20;one.&#x20;Audit&#x20;records&#x20;can&#x20;be&#x20;generated&#x20;from&#x20;various&#x20;components&#x20;within&#x20;the&#x20;information&#x20;system&#x20;&#40;e.g.,&#x20;module&#x20;or&#x20;policy&#x20;filter&#41;.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;chacl&#x20;command.&#x20;-&#x20;64&#x20;Bit&#x20;systems:&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;path=/usr/bin/chacl&#x20;-F&#x20;perm=x&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;perm_chng&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-perm_chng.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.17\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}]'),(29619,'Ensure&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;usermod&#x20;command&#x20;are&#x20;recorded.','The&#x20;operating&#x20;system&#x20;must&#x20;generate&#x20;audit&#x20;records&#x20;for&#x20;successful/unsuccessful&#x20;uses&#x20;of&#x20;the&#x20;usermod&#x20;command.','The&#x20;usermod&#x20;command&#x20;modifies&#x20;the&#x20;system&#x20;account&#x20;files&#x20;to&#x20;reflect&#x20;the&#x20;changes&#x20;that&#x20;are&#x20;specified&#x20;on&#x20;the&#x20;command&#x20;line.&#x20;Without&#x20;generating&#x20;audit&#x20;records&#x20;that&#x20;are&#x20;specific&#x20;to&#x20;the&#x20;security&#x20;and&#x20;mission&#x20;needs&#x20;of&#x20;the&#x20;organization,&#x20;it&#x20;would&#x20;be&#x20;difficult&#x20;to&#x20;establish,&#x20;correlate,&#x20;and&#x20;investigate&#x20;the&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident&#x20;or&#x20;identify&#x20;those&#x20;responsible&#x20;for&#x20;one.&#x20;Audit&#x20;records&#x20;can&#x20;be&#x20;generated&#x20;from&#x20;various&#x20;components&#x20;within&#x20;the&#x20;information&#x20;system&#x20;&#40;e.g.,&#x20;module&#x20;or&#x20;policy&#x20;filter&#41;.','','Create&#x20;audit&#x20;rules:&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;successful&#x20;and&#x20;unsuccessful&#x20;attempts&#x20;to&#x20;use&#x20;the&#x20;usermod&#x20;command.&#x20;-&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;path=/usr/sbin/usermod&#x20;-F&#x20;perm=x&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;usermod&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-usermod.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;Load&#x20;audit&#x20;rules:&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi&#x20;-&#x20;32&#x20;Bit&#x20;systems:&#x20;Follow&#x20;the&#x20;same&#x20;procedures&#x20;as&#x20;for&#x20;64&#x20;bit&#x20;systems&#x20;and&#x20;ignore&#x20;any&#x20;entries&#x20;with&#x20;b64.','[{\"cis\": [\"4.1.3.18\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}]'),(29620,'Ensure&#x20;kernel&#x20;module&#x20;loading&#x20;unloading&#x20;and&#x20;modification&#x20;is&#x20;collected.','Monitor&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;kernel&#x20;modules.&#x20;All&#x20;the&#x20;loading&#x20;/&#x20;listing&#x20;/&#x20;dependency&#x20;checking&#x20;of&#x20;modules&#x20;is&#x20;done&#x20;by&#x20;kmod&#x20;via&#x20;symbolic&#x20;links.&#x20;The&#x20;following&#x20;system&#x20;calls&#x20;control&#x20;loading&#x20;and&#x20;unloading&#x20;of&#x20;modules:&#x20;-&#x20;init_module&#x20;-&#x20;load&#x20;a&#x20;module.&#x20;-&#x20;finit_module&#x20;-&#x20;load&#x20;a&#x20;module&#x20;&#40;used&#x20;when&#x20;the&#x20;overhead&#x20;of&#x20;using&#x20;cryptographically&#x20;signed&#x20;modules&#x20;to&#x20;determine&#x20;the&#x20;authenticity&#x20;of&#x20;a&#x20;module&#x20;can&#x20;be&#x20;avoided&#41;.&#x20;-&#x20;delete_module&#x20;-&#x20;delete&#x20;a&#x20;module.&#x20;-&#x20;create_module&#x20;-&#x20;create&#x20;a&#x20;loadable&#x20;module&#x20;entry.&#x20;-&#x20;query_module&#x20;-&#x20;query&#x20;the&#x20;kernel&#x20;for&#x20;various&#x20;bits&#x20;pertaining&#x20;to&#x20;modules.&#x20;Any&#x20;execution&#x20;of&#x20;the&#x20;loading&#x20;and&#x20;unloading&#x20;module&#x20;programs&#x20;and&#x20;system&#x20;calls&#x20;will&#x20;trigger&#x20;an&#x20;audit&#x20;record&#x20;with&#x20;an&#x20;identifier&#x20;of&#x20;modules.','Monitoring&#x20;the&#x20;use&#x20;of&#x20;all&#x20;the&#x20;various&#x20;ways&#x20;to&#x20;manipulate&#x20;kernel&#x20;modules&#x20;could&#x20;provide&#x20;system&#x20;administrators&#x20;with&#x20;evidence&#x20;that&#x20;an&#x20;unauthorized&#x20;change&#x20;was&#x20;made&#x20;to&#x20;a&#x20;kernel&#x20;module,&#x20;possibly&#x20;compromising&#x20;the&#x20;security&#x20;of&#x20;the&#x20;system.','','Create&#x20;audit&#x20;rules&#x20;Edit&#x20;or&#x20;create&#x20;a&#x20;file&#x20;in&#x20;the&#x20;/etc/audit/rules.d/&#x20;directory,&#x20;ending&#x20;in&#x20;.rules&#x20;extension,&#x20;with&#x20;the&#x20;relevant&#x20;rules&#x20;to&#x20;monitor&#x20;kernel&#x20;module&#x20;modification.&#x20;64&#x20;Bit&#x20;systems&#x20;Example:&#x20;#&#x20;{&#x20;UID_MIN=$&#40;awk&#x20;&#039;/^s*UID_MIN/{print&#x20;$2}&#039;&#x20;/etc/login.defs&#41;&#x20;[&#x20;-n&#x20;&quot;${UID_MIN}&quot;&#x20;]&#x20;&amp;&amp;&#x20;printf&#x20;&quot;&#x20;-a&#x20;always,exit&#x20;-F&#x20;arch=b64&#x20;-S&#x20;init_module,finit_module,delete_module,create_module,query_module&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;kernel_modules&#x20;-a&#x20;always,exit&#x20;-F&#x20;path=/usr/bin/kmod&#x20;-F&#x20;perm=x&#x20;-F&#x20;auid&gt;=${UID_MIN}&#x20;-F&#x20;auid!=unset&#x20;-k&#x20;kernel_modules&#x20;&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/50-kernel_modules.rules&#x20;||&#x20;printf&#x20;&quot;ERROR:&#x20;Variable&#x20;&#039;UID_MIN&#039;&#x20;is&#x20;unset.&#x0a;&quot;&#x20;}&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.19\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}, {\"mitre_mitigations\": [\"M1047\"]}]'),(29621,'Ensure&#x20;the&#x20;audit&#x20;configuration&#x20;is&#x20;immutable.','Set&#x20;system&#x20;audit&#x20;so&#x20;that&#x20;audit&#x20;rules&#x20;cannot&#x20;be&#x20;modified&#x20;with&#x20;auditctl.&#x20;Setting&#x20;the&#x20;flag&#x20;&quot;-e&#x20;2&quot;&#x20;forces&#x20;audit&#x20;to&#x20;be&#x20;put&#x20;in&#x20;immutable&#x20;mode.&#x20;Audit&#x20;changes&#x20;can&#x20;only&#x20;be&#x20;made&#x20;on&#x20;system&#x20;reboot.&#x20;Note:&#x20;This&#x20;setting&#x20;will&#x20;require&#x20;the&#x20;system&#x20;to&#x20;be&#x20;rebooted&#x20;to&#x20;update&#x20;the&#x20;active&#x20;auditd&#x20;configuration&#x20;settings.','In&#x20;immutable&#x20;mode,&#x20;unauthorized&#x20;users&#x20;cannot&#x20;execute&#x20;changes&#x20;to&#x20;the&#x20;audit&#x20;system&#x20;to&#x20;potentially&#x20;hide&#x20;malicious&#x20;activity&#x20;and&#x20;then&#x20;put&#x20;the&#x20;audit&#x20;rules&#x20;back.&#x20;Users&#x20;would&#x20;most&#x20;likely&#x20;notice&#x20;a&#x20;system&#x20;reboot&#x20;and&#x20;that&#x20;could&#x20;alert&#x20;administrators&#x20;of&#x20;an&#x20;attempt&#x20;to&#x20;make&#x20;unauthorized&#x20;audit&#x20;changes.','','Edit&#x20;or&#x20;create&#x20;the&#x20;file&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;and&#x20;add&#x20;the&#x20;line&#x20;-e&#x20;2&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file:&#x20;Example:&#x20;#&#x20;printf&#x20;--&#x20;&quot;-e&#x20;2&quot;&#x20;&gt;&gt;&#x20;/etc/audit/rules.d/99-finalize.rules&#x20;Load&#x20;audit&#x20;rules&#x20;Merge&#x20;and&#x20;load&#x20;the&#x20;rules&#x20;into&#x20;active&#x20;configuration:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;#&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;printf&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&#x0a;&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.20\"]}, {\"cis_csc_v8\": [\"3.3\", \"8.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.3\", \"AC.L2-3.1.5\", \"AU.L2-3.3.1\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\", \"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\", \"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"AU-3\", \"AU-3(1)\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29622,'Ensure&#x20;the&#x20;running&#x20;and&#x20;on&#x20;disk&#x20;configuration&#x20;is&#x20;the&#x20;same.','The&#x20;Audit&#x20;system&#x20;have&#x20;both&#x20;on&#x20;disk&#x20;and&#x20;running&#x20;configuration.&#x20;It&#x20;is&#x20;possible&#x20;for&#x20;these&#x20;configuration&#x20;settings&#x20;to&#x20;differ.&#x20;Note:&#x20;Due&#x20;to&#x20;the&#x20;limitations&#x20;of&#x20;augenrules&#x20;and&#x20;auditctl,&#x20;it&#x20;is&#x20;not&#x20;absolutely&#x20;guaranteed&#x20;that&#x20;loading&#x20;the&#x20;rule&#x20;sets&#x20;via&#x20;augenrules&#x20;--load&#x20;will&#x20;result&#x20;in&#x20;all&#x20;rules&#x20;being&#x20;loaded&#x20;or&#x20;even&#x20;that&#x20;the&#x20;user&#x20;will&#x20;be&#x20;informed&#x20;if&#x20;there&#x20;was&#x20;a&#x20;problem&#x20;loading&#x20;the&#x20;rules.','Configuration&#x20;differences&#x20;between&#x20;what&#x20;is&#x20;currently&#x20;running&#x20;and&#x20;what&#x20;is&#x20;on&#x20;disk&#x20;could&#x20;cause&#x20;unexpected&#x20;problems&#x20;or&#x20;may&#x20;give&#x20;a&#x20;false&#x20;impression&#x20;of&#x20;compliance&#x20;requirements.','','If&#x20;the&#x20;rules&#x20;are&#x20;not&#x20;aligned&#x20;across&#x20;all&#x20;three&#x20;&#40;&#41;&#x20;areas,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;merge&#x20;and&#x20;load&#x20;all&#x20;rules:&#x20;#&#x20;augenrules&#x20;--load&#x20;Check&#x20;if&#x20;reboot&#x20;is&#x20;required.&#x20;if&#x20;[[&#x20;$&#40;auditctl&#x20;-s&#x20;|&#x20;grep&#x20;&quot;enabled&quot;&#41;&#x20;=~&#x20;&quot;2&quot;&#x20;]];&#x20;then&#x20;echo&#x20;&quot;Reboot&#x20;required&#x20;to&#x20;load&#x20;rules&quot;;&#x20;fi.','[{\"cis\": [\"4.1.3.21\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}]'),(29623,'Ensure&#x20;only&#x20;authorized&#x20;groups&#x20;are&#x20;assigned&#x20;ownership&#x20;of&#x20;audit&#x20;log&#x20;files.','Audit&#x20;log&#x20;files&#x20;contain&#x20;information&#x20;about&#x20;the&#x20;system&#x20;and&#x20;system&#x20;activity.','Access&#x20;to&#x20;audit&#x20;records&#x20;can&#x20;reveal&#x20;system&#x20;and&#x20;configuration&#x20;data&#x20;to&#x20;attackers,&#x20;potentially&#x20;compromising&#x20;its&#x20;confidentiality.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;configure&#x20;the&#x20;audit&#x20;log&#x20;files&#x20;to&#x20;be&#x20;owned&#x20;by&#x20;adm&#x20;group:&#x20;#&#x20;find&#x20;$&#40;dirname&#x20;$&#40;awk&#x20;-F&quot;=&quot;&#x20;&#039;/^s*log_file/&#x20;{print&#x20;$2}&#039;&#x20;/etc/audit/auditd.conf&#x20;|&#x20;xargs&#41;&#41;&#x20;-type&#x20;f&#x20;&#40;&#x20;!&#x20;-group&#x20;adm&#x20;-a&#x20;!&#x20;-group&#x20;root&#x20;&#41;&#x20;-exec&#x20;chgrp&#x20;adm&#x20;{}&#x20;+&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;configure&#x20;the&#x20;audit&#x20;log&#x20;files&#x20;to&#x20;be&#x20;owned&#x20;by&#x20;the&#x20;adm&#x20;group:&#x20;#&#x20;chgrp&#x20;adm&#x20;/var/log/audit/&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;log_group&#x20;parameter&#x20;in&#x20;the&#x20;audit&#x20;configuration&#x20;file&#x20;to&#x20;log_group&#x20;=&#x20;adm:&#x20;#&#x20;sed&#x20;-ri&#x20;&#039;s/^s*#?s*log_groups*=s*S+&#40;s*#.*&#41;?.*$/log_group&#x20;=&#x20;adm1/&#039;&#x20;/etc/audit/auditd.conf&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;restart&#x20;the&#x20;audit&#x20;daemon&#x20;to&#x20;reload&#x20;the&#x20;configuration&#x20;file:&#x20;#&#x20;systemctl&#x20;restart&#x20;auditd.','[{\"cis\": [\"4.1.4.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29624,'Ensure&#x20;audit&#x20;configuration&#x20;files&#x20;are&#x20;640&#x20;or&#x20;more&#x20;restrictive.','Audit&#x20;configuration&#x20;files&#x20;control&#x20;auditd&#x20;and&#x20;what&#x20;events&#x20;are&#x20;audited.','Access&#x20;to&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;could&#x20;allow&#x20;unauthorized&#x20;personnel&#x20;to&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events.&#x20;Misconfigured&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events&#x20;or&#x20;impact&#x20;the&#x20;system&#039;s&#x20;performance&#x20;by&#x20;overwhelming&#x20;the&#x20;audit&#x20;log.&#x20;Misconfiguration&#x20;of&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;also&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;to&#x20;establish&#x20;and&#x20;investigate&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;than&#x20;0640&#x20;from&#x20;the&#x20;audit&#x20;configuration&#x20;files:&#x20;#&#x20;find&#x20;/etc/audit/&#x20;-type&#x20;f&#x20;&#40;&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-o&#x20;-name&#x20;&#039;*.rules&#039;&#x20;&#41;&#x20;-exec&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;{}&#x20;+.','[{\"cis\": [\"4.1.4.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29625,'Ensure&#x20;audit&#x20;configuration&#x20;files&#x20;are&#x20;owned&#x20;by&#x20;root.','Audit&#x20;configuration&#x20;files&#x20;control&#x20;auditd&#x20;and&#x20;what&#x20;events&#x20;are&#x20;audited.','Access&#x20;to&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;could&#x20;allow&#x20;unauthorized&#x20;personnel&#x20;to&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events.&#x20;Misconfigured&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events&#x20;or&#x20;impact&#x20;the&#x20;system&#039;s&#x20;performance&#x20;by&#x20;overwhelming&#x20;the&#x20;audit&#x20;log.&#x20;Misconfiguration&#x20;of&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;also&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;to&#x20;establish&#x20;and&#x20;investigate&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;ownership&#x20;to&#x20;root&#x20;user:&#x20;#&#x20;find&#x20;/etc/audit/&#x20;-type&#x20;f&#x20;&#40;&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-o&#x20;-name&#x20;&#039;*.rules&#039;&#x20;&#41;&#x20;!&#x20;-user&#x20;root&#x20;-exec&#x20;chown&#x20;root&#x20;{}&#x20;+.','[{\"cis\": [\"4.1.4.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29626,'Ensure&#x20;audit&#x20;configuration&#x20;files&#x20;belong&#x20;to&#x20;group&#x20;root.','Audit&#x20;configuration&#x20;files&#x20;control&#x20;auditd&#x20;and&#x20;what&#x20;events&#x20;are&#x20;audited.','Access&#x20;to&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;could&#x20;allow&#x20;unauthorized&#x20;personnel&#x20;to&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events.&#x20;Misconfigured&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;prevent&#x20;the&#x20;auditing&#x20;of&#x20;critical&#x20;events&#x20;or&#x20;impact&#x20;the&#x20;system&#039;s&#x20;performance&#x20;by&#x20;overwhelming&#x20;the&#x20;audit&#x20;log.&#x20;Misconfiguration&#x20;of&#x20;the&#x20;audit&#x20;configuration&#x20;files&#x20;may&#x20;also&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;to&#x20;establish&#x20;and&#x20;investigate&#x20;events&#x20;relating&#x20;to&#x20;an&#x20;incident.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;group&#x20;to&#x20;root:&#x20;#&#x20;find&#x20;/etc/audit/&#x20;-type&#x20;f&#x20;&#40;&#x20;-name&#x20;&#039;*.conf&#039;&#x20;-o&#x20;-name&#x20;&#039;*.rules&#039;&#x20;&#41;&#x20;!&#x20;-group&#x20;root&#x20;-exec&#x20;chgrp&#x20;root&#x20;{}&#x20;+.','[{\"cis\": [\"4.1.4.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29627,'Ensure&#x20;audit&#x20;tools&#x20;are&#x20;755&#x20;or&#x20;more&#x20;restrictive.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;from&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;chmod&#x20;go-w&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules.','[{\"cis\": [\"4.1.4.8\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29628,'Ensure&#x20;audit&#x20;tools&#x20;are&#x20;owned&#x20;by&#x20;root.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;the&#x20;owner&#x20;of&#x20;the&#x20;audit&#x20;tools&#x20;to&#x20;the&#x20;root&#x20;user:&#x20;#&#x20;chown&#x20;root&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules.','[{\"cis\": [\"4.1.4.9\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29629,'Ensure&#x20;audit&#x20;tools&#x20;belong&#x20;to&#x20;group&#x20;root.','Audit&#x20;tools&#x20;include,&#x20;but&#x20;are&#x20;not&#x20;limited&#x20;to,&#x20;vendor-provided&#x20;and&#x20;open&#x20;source&#x20;audit&#x20;tools&#x20;needed&#x20;to&#x20;successfully&#x20;view&#x20;and&#x20;manipulate&#x20;audit&#x20;information&#x20;system&#x20;activity&#x20;and&#x20;records.&#x20;Audit&#x20;tools&#x20;include&#x20;custom&#x20;queries&#x20;and&#x20;report&#x20;generators.','Protecting&#x20;audit&#x20;information&#x20;includes&#x20;identifying&#x20;and&#x20;protecting&#x20;the&#x20;tools&#x20;used&#x20;to&#x20;view&#x20;and&#x20;manipulate&#x20;log&#x20;data.&#x20;Protecting&#x20;audit&#x20;tools&#x20;is&#x20;necessary&#x20;to&#x20;prevent&#x20;unauthorized&#x20;operation&#x20;on&#x20;audit&#x20;information.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;more&#x20;permissive&#x20;mode&#x20;from&#x20;the&#x20;audit&#x20;tools:&#x20;#&#x20;chmod&#x20;go-w&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;change&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;audit&#x20;tools&#x20;to&#x20;root&#x20;user&#x20;and&#x20;group:&#x20;#&#x20;chown&#x20;root:root&#x20;/sbin/auditctl&#x20;/sbin/aureport&#x20;/sbin/ausearch&#x20;/sbin/autrace&#x20;/sbin/auditd&#x20;/sbin/augenrules.','[{\"cis\": [\"4.1.4.10\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29630,'Ensure&#x20;systemd-journal-remote&#x20;is&#x20;installed.','Journald&#x20;&#40;via&#x20;systemd-journal-remote&#41;&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;log&#x20;events&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;enabling&#x20;centralised&#x20;log&#x20;management.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;systemd-journal-remote:&#x20;#&#x20;apt&#x20;install&#x20;systemd-journal-remote.','[{\"cis\": [\"4.2.1.1.1\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(29631,'Ensure&#x20;systemd-journal-remote&#x20;is&#x20;enabled.','Journald&#x20;&#40;via&#x20;systemd-journal-remote&#41;&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;send&#x20;log&#x20;events&#x20;it&#x20;gathers&#x20;to&#x20;a&#x20;remote&#x20;log&#x20;host&#x20;or&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;enabling&#x20;centralised&#x20;log&#x20;management.','Storing&#x20;log&#x20;data&#x20;on&#x20;a&#x20;remote&#x20;host&#x20;protects&#x20;log&#x20;integrity&#x20;from&#x20;local&#x20;attacks.&#x20;If&#x20;an&#x20;attacker&#x20;gains&#x20;root&#x20;access&#x20;on&#x20;the&#x20;local&#x20;system,&#x20;they&#x20;could&#x20;tamper&#x20;with&#x20;or&#x20;remove&#x20;log&#x20;data&#x20;that&#x20;is&#x20;stored&#x20;on&#x20;the&#x20;local&#x20;system.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;systemd-journal-remote:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;systemd-journal-upload.service.','[{\"cis\": [\"4.2.1.1.3\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(29632,'Ensure&#x20;journald&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;recieve&#x20;logs&#x20;from&#x20;a&#x20;remote&#x20;client.','Journald&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;acting&#x20;as&#x20;a&#x20;log&#x20;server.&#x20;Clients&#x20;should&#x20;not&#x20;receive&#x20;data&#x20;from&#x20;other&#x20;hosts.&#x20;NOTE:&#x20;-&#x20;The&#x20;same&#x20;package,&#x20;systemd-journal-remote,&#x20;is&#x20;used&#x20;for&#x20;both&#x20;sending&#x20;logs&#x20;to&#x20;remote&#x20;hosts&#x20;and&#x20;receiving&#x20;incoming&#x20;logs.&#x20;-&#x20;With&#x20;regards&#x20;to&#x20;receiving&#x20;logs,&#x20;there&#x20;are&#x20;two&#x20;services;&#x20;systemd-journal-remote.socket&#x20;and&#x20;systemd-journal-remote.service.','If&#x20;a&#x20;client&#x20;is&#x20;configured&#x20;to&#x20;also&#x20;receive&#x20;data,&#x20;thus&#x20;turning&#x20;it&#x20;into&#x20;a&#x20;server,&#x20;the&#x20;client&#x20;system&#x20;is&#x20;acting&#x20;outside&#x20;it&#039;s&#x20;operational&#x20;boundary.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;systemd-journal-remote.socket:&#x20;#&#x20;systemctl&#x20;--now&#x20;disable&#x20;systemd-journal-remote.socket.','[{\"cis\": [\"4.2.1.1.4\"]}, {\"cis_csc_v8\": [\"4.8\", \"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\", \"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(29633,'Ensure&#x20;journald&#x20;service&#x20;is&#x20;enabled.','Ensure&#x20;that&#x20;the&#x20;systemd-journald&#x20;service&#x20;is&#x20;enabled&#x20;to&#x20;allow&#x20;capturing&#x20;of&#x20;logging&#x20;events.','If&#x20;the&#x20;systemd-journald&#x20;service&#x20;is&#x20;not&#x20;enabled&#x20;to&#x20;start&#x20;on&#x20;boot,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;capture&#x20;logging&#x20;events.','','By&#x20;default&#x20;the&#x20;systemd-journald&#x20;service&#x20;does&#x20;not&#x20;have&#x20;an&#x20;[Install]&#x20;section&#x20;and&#x20;thus&#x20;cannot&#x20;be&#x20;enabled&#x20;/&#x20;disabled.&#x20;It&#x20;is&#x20;meant&#x20;to&#x20;be&#x20;referenced&#x20;as&#x20;Requires&#x20;or&#x20;Wants&#x20;by&#x20;other&#x20;unit&#x20;files.&#x20;As&#x20;such,&#x20;if&#x20;the&#x20;status&#x20;of&#x20;systemd-journald&#x20;is&#x20;not&#x20;static,&#x20;investigate&#x20;why.','[{\"cis\": [\"4.2.1.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29634,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;compress&#x20;large&#x20;log&#x20;files.','The&#x20;journald&#x20;system&#x20;includes&#x20;the&#x20;capability&#x20;of&#x20;compressing&#x20;overly&#x20;large&#x20;files&#x20;to&#x20;avoid&#x20;filling&#x20;up&#x20;the&#x20;system&#x20;with&#x20;logs&#x20;or&#x20;making&#x20;the&#x20;logs&#x20;unmanageably&#x20;large.','Uncompressed&#x20;large&#x20;files&#x20;may&#x20;unexpectedly&#x20;fill&#x20;a&#x20;filesystem&#x20;leading&#x20;to&#x20;resource&#x20;unavailability.&#x20;Compressing&#x20;logs&#x20;prior&#x20;to&#x20;write&#x20;can&#x20;prevent&#x20;sudden,&#x20;unexpected&#x20;filesystem&#x20;impacts.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Compress=yes&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald.','[{\"cis\": [\"4.2.1.3\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.3\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.4\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.7\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"A1.1\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1053\"]}]'),(29635,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;write&#x20;logfiles&#x20;to&#x20;persistent&#x20;disk.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Logs&#x20;in&#x20;memory&#x20;will&#x20;be&#x20;lost&#x20;upon&#x20;a&#x20;system&#x20;reboot.&#x20;By&#x20;persisting&#x20;logs&#x20;to&#x20;local&#x20;disk&#x20;on&#x20;the&#x20;server&#x20;they&#x20;are&#x20;protected&#x20;from&#x20;loss&#x20;due&#x20;to&#x20;a&#x20;reboot.','Writing&#x20;log&#x20;data&#x20;to&#x20;disk&#x20;will&#x20;provide&#x20;the&#x20;ability&#x20;to&#x20;forensically&#x20;reconstruct&#x20;events&#x20;which&#x20;may&#x20;have&#x20;impacted&#x20;the&#x20;operations&#x20;or&#x20;security&#x20;of&#x20;a&#x20;system&#x20;even&#x20;after&#x20;a&#x20;system&#x20;crash&#x20;or&#x20;reboot.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Storage=persistent&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald.','[{\"cis\": [\"4.2.1.4\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29636,'Ensure&#x20;journald&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;should&#x20;be&#x20;kept&#x20;in&#x20;the&#x20;confines&#x20;of&#x20;the&#x20;service&#x20;and&#x20;not&#x20;forwarded&#x20;on&#x20;to&#x20;other&#x20;services.','IF&#x20;journald&#x20;is&#x20;the&#x20;method&#x20;for&#x20;capturing&#x20;logs,&#x20;all&#x20;logs&#x20;of&#x20;the&#x20;system&#x20;should&#x20;be&#x20;handled&#x20;by&#x20;journald&#x20;and&#x20;not&#x20;forwarded&#x20;to&#x20;other&#x20;logging&#x20;mechanisms.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;ensure&#x20;that&#x20;ForwardToSyslog=yes&#x20;is&#x20;removed.&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;systemd-journald.','[{\"cis\": [\"4.2.1.5\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.9\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.5.3\", \"10.5.4\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"10.3.3\"]}, {\"nist_sp_800-53\": [\"AU-7\", \"AU-6(3)\"]}, {\"soc_2\": [\"PL1.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0040\"]}, {\"mitre_mitigations\": [\"M1029\"]}]'),(29637,'Ensure&#x20;rsyslog&#x20;is&#x20;installed.','The&#x20;rsyslog&#x20;software&#x20;is&#x20;recommended&#x20;in&#x20;environments&#x20;where&#x20;journald&#x20;does&#x20;not&#x20;meet&#x20;operation&#x20;requirements.','The&#x20;security&#x20;enhancements&#x20;of&#x20;rsyslog&#x20;such&#x20;as&#x20;connection-oriented&#x20;&#40;i.e.&#x20;TCP&#41;&#x20;transmission&#x20;of&#x20;logs,&#x20;the&#x20;option&#x20;to&#x20;log&#x20;to&#x20;database&#x20;formats,&#x20;and&#x20;the&#x20;encryption&#x20;of&#x20;log&#x20;data&#x20;en&#x20;route&#x20;to&#x20;a&#x20;central&#x20;logging&#x20;server&#41;&#x20;justify&#x20;installing&#x20;and&#x20;configuring&#x20;the&#x20;package.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;rsyslog:&#x20;#&#x20;apt&#x20;install&#x20;rsyslog.','[{\"cis\": [\"4.2.2.1\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1005\", \"T1070\", \"T1070.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29638,'Ensure&#x20;rsyslog&#x20;service&#x20;is&#x20;enabled.','Once&#x20;the&#x20;rsyslog&#x20;package&#x20;is&#x20;installed,&#x20;ensure&#x20;that&#x20;the&#x20;service&#x20;is&#x20;enabled.','If&#x20;the&#x20;rsyslog&#x20;service&#x20;is&#x20;not&#x20;enabled&#x20;to&#x20;start&#x20;on&#x20;boot,&#x20;the&#x20;system&#x20;will&#x20;not&#x20;capture&#x20;logging&#x20;events.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;rsyslog:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;rsyslog.','[{\"cis\": [\"4.2.2.2\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29639,'Ensure&#x20;journald&#x20;is&#x20;configured&#x20;to&#x20;send&#x20;logs&#x20;to&#x20;rsyslog.','Data&#x20;from&#x20;journald&#x20;may&#x20;be&#x20;stored&#x20;in&#x20;volatile&#x20;memory&#x20;or&#x20;persisted&#x20;locally&#x20;on&#x20;the&#x20;server.&#x20;Utilities&#x20;exist&#x20;to&#x20;accept&#x20;remote&#x20;export&#x20;of&#x20;journald&#x20;logs,&#x20;however,&#x20;use&#x20;of&#x20;the&#x20;RSyslog&#x20;service&#x20;provides&#x20;a&#x20;consistent&#x20;means&#x20;of&#x20;log&#x20;collection&#x20;and&#x20;export.','IF&#x20;RSyslog&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;capturing&#x20;logs,&#x20;all&#x20;logs&#x20;of&#x20;the&#x20;system&#x20;should&#x20;be&#x20;sent&#x20;to&#x20;it&#x20;for&#x20;further&#x20;processing.','','Edit&#x20;the&#x20;/etc/systemd/journald.conf&#x20;file&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;ForwardToSyslog=yes&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.2.3\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.9\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"6.5\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"10.5.3\", \"10.5.4\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"10.3.3\"]}, {\"nist_sp_800-53\": [\"AU-7\", \"AU-6(3)\"]}, {\"soc_2\": [\"PL1.4\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}]'),(29640,'Ensure&#x20;rsyslog&#x20;default&#x20;file&#x20;permissions&#x20;are&#x20;configured.','RSyslog&#x20;will&#x20;create&#x20;logfiles&#x20;that&#x20;do&#x20;not&#x20;already&#x20;exist&#x20;on&#x20;the&#x20;system.&#x20;This&#x20;setting&#x20;controls&#x20;what&#x20;permissions&#x20;will&#x20;be&#x20;applied&#x20;to&#x20;these&#x20;newly&#x20;created&#x20;files.','It&#x20;is&#x20;important&#x20;to&#x20;ensure&#x20;that&#x20;log&#x20;files&#x20;have&#x20;the&#x20;correct&#x20;permissions&#x20;to&#x20;ensure&#x20;that&#x20;sensitive&#x20;data&#x20;is&#x20;archived&#x20;and&#x20;protected.','The&#x20;systems&#x20;global&#x20;umask&#x20;could&#x20;override,&#x20;but&#x20;only&#x20;making&#x20;the&#x20;file&#x20;permissions&#x20;stricter,&#x20;what&#x20;is&#x20;configured&#x20;in&#x20;RSyslog&#x20;with&#x20;the&#x20;FileCreateMode&#x20;directive.&#x20;RSyslog&#x20;also&#x20;has&#x20;it&#039;s&#x20;own&#x20;$umask&#x20;directive&#x20;that&#x20;can&#x20;alter&#x20;the&#x20;intended&#x20;file&#x20;creation&#x20;mode.&#x20;In&#x20;addition,&#x20;consideration&#x20;should&#x20;be&#x20;given&#x20;to&#x20;how&#x20;FileCreateMode&#x20;is&#x20;used.&#x20;Thus&#x20;it&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;intended&#x20;file&#x20;creation&#x20;mode&#x20;is&#x20;not&#x20;overridden&#x20;with&#x20;less&#x20;restrictive&#x20;settings&#x20;in&#x20;/etc/rsyslog.conf,&#x20;/etc/rsyslog.d&#47;&#42;conf&#x20;files&#x20;and&#x20;that&#x20;FileCreateMode&#x20;is&#x20;set&#x20;before&#x20;any&#x20;file&#x20;is&#x20;created.','Edit&#x20;either&#x20;/etc/rsyslog.conf&#x20;or&#x20;a&#x20;dedicated&#x20;.conf&#x20;file&#x20;in&#x20;/etc/rsyslog.d/&#x20;and&#x20;set&#x20;$FileCreateMode&#x20;to&#x20;0640&#x20;or&#x20;more&#x20;restrictive:&#x20;$FileCreateMode&#x20;0640&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.2.4\"]}, {\"cis_csc_v8\": [\"3.3\", \"8.2\"]}, {\"cis_csc_v7\": [\"5.1\", \"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\", \"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\", \"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\", \"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\", \"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1083\"]}, {\"mitre_tactics\": [\"TA0007\"]}]'),(29641,'Ensure&#x20;rsyslog&#x20;is&#x20;not&#x20;configured&#x20;to&#x20;receive&#x20;logs&#x20;from&#x20;a&#x20;remote&#x20;client.','RSyslog&#x20;supports&#x20;the&#x20;ability&#x20;to&#x20;receive&#x20;messages&#x20;from&#x20;remote&#x20;hosts,&#x20;thus&#x20;acting&#x20;as&#x20;a&#x20;log&#x20;server.&#x20;Clients&#x20;should&#x20;not&#x20;receive&#x20;data&#x20;from&#x20;other&#x20;hosts.','If&#x20;a&#x20;client&#x20;is&#x20;configured&#x20;to&#x20;also&#x20;receive&#x20;data,&#x20;thus&#x20;turning&#x20;it&#x20;into&#x20;a&#x20;server,&#x20;the&#x20;client&#x20;system&#x20;is&#x20;acting&#x20;outside&#x20;it&#039;s&#x20;operational&#x20;boundary.','','Should&#x20;there&#x20;be&#x20;any&#x20;active&#x20;log&#x20;server&#x20;configuration&#x20;found&#x20;in&#x20;the&#x20;auditing&#x20;section,&#x20;modify&#x20;those&#x20;file&#x20;and&#x20;remove&#x20;the&#x20;specific&#x20;lines&#x20;highlighted&#x20;by&#x20;the&#x20;audit.&#x20;Ensure&#x20;none&#x20;of&#x20;the&#x20;following&#x20;entries&#x20;are&#x20;present&#x20;in&#x20;any&#x20;of&#x20;/etc/rsyslog.conf&#x20;or&#x20;/etc/rsyslog.d&#47;&#42;.conf.&#x20;Old&#x20;format&#x20;$ModLoad&#x20;imtcp&#x20;$InputTCPServerRun&#x20;New&#x20;format&#x20;module&#40;load=&quot;imtcp&quot;&#41;&#x20;input&#40;type=&quot;imtcp&quot;&#x20;port=&quot;514&quot;&#41;&#x20;Restart&#x20;the&#x20;service:&#x20;#&#x20;systemctl&#x20;restart&#x20;rsyslog.','[{\"cis\": [\"4.2.2.7\"]}, {\"cis_csc_v8\": [\"4.8\", \"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\", \"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1070\", \"T1070.002\", \"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29642,'Ensure&#x20;cron&#x20;daemon&#x20;is&#x20;enabled&#x20;and&#x20;running.','The&#x20;cron&#x20;daemon&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;batch&#x20;jobs&#x20;on&#x20;the&#x20;system.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','While&#x20;there&#x20;may&#x20;not&#x20;be&#x20;user&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;be&#x20;run&#x20;on&#x20;the&#x20;system,&#x20;the&#x20;system&#x20;does&#x20;have&#x20;maintenance&#x20;jobs&#x20;that&#x20;may&#x20;include&#x20;security&#x20;monitoring&#x20;that&#x20;have&#x20;to&#x20;run,&#x20;and&#x20;cron&#x20;is&#x20;used&#x20;to&#x20;execute&#x20;them.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;and&#x20;start&#x20;cron:&#x20;#&#x20;systemctl&#x20;--now&#x20;enable&#x20;cron.','[{\"cis\": [\"5.1.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.001\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29643,'Ensure&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;are&#x20;configured.','The&#x20;/etc/crontab&#x20;file&#x20;is&#x20;used&#x20;by&#x20;cron&#x20;to&#x20;control&#x20;its&#x20;own&#x20;jobs.&#x20;The&#x20;commands&#x20;in&#x20;this&#x20;item&#x20;make&#x20;sure&#x20;that&#x20;root&#x20;is&#x20;the&#x20;user&#x20;and&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file&#x20;and&#x20;that&#x20;only&#x20;the&#x20;owner&#x20;can&#x20;access&#x20;the&#x20;file.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','This&#x20;file&#x20;contains&#x20;information&#x20;on&#x20;what&#x20;system&#x20;jobs&#x20;are&#x20;run&#x20;by&#x20;cron.&#x20;Write&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;unprivileged&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;elevate&#x20;their&#x20;privileges.&#x20;Read&#x20;access&#x20;to&#x20;these&#x20;files&#x20;could&#x20;provide&#x20;users&#x20;with&#x20;the&#x20;ability&#x20;to&#x20;gain&#x20;insight&#x20;on&#x20;system&#x20;jobs&#x20;that&#x20;run&#x20;on&#x20;the&#x20;system&#x20;and&#x20;could&#x20;provide&#x20;them&#x20;a&#x20;way&#x20;to&#x20;gain&#x20;unauthorized&#x20;privileged&#x20;access.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/crontab&#x20;:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/crontab&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/crontab.','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29644,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.hourly&#x20;are&#x20;configured.','This&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;an&#x20;hourly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.hourly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.hourly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.hourly/.','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29645,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.daily&#x20;are&#x20;configured.','The&#x20;/etc/cron.daily&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;daily&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.daily&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.daily/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.daily/.','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29646,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.weekly&#x20;are&#x20;configured.','The&#x20;/etc/cron.weekly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;weekly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.weekly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.weekly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.weekly/.','[{\"cis\": [\"5.1.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29647,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.monthly&#x20;are&#x20;configured.','The&#x20;/etc/cron.monthly&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;on&#x20;a&#x20;monthly&#x20;basis.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.monthly&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.monthly/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.monthly/.','[{\"cis\": [\"5.1.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29648,'Ensure&#x20;permissions&#x20;on&#x20;/etc/cron.d&#x20;are&#x20;configured.','The&#x20;/etc/cron.d&#x20;directory&#x20;contains&#x20;system&#x20;cron&#x20;jobs&#x20;that&#x20;need&#x20;to&#x20;run&#x20;in&#x20;a&#x20;similar&#x20;manner&#x20;to&#x20;the&#x20;hourly,&#x20;daily&#x20;weekly&#x20;and&#x20;monthly&#x20;jobs&#x20;from&#x20;/etc/crontab,&#x20;but&#x20;require&#x20;more&#x20;granular&#x20;control&#x20;as&#x20;to&#x20;when&#x20;they&#x20;run.&#x20;The&#x20;files&#x20;in&#x20;this&#x20;directory&#x20;cannot&#x20;be&#x20;manipulated&#x20;by&#x20;the&#x20;crontab&#x20;command,&#x20;but&#x20;are&#x20;instead&#x20;edited&#x20;by&#x20;system&#x20;administrators&#x20;using&#x20;a&#x20;text&#x20;editor.&#x20;The&#x20;commands&#x20;below&#x20;restrict&#x20;read/write&#x20;and&#x20;search&#x20;access&#x20;to&#x20;user&#x20;and&#x20;group&#x20;root,&#x20;preventing&#x20;regular&#x20;users&#x20;from&#x20;accessing&#x20;this&#x20;directory.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Granting&#x20;write&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;for&#x20;non-privileged&#x20;users&#x20;could&#x20;provide&#x20;them&#x20;the&#x20;means&#x20;for&#x20;gaining&#x20;unauthorized&#x20;elevated&#x20;privileges.&#x20;Granting&#x20;read&#x20;access&#x20;to&#x20;this&#x20;directory&#x20;could&#x20;give&#x20;an&#x20;unprivileged&#x20;user&#x20;insight&#x20;in&#x20;how&#x20;to&#x20;gain&#x20;elevated&#x20;privileges&#x20;or&#x20;circumvent&#x20;auditing&#x20;controls.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;the&#x20;/etc/cron.d&#x20;directory:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.d/&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/cron.d/.','[{\"cis\": [\"5.1.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29649,'Ensure&#x20;cron&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/cron.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;this&#x20;service.&#x20;If&#x20;/etc/cron.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/cron.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;this&#x20;file&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/cron.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;cron.&#x20;Notes:&#x20;-&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;cron&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.&#x20;-&#x20;Even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;-&#x20;The&#x20;cron.allow&#x20;file&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;cron&#x20;jobs.&#x20;Using&#x20;the&#x20;cron.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;cron&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/cron.deny:&#x20;#&#x20;rm&#x20;/etc/cron.deny&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/cron.allow&#x20;#&#x20;touch&#x20;/etc/cron.allow&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/cron.allow:&#x20;#&#x20;chmod&#x20;g-wx,o-rwx&#x20;/etc/cron.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/cron.allow.','[{\"cis\": [\"5.1.8\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29650,'Ensure&#x20;at&#x20;is&#x20;restricted&#x20;to&#x20;authorized&#x20;users.','Configure&#x20;/etc/at.allow&#x20;to&#x20;allow&#x20;specific&#x20;users&#x20;to&#x20;use&#x20;this&#x20;service.&#x20;If&#x20;/etc/at.allow&#x20;does&#x20;not&#x20;exist,&#x20;then&#x20;/etc/at.deny&#x20;is&#x20;checked.&#x20;Any&#x20;user&#x20;not&#x20;specifically&#x20;defined&#x20;in&#x20;this&#x20;file&#x20;is&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;By&#x20;removing&#x20;the&#x20;file,&#x20;only&#x20;users&#x20;in&#x20;/etc/at.allow&#x20;are&#x20;allowed&#x20;to&#x20;use&#x20;at.&#x20;Note:&#x20;Other&#x20;methods,&#x20;such&#x20;as&#x20;systemd&#x20;timers,&#x20;exist&#x20;for&#x20;scheduling&#x20;jobs.&#x20;If&#x20;another&#x20;method&#x20;is&#x20;used,&#x20;at&#x20;should&#x20;be&#x20;removed,&#x20;and&#x20;the&#x20;alternate&#x20;method&#x20;should&#x20;be&#x20;secured&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;is&#x20;authorized&#x20;to&#x20;schedule&#x20;at&#x20;jobs.&#x20;Using&#x20;the&#x20;at.allow&#x20;file&#x20;to&#x20;control&#x20;who&#x20;can&#x20;run&#x20;at&#x20;jobs&#x20;enforces&#x20;this&#x20;policy.&#x20;It&#x20;is&#x20;easier&#x20;to&#x20;manage&#x20;an&#x20;allow&#x20;list&#x20;than&#x20;a&#x20;deny&#x20;list.&#x20;In&#x20;a&#x20;deny&#x20;list,&#x20;you&#x20;could&#x20;potentially&#x20;add&#x20;a&#x20;user&#x20;ID&#x20;to&#x20;the&#x20;system&#x20;and&#x20;forget&#x20;to&#x20;add&#x20;it&#x20;to&#x20;the&#x20;deny&#x20;files.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;/etc/at.deny:&#x20;#&#x20;rm&#x20;/etc/at.deny&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;create&#x20;/etc/at.allow&#x20;#&#x20;touch&#x20;/etc/at.allow&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;permissions&#x20;and&#x20;ownership&#x20;for&#x20;/etc/at.allow:&#x20;#&#x20;chmod&#x20;g-wx,o-rwx&#x20;/etc/at.allow&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/at.allow.','[{\"cis\": [\"5.1.9\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1053\", \"T1053.003\"]}, {\"mitre_tactics\": [\"TA0002\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29651,'Ensure&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config&#x20;are&#x20;configured.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;contains&#x20;configuration&#x20;specifications&#x20;for&#x20;sshd.&#x20;The&#x20;command&#x20;below&#x20;sets&#x20;the&#x20;owner&#x20;and&#x20;group&#x20;of&#x20;the&#x20;file&#x20;to&#x20;root.','The&#x20;/etc/ssh/sshd_config&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;and&#x20;permissions&#x20;on&#x20;/etc/ssh/sshd_config:&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/ssh/sshd_config&#x20;#&#x20;chmod&#x20;og-rwx&#x20;/etc/ssh/sshd_config.','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1098\", \"T1098.004\", \"T1543\", \"T1543.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29652,'Ensure&#x20;SSH&#x20;access&#x20;is&#x20;limited.','There&#x20;are&#x20;several&#x20;options&#x20;available&#x20;to&#x20;limit&#x20;which&#x20;users&#x20;and&#x20;group&#x20;can&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;at&#x20;least&#x20;one&#x20;of&#x20;the&#x20;following&#x20;options&#x20;be&#x20;leveraged:&#x20;-&#x20;AllowUsers:&#x20;&gt;&#x20;The&#x20;AllowUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;only&#x20;allowing&#x20;the&#x20;allowed&#x20;users&#x20;to&#x20;log&#x20;in&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;AllowGroups:&#x20;&gt;&#x20;The&#x20;AllowGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;allowing&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;-&#x20;DenyUsers:&#x20;&gt;&#x20;The&#x20;DenyUsers&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;user&#x20;names.&#x20;Numeric&#x20;user&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.&#x20;If&#x20;a&#x20;system&#x20;administrator&#x20;wants&#x20;to&#x20;restrict&#x20;user&#x20;access&#x20;further&#x20;by&#x20;specifically&#x20;denying&#x20;a&#x20;user&#039;s&#x20;access&#x20;from&#x20;a&#x20;particular&#x20;host,&#x20;the&#x20;entry&#x20;can&#x20;be&#x20;specified&#x20;in&#x20;the&#x20;form&#x20;of&#x20;user@host.&#x20;-&#x20;DenyGroups:&#x20;&gt;&#x20;The&#x20;DenyGroups&#x20;variable&#x20;gives&#x20;the&#x20;system&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;denying&#x20;specific&#x20;groups&#x20;of&#x20;users&#x20;to&#x20;ssh&#x20;into&#x20;the&#x20;system.&#x20;The&#x20;list&#x20;consists&#x20;of&#x20;space&#x20;separated&#x20;group&#x20;names.&#x20;Numeric&#x20;group&#x20;IDs&#x20;are&#x20;not&#x20;recognized&#x20;with&#x20;this&#x20;variable.','Restricting&#x20;which&#x20;users&#x20;can&#x20;remotely&#x20;access&#x20;the&#x20;system&#x20;via&#x20;SSH&#x20;will&#x20;help&#x20;ensure&#x20;that&#x20;only&#x20;authorized&#x20;users&#x20;access&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;one&#x20;or&#x20;more&#x20;of&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;AllowGroups&#x20;&lt;grouplist&gt;&#x20;OR&#x20;DenyUsers&#x20;&lt;userlist&gt;&#x20;OR&#x20;DenyGroups&#x20;&lt;grouplist&gt;.','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1021\", \"T1021.004\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1018\"]}]'),(29653,'Ensure&#x20;SSH&#x20;LogLevel&#x20;is&#x20;appropriate.','INFO&#x20;level&#x20;is&#x20;the&#x20;basic&#x20;level&#x20;that&#x20;only&#x20;records&#x20;login&#x20;activity&#x20;of&#x20;SSH&#x20;users.&#x20;In&#x20;many&#x20;situations,&#x20;such&#x20;as&#x20;Incident&#x20;Response,&#x20;it&#x20;is&#x20;important&#x20;to&#x20;determine&#x20;when&#x20;a&#x20;particular&#x20;user&#x20;was&#x20;active&#x20;on&#x20;a&#x20;system.&#x20;The&#x20;logout&#x20;record&#x20;can&#x20;eliminate&#x20;those&#x20;users&#x20;who&#x20;disconnected,&#x20;which&#x20;helps&#x20;narrow&#x20;the&#x20;field.&#x20;VERBOSE&#x20;level&#x20;specifies&#x20;that&#x20;login&#x20;and&#x20;logout&#x20;activity&#x20;as&#x20;well&#x20;as&#x20;the&#x20;key&#x20;fingerprint&#x20;for&#x20;any&#x20;SSH&#x20;key&#x20;used&#x20;for&#x20;login&#x20;will&#x20;be&#x20;logged.&#x20;This&#x20;information&#x20;is&#x20;important&#x20;for&#x20;SSH&#x20;key&#x20;management,&#x20;especially&#x20;in&#x20;legacy&#x20;environments.','SSH&#x20;provides&#x20;several&#x20;logging&#x20;levels&#x20;with&#x20;varying&#x20;amounts&#x20;of&#x20;verbosity.&#x20;DEBUG&#x20;is&#x20;specifically&#x20;not&#x20;recommended&#x20;other&#x20;than&#x20;strictly&#x20;for&#x20;debugging&#x20;SSH&#x20;communications&#x20;since&#x20;it&#x20;provides&#x20;so&#x20;much&#x20;data&#x20;that&#x20;it&#x20;is&#x20;difficult&#x20;to&#x20;identify&#x20;important&#x20;security&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LogLevel&#x20;VERBOSE&#x20;OR&#x20;LogLevel&#x20;INFO.','[{\"cis\": [\"5.2.5\"]}, {\"cis_csc_v8\": [\"8.2\"]}, {\"cis_csc_v7\": [\"6.2\", \"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"pci_dss_3.2.1\": [\"10.2\", \"10.3\"]}, {\"pci_dss_4.0\": [\"5.3.4\", \"6.4.1\", \"6.4.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0005\"]}]'),(29654,'Ensure&#x20;SSH&#x20;PAM&#x20;is&#x20;enabled.','The&#x20;UsePAM&#x20;directive&#x20;enables&#x20;the&#x20;Pluggable&#x20;Authentication&#x20;Module&#x20;&#40;PAM&#41;&#x20;interface.&#x20;If&#x20;set&#x20;to&#x20;yes&#x20;this&#x20;will&#x20;enable&#x20;PAM&#x20;authentication&#x20;using&#x20;ChallengeResponseAuthentication&#x20;and&#x20;PasswordAuthentication&#x20;directives&#x20;in&#x20;addition&#x20;to&#x20;PAM&#x20;account&#x20;and&#x20;session&#x20;module&#x20;processing&#x20;for&#x20;all&#x20;authentication&#x20;types.','When&#x20;usePAM&#x20;is&#x20;set&#x20;to&#x20;yes,&#x20;PAM&#x20;runs&#x20;through&#x20;account&#x20;and&#x20;session&#x20;types&#x20;properly.&#x20;This&#x20;is&#x20;important&#x20;if&#x20;you&#x20;want&#x20;to&#x20;restrict&#x20;access&#x20;to&#x20;services&#x20;based&#x20;off&#x20;of&#x20;IP,&#x20;time&#x20;or&#x20;other&#x20;factors&#x20;of&#x20;the&#x20;account.&#x20;Additionally,&#x20;you&#x20;can&#x20;make&#x20;sure&#x20;users&#x20;inherit&#x20;certain&#x20;environment&#x20;variables&#x20;on&#x20;login&#x20;or&#x20;disallow&#x20;access&#x20;to&#x20;the&#x20;server.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;UsePAM&#x20;yes.','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1021\", \"T1021.004\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1035\"]}]'),(29655,'Ensure&#x20;SSH&#x20;root&#x20;login&#x20;is&#x20;disabled.','The&#x20;PermitRootLogin&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;root&#x20;user&#x20;can&#x20;log&#x20;in&#x20;using&#x20;SSH.&#x20;The&#x20;default&#x20;is&#x20;prohibit-password.','Disallowing&#x20;root&#x20;logins&#x20;over&#x20;SSH&#x20;requires&#x20;system&#x20;admins&#x20;to&#x20;authenticate&#x20;using&#x20;their&#x20;own&#x20;individual&#x20;account,&#x20;then&#x20;escalating&#x20;to&#x20;root.&#x20;This&#x20;limits&#x20;opportunity&#x20;for&#x20;non-repudiation&#x20;and&#x20;provides&#x20;a&#x20;clear&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;a&#x20;security&#x20;incident.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitRootLogin&#x20;no.','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29656,'Ensure&#x20;SSH&#x20;HostbasedAuthentication&#x20;is&#x20;disabled.','The&#x20;HostbasedAuthentication&#x20;parameter&#x20;specifies&#x20;if&#x20;authentication&#x20;is&#x20;allowed&#x20;through&#x20;trusted&#x20;hosts&#x20;via&#x20;the&#x20;user&#x20;of&#x20;.rhosts,&#x20;or&#x20;/etc/hosts.equiv,&#x20;along&#x20;with&#x20;successful&#x20;public&#x20;key&#x20;client&#x20;host&#x20;authentication.','Even&#x20;though&#x20;the&#x20;.rhosts&#x20;files&#x20;are&#x20;ineffective&#x20;if&#x20;support&#x20;is&#x20;disabled&#x20;in&#x20;/etc/pam.conf,&#x20;disabling&#x20;the&#x20;ability&#x20;to&#x20;use&#x20;.rhosts&#x20;files&#x20;in&#x20;SSH&#x20;provides&#x20;an&#x20;additional&#x20;layer&#x20;of&#x20;protection.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;HostbasedAuthentication&#x20;no.','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29657,'Ensure&#x20;SSH&#x20;PermitEmptyPasswords&#x20;is&#x20;disabled.','The&#x20;PermitEmptyPasswords&#x20;parameter&#x20;specifies&#x20;if&#x20;the&#x20;SSH&#x20;server&#x20;allows&#x20;login&#x20;to&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;strings.','Disallowing&#x20;remote&#x20;shell&#x20;access&#x20;to&#x20;accounts&#x20;that&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;reduces&#x20;the&#x20;probability&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;the&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitEmptyPasswords&#x20;no.','[{\"cis\": [\"5.2.9\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"16.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29658,'Ensure&#x20;SSH&#x20;PermitUserEnvironment&#x20;is&#x20;disabled.','The&#x20;PermitUserEnvironment&#x20;option&#x20;allows&#x20;users&#x20;to&#x20;present&#x20;environment&#x20;options&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','Permitting&#x20;users&#x20;the&#x20;ability&#x20;to&#x20;set&#x20;environment&#x20;variables&#x20;through&#x20;the&#x20;SSH&#x20;daemon&#x20;could&#x20;potentially&#x20;allow&#x20;users&#x20;to&#x20;bypass&#x20;security&#x20;controls&#x20;&#40;e.g.&#x20;setting&#x20;an&#x20;execution&#x20;path&#x20;that&#x20;has&#x20;SSH&#x20;executing&#x20;trojan&#039;d&#x20;programs&#41;.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;PermitUserEnvironment&#x20;no.','[{\"cis\": [\"5.2.10\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1021\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29659,'Ensure&#x20;SSH&#x20;IgnoreRhosts&#x20;is&#x20;enabled.','The&#x20;IgnoreRhosts&#x20;parameter&#x20;specifies&#x20;that&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;will&#x20;not&#x20;be&#x20;used&#x20;in&#x20;RhostsRSAAuthentication&#x20;or&#x20;HostbasedAuthentication.','Setting&#x20;this&#x20;parameter&#x20;forces&#x20;users&#x20;to&#x20;enter&#x20;a&#x20;password&#x20;when&#x20;authenticating&#x20;with&#x20;SSH.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;IgnoreRhosts&#x20;yes.','[{\"cis\": [\"5.2.11\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29660,'Ensure&#x20;SSH&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled.','The&#x20;X11Forwarding&#x20;parameter&#x20;provides&#x20;the&#x20;ability&#x20;to&#x20;tunnel&#x20;X11&#x20;traffic&#x20;through&#x20;the&#x20;connection&#x20;to&#x20;enable&#x20;remote&#x20;graphic&#x20;connections.','Disable&#x20;X11&#x20;forwarding&#x20;unless&#x20;there&#x20;is&#x20;an&#x20;operational&#x20;requirement&#x20;to&#x20;use&#x20;X11&#x20;applications&#x20;directly.&#x20;There&#x20;is&#x20;a&#x20;small&#x20;risk&#x20;that&#x20;the&#x20;remote&#x20;X11&#x20;servers&#x20;of&#x20;users&#x20;who&#x20;are&#x20;logged&#x20;in&#x20;via&#x20;SSH&#x20;with&#x20;X11&#x20;forwarding&#x20;could&#x20;be&#x20;compromised&#x20;by&#x20;other&#x20;users&#x20;on&#x20;the&#x20;X11&#x20;server.&#x20;Note&#x20;that&#x20;even&#x20;if&#x20;X11&#x20;forwarding&#x20;is&#x20;disabled,&#x20;users&#x20;can&#x20;always&#x20;install&#x20;their&#x20;own&#x20;forwarders.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;X11Forwarding&#x20;no.','[{\"cis\": [\"5.2.12\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"pci_dss_3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1210\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29661,'Ensure&#x20;only&#x20;strong&#x20;Ciphers&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;ciphers&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Note:&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;ciphers.&#x20;-&#x20;Ensure&#x20;that&#x20;ciphers&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;-&#x20;The&#x20;only&#x20;&quot;strong&quot;&#x20;ciphers&#x20;currently&#x20;FIPS&#x20;140-2&#x20;compliant&#x20;are:&#x20;aes256-ctr,&#x20;aes192-ctr,&#x20;aes128-ctr.&#x20;-&#x20;Supported&#x20;ciphers&#x20;in&#x20;openSSH&#x20;8.2:&#x20;3des-cbc,&#x20;aes128-cbc,&#x20;aes192-cbc,&#x20;aes256-cbc,&#x20;aes128-ctr,&#x20;aes192-ctr,&#x20;aes256-ctr,&#x20;aes128-gcm@openssh.com,&#x20;aes256-gcm@openssh.com,&#x20;chacha20-poly1305@openssh.com.','Weak&#x20;ciphers&#x20;that&#x20;are&#x20;used&#x20;for&#x20;authentication&#x20;to&#x20;the&#x20;cryptographic&#x20;module&#x20;cannot&#x20;be&#x20;relied&#x20;upon&#x20;to&#x20;provide&#x20;confidentiality&#x20;or&#x20;integrity,&#x20;and&#x20;system&#x20;data&#x20;may&#x20;be&#x20;compromised.&#x20;-&#x20;The&#x20;Triple&#x20;DES&#x20;ciphers,&#x20;as&#x20;used&#x20;in&#x20;SSH,&#x20;have&#x20;a&#x20;birthday&#x20;bound&#x20;of&#x20;approximately&#x20;four&#x20;billion&#x20;blocks,&#x20;which&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;obtain&#x20;clear&#x20;text&#x20;data&#x20;via&#x20;a&#x20;birthday&#x20;attack&#x20;against&#x20;a&#x20;long-duration&#x20;encrypted&#x20;session,&#x20;aka&#x20;a&#x20;&quot;Sweet32&quot;&#x20;attack.&#x20;-&#x20;Error&#x20;handling&#x20;in&#x20;the&#x20;SSH&#x20;protocol;&#x20;Client&#x20;and&#x20;Server,&#x20;when&#x20;using&#x20;a&#x20;block&#x20;cipher&#x20;algorithm&#x20;in&#x20;Cipher&#x20;Block&#x20;Chaining&#x20;&#40;CBC&#41;&#x20;mode,&#x20;makes&#x20;it&#x20;easier&#x20;for&#x20;remote&#x20;attackers&#x20;to&#x20;recover&#x20;certain&#x20;plain&#x20;text&#x20;data&#x20;from&#x20;an&#x20;arbitrary&#x20;block&#x20;of&#x20;cipher&#x20;text&#x20;in&#x20;an&#x20;SSH&#x20;session&#x20;via&#x20;unknown&#x20;vectors.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;Ciphers&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;ciphers.&#x20;Example:&#x20;Ciphers&#x20;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr.','[{\"cis\": [\"5.2.13\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"AC-17(2)\", \"SC-8\", \"SC-8(1)\"]}, {\"iso_27001-2013\": [\"A.10.1.1\", \"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1040\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}]'),(29662,'Ensure&#x20;only&#x20;strong&#x20;MAC&#x20;algorithms&#x20;are&#x20;used.','This&#x20;variable&#x20;limits&#x20;the&#x20;types&#x20;of&#x20;MAC&#x20;algorithms&#x20;that&#x20;SSH&#x20;can&#x20;use&#x20;during&#x20;communication.&#x20;Notes:&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;MACs.&#x20;-&#x20;Ensure&#x20;that&#x20;MACs&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;-&#x20;The&#x20;only&#x20;&quot;strong&quot;&#x20;MACs&#x20;currently&#x20;FIPS&#x20;140-2&#x20;approved&#x20;are:&#x20;hmac-sha2-256,&#x20;hmac-sha2-512.&#x20;-&#x20;The&#x20;Supported&#x20;MACs&#x20;are:&#x20;hmac-md5,&#x20;hmac-md5-96,&#x20;hmac-sha1,&#x20;hmac-sha1-96,&#x20;hmac-sha2-256,&#x20;hmac-sha2-512,&#x20;umac-64@openssh.co,&#x20;umac-128@openssh.com,&#x20;hmac-md5-etm@openssh.com,&#x20;hmac-md5-96-etm@openssh.com,&#x20;hmac-sha1-etm@openssh.com,&#x20;hmac-sha1-96-etm@openssh.com,&#x20;hmac-sha2-256-etm@openss.com,&#x20;hmac-sha2-512-etm@openssh.com,&#x20;umac-64-etm@openssh.com,&#x20;umac-128-etm@openssh.com.','MD5&#x20;and&#x20;96-bit&#x20;MAC&#x20;algorithms&#x20;are&#x20;considered&#x20;weak&#x20;and&#x20;have&#x20;been&#x20;shown&#x20;to&#x20;increase&#x20;exploitability&#x20;in&#x20;SSH&#x20;downgrade&#x20;attacks.&#x20;Weak&#x20;algorithms&#x20;continue&#x20;to&#x20;have&#x20;a&#x20;great&#x20;deal&#x20;of&#x20;attention&#x20;as&#x20;a&#x20;weak&#x20;spot&#x20;that&#x20;can&#x20;be&#x20;exploited&#x20;with&#x20;expanded&#x20;computing&#x20;power.&#x20;An&#x20;attacker&#x20;that&#x20;breaks&#x20;the&#x20;algorithm&#x20;could&#x20;take&#x20;advantage&#x20;of&#x20;a&#x20;MiTM&#x20;position&#x20;to&#x20;decrypt&#x20;the&#x20;SSH&#x20;tunnel&#x20;and&#x20;capture&#x20;credentials&#x20;and&#x20;information.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;and&#x20;add/modify&#x20;the&#x20;MACs&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;MACs.Example:&#x20;MACs&#x20;hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256.','[{\"cis\": [\"5.2.14\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"cis_csc_v7\": [\"14.4\", \"16.5\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"AC-17(2)\", \"SC-8\", \"SC-8(1)\"]}, {\"iso_27001-2013\": [\"A.10.1.1\", \"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1040\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}]'),(29663,'Ensure&#x20;only&#x20;strong&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;are&#x20;used.','Key&#x20;exchange&#x20;is&#x20;any&#x20;method&#x20;in&#x20;cryptography&#x20;by&#x20;which&#x20;cryptographic&#x20;keys&#x20;are&#x20;exchanged&#x20;between&#x20;two&#x20;parties,&#x20;allowing&#x20;use&#x20;of&#x20;a&#x20;cryptographic&#x20;algorithm.&#x20;If&#x20;the&#x20;sender&#x20;and&#x20;receiver&#x20;wish&#x20;to&#x20;exchange&#x20;encrypted&#x20;messages,&#x20;each&#x20;must&#x20;be&#x20;equipped&#x20;to&#x20;encrypt&#x20;messages&#x20;to&#x20;be&#x20;sent&#x20;and&#x20;decrypt&#x20;messages&#x20;received.&#x20;Notes:&#x20;-&#x20;Kex&#x20;algorithms&#x20;have&#x20;a&#x20;higher&#x20;preference&#x20;the&#x20;earlier&#x20;they&#x20;appear&#x20;in&#x20;the&#x20;list.&#x20;-&#x20;Some&#x20;organizations&#x20;may&#x20;have&#x20;stricter&#x20;requirements&#x20;for&#x20;approved&#x20;Key&#x20;exchange&#x20;algorithms.&#x20;-&#x20;Ensure&#x20;that&#x20;Key&#x20;exchange&#x20;algorithms&#x20;used&#x20;are&#x20;in&#x20;compliance&#x20;with&#x20;site&#x20;policy.&#x20;-&#x20;The&#x20;only&#x20;Key&#x20;Exchange&#x20;Algorithms&#x20;currently&#x20;FIPS&#x20;140-2&#x20;approved&#x20;are:&#x20;ecdh-sha2-nistp256,&#x20;ecdh-sha2-nistp384,&#x20;ecdh-sha2-nistp521,&#x20;diffie-hellman-group-exchange-sha256,&#x20;diffie-hellman-group16-sha512,&#x20;diffie-hellman-group18-sha512,&#x20;diffie-hellman-group14-sha256.&#x20;-&#x20;The&#x20;Key&#x20;Exchange&#x20;algorithms&#x20;supported&#x20;by&#x20;OpenSSH&#x20;8.2&#x20;are:&#x20;curve25519-sha256,&#x20;curve25519-sha256@libssh.org,&#x20;diffie-hellman-group1-sha1,&#x20;diffie-hellman-group14-sha1,&#x20;diffie-hellman-group14-sha256,&#x20;diffie-hellman-group16-sha512,&#x20;diffie-hellman-group18-sha512,&#x20;diffie-hellman-group-exchange-sha1,&#x20;diffie-hellman-group-exchange-sha256,&#x20;ecdh-sha2-nistp256,&#x20;ecdh-sha2-nistp384,&#x20;ecdh-sha2-nistp521,&#x20;sntrup4591761x25519-sha512@tinyssh.org.','Key&#x20;exchange&#x20;methods&#x20;that&#x20;are&#x20;considered&#x20;weak&#x20;should&#x20;be&#x20;removed.&#x20;A&#x20;key&#x20;exchange&#x20;method&#x20;may&#x20;be&#x20;weak&#x20;because&#x20;too&#x20;few&#x20;bits&#x20;are&#x20;used,&#x20;or&#x20;the&#x20;hashing&#x20;algorithm&#x20;is&#x20;considered&#x20;too&#x20;weak.&#x20;Using&#x20;weak&#x20;algorithms&#x20;could&#x20;expose&#x20;connections&#x20;to&#x20;man-in-the-middle&#x20;attacks.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;add/modify&#x20;the&#x20;KexAlgorithms&#x20;line&#x20;to&#x20;contain&#x20;a&#x20;comma&#x20;separated&#x20;list&#x20;of&#x20;the&#x20;site&#x20;approved&#x20;key&#x20;exchange&#x20;algorithms&#x20;Example:&#x20;KexAlgorithms&#x20;curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256.','[{\"cis\": [\"5.2.15\"]}, {\"cis_csc_v8\": [\"3.10\"]}, {\"cis_csc_v7\": [\"14.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.17\", \"AC.L2-3.1.13\", \"IA.L2-3.5.10\", \"SC.L2-3.13.11\", \"SC.L2-3.13.8\", \"SC.L2-3.13.15\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(1)\", \"164.312(e)(2)(i)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"2.1.1\", \"4.1\", \"4.1.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"2.2.7\", \"4.1.1\", \"4.2.1\", \"4.2.1.2\", \"4.2.2\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"AC-17(2)\", \"SC-8\", \"SC-8(1)\"]}, {\"iso_27001-2013\": [\"A.10.1.1\", \"A.13.1.1\"]}, {\"mitre_techniques\": [\"T1040\", \"T1557\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}]'),(29664,'Ensure&#x20;SSH&#x20;AllowTcpForwarding&#x20;is&#x20;disabled.','SSH&#x20;port&#x20;forwarding&#x20;is&#x20;a&#x20;mechanism&#x20;in&#x20;SSH&#x20;for&#x20;tunneling&#x20;application&#x20;ports&#x20;from&#x20;the&#x20;client&#x20;to&#x20;the&#x20;server,&#x20;or&#x20;servers&#x20;to&#x20;clients.&#x20;It&#x20;can&#x20;be&#x20;used&#x20;for&#x20;adding&#x20;encryption&#x20;to&#x20;legacy&#x20;applications,&#x20;going&#x20;through&#x20;firewalls,&#x20;and&#x20;some&#x20;system&#x20;administrators&#x20;and&#x20;IT&#x20;professionals&#x20;use&#x20;it&#x20;for&#x20;opening&#x20;backdoors&#x20;into&#x20;the&#x20;internal&#x20;network&#x20;from&#x20;their&#x20;home&#x20;machines.','Leaving&#x20;port&#x20;forwarding&#x20;enabled&#x20;can&#x20;expose&#x20;the&#x20;organization&#x20;to&#x20;security&#x20;risks&#x20;and&#x20;backdoors.&#x20;SSH&#x20;connections&#x20;are&#x20;protected&#x20;with&#x20;strong&#x20;encryption.&#x20;This&#x20;makes&#x20;their&#x20;contents&#x20;invisible&#x20;to&#x20;most&#x20;deployed&#x20;network&#x20;monitoring&#x20;and&#x20;traffic&#x20;filtering&#x20;solutions.&#x20;This&#x20;invisibility&#x20;carries&#x20;considerable&#x20;risk&#x20;potential&#x20;if&#x20;it&#x20;is&#x20;used&#x20;for&#x20;malicious&#x20;purposes&#x20;such&#x20;as&#x20;data&#x20;exfiltration.&#x20;Cybercriminals&#x20;or&#x20;malware&#x20;could&#x20;exploit&#x20;SSH&#x20;to&#x20;hide&#x20;their&#x20;unauthorized&#x20;communications,&#x20;or&#x20;to&#x20;exfiltrate&#x20;stolen&#x20;data&#x20;from&#x20;the&#x20;target&#x20;network.','SSH&#x20;tunnels&#x20;are&#x20;widely&#x20;used&#x20;in&#x20;many&#x20;corporate&#x20;environments.&#x20;In&#x20;some&#x20;environments&#x20;the&#x20;applications&#x20;themselves&#x20;may&#x20;have&#x20;very&#x20;limited&#x20;native&#x20;support&#x20;for&#x20;security.&#x20;By&#x20;utilizing&#x20;tunneling,&#x20;compliance&#x20;with&#x20;SOX,&#x20;HIPAA,&#x20;PCI-DSS,&#x20;and&#x20;other&#x20;standards&#x20;can&#x20;be&#x20;achieved&#x20;without&#x20;having&#x20;to&#x20;modify&#x20;the&#x20;applications.','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;AllowTcpForwarding&#x20;no.','[{\"cis\": [\"5.2.16\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1048\", \"T1048.002\", \"T1572\"]}, {\"mitre_tactics\": [\"TA0008\"]}, {\"mitre_mitigations\": [\"M1042\"]}]'),(29665,'Ensure&#x20;SSH&#x20;warning&#x20;banner&#x20;is&#x20;configured.','The&#x20;Banner&#x20;parameter&#x20;specifies&#x20;a&#x20;file&#x20;whose&#x20;contents&#x20;must&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;remote&#x20;user&#x20;before&#x20;authentication&#x20;is&#x20;permitted.&#x20;By&#x20;default,&#x20;no&#x20;banner&#x20;is&#x20;displayed.','Banners&#x20;are&#x20;used&#x20;to&#x20;warn&#x20;connecting&#x20;users&#x20;of&#x20;the&#x20;particular&#x20;site&#039;s&#x20;policy&#x20;regarding&#x20;connection.&#x20;Presenting&#x20;a&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;login&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;Banner&#x20;/etc/issue.net.','[{\"cis\": [\"5.2.17\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_tactics\": [\"TA0001\", \"TA0007\"]}, {\"mitre_mitigations\": [\"M1035\"]}]'),(29666,'Ensure&#x20;SSH&#x20;MaxAuthTries&#x20;is&#x20;set&#x20;to&#x20;4&#x20;or&#x20;less.','The&#x20;MaxAuthTries&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;authentication&#x20;attempts&#x20;permitted&#x20;per&#x20;connection.&#x20;When&#x20;the&#x20;login&#x20;failure&#x20;count&#x20;reaches&#x20;half&#x20;the&#x20;number,&#x20;error&#x20;messages&#x20;will&#x20;be&#x20;written&#x20;to&#x20;the&#x20;syslog&#x20;file&#x20;detailing&#x20;the&#x20;login&#x20;failure.','Setting&#x20;the&#x20;MaxAuthTries&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;4,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxAuthTries&#x20;4.','[{\"cis\": [\"5.2.18\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"16.13\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1036\"]}]'),(29667,'Ensure&#x20;SSH&#x20;MaxStartups&#x20;is&#x20;configured.','The&#x20;MaxStartups&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections&#x20;to&#x20;the&#x20;SSH&#x20;daemon.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;pending&#x20;authentication&#x20;connection&#x20;attempts,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxStartups&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxStartups&#x20;10:30:60.','[{\"cis\": [\"5.2.19\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}]'),(29668,'Ensure&#x20;SSH&#x20;MaxSessions&#x20;is&#x20;set&#x20;to&#x20;10&#x20;or&#x20;less.','The&#x20;MaxSessions&#x20;parameter&#x20;specifies&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;open&#x20;sessions&#x20;permitted&#x20;from&#x20;a&#x20;given&#x20;connection.','To&#x20;protect&#x20;a&#x20;system&#x20;from&#x20;denial&#x20;of&#x20;service&#x20;due&#x20;to&#x20;a&#x20;large&#x20;number&#x20;of&#x20;concurrent&#x20;sessions,&#x20;use&#x20;the&#x20;rate&#x20;limiting&#x20;function&#x20;of&#x20;MaxSessions&#x20;to&#x20;protect&#x20;availability&#x20;of&#x20;sshd&#x20;logins&#x20;and&#x20;prevent&#x20;overwhelming&#x20;the&#x20;daemon.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;MaxSessions&#x20;10.','[{\"cis\": [\"5.2.20\"]}, {\"mitre_techniques\": [\"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0040\"]}]'),(29669,'Ensure&#x20;SSH&#x20;LoginGraceTime&#x20;is&#x20;set&#x20;to&#x20;one&#x20;minute&#x20;or&#x20;less.','The&#x20;LoginGraceTime&#x20;parameter&#x20;specifies&#x20;the&#x20;time&#x20;allowed&#x20;for&#x20;successful&#x20;authentication&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;The&#x20;longer&#x20;the&#x20;Grace&#x20;period&#x20;is&#x20;the&#x20;more&#x20;open&#x20;unauthenticated&#x20;connections&#x20;can&#x20;exist.&#x20;Like&#x20;other&#x20;session&#x20;controls&#x20;in&#x20;this&#x20;session&#x20;the&#x20;Grace&#x20;Period&#x20;should&#x20;be&#x20;limited&#x20;to&#x20;appropriate&#x20;organizational&#x20;limits&#x20;to&#x20;ensure&#x20;the&#x20;service&#x20;is&#x20;available&#x20;for&#x20;needed&#x20;access.','Setting&#x20;the&#x20;LoginGraceTime&#x20;parameter&#x20;to&#x20;a&#x20;low&#x20;number&#x20;will&#x20;minimize&#x20;the&#x20;risk&#x20;of&#x20;successful&#x20;brute&#x20;force&#x20;attacks&#x20;to&#x20;the&#x20;SSH&#x20;server.&#x20;It&#x20;will&#x20;also&#x20;limit&#x20;the&#x20;number&#x20;of&#x20;concurrent&#x20;unauthenticated&#x20;connections.&#x20;While&#x20;the&#x20;recommended&#x20;setting&#x20;is&#x20;60&#x20;seconds&#x20;&#40;1&#x20;Minute&#41;,&#x20;set&#x20;the&#x20;number&#x20;based&#x20;on&#x20;site&#x20;policy.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameter&#x20;as&#x20;follows:&#x20;LoginGraceTime&#x20;60.','[{\"cis\": [\"5.2.21\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.6\", \"CM.L2-3.4.2\", \"CM.L2-3.4.7\"]}, {\"pci_dss_3.2.1\": [\"2.2\", \"11.5\"]}, {\"pci_dss_4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.5.1\", \"1.2.7\", \"2.1.1\", \"2.2.1\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\", \"T1110.004\", \"T1499\", \"T1499.002\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1036\"]}]'),(29670,'Ensure&#x20;SSH&#x20;Idle&#x20;Timeout&#x20;Interval&#x20;is&#x20;configured.','NOTE:&#x20;To&#x20;clarify,&#x20;the&#x20;two&#x20;settings&#x20;described&#x20;below&#x20;is&#x20;only&#x20;meant&#x20;for&#x20;idle&#x20;connections&#x20;from&#x20;a&#x20;protocol&#x20;perspective&#x20;and&#x20;not&#x20;meant&#x20;to&#x20;check&#x20;if&#x20;the&#x20;user&#x20;is&#x20;active&#x20;or&#x20;not.&#x20;An&#x20;idle&#x20;user&#x20;does&#x20;not&#x20;mean&#x20;an&#x20;idle&#x20;connection.&#x20;SSH&#x20;does&#x20;not&#x20;and&#x20;never&#x20;had,&#x20;intentionally,&#x20;the&#x20;capability&#x20;to&#x20;drop&#x20;idle&#x20;users.&#x20;In&#x20;SSH&#x20;versions&#x20;before&#x20;8.2p1&#x20;there&#x20;was&#x20;a&#x20;bug&#x20;that&#x20;caused&#x20;these&#x20;values&#x20;to&#x20;behave&#x20;in&#x20;such&#x20;a&#x20;manner&#x20;that&#x20;they&#x20;where&#x20;abused&#x20;to&#x20;disconnect&#x20;idle&#x20;users.&#x20;This&#x20;bug&#x20;has&#x20;been&#x20;resolved&#x20;in&#x20;8.2p1&#x20;and&#x20;thus&#x20;it&#x20;can&#x20;no&#x20;longer&#x20;be&#x20;abused&#x20;disconnect&#x20;idle&#x20;users.&#x20;The&#x20;two&#x20;options&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax&#x20;control&#x20;the&#x20;timeout&#x20;of&#x20;SSH&#x20;sessions.&#x20;Taken&#x20;directly&#x20;from&#x20;man&#x20;5&#x20;sshd_config:&#x20;-&#x20;ClientAliveInterval&#x20;Sets&#x20;a&#x20;timeout&#x20;interval&#x20;in&#x20;seconds&#x20;after&#x20;which&#x20;if&#x20;no&#x20;data&#x20;has&#x20;been&#x20;received&#x20;from&#x20;the&#x20;client,&#x20;sshd&#40;8&#41;&#x20;will&#x20;send&#x20;a&#x20;message&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;to&#x20;request&#x20;a&#x20;response&#x20;from&#x20;the&#x20;client.&#x20;The&#x20;default&#x20;is&#x20;0,&#x20;indicating&#x20;that&#x20;these&#x20;messages&#x20;will&#x20;not&#x20;be&#x20;sent&#x20;to&#x20;the&#x20;client.&#x20;-&#x20;ClientAliveCountMax&#x20;Sets&#x20;the&#x20;number&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;which&#x20;may&#x20;be&#x20;sent&#x20;without&#x20;sshd&#40;8&#41;&#x20;receiving&#x20;any&#x20;messages&#x20;back&#x20;from&#x20;the&#x20;client.&#x20;If&#x20;this&#x20;threshold&#x20;is&#x20;reached&#x20;while&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;being&#x20;sent,&#x20;sshd&#x20;will&#x20;disconnect&#x20;the&#x20;client,&#x20;terminating&#x20;the&#x20;session.&#x20;It&#x20;is&#x20;important&#x20;to&#x20;note&#x20;that&#x20;the&#x20;use&#x20;of&#x20;client&#x20;alive&#x20;messages&#x20;is&#x20;very&#x20;different&#x20;from&#x20;TCPKeepAlive.&#x20;The&#x20;client&#x20;alive&#x20;messages&#x20;are&#x20;sent&#x20;through&#x20;the&#x20;encrypted&#x20;channel&#x20;and&#x20;therefore&#x20;will&#x20;not&#x20;be&#x20;spoofable.&#x20;The&#x20;TCP&#x20;keepalive&#x20;option&#x20;en-abled&#x20;by&#x20;TCPKeepAlive&#x20;is&#x20;spoofable.&#x20;The&#x20;client&#x20;alive&#x20;mechanism&#x20;is&#x20;valuable&#x20;when&#x20;the&#x20;client&#x20;or&#x20;server&#x20;depend&#x20;on&#x20;knowing&#x20;when&#x20;a&#x20;connection&#x20;has&#x20;become&#x20;unresponsive.&#x20;The&#x20;default&#x20;value&#x20;is&#x20;3.&#x20;If&#x20;ClientAliveInterval&#x20;is&#x20;set&#x20;to&#x20;15,&#x20;and&#x20;ClientAliveCountMax&#x20;is&#x20;left&#x20;at&#x20;the&#x20;default,&#x20;unresponsive&#x20;SSH&#x20;clients&#x20;will&#x20;be&#x20;disconnected&#x20;after&#x20;approximately&#x20;45&#x20;seconds.&#x20;Setting&#x20;a&#x20;zero&#x20;ClientAliveCountMax&#x20;disables&#x20;connection&#x20;termination.','In&#x20;order&#x20;to&#x20;prevent&#x20;resource&#x20;exhaustion,&#x20;appropriate&#x20;values&#x20;should&#x20;be&#x20;set&#x20;for&#x20;both&#x20;ClientAliveInterval&#x20;and&#x20;ClientAliveCountMax.&#x20;Specifically,&#x20;looking&#x20;at&#x20;the&#x20;source&#x20;code,&#x20;ClientAliveCountMax&#x20;must&#x20;be&#x20;greater&#x20;than&#x20;zero&#x20;in&#x20;order&#x20;to&#x20;utilize&#x20;the&#x20;ability&#x20;of&#x20;SSH&#x20;to&#x20;drop&#x20;idle&#x20;connections.&#x20;If&#x20;connections&#x20;are&#x20;allowed&#x20;to&#x20;stay&#x20;open&#x20;indefinately,&#x20;this&#x20;can&#x20;potentially&#x20;be&#x20;used&#x20;as&#x20;a&#x20;DDOS&#x20;attack&#x20;or&#x20;simple&#x20;resource&#x20;exhaustion&#x20;could&#x20;occur&#x20;over&#x20;unreliable&#x20;networks.&#x20;The&#x20;example&#x20;set&#x20;here&#x20;is&#x20;a&#x20;45&#x20;second&#x20;timeout.&#x20;Consult&#x20;your&#x20;site&#x20;policy&#x20;for&#x20;network&#x20;timeouts&#x20;and&#x20;apply&#x20;as&#x20;appropriate.','','Edit&#x20;the&#x20;/etc/ssh/sshd_config&#x20;file&#x20;to&#x20;set&#x20;the&#x20;parameters&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;ClientAliveInterval&#x20;15&#x20;ClientAliveCountMax&#x20;3.','[{\"cis\": [\"5.2.22\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(29671,'Ensure&#x20;sudo&#x20;is&#x20;installed.','sudo&#x20;allows&#x20;a&#x20;permitted&#x20;user&#x20;to&#x20;execute&#x20;a&#x20;command&#x20;as&#x20;the&#x20;superuser&#x20;or&#x20;another&#x20;user,&#x20;as&#x20;specified&#x20;by&#x20;the&#x20;security&#x20;policy.&#x20;The&#x20;invoking&#x20;user&#039;s&#x20;real&#x20;&#40;not&#x20;effective&#41;&#x20;user&#x20;ID&#x20;is&#x20;used&#x20;to&#x20;determine&#x20;the&#x20;user&#x20;name&#x20;with&#x20;which&#x20;to&#x20;query&#x20;the&#x20;security&#x20;policy.','sudo&#x20;supports&#x20;a&#x20;plug-in&#x20;architecture&#x20;for&#x20;security&#x20;policies&#x20;and&#x20;input/output&#x20;logging.&#x20;Third&#x20;parties&#x20;can&#x20;develop&#x20;and&#x20;distribute&#x20;their&#x20;own&#x20;policy&#x20;and&#x20;I/O&#x20;logging&#x20;plug-ins&#x20;to&#x20;work&#x20;seamlessly&#x20;with&#x20;the&#x20;sudo&#x20;front&#x20;end.&#x20;The&#x20;default&#x20;security&#x20;policy&#x20;is&#x20;sudoers,&#x20;which&#x20;is&#x20;configured&#x20;via&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;and&#x20;any&#x20;entries&#x20;in&#x20;/etc/sudoers.d.&#x20;The&#x20;security&#x20;policy&#x20;determines&#x20;what&#x20;privileges,&#x20;if&#x20;any,&#x20;a&#x20;user&#x20;has&#x20;to&#x20;run&#x20;sudo.&#x20;The&#x20;policy&#x20;may&#x20;require&#x20;that&#x20;users&#x20;authenticate&#x20;themselves&#x20;with&#x20;a&#x20;password&#x20;or&#x20;another&#x20;authentication&#x20;mechanism.&#x20;If&#x20;authentication&#x20;is&#x20;required,&#x20;sudo&#x20;will&#x20;exit&#x20;if&#x20;the&#x20;user&#039;s&#x20;password&#x20;is&#x20;not&#x20;entered&#x20;within&#x20;a&#x20;configurable&#x20;time&#x20;limit.&#x20;This&#x20;limit&#x20;is&#x20;policy-specific.','','First&#x20;determine&#x20;is&#x20;LDAP&#x20;functionality&#x20;is&#x20;required.&#x20;If&#x20;so,&#x20;then&#x20;install&#x20;sudo-ldap,&#x20;else&#x20;install&#x20;sudo.&#x20;Example:&#x20;#&#x20;apt&#x20;install&#x20;sudo.','[{\"cis\": [\"5.3.1\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}]'),(29672,'Ensure&#x20;sudo&#x20;commands&#x20;use&#x20;pty.','sudo&#x20;can&#x20;be&#x20;configured&#x20;to&#x20;run&#x20;only&#x20;from&#x20;a&#x20;pseudo&#x20;terminal&#x20;&#40;pseudo-pty&#41;.','Attackers&#x20;can&#x20;run&#x20;a&#x20;malicious&#x20;program&#x20;using&#x20;sudo&#x20;which&#x20;would&#x20;fork&#x20;a&#x20;background&#x20;process&#x20;that&#x20;remains&#x20;even&#x20;when&#x20;the&#x20;main&#x20;program&#x20;has&#x20;finished&#x20;executing.','WARNING:&#x20;Editing&#x20;the&#x20;sudo&#x20;configuration&#x20;incorrectly&#x20;can&#x20;cause&#x20;sudo&#x20;to&#x20;stop&#x20;functioning.&#x20;Always&#x20;use&#x20;visudo&#x20;to&#x20;modify&#x20;sudo&#x20;configuration&#x20;files.','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;with&#x20;visudo&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Defaults&#x20;use_pty.','[{\"cis\": [\"5.3.2\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.8.1.3\", \"A.14.2.5\"]}, {\"mitre_techniques\": [\"T1548\", \"T1548.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}]');
INSERT INTO `tsca` VALUES (29673,'Ensure&#x20;sudo&#x20;log&#x20;file&#x20;exists.','sudo&#x20;can&#x20;use&#x20;a&#x20;custom&#x20;log&#x20;file.','A&#x20;sudo&#x20;log&#x20;file&#x20;simplifies&#x20;auditing&#x20;of&#x20;sudo&#x20;commands.','WARNING:&#x20;Editing&#x20;the&#x20;sudo&#x20;configuration&#x20;incorrectly&#x20;can&#x20;cause&#x20;sudo&#x20;to&#x20;stop&#x20;functioning.&#x20;Always&#x20;use&#x20;visudo&#x20;to&#x20;modify&#x20;sudo&#x20;configuration&#x20;files.','Edit&#x20;the&#x20;file&#x20;/etc/sudoers&#x20;or&#x20;a&#x20;file&#x20;in&#x20;/etc/sudoers.d/&#x20;with&#x20;visudo&#x20;or&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;add&#x20;the&#x20;following&#x20;line:&#x20;Example:&#x20;Defaults&#x20;logfile=&quot;/var/log/sudo.log&quot;.','[{\"cis\": [\"5.3.3\"]}, {\"cis_csc_v8\": [\"8.5\"]}, {\"cis_csc_v7\": [\"6.3\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"pci_dss_3.2.1\": [\"10.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_4.0\": [\"9.4.5\", \"10.2\", \"10.2.1\", \"10.2.1.2\", \"10.2.1.5\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"iso_27001-2013\": [\"A.12.4.1\"]}, {\"mitre_techniques\": [\"T1562\", \"T1562.006\"]}, {\"mitre_tactics\": [\"TA0004\"]}]'),(29674,'Ensure&#x20;users&#x20;must&#x20;provide&#x20;password&#x20;for&#x20;privilege&#x20;escalation.','The&#x20;operating&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;so&#x20;that&#x20;users&#x20;must&#x20;provide&#x20;a&#x20;password&#x20;for&#x20;privilege&#x20;escalation.','Without&#x20;&#40;re-&#41;authentication,&#x20;users&#x20;may&#x20;access&#x20;resources&#x20;or&#x20;perform&#x20;tasks&#x20;for&#x20;which&#x20;they&#x20;do&#x20;not&#x20;have&#x20;authorization.&#x20;When&#x20;operating&#x20;systems&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;escalate&#x20;a&#x20;functional&#x20;capability,&#x20;it&#x20;is&#x20;critical&#x20;the&#x20;user&#x20;&#40;re-&#41;authenticate.','This&#x20;will&#x20;prevent&#x20;automated&#x20;processes&#x20;from&#x20;being&#x20;able&#x20;to&#x20;elevate&#x20;privileges.','Based&#x20;on&#x20;the&#x20;outcome&#x20;of&#x20;the&#x20;audit&#x20;procedure,&#x20;use&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;to&#x20;edit&#x20;the&#x20;relevant&#x20;sudoers&#x20;file.&#x20;Remove&#x20;any&#x20;line&#x20;with&#x20;occurrences&#x20;of&#x20;NOPASSWD&#x20;tags&#x20;in&#x20;the&#x20;file.','[{\"cis\": [\"5.3.4\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(29675,'Ensure&#x20;re-authentication&#x20;for&#x20;privilege&#x20;escalation&#x20;is&#x20;not&#x20;disabled&#x20;globally.','The&#x20;operating&#x20;system&#x20;must&#x20;be&#x20;configured&#x20;so&#x20;that&#x20;users&#x20;must&#x20;re-authenticate&#x20;for&#x20;privilege&#x20;escalation.','Without&#x20;re-authentication,&#x20;users&#x20;may&#x20;access&#x20;resources&#x20;or&#x20;perform&#x20;tasks&#x20;for&#x20;which&#x20;they&#x20;do&#x20;not&#x20;have&#x20;authorization.&#x20;When&#x20;operating&#x20;systems&#x20;provide&#x20;the&#x20;capability&#x20;to&#x20;escalate&#x20;a&#x20;functional&#x20;capability,&#x20;it&#x20;is&#x20;critical&#x20;the&#x20;user&#x20;re-authenticate.','','Configure&#x20;the&#x20;operating&#x20;system&#x20;to&#x20;require&#x20;users&#x20;to&#x20;reauthenticate&#x20;for&#x20;privilege&#x20;escalation.&#x20;Based&#x20;on&#x20;the&#x20;outcome&#x20;of&#x20;the&#x20;audit&#x20;procedure,&#x20;use&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;to&#x20;edit&#x20;the&#x20;relevant&#x20;sudoers&#x20;file.&#x20;Remove&#x20;any&#x20;occurrences&#x20;of&#x20;!authenticate&#x20;tags&#x20;in&#x20;the&#x20;file&#40;s&#41;.','[{\"cis\": [\"5.3.5\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(29676,'Ensure&#x20;sudo&#x20;authentication&#x20;timeout&#x20;is&#x20;configured&#x20;correctly.','sudo&#x20;caches&#x20;used&#x20;credentials&#x20;for&#x20;a&#x20;default&#x20;of&#x20;15&#x20;minutes.&#x20;This&#x20;is&#x20;for&#x20;ease&#x20;of&#x20;use&#x20;when&#x20;there&#x20;are&#x20;multiple&#x20;administrative&#x20;tasks&#x20;to&#x20;perform.&#x20;The&#x20;timeout&#x20;can&#x20;be&#x20;modified&#x20;to&#x20;suit&#x20;local&#x20;security&#x20;policies.&#x20;This&#x20;default&#x20;is&#x20;distribution&#x20;specific.&#x20;See&#x20;audit&#x20;section&#x20;for&#x20;further&#x20;information.','Setting&#x20;a&#x20;timeout&#x20;value&#x20;reduces&#x20;the&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;unauthorized&#x20;privileged&#x20;access&#x20;to&#x20;another&#x20;user.','','If&#x20;the&#x20;currently&#x20;configured&#x20;timeout&#x20;is&#x20;larger&#x20;than&#x20;15&#x20;minutes,&#x20;edit&#x20;the&#x20;file&#x20;listed&#x20;in&#x20;the&#x20;audit&#x20;section&#x20;with&#x20;visudo&#x20;-f&#x20;&lt;PATH&#x20;TO&#x20;FILE&gt;&#x20;and&#x20;modify&#x20;the&#x20;entry&#x20;timestamp_timeout=&#x20;to&#x20;15&#x20;minutes&#x20;or&#x20;less&#x20;as&#x20;per&#x20;your&#x20;site&#x20;policy.&#x20;The&#x20;value&#x20;is&#x20;in&#x20;minutes.&#x20;This&#x20;particular&#x20;entry&#x20;may&#x20;appear&#x20;on&#x20;it&#039;s&#x20;own,&#x20;or&#x20;on&#x20;the&#x20;same&#x20;line&#x20;as&#x20;env_reset.&#x20;See&#x20;the&#x20;following&#x20;two&#x20;examples:&#x20;Defaults&#x20;Defaults&#x20;Defaults&#x20;env_reset,&#x20;timestamp_timeout=15&#x20;timestamp_timeout=15&#x20;env_reset.','[{\"cis\": [\"5.3.6\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}]'),(29677,'Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','The&#x20;su&#x20;command&#x20;allows&#x20;a&#x20;user&#x20;to&#x20;run&#x20;a&#x20;command&#x20;or&#x20;shell&#x20;as&#x20;another&#x20;user.&#x20;The&#x20;program&#x20;has&#x20;been&#x20;superseded&#x20;by&#x20;sudo,&#x20;which&#x20;allows&#x20;for&#x20;more&#x20;granular&#x20;control&#x20;over&#x20;privileged&#x20;access.&#x20;Normally,&#x20;the&#x20;su&#x20;command&#x20;can&#x20;be&#x20;executed&#x20;by&#x20;any&#x20;user.&#x20;By&#x20;uncommenting&#x20;the&#x20;pam_wheel.so&#x20;statement&#x20;in&#x20;/etc/pam.d/su,&#x20;the&#x20;su&#x20;command&#x20;will&#x20;only&#x20;allow&#x20;users&#x20;in&#x20;a&#x20;specific&#x20;groups&#x20;to&#x20;execute&#x20;su.&#x20;This&#x20;group&#x20;should&#x20;be&#x20;empty&#x20;to&#x20;reinforce&#x20;the&#x20;use&#x20;of&#x20;sudo&#x20;for&#x20;privileged&#x20;access.','Restricting&#x20;the&#x20;use&#x20;of&#x20;su&#x20;,&#x20;and&#x20;using&#x20;sudo&#x20;in&#x20;its&#x20;place,&#x20;provides&#x20;system&#x20;administrators&#x20;better&#x20;control&#x20;of&#x20;the&#x20;escalation&#x20;of&#x20;user&#x20;privileges&#x20;to&#x20;execute&#x20;privileged&#x20;commands.&#x20;The&#x20;sudo&#x20;utility&#x20;also&#x20;provides&#x20;a&#x20;better&#x20;logging&#x20;and&#x20;audit&#x20;mechanism,&#x20;as&#x20;it&#x20;can&#x20;log&#x20;each&#x20;command&#x20;executed&#x20;via&#x20;sudo&#x20;,&#x20;whereas&#x20;su&#x20;can&#x20;only&#x20;record&#x20;that&#x20;a&#x20;user&#x20;executed&#x20;the&#x20;su&#x20;program.','','Create&#x20;an&#x20;empty&#x20;group&#x20;that&#x20;will&#x20;be&#x20;specified&#x20;for&#x20;use&#x20;of&#x20;the&#x20;su&#x20;command.&#x20;The&#x20;group&#x20;should&#x20;be&#x20;named&#x20;according&#x20;to&#x20;site&#x20;policy.&#x20;Example:&#x20;#&#x20;groupadd&#x20;sugroup&#x20;Add&#x20;the&#x20;following&#x20;line&#x20;to&#x20;the&#x20;/etc/pam.d/su&#x20;file,&#x20;specifying&#x20;the&#x20;empty&#x20;group:&#x20;auth&#x20;required&#x20;pam_wheel.so&#x20;use_uid&#x20;group=sugroup.','[{\"cis\": [\"5.3.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(29678,'Ensure&#x20;password&#x20;creation&#x20;requirements&#x20;are&#x20;configured.','The&#x20;pam_pwquality.so&#x20;module&#x20;checks&#x20;the&#x20;strength&#x20;of&#x20;passwords.&#x20;It&#x20;performs&#x20;checks&#x20;such&#x20;as&#x20;making&#x20;sure&#x20;a&#x20;password&#x20;is&#x20;not&#x20;a&#x20;dictionary&#x20;word,&#x20;it&#x20;is&#x20;a&#x20;certain&#x20;length,&#x20;contains&#x20;a&#x20;mix&#x20;of&#x20;characters&#x20;&#40;e.g.&#x20;alphabet,&#x20;numeric,&#x20;other&#41;&#x20;and&#x20;more.&#x20;The&#x20;following&#x20;options&#x20;are&#x20;set&#x20;in&#x20;the&#x20;/etc/security/pwquality.conf&#x20;file:&#x20;-&#x20;Password&#x20;Length:&#x20;&gt;&#x20;minlen&#x20;=&#x20;14&#x20;-&#x20;password&#x20;must&#x20;be&#x20;14&#x20;characters&#x20;or&#x20;more.&#x20;-&#x20;Password&#x20;complexity:&#x20;&gt;&#x20;minclass&#x20;=&#x20;4&#x20;-&#x20;The&#x20;minimum&#x20;number&#x20;of&#x20;required&#x20;classes&#x20;of&#x20;characters&#x20;for&#x20;the&#x20;new&#x20;password&#x20;&#40;digits,&#x20;uppercase,&#x20;lowercase,&#x20;others&#41;&#x20;OR&#x20;&gt;&#x20;dcredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;digit.&#x20;&gt;&#x20;ucredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;uppercase&#x20;character.&#x20;&gt;&#x20;ocredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;special&#x20;character.&#x20;&gt;&#x20;lcredit&#x20;=&#x20;-1&#x20;-&#x20;provide&#x20;at&#x20;least&#x20;one&#x20;lowercase&#x20;character.','Strong&#x20;passwords&#x20;protect&#x20;systems&#x20;from&#x20;being&#x20;hacked&#x20;through&#x20;brute&#x20;force&#x20;methods.','','The&#x20;following&#x20;setting&#x20;is&#x20;a&#x20;recommend&#x20;example&#x20;policy.&#x20;Alter&#x20;these&#x20;values&#x20;to&#x20;conform&#x20;to&#x20;your&#x20;own&#x20;organization&#039;s&#x20;password&#x20;policies.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;the&#x20;pam_pwquality&#x20;module:&#x20;#&#x20;apt&#x20;install&#x20;libpam-pwquality&#x20;Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;password&#x20;length&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;minlen&#x20;=&#x20;14&#x20;.Edit&#x20;the&#x20;file&#x20;/etc/security/pwquality.conf&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;following&#x20;line&#x20;for&#x20;.password&#x20;complexity&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy:&#x20;Option&#x20;1&#x20;minclass&#x20;=&#x20;4&#x20;Option&#x20;2&#x20;dcredit&#x20;=&#x20;-1,&#x20;ucredit&#x20;=&#x20;-1,&#x20;ocredit&#x20;=&#x20;-1,&#x20;lcredit&#x20;=&#x20;-1.','[{\"cis\": [\"5.4.1\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.001\", \"T1110.002\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29679,'Ensure&#x20;lockout&#x20;for&#x20;failed&#x20;password&#x20;attempts&#x20;is&#x20;configured.','Lock&#x20;out&#x20;users&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts.&#x20;The&#x20;first&#x20;sets&#x20;of&#x20;changes&#x20;are&#x20;made&#x20;to&#x20;the&#x20;common&#x20;PAM&#x20;configuration&#x20;files.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;are&#x20;applied&#x20;to&#x20;the&#x20;program&#x20;specific&#x20;PAM&#x20;configuration&#x20;file.&#x20;The&#x20;second&#x20;set&#x20;of&#x20;changes&#x20;must&#x20;be&#x20;applied&#x20;to&#x20;each&#x20;program&#x20;that&#x20;will&#x20;lock&#x20;out&#x20;users.&#x20;Check&#x20;the&#x20;documentation&#x20;for&#x20;each&#x20;secondary&#x20;program&#x20;for&#x20;instructions&#x20;on&#x20;how&#x20;to&#x20;configure&#x20;them&#x20;to&#x20;work&#x20;with&#x20;PAM.&#x20;All&#x20;configuration&#x20;of&#x20;faillock&#x20;is&#x20;located&#x20;in&#x20;/etc/security/faillock.conf&#x20;and&#x20;well&#x20;commented.&#x20;-&#x20;deny&#x20;&gt;&#x20;Deny&#x20;access&#x20;if&#x20;the&#x20;number&#x20;of&#x20;consecutive&#x20;authentication&#x20;failures&#x20;for&#x20;this&#x20;user&#x20;during&#x20;the&#x20;recent&#x20;interval&#x20;exceeds&#x20;n&#x20;tries.&#x20;-&#x20;fail_interval&#x20;&gt;&#x20;The&#x20;length&#x20;of&#x20;the&#x20;interval,&#x20;in&#x20;seconds,&#x20;during&#x20;which&#x20;the&#x20;consecutive&#x20;authentication&#x20;failures&#x20;must&#x20;happen&#x20;for&#x20;the&#x20;user&#x20;account&#x20;to&#x20;be&#x20;locked&#x20;out.&#x20;-&#x20;unlock_time&#x20;&gt;&#x20;The&#x20;access&#x20;will&#x20;be&#x20;re-enabled&#x20;after&#x20;n&#x20;seconds&#x20;after&#x20;the&#x20;lock&#x20;out.&#x20;The&#x20;value&#x20;0&#x20;has&#x20;the&#x20;same&#x20;meaning&#x20;as&#x20;value&#x20;never&#x20;-&#x20;the&#x20;access&#x20;will&#x20;not&#x20;be&#x20;re-enabled&#x20;without&#x20;resetting&#x20;the&#x20;faillock&#x20;entries&#x20;by&#x20;the&#x20;faillock&#x20;command.&#x20;Set&#x20;the&#x20;lockout&#x20;number&#x20;and&#x20;unlock&#x20;time&#x20;in&#x20;accordance&#x20;with&#x20;local&#x20;site&#x20;policy.','Locking&#x20;out&#x20;user&#x20;IDs&#x20;after&#x20;n&#x20;unsuccessful&#x20;consecutive&#x20;login&#x20;attempts&#x20;mitigates&#x20;brute&#x20;force&#x20;password&#x20;attacks&#x20;against&#x20;your&#x20;systems.','It&#x20;is&#x20;critical&#x20;to&#x20;test&#x20;and&#x20;validate&#x20;any&#x20;PAM&#x20;changes&#x20;before&#x20;deploying.&#x20;Any&#x20;misconfiguration&#x20;could&#x20;cause&#x20;the&#x20;system&#x20;to&#x20;be&#x20;inaccessible.','NOTE:&#x20;Pay&#x20;special&#x20;attention&#x20;to&#x20;the&#x20;configuration.&#x20;Incorrect&#x20;configuration&#x20;can&#x20;cause&#x20;system&#x20;lock&#x20;outs.&#x20;This&#x20;is&#x20;example&#x20;configuration.&#x20;You&#x20;configuration&#x20;may&#x20;differ&#x20;based&#x20;on&#x20;previous&#x20;changes&#x20;to&#x20;the&#x20;files.&#x20;Common&#x20;auth:&#x20;Edit&#x20;/etc/pam.d/common-auth&#x20;and&#x20;ensure&#x20;that&#x20;faillock&#x20;is&#x20;configured.&#x20;Note:&#x20;It&#x20;is&#x20;critical&#x20;to&#x20;understand&#x20;each&#x20;line&#x20;and&#x20;the&#x20;relevant&#x20;arguments&#x20;for&#x20;successful&#x20;implementation.&#x20;The&#x20;order&#x20;of&#x20;these&#x20;entries&#x20;is&#x20;very&#x20;specific.&#x20;The&#x20;pam_faillock.so&#x20;lines&#x20;surround&#x20;the&#x20;pam_unix.so&#x20;line.&#x20;The&#x20;comment&#x20;&quot;Added&#x20;to&#x20;enable&#x20;faillock&quot;&#x20;is&#x20;shown&#x20;to&#x20;highlight&#x20;the&#x20;additional&#x20;lines&#x20;and&#x20;their&#x20;order&#x20;in&#x20;the&#x20;file.&#x20;#&#x20;here&#x20;are&#x20;the&#x20;per-package&#x20;modules&#x20;&#40;the&#x20;&quot;Primary&quot;&#x20;block&#41;&#x20;auth&#x20;required&#x20;pam_faillock.so&#x20;preauth&#x20;#&#x20;Added&#x20;to&#x20;enable&#x20;faillock&#x20;auth&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;nullok&#x20;auth&#x20;[default=die]&#x20;pam_faillock.so&#x20;authfail&#x20;#&#x20;Added&#x20;to&#x20;enable&#x20;faillock&#x20;auth&#x20;sufficient&#x20;pam_faillock.so&#x20;authsucc&#x20;#&#x20;Added&#x20;to&#x20;enable&#x20;faillock&#x20;#&#x20;here&#039;s&#x20;the&#x20;fallback&#x20;if&#x20;no&#x20;module&#x20;succeeds&#x20;auth&#x20;requisite&#x20;pam_deny.so&#x20;#&#x20;prime&#x20;the&#x20;stack&#x20;with&#x20;a&#x20;positive&#x20;return&#x20;value&#x20;if&#x20;there&#x20;isn&#039;t&#x20;one&#x20;already;&#x20;#&#x20;this&#x20;avoids&#x20;us&#x20;returning&#x20;an&#x20;error&#x20;just&#x20;because&#x20;nothing&#x20;sets&#x20;a&#x20;success&#x20;code&#x20;#&#x20;since&#x20;the&#x20;modules&#x20;above&#x20;will&#x20;each&#x20;just&#x20;jump&#x20;around&#x20;auth&#x20;required&#x20;pam_permit.so&#x20;#&#x20;and&#x20;here&#x20;are&#x20;more&#x20;per-package&#x20;modules&#x20;&#40;the&#x20;&quot;Additional&quot;&#x20;block&#41;&#x20;auth&#x20;optional&#x20;pam_cap.so&#x20;#&#x20;end&#x20;of&#x20;pam-auth-update&#x20;config&#x20;Common&#x20;account:&#x20;Edit&#x20;/etc/pam.d/common-account&#x20;and&#x20;ensure&#x20;that&#x20;the&#x20;following&#x20;stanza&#x20;is&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file.&#x20;&gt;&#x20;account&#x20;&gt;&#x20;required&#x20;&gt;&#x20;pam_faillock.so.&#x20;Fail&#x20;lock&#x20;configuration:&#x20;Edit&#x20;/etc/security/faillock.conf&#x20;and&#x20;configure&#x20;it&#x20;per&#x20;your&#x20;site&#x20;policy.&#x20;Example:&#x20;deny&#x20;=&#x20;4&#x20;&gt;&#x20;fail_interval&#x20;=&#x20;900&#x20;&gt;&#x20;unlock&#x20;time&#x20;=&#x20;600.','[{\"cis\": [\"5.4.2\"]}, {\"cis_csc_v8\": [\"6.2\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\"]}, {\"hipaa\": [\"164.308(a)(3)(ii)(C)\"]}, {\"pci_dss_3.2.1\": [\"8.1.3\"]}, {\"pci_dss_4.0\": [\"8.2.4\", \"8.2.5\"]}, {\"nist_sp_800-53\": [\"AC-2(1)\"]}, {\"soc_2\": [\"CC6.2\", \"CC6.3\"]}, {\"iso_27001-2013\": [\"A.9.2.6\"]}, {\"mitre_techniques\": [\"T1110\", \"T1110.001\", \"T1110.003\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29680,'Ensure&#x20;password&#x20;reuse&#x20;is&#x20;limited.','The&#x20;/etc/security/opasswd&#x20;file&#x20;stores&#x20;the&#x20;users&#x20;old&#x20;passwords&#x20;and&#x20;can&#x20;be&#x20;checked&#x20;to&#x20;ensure&#x20;that&#x20;users&#x20;are&#x20;not&#x20;recycling&#x20;recent&#x20;passwords.','Forcing&#x20;users&#x20;not&#x20;to&#x20;reuse&#x20;their&#x20;past&#x20;5&#x20;passwords&#x20;make&#x20;it&#x20;less&#x20;likely&#x20;that&#x20;an&#x20;attacker&#x20;will&#x20;be&#x20;able&#x20;to&#x20;guess&#x20;the&#x20;password.','','NOTE:&#x20;Pay&#x20;special&#x20;attention&#x20;to&#x20;the&#x20;configuration.&#x20;Incorrect&#x20;configuration&#x20;can&#x20;cause&#x20;system&#x20;lock&#x20;outs.&#x20;This&#x20;is&#x20;example&#x20;configuration.&#x20;You&#x20;configuration&#x20;may&#x20;differ&#x20;based&#x20;on&#x20;previous&#x20;changes&#x20;to&#x20;the&#x20;files.&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;to&#x20;include&#x20;the&#x20;remember=&#x20;option&#x20;of&#x20;5&#x20;or&#x20;more.&#x20;If&#x20;this&#x20;line&#x20;doesn&#039;t&#x20;exist,&#x20;add&#x20;the&#x20;line&#x20;directly&#x20;above&#x20;the&#x20;line:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;pam_unix.so&#x20;obscure&#x20;yescrypt:&#x20;Example:&#x20;password&#x20;required&#x20;pam_pwhistory.so&#x20;use_authtok&#x20;remember=5.','[{\"cis\": [\"5.4.3\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.004\"]}]'),(29681,'Ensure&#x20;password&#x20;hashing&#x20;algorithm&#x20;is&#x20;up&#x20;to&#x20;date&#x20;with&#x20;the&#x20;latest&#x20;standards.','The&#x20;commands&#x20;below&#x20;change&#x20;password&#x20;encryption&#x20;to&#x20;yescrypt.&#x20;All&#x20;existing&#x20;accounts&#x20;will&#x20;need&#x20;to&#x20;perform&#x20;a&#x20;password&#x20;change&#x20;to&#x20;upgrade&#x20;the&#x20;stored&#x20;hashes&#x20;to&#x20;the&#x20;new&#x20;algorithm.','The&#x20;yescrypt&#x20;algorithm&#x20;provides&#x20;much&#x20;stronger&#x20;hashing&#x20;than&#x20;previous&#x20;available&#x20;algorithms,&#x20;thus&#x20;providing&#x20;additional&#x20;protection&#x20;to&#x20;the&#x20;system&#x20;by&#x20;increasing&#x20;the&#x20;level&#x20;of&#x20;effort&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;successfully&#x20;determine&#x20;passwords.&#x20;Note:&#x20;these&#x20;change&#x20;only&#x20;apply&#x20;to&#x20;accounts&#x20;configured&#x20;on&#x20;the&#x20;local&#x20;system.','','NOTE:&#x20;Pay&#x20;special&#x20;attention&#x20;to&#x20;the&#x20;configuration.&#x20;Incorrect&#x20;configuration&#x20;can&#x20;cause&#x20;system&#x20;lock&#x20;outs.&#x20;This&#x20;is&#x20;example&#x20;configuration.&#x20;You&#x20;configuration&#x20;may&#x20;differ&#x20;based&#x20;on&#x20;previous&#x20;changes&#x20;to&#x20;the&#x20;files.&#x20;PAM&#x20;Edit&#x20;the&#x20;/etc/pam.d/common-password&#x20;file&#x20;and&#x20;ensure&#x20;that&#x20;no&#x20;hashing&#x20;algorithm&#x20;option&#x20;for&#x20;pam_unix.so&#x20;is&#x20;set:&#x20;password&#x20;[success=1&#x20;default=ignore]&#x20;try_first_pass&#x20;remember=5&#x20;pam_unix.so&#x20;obscure&#x20;use_authtok&#x20;-&#x20;Login&#x20;definitions:&#x20;Edit&#x20;/etc/login.defs&#x20;and&#x20;ensure&#x20;that&#x20;ENCRYPT_METHOD&#x20;is&#x20;set&#x20;to&#x20;yescrypt.','[{\"cis\": [\"5.4.4\"]}, {\"cis_csc_v8\": [\"3.11\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1110\", \"T1110.002\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1041\"]}]'),(29682,'Ensure&#x20;minimum&#x20;days&#x20;between&#x20;password&#x20;changes&#x20;is&#x20;configured.','The&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;prevent&#x20;users&#x20;from&#x20;changing&#x20;their&#x20;password&#x20;until&#x20;a&#x20;minimum&#x20;number&#x20;of&#x20;days&#x20;have&#x20;passed&#x20;since&#x20;the&#x20;last&#x20;time&#x20;the&#x20;user&#x20;changed&#x20;their&#x20;password.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;1&#x20;or&#x20;more&#x20;days.','By&#x20;restricting&#x20;the&#x20;frequency&#x20;of&#x20;password&#x20;changes,&#x20;an&#x20;administrator&#x20;can&#x20;prevent&#x20;users&#x20;from&#x20;repeatedly&#x20;changing&#x20;their&#x20;password&#x20;in&#x20;an&#x20;attempt&#x20;to&#x20;circumvent&#x20;password&#x20;reuse&#x20;controls.','','Set&#x20;the&#x20;PASS_MIN_DAYS&#x20;parameter&#x20;to&#x20;1&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MIN_DAYS&#x20;1&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--mindays&#x20;1&#x20;&lt;user&gt;.','[{\"cis\": [\"5.5.1.1\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.004\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29683,'Ensure&#x20;password&#x20;expiration&#x20;is&#x20;365&#x20;days&#x20;or&#x20;less.','The&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;force&#x20;passwords&#x20;to&#x20;expire&#x20;once&#x20;they&#x20;reach&#x20;a&#x20;defined&#x20;age.','The&#x20;window&#x20;of&#x20;opportunity&#x20;for&#x20;an&#x20;attacker&#x20;to&#x20;leverage&#x20;compromised&#x20;credentials&#x20;or&#x20;successfully&#x20;compromise&#x20;credentials&#x20;via&#x20;an&#x20;online&#x20;brute&#x20;force&#x20;attack&#x20;is&#x20;limited&#x20;by&#x20;the&#x20;age&#x20;of&#x20;the&#x20;password.&#x20;Therefore,&#x20;reducing&#x20;the&#x20;maximum&#x20;age&#x20;of&#x20;a&#x20;password&#x20;also&#x20;reduces&#x20;an&#x20;attacker&#039;s&#x20;window&#x20;of&#x20;opportunity.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;does&#x20;not&#x20;exceed&#x20;365&#x20;days&#x20;and&#x20;is&#x20;greater&#x20;than&#x20;the&#x20;value&#x20;of&#x20;PASS_MIN_DAYS.','','Set&#x20;the&#x20;PASS_MAX_DAYS&#x20;parameter&#x20;to&#x20;conform&#x20;to&#x20;site&#x20;policy&#x20;in&#x20;/etc/login.defs&#x20;:&#x20;PASS_MAX_DAYS&#x20;365&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--maxdays&#x20;365&#x20;&lt;user&gt;.','[{\"cis\": [\"5.5.1.2\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.002\", \"T1078.003\", \"T1078.004\", \"T1110\", \"T1110.001\", \"T1110.002\", \"T1110.003\", \"T1110.004\"]}]'),(29684,'Ensure&#x20;password&#x20;expiration&#x20;warning&#x20;days&#x20;is&#x20;7&#x20;or&#x20;more.','The&#x20;PASS_WARN_AGE&#x20;parameter&#x20;in&#x20;/etc/login.defs&#x20;allows&#x20;an&#x20;administrator&#x20;to&#x20;notify&#x20;users&#x20;that&#x20;their&#x20;password&#x20;will&#x20;expire&#x20;in&#x20;a&#x20;defined&#x20;number&#x20;of&#x20;days.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;be&#x20;set&#x20;to&#x20;7&#x20;or&#x20;more&#x20;days.','Providing&#x20;an&#x20;advance&#x20;warning&#x20;that&#x20;a&#x20;password&#x20;will&#x20;be&#x20;expiring&#x20;gives&#x20;users&#x20;time&#x20;to&#x20;think&#x20;of&#x20;a&#x20;secure&#x20;password.&#x20;Users&#x20;caught&#x20;unaware&#x20;may&#x20;choose&#x20;a&#x20;simple&#x20;password&#x20;or&#x20;write&#x20;it&#x20;down&#x20;where&#x20;it&#x20;may&#x20;be&#x20;discovered.','','Set&#x20;the&#x20;PASS_WARN_AGE&#x20;parameter&#x20;to&#x20;7&#x20;in&#x20;/etc/login.defs&#x20;:PASS_WARN_AGE&#x20;7&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--warndays&#x20;7&#x20;&lt;user&gt;.','[{\"cis\": [\"5.5.1.3\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_tactics\": [\"TA0006\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29685,'Ensure&#x20;inactive&#x20;password&#x20;lock&#x20;is&#x20;30&#x20;days&#x20;or&#x20;less.','User&#x20;accounts&#x20;that&#x20;have&#x20;been&#x20;inactive&#x20;for&#x20;over&#x20;a&#x20;given&#x20;period&#x20;of&#x20;time&#x20;can&#x20;be&#x20;automatically&#x20;disabled.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;accounts&#x20;that&#x20;are&#x20;inactive&#x20;for&#x20;30&#x20;days&#x20;after&#x20;password&#x20;expiration&#x20;be&#x20;disabled.','Inactive&#x20;accounts&#x20;pose&#x20;a&#x20;threat&#x20;to&#x20;system&#x20;security&#x20;since&#x20;the&#x20;users&#x20;are&#x20;not&#x20;logging&#x20;in&#x20;to&#x20;notice&#x20;failed&#x20;login&#x20;attempts&#x20;or&#x20;other&#x20;anomalies.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;default&#x20;password&#x20;inactivity&#x20;period&#x20;to&#x20;30&#x20;days:&#x20;#&#x20;useradd&#x20;-D&#x20;-f&#x20;30&#x20;Modify&#x20;user&#x20;parameters&#x20;for&#x20;all&#x20;users&#x20;with&#x20;a&#x20;password&#x20;set&#x20;to&#x20;match:&#x20;#&#x20;chage&#x20;--inactive&#x20;30&#x20;&lt;user&gt;.','[{\"cis\": [\"5.5.1.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.002\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29686,'Ensure&#x20;default&#x20;group&#x20;for&#x20;the&#x20;root&#x20;account&#x20;is&#x20;GID&#x20;0.','The&#x20;usermod&#x20;command&#x20;can&#x20;be&#x20;used&#x20;to&#x20;specify&#x20;which&#x20;group&#x20;the&#x20;root&#x20;user&#x20;belongs&#x20;to.&#x20;This&#x20;affects&#x20;permissions&#x20;of&#x20;files&#x20;that&#x20;are&#x20;created&#x20;by&#x20;the&#x20;root&#x20;user.','Using&#x20;GID&#x20;0&#x20;for&#x20;the&#x20;root&#x20;account&#x20;helps&#x20;prevent&#x20;root&#x20;-owned&#x20;files&#x20;from&#x20;accidentally&#x20;becoming&#x20;accessible&#x20;to&#x20;non-privileged&#x20;users.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;root&#x20;user&#x20;default&#x20;group&#x20;to&#x20;GID&#x20;0&#x20;:&#x20;#&#x20;usermod&#x20;-g&#x20;0&#x20;root.','[{\"cis\": [\"5.5.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(29687,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd&#x20;are&#x20;configured.','The&#x20;/etc/passwd&#x20;file&#x20;contains&#x20;user&#x20;account&#x20;information&#x20;that&#x20;is&#x20;used&#x20;by&#x20;many&#x20;system&#x20;utilities&#x20;and&#x20;therefore&#x20;must&#x20;be&#x20;readable&#x20;for&#x20;these&#x20;utilities&#x20;to&#x20;operate.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;write&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/passwd:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd.','[{\"cis\": [\"6.1.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29688,'Ensure&#x20;permissions&#x20;on&#x20;/etc/passwd-&#x20;are&#x20;configured.','The&#x20;/etc/passwd-&#x20;file&#x20;contains&#x20;backup&#x20;user&#x20;account&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/passwd-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/passwd-:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/passwd-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/passwd-.','[{\"cis\": [\"6.1.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29689,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group&#x20;are&#x20;configured.','The&#x20;/etc/group&#x20;file&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.&#x20;The&#x20;command&#x20;below&#x20;allows&#x20;read/write&#x20;access&#x20;for&#x20;root&#x20;and&#x20;read&#x20;access&#x20;for&#x20;everyone&#x20;else.','The&#x20;/etc/group&#x20;file&#x20;needs&#x20;to&#x20;be&#x20;protected&#x20;from&#x20;unauthorized&#x20;changes&#x20;by&#x20;non-privileged&#x20;users,&#x20;but&#x20;needs&#x20;to&#x20;be&#x20;readable&#x20;as&#x20;this&#x20;information&#x20;is&#x20;used&#x20;with&#x20;many&#x20;non-privileged&#x20;programs.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/group:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group.','[{\"cis\": [\"6.1.3\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29690,'Ensure&#x20;permissions&#x20;on&#x20;/etc/group-&#x20;are&#x20;configured.','The&#x20;/etc/group-&#x20;file&#x20;contains&#x20;a&#x20;backup&#x20;list&#x20;of&#x20;all&#x20;the&#x20;valid&#x20;groups&#x20;defined&#x20;in&#x20;the&#x20;system.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/group-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;remove&#x20;excess&#x20;permissions,&#x20;set&#x20;owner,&#x20;and&#x20;set&#x20;group&#x20;on&#x20;/etc/group-:&#x20;#&#x20;chmod&#x20;u-x,go-wx&#x20;/etc/group-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/group-.','[{\"cis\": [\"6.1.4\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29691,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow&#x20;are&#x20;configured.','The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/shadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;&#40;such&#x20;as&#x20;expiration&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;user&#x20;accounts.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/shadow&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow&#x20;-OR-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/shadow:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow.','[{\"cis\": [\"6.1.5\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29692,'Ensure&#x20;permissions&#x20;on&#x20;/etc/shadow-&#x20;are&#x20;configured.','The&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;user&#x20;accounts&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/shadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/shadow-&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/shadow-&#x20;-OR-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/shadow-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/shadow-:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/shadow-.','[{\"cis\": [\"6.1.6\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29693,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow&#x20;are&#x20;configured.','The&#x20;/etc/gshadow&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;the&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','If&#x20;attackers&#x20;can&#x20;gain&#x20;read&#x20;access&#x20;to&#x20;the&#x20;/etc/gshadow&#x20;file,&#x20;they&#x20;can&#x20;easily&#x20;run&#x20;a&#x20;password&#x20;cracking&#x20;program&#x20;against&#x20;the&#x20;hashed&#x20;password&#x20;to&#x20;break&#x20;it.&#x20;Other&#x20;security&#x20;information&#x20;that&#x20;is&#x20;stored&#x20;in&#x20;the&#x20;/etc/gshadow&#x20;file&#x20;&#40;such&#x20;as&#x20;group&#x20;administrators&#41;&#x20;could&#x20;also&#x20;be&#x20;useful&#x20;to&#x20;subvert&#x20;the&#x20;group.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/gshadow&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow&#x20;-OR-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/gshadow:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/gshadow.','[{\"cis\": [\"6.1.7\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29694,'Ensure&#x20;permissions&#x20;on&#x20;/etc/gshadow-&#x20;are&#x20;configured.','The&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;used&#x20;to&#x20;store&#x20;backup&#x20;information&#x20;about&#x20;groups&#x20;that&#x20;is&#x20;critical&#x20;to&#x20;the&#x20;security&#x20;of&#x20;those&#x20;accounts,&#x20;such&#x20;as&#x20;the&#x20;hashed&#x20;password&#x20;and&#x20;other&#x20;security&#x20;information.','It&#x20;is&#x20;critical&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;/etc/gshadow-&#x20;file&#x20;is&#x20;protected&#x20;from&#x20;unauthorized&#x20;access.&#x20;Although&#x20;it&#x20;is&#x20;protected&#x20;by&#x20;default,&#x20;the&#x20;file&#x20;permissions&#x20;could&#x20;be&#x20;changed&#x20;either&#x20;inadvertently&#x20;or&#x20;through&#x20;malicious&#x20;actions.','','Run&#x20;one&#x20;of&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;ownership&#x20;of&#x20;/etc/gshadow-&#x20;to&#x20;root&#x20;and&#x20;group&#x20;to&#x20;either&#x20;root&#x20;or&#x20;shadow:&#x20;#&#x20;chown&#x20;root:shadow&#x20;/etc/gshadow-&#x20;-OR-&#x20;#&#x20;chown&#x20;root:root&#x20;/etc/gshadow-&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;excess&#x20;permissions&#x20;form&#x20;/etc/gshadow-:&#x20;#&#x20;chmod&#x20;u-x,g-wx,o-rwx&#x20;/etc/gshadow-.','[{\"cis\": [\"6.1.8\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.3\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"pci_dss_3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_4.0\": [\"1.3.1\", \"7.1\"]}, {\"nist_sp_800-53\": [\"AC-3\", \"MP-2\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\", \"T1222\", \"T1222.002\"]}, {\"mitre_tactics\": [\"TA0005\"]}, {\"mitre_mitigations\": [\"M1022\"]}]'),(29695,'Ensure&#x20;accounts&#x20;in&#x20;/etc/passwd&#x20;use&#x20;shadowed&#x20;passwords.','Local&#x20;accounts&#x20;can&#x20;uses&#x20;shadowed&#x20;passwords.&#x20;With&#x20;shadowed&#x20;passwords,&#x20;The&#x20;passwords&#x20;are&#x20;saved&#x20;in&#x20;shadow&#x20;password&#x20;file,&#x20;/etc/shadow,&#x20;encrypted&#x20;by&#x20;a&#x20;salted&#x20;one-way&#x20;hash.&#x20;Accounts&#x20;with&#x20;a&#x20;shadowed&#x20;password&#x20;have&#x20;an&#x20;x&#x20;in&#x20;the&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd.','The&#x20;/etc/passwd&#x20;file&#x20;also&#x20;contains&#x20;information&#x20;like&#x20;user&#x20;ID&#039;s&#x20;and&#x20;group&#x20;ID&#039;s&#x20;that&#x20;are&#x20;used&#x20;by&#x20;many&#x20;system&#x20;programs.&#x20;Therefore,&#x20;the&#x20;/etc/passwd&#x20;file&#x20;must&#x20;remain&#x20;world&#x20;readable.&#x20;In&#x20;spite&#x20;of&#x20;encoding&#x20;the&#x20;password&#x20;with&#x20;a&#x20;randomly-generated&#x20;one-way&#x20;hash&#x20;function,&#x20;an&#x20;attacker&#x20;could&#x20;still&#x20;break&#x20;the&#x20;system&#x20;if&#x20;they&#x20;got&#x20;access&#x20;to&#x20;the&#x20;/etc/passwd&#x20;file.&#x20;This&#x20;can&#x20;be&#x20;mitigated&#x20;by&#x20;using&#x20;shadowed&#x20;passwords,&#x20;thus&#x20;moving&#x20;the&#x20;passwords&#x20;in&#x20;the&#x20;/etc/passwd&#x20;file&#x20;to&#x20;/etc/shadow.&#x20;The&#x20;/etc/shadow&#x20;file&#x20;is&#x20;set&#x20;so&#x20;only&#x20;root&#x20;will&#x20;be&#x20;able&#x20;to&#x20;read&#x20;and&#x20;write.&#x20;This&#x20;helps&#x20;mitigate&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;encoded&#x20;passwords&#x20;with&#x20;which&#x20;to&#x20;perform&#x20;a&#x20;dictionary&#x20;attack.&#x20;Note:&#x20;-&#x20;All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.&#x20;-&#x20;A&#x20;user&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;second&#x20;field&#x20;in&#x20;/etc/passwd&#x20;allows&#x20;the&#x20;account&#x20;to&#x20;be&#x20;logged&#x20;into&#x20;by&#x20;providing&#x20;only&#x20;the&#x20;username.','','Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;accounts&#x20;to&#x20;use&#x20;shadowed&#x20;passwords:&#x20;#&#x20;sed&#x20;-e&#x20;&#039;s/^&#40;[a-zA-Z0-9_]*&#41;:[^:]*:/1:x:/&#039;&#x20;-i&#x20;/etc/passwd&#x20;Investigate&#x20;to&#x20;determine&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for,&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.1\"]}, {\"cis_csc_v8\": [\"3.11\"]}, {\"cis_csc_v7\": [\"16.4\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"pci_dss_3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.10.1.1\"]}, {\"mitre_techniques\": [\"T1003\", \"T1003.008\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29696,'Ensure&#x20;/etc/shadow&#x20;password&#x20;fields&#x20;are&#x20;not&#x20;empty.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password.','All&#x20;accounts&#x20;must&#x20;have&#x20;passwords&#x20;or&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;the&#x20;account&#x20;from&#x20;being&#x20;used&#x20;by&#x20;an&#x20;unauthorized&#x20;user.','','If&#x20;any&#x20;accounts&#x20;in&#x20;the&#x20;/etc/shadow&#x20;file&#x20;do&#x20;not&#x20;have&#x20;a&#x20;password,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;lock&#x20;the&#x20;account&#x20;until&#x20;it&#x20;can&#x20;be&#x20;determined&#x20;why&#x20;it&#x20;does&#x20;not&#x20;have&#x20;a&#x20;password:&#x20;#&#x20;passwd&#x20;-l&#x20;&lt;username&gt;&#x20;Also,&#x20;check&#x20;to&#x20;see&#x20;if&#x20;the&#x20;account&#x20;is&#x20;logged&#x20;in&#x20;and&#x20;investigate&#x20;what&#x20;it&#x20;is&#x20;being&#x20;used&#x20;for&#x20;to&#x20;determine&#x20;if&#x20;it&#x20;needs&#x20;to&#x20;be&#x20;forced&#x20;off.','[{\"cis\": [\"6.2.2\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"pci_dss_4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1078\", \"T1078.001\", \"T1078.003\"]}, {\"mitre_tactics\": [\"TA0003\"]}, {\"mitre_mitigations\": [\"M1027\"]}]'),(29697,'Ensure&#x20;root&#x20;is&#x20;the&#x20;only&#x20;UID&#x20;0&#x20;account.','Any&#x20;account&#x20;with&#x20;UID&#x20;0&#x20;has&#x20;superuser&#x20;privileges&#x20;on&#x20;the&#x20;system.','This&#x20;access&#x20;must&#x20;be&#x20;limited&#x20;to&#x20;only&#x20;the&#x20;default&#x20;root&#x20;account&#x20;and&#x20;only&#x20;from&#x20;the&#x20;system&#x20;console.&#x20;Administrative&#x20;access&#x20;must&#x20;be&#x20;through&#x20;an&#x20;unprivileged&#x20;account&#x20;using&#x20;an&#x20;approved&#x20;mechanism&#x20;as&#x20;noted&#x20;in&#x20;Item&#x20;5.6&#x20;Ensure&#x20;access&#x20;to&#x20;the&#x20;su&#x20;command&#x20;is&#x20;restricted.','','Remove&#x20;any&#x20;users&#x20;other&#x20;than&#x20;root&#x20;with&#x20;UID&#x20;0&#x20;or&#x20;assign&#x20;them&#x20;a&#x20;new&#x20;UID&#x20;if&#x20;appropriate.','[{\"cis\": [\"6.2.10\"]}, {\"mitre_techniques\": [\"T1548\"]}, {\"mitre_tactics\": [\"TA0001\"]}, {\"mitre_mitigations\": [\"M1026\"]}]'),(30001,'Install&#x20;and&#x20;configure&#x20;HP-UX&#x20;Secure&#x20;Shell.','OpenSSH&#x20;is&#x20;a&#x20;popular&#x20;free&#x20;distribution&#x20;of&#x20;the&#x20;standards-track&#x20;SSH&#x20;protocols&#x20;which&#x20;allows&#x20;secure&#x20;encrypted&#x20;network&#x20;logins&#x20;and&#x20;file&#x20;transfers.&#x20;HP-UX&#x20;Secure&#x20;Shell&#x20;is&#x20;HP&#039;s&#x20;pre-compiled&#x20;and&#x20;supported&#x20;version&#x20;of&#x20;OpenSSH.','Common&#x20;login&#x20;and&#x20;file&#x20;transfer&#x20;services&#x20;such&#x20;as&#x20;telnet,&#x20;FTP,&#x20;rsh,&#x20;rlogin,&#x20;and&#x20;rcp&#x20;use&#x20;insecure,&#x20;clear-text&#x20;protocols&#x20;that&#x20;are&#x20;vulnerable&#x20;to&#x20;attack.&#x20;OpenSSH&#x20;provides&#x20;a&#x20;secure,&#x20;encrypted&#x20;replacement&#x20;for&#x20;these&#x20;services.&#x20;Security&#x20;is&#x20;improved&#x20;by&#x20;further&#x20;constraining&#x20;services&#x20;in&#x20;the&#x20;default&#x20;configuration.','','Perform&#x20;the&#x20;following&#x20;to&#x20;install&#x20;and&#x20;securely&#x20;configure&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;&#x20;1.&#x20;Download&#x20;and&#x20;install&#x20;HP-UX&#x20;Secure&#x20;Shell&#x20;if&#x20;not&#x20;already&#x20;installed&#x20;on&#x20;the&#x20;system.&#x20;2.&#x20;Perform&#x20;the&#x20;following&#x20;post-installation&#x20;actions&#x20;to&#x20;secure&#x20;the&#x20;SSH&#x20;service:&#x20;a.&#x20;Change&#x20;to&#x20;the&#x20;/opt/ssh/etc&#x20;directory&#x20;b.&#x20;Open&#x20;sshd_config&#x20;c.&#x20;Set&#x20;the&#x20;Protocol&#x20;token&#x20;to&#x20;2.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;d.&#x20;Set&#x20;the&#x20;X11Forwarding&#x20;token&#x20;to&#x20;yes.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;e.&#x20;Set&#x20;the&#x20;IgnoreRhosts&#x20;token&#x20;to&#x20;yes.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;f.&#x20;Set&#x20;the&#x20;RhostsAuthentication&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;g.&#x20;Set&#x20;the&#x20;RhostsRSAAuthentication&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;h.&#x20;Set&#x20;the&#x20;PermitRootLogin&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;i.&#x20;Set&#x20;the&#x20;PermitEmptyPasswords&#x20;token&#x20;to&#x20;no.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;j.&#x20;Set&#x20;the&#x20;Banner&#x20;token&#x20;to&#x20;/etc/issue.&#x20;If&#x20;it&#x20;is&#x20;absent,&#x20;add&#x20;and&#x20;set&#x20;it.&#x20;k.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;sshd_config&#x20;and&#x20;ssh_config.&#x20;l.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;sshd_config&#x20;and&#x20;ssh_config.&#x20;m.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;sshd_config&#x20;and&#x20;ssh_config&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;13&#x20;|&#x20;P&#x20;a&#x20;g&#x20;e&#x20;cd&#x20;/opt/ssh/etc&#x20;cp&#x20;-p&#x20;sshd_config&#x20;sshd_config.tmp&#x20;awk&#x20;&#039;&#x20;/^Protocol/&#x20;/^IgnoreRhosts/&#x20;/^RhostsAuthentication/&#x20;/^RhostsRSAAuthentication/&#x20;{&#x20;$2&#x20;=&quot;no&quot;&#x20;};&#x20;/&#40;^#|^&#41;PermitRootLogin/&#x20;&#x20;&#x20;&#x20;{&#x20;$1&#x20;=&#x20;&quot;PermitRootLogin&quot;;&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;};&#x20;/^PermitEmptyPasswords/&#x20;&#x20;&#x20;&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;};&#x20;/^#Banner/&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;{&#x20;$1&#x20;=&#x20;&quot;Banner&quot;;&#x20;$2&#x20;=&#x20;&quot;/etc/issue&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;sshd_config.tmp&#x20;&gt;&#x20;sshd_config&#x20;{&#x20;$2&#x20;=&quot;2&quot;};&#x20;{&#x20;$2&#x20;=&#x20;&quot;yes&quot;&#x20;};&#x20;{&#x20;$2&#x20;=&#x20;&quot;no&quot;&#x20;};&#x20;rm&#x20;-f&#x20;sshd_config.tmp&#x20;chown&#x20;root:sys&#x20;ssh_config&#x20;sshd_config&#x20;chmod&#x20;go-w&#x20;ssh_config&#x20;sshd_config','[{\"cis\": [\"1.1.2\"]}, {\"cis_level\": [\"1\"]}]'),(30002,'Use&#x20;Bastille&#x20;to&#x20;report&#x20;security&#x20;configuration&#x20;state.','Bastille&#x20;is&#x20;a&#x20;security&#x20;hardening,&#x20;lockdown&#x20;tool&#x20;supplied&#x20;with&#x20;HP-UX&#x20;to&#x20;assist&#x20;administrators&#x20;in&#x20;securing&#x20;their&#x20;systems.&#x20;Included&#x20;is&#x20;an&#x20;assessment&#x20;function&#x20;that&#x20;covers&#x20;a&#x20;wide&#x20;range&#x20;of&#x20;lockdown&#x20;items&#x20;including&#x20;most&#x20;all&#x20;items&#x20;in&#x20;this&#x20;Benchmark.&#x20;Bastille&#x20;can&#x20;serve&#x20;as&#x20;a&#x20;reporting&#x20;and&#x20;audit&#x20;tool.&#x20;Appendix&#x20;D&#x20;provides&#x20;a&#x20;mapping&#x20;of&#x20;Benchmark&#x20;items&#x20;to&#x20;related&#x20;Bastille&#x20;configuration&#x20;items.','An&#x20;automated,&#x20;tested,&#x20;and&#x20;vendor&#x20;supported&#x20;reporting&#x20;tool&#x20;such&#x20;as&#x20;Bastille&#x20;is&#x20;more&#x20;efficient&#x20;and&#x20;less&#x20;error-prone&#x20;than&#x20;most&#x20;manual&#x20;or&#x20;custom&#x20;scripted&#x20;methods.','','Run&#x20;Bastille&#x20;to&#x20;create&#x20;an&#x20;assessment&#x20;report&#x20;as&#x20;shown:&#x20;/opt/sec_mgmt/bastille/bin/bastille&#x20;--assessnobrowser','[{\"cis\": [\"1.1.3\"]}]'),(30003,'Disable&#x20;Standard&#x20;Services.','The&#x20;stock&#x20;/etc/inetd.conf&#x20;file&#x20;shipped&#x20;with&#x20;HP-UX&#x20;contains&#x20;many&#x20;services&#x20;which&#x20;are&#x20;rarely&#x20;used,&#x20;or&#x20;which&#x20;have&#x20;more&#x20;secure&#x20;alternatives.&#x20;Indeed,&#x20;after&#x20;enabling&#x20;SSH&#x20;&#40;see&#x20;item&#x20;1.1.2&#41;&#x20;it&#x20;may&#x20;be&#x20;possible&#x20;to&#x20;completely&#x20;do&#x20;away&#x20;with&#x20;all&#x20;inetd-based&#x20;services,&#x20;since&#x20;SSH&#x20;provides&#x20;both&#x20;a&#x20;secure&#x20;login&#x20;mechanism&#x20;and&#x20;a&#x20;means&#x20;of&#x20;transferring&#x20;files&#x20;to&#x20;and&#x20;from&#x20;the&#x20;system.&#x20;The&#x20;steps&#x20;articulated&#x20;in&#x20;the&#x20;Remediation&#x20;section&#x20;will&#x20;disable&#x20;all&#x20;services&#x20;normally&#x20;enabled&#x20;in&#x20;the&#x20;HP-UX&#x20;inetd.conf&#x20;file.&#x20;The&#x20;rest&#x20;of&#x20;the&#x20;actions&#x20;in&#x20;this&#x20;section&#x20;give&#x20;the&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;re-enabling&#x20;certain&#x20;services&mdash;in&#x20;particular,&#x20;the&#x20;services&#x20;that&#x20;are&#x20;disabled&#x20;in&#x20;the&#x20;last&#x20;two&#x20;loops&#x20;in&#x20;the&#x20;Action&#x20;section&#x20;below.','The&#x20;stock&#x20;/etc/inetd.conf&#x20;file&#x20;shipped&#x20;with&#x20;HP-UX&#x20;contains&#x20;services&#x20;that&#x20;are&#x20;rarely&#x20;used&#x20;or&#x20;have&#x20;more&#x20;secure&#x20;alternatives.&#x20;Removing&#x20;these&#x20;from&#x20;inetd&#x20;will&#x20;avoid&#x20;exposure&#x20;to&#x20;possible&#x20;security&#x20;vulnerability&#x20;in&#x20;those&#x20;services.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;standard&#x20;inetd-based&#x20;services:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/etc&#x20;directory&#x20;2.&#x20;Open&#x20;inetd.conf&#x20;3.&#x20;Disable&#x20;the&#x20;following&#x20;services&#x20;by&#x20;adding&#x20;a&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;to&#x20;the&#x20;beginning&#x20;of&#x20;its&#x20;definition:&#x20;a.&#x20;echo&#x20;b.&#x20;discard&#x20;c.&#x20;daytime&#x20;d.&#x20;chargen&#x20;e.&#x20;dtspc&#x20;f.&#x20;exec&#x20;g.&#x20;ntalk&#x20;h.&#x20;finger&#x20;i.&#x20;uucp&#x20;j.&#x20;ident&#x20;k.&#x20;auth&#x20;l.&#x20;instl_boots&#x20;m.&#x20;registrar&#x20;n.&#x20;recserv&#x20;o.&#x20;rpc.rstatd&#x20;p.&#x20;rpc.rusersd&#x20;q.&#x20;rpc.rwalld&#x20;r.&#x20;rpc.sprayd&#x20;s.&#x20;rpc.cmsd&#x20;t.&#x20;kcms_server&#x20;u.&#x20;printer&#x20;v.&#x20;shell&#x20;w.&#x20;login&#x20;h.&#x20;finger&#x20;x.&#x20;telnet&#x20;y.&#x20;ftp&#x20;z.&#x20;tftp&#x20;aa.&#x20;bootps&#x20;bb.&#x20;kshell&#x20;cc.&#x20;klogin&#x20;dd.&#x20;rpc.rquotad&#x20;ee.&#x20;rpc.ttdbserver&#x20;4.&#x20;Save&#x20;inetd.conf.&#x20;5.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;inetd.conf.&#x20;6.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;inetd.conf.&#x20;7.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;inetd.conf&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;8.&#x20;Remove&#x20;the&#x20;executable&#x20;and&#x20;sticky&#x20;bit&#x20;from&#x20;inetd.conf.&#x20;9.&#x20;Invoke&#x20;inetd&#x20;to&#x20;reread&#x20;it&#039;s&#x20;config&#x20;file:&#x20;inetd&#x20;-c&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;cd&#x20;/etc&#x20;for&#x20;svc&#x20;in&#x20;echo&#x20;discard&#x20;daytime&#x20;chargen&#x20;dtspc&#x20;&#x20;exec&#x20;ntalk&#x20;finger&#x20;uucp&#x20;ident&#x20;auth&#x20;&#x20;instl_boots&#x20;registrar&#x20;recserv;&#x20;do&#x20;awk&#x20;&quot;&#40;$1&#x20;==&#x20;&quot;$svc&quot;&#41;&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{print}&quot;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;for&#x20;svc&#x20;in&#x20;rpc.rstatd&#x20;rpc.rusersd&#x20;rpc.rwalld&#x20;&#x20;rpc.sprayd&#x20;rpc.cmsd&#x20;kcms_server;&#x20;do&#x20;awk&#x20;&quot;/&#92;/$svc/&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{&#x20;print&#x20;}&quot;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;for&#x20;svc&#x20;in&#x20;printer&#x20;shell&#x20;login&#x20;telnet&#x20;ftp&#x20;tftp&#x20;&#x20;bootps&#x20;kshell&#x20;klogin;&#x20;do&#x20;awk&#x20;&quot;&#40;$1&#x20;==&#x20;&quot;$svc&quot;&#41;&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{print}&quot;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;for&#x20;svc&#x20;in&#x20;rpc.rquotad&#x20;rpc.ttdbserver;&#x20;do&#x20;awk&#x20;&quot;/^$svc&#92;//&#x20;{&#x20;$1&#x20;=&#x20;&quot;#&quot;&#x20;$1&#x20;};&#x20;{&#x20;print&#x20;}&quot;&#x20;&#x20;/etc/inetd.conf&#x20;&gt;&#x20;/etc/inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;done&#x20;chown&#x20;root:sys&#x20;inetd.conf&#x20;chmod&#x20;go-w,a-xs&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new&#x20;inetd&#x20;-c','[{\"cis\": [\"1.2.1\"]}, {\"cis_level\": [\"1\"]}]'),(30004,'Only&#x20;enable&#x20;telnet&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;telnet.&#x20;Telnet&#x20;uses&#x20;an&#x20;unencrypted&#x20;network&#x20;protocol,&#x20;which&#x20;means&#x20;data&#x20;from&#x20;the&#x20;login&#x20;session&#x20;&#40;such&#x20;as&#x20;passwords&#x20;and&#x20;all&#x20;other&#x20;data&#x20;transmitted&#x20;during&#x20;the&#x20;session&#41;&#x20;can&#x20;be&#x20;stolen&#x20;by&#x20;eavesdroppers&#x20;on&#x20;the&#x20;network,&#x20;and&#x20;also&#x20;that&#x20;the&#x20;session&#x20;can&#x20;be&#x20;hijacked&#x20;by&#x20;outsiders&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;remote&#x20;system.&#x20;HP-UX&#x20;Secure&#x20;Shell&#x20;&#40;OpenSSH&#41;&#x20;provides&#x20;an&#x20;encrypted&#x20;alternative&#x20;to&#x20;telnet&#x20;&#40;and&#x20;other&#x20;utilities&#41;&#x20;and&#x20;should&#x20;be&#x20;used&#x20;instead.','There&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;that&#x20;requires&#x20;users&#x20;to&#x20;access&#x20;the&#x20;system&#x20;via&#x20;telnet&#x20;instead&#x20;of&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;protocol.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;telnet:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;telnet&#x20;service&#x20;definition.&#x20;3.&#x20;Add&#x20;-b&#x20;/etc/issue&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;telnet&#x20;service&#x20;definition.&#x20;This&#x20;will&#x20;cause&#x20;telnet&#x20;to&#x20;display&#x20;the&#x20;contents&#x20;of&#x20;/etc/issue&#x20;to&#x20;users&#x20;attempting&#x20;to&#x20;access&#x20;the&#x20;system&#x20;via&#x20;telnet.&#x20;4.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;/^#telnet/&#x20;{&#x20;$1&#x20;=&#x20;&quot;telnet&quot;&#x20;print&#x20;$0&#x20;&quot;&#x20;-b&#x20;/etc/issue&quot;;&#x20;next}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;/etc/inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.2\"]}]'),(30005,'Only&#x20;enable&#x20;FTP&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;ftp.&#x20;Like&#x20;telnet,&#x20;the&#x20;FTP&#x20;protocol&#x20;is&#x20;unencrypted,&#x20;which&#x20;means&#x20;passwords&#x20;and&#x20;other&#x20;data&#x20;transmitted&#x20;during&#x20;the&#x20;session&#x20;can&#x20;be&#x20;captured&#x20;by&#x20;sniffing&#x20;the&#x20;network,&#x20;and&#x20;that&#x20;the&#x20;FTP&#x20;session&#x20;itself&#x20;can&#x20;be&#x20;hijacked&#x20;by&#x20;an&#x20;external&#x20;attacker.&#x20;SSH&#x20;provides&#x20;two&#x20;alternative,&#x20;encrypted&#x20;file&#x20;transfer&#x20;mechanisms,&#x20;scp&#x20;and&#x20;sftp,&#x20;which&#x20;should&#x20;be&#x20;used&#x20;instead&#x20;of&#x20;FTP.&#x20;Even&#x20;if&#x20;FTP&#x20;is&#x20;required&#x20;because&#x20;the&#x20;local&#x20;system&#x20;is&#x20;an&#x20;anonymous&#x20;FTP&#x20;server,&#x20;consider&#x20;requiring&#x20;authenticated&#x20;users&#x20;on&#x20;the&#x20;system&#x20;to&#x20;transfer&#x20;files&#x20;via&#x20;SSH-based&#x20;protocols.&#x20;For&#x20;further&#x20;information&#x20;on&#x20;restricting&#x20;FTP&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;see&#x20;item&#x20;1.6.2&#x20;below.&#x20;Sites&#x20;may&#x20;also&#x20;consider&#x20;augmenting&#x20;the&#x20;&#039;ftpd&#x20;-l&#039;&#x20;below&#x20;with&#x20;&#039;-v&#039;&#x20;&#40;10.x&#x20;and&#x20;11.x&#41;&#x20;or&#x20;&#039;-L&#039;&#x20;&#40;11.x&#x20;only&#41;&#x20;for&#x20;additional&#x20;logging&#x20;of&#x20;FTP&#x20;transactions,&#x20;or&#x20;with&#x20;&#039;-a&#039;&#x20;&#40;11.x&#x20;only&#41;&#x20;for&#x20;fine&#x20;grain&#x20;FTP&#x20;access&#x20;control&#x20;through&#x20;the&#x20;use&#x20;of&#x20;a&#x20;configuration&#x20;file&#x20;-&#x20;see&#x20;the&#x20;ftpd&#40;1M&#41;&#x20;man&#x20;page&#x20;on&#x20;your&#x20;systems&#x20;for&#x20;details.','This&#x20;machine&#x20;serves&#x20;as&#x20;an&#x20;&#40;anonymous&#41;&#x20;FTP&#x20;server&#x20;or&#x20;other&#x20;mission-critical&#x20;role&#x20;where&#x20;data&#x20;must&#x20;be&#x20;transferred&#x20;via&#x20;FTP&#x20;instead&#x20;of&#x20;the&#x20;more&#x20;secure&#x20;alternatives.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;FTP:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;ftp&#x20;service&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;&#x20;/^#ftp/&#x20;{&#x20;$1&#x20;=&#x20;&quot;ftp&quot;;&#x20;print&#x20;$0;&#x20;next}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.3\"]}]'),(30006,'Only&#x20;enable&#x20;rlogin/remsh/rcp&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;rlogin/remsh/rcp.&#x20;SSH&#x20;was&#x20;designed&#x20;to&#x20;be&#x20;a&#x20;drop-in&#x20;replacement&#x20;for&#x20;these&#x20;protocols.&#x20;Given&#x20;the&#x20;wide&#x20;availability&#x20;of&#x20;free&#x20;SSH&#x20;implementations,&#x20;there&#x20;are&#x20;few&#x20;cases&#x20;where&#x20;these&#x20;tools&#x20;cannot&#x20;be&#x20;replaced&#x20;with&#x20;SSH&#x20;&#40;again,&#x20;see&#x20;item&#x20;1.2.1&#x20;-&#x20;Install&#x20;SSH&#41;.','There&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;to&#x20;use&#x20;rlogin/remsh/rcp&#x20;instead&#x20;of&#x20;the&#x20;more&#x20;secure&#x20;ssh/scp.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;rlogin/remsh/rcp:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;shell&#x20;and&#x20;login&#x20;service&#x20;definitions.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#shell/shell/;&#x20;s/^#login/login/&#039;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.4\"]}]'),(30007,'Only&#x20;enable&#x20;TFTP&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;TFTP.&#x20;TFTP&#x20;is&#x20;typically&#x20;used&#x20;for&#x20;network&#x20;booting&#x20;of&#x20;diskless&#x20;workstations,&#x20;X-terminals,&#x20;and&#x20;other&#x20;similar&#x20;devices.&#x20;TFTP&#x20;is&#x20;also&#x20;used&#x20;during&#x20;network&#x20;installs&#x20;of&#x20;systems&#x20;via&#x20;the&#x20;HP-UX&#x20;Ignite&#x20;facility.&#x20;Routers&#x20;and&#x20;other&#x20;network&#x20;devices&#x20;may&#x20;copy&#x20;configuration&#x20;data&#x20;to&#x20;remote&#x20;systems&#x20;via&#x20;TFTP&#x20;for&#x20;backup.','This&#x20;system&#x20;serves&#x20;as&#x20;a&#x20;boot&#x20;server&#x20;or&#x20;has&#x20;other&#x20;mission-critical&#x20;roles&#x20;where&#x20;data&#x20;must&#x20;be&#x20;transferred&#x20;to&#x20;and&#x20;from&#x20;this&#x20;system&#x20;via&#x20;TFTP.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;TFTP:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;tftp&#x20;service&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#tftp/tftp/&#039;&#x20;inetd.conf&#x20;&gt;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new&#x20;mkdir&#x20;-p&#x20;/var/opt/ignite','[{\"cis\": [\"1.2.5\"]}]'),(30008,'Only&#x20;enable&#x20;printer&#x20;service&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;rlpdaemon&#x20;based&#x20;printer&#x20;service.&#x20;rlpdaemon&#x20;provides&#x20;a&#x20;BSD-compatible&#x20;print&#x20;server&#x20;interface.&#x20;Even&#x20;machines&#x20;that&#x20;are&#x20;print&#x20;servers&#x20;may&#x20;wish&#x20;to&#x20;leave&#x20;this&#x20;service&#x20;disabled&#x20;if&#x20;they&#x20;do&#x20;not&#x20;need&#x20;to&#x20;support&#x20;BSD-style&#x20;printing.','This&#x20;machine&#x20;a&#x20;print&#x20;server&#x20;for&#x20;your&#x20;network.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;the&#x20;rlpdaemon&#x20;based&#x20;printer&#x20;service:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;printer&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;&#x20;sed&#x20;&#039;s/^#printer/printer/&#039;&#x20;inetd.conf&#x20;&gt;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.6\"]}]'),(30009,'Only&#x20;enable&#x20;rquotad&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;rquotad.&#x20;rquotad&#x20;allows&#x20;NFS&#x20;clients&#x20;to&#x20;enforce&#x20;disk&#x20;quotas&#x20;on&#x20;file&#x20;systems&#x20;that&#x20;are&#x20;mounted&#x20;from&#x20;the&#x20;local&#x20;system.&#x20;If&#x20;your&#x20;site&#x20;does&#x20;not&#x20;use&#x20;disk&#x20;quotas,&#x20;then&#x20;you&#x20;may&#x20;leave&#x20;the&#x20;rquotad&#x20;service&#x20;disabled.','This&#x20;system&#x20;an&#x20;NFS&#x20;file&#x20;server&#x20;that&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;disk&#x20;quotas.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;rquotad:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;rquotad&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;&#x20;$6&#x20;~&#x20;//rpc.rquotad$/&#x20;{&#x20;sub&#40;/^#/,&#x20;&quot;&quot;&#41;&#x20;}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.7\"]}]'),(30010,'Only&#x20;enable&#x20;CDE-related&#x20;daemons&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;CDE-related&#x20;daemons.&#x20;The&#x20;rpc.ttdbserver&#x20;service&#x20;supports&#x20;HP&#039;s&#x20;CDE&#x20;windowing&#x20;environment.&#x20;This&#x20;service&#x20;has&#x20;a&#x20;history&#x20;of&#x20;security&#x20;problems.&#x20;Not&#x20;only&#x20;is&#x20;it&#x20;vital&#x20;to&#x20;keep&#x20;up&#x20;to&#x20;date&#x20;on&#x20;vendor&#x20;patches,&#x20;but&#x20;also&#x20;never&#x20;enable&#x20;this&#x20;service&#x20;on&#x20;any&#x20;system&#x20;which&#x20;is&#x20;not&#x20;well&#x20;protected&#x20;by&#x20;a&#x20;complete&#x20;network&#x20;security&#x20;infrastructure&#x20;&#40;including&#x20;network&#x20;and&#x20;host-based&#x20;firewalls,&#x20;packet&#x20;filters,&#x20;and&#x20;intrusion&#x20;detection&#x20;infrastructure&#41;.&#x20;Note&#x20;that&#x20;since&#x20;this&#x20;service&#x20;uses&#x20;ONC&#x20;RPC&#x20;mechanisms,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;system&#039;s&#x20;RPC&#x20;portmapper&#x20;&#40;rpcbind&#41;&#x20;also&#x20;be&#x20;enabled&#x20;when&#x20;this&#x20;service&#x20;is&#x20;turned&#x20;on.','There&#x20;a&#x20;mission-critical&#x20;reason&#x20;to&#x20;run&#x20;a&#x20;CDE&#x20;GUI&#x20;on&#x20;this&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;CDE-related&#x20;daemons:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;rpc.ttdbserver&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;awk&#x20;&#039;&#x20;$6&#x20;~&#x20;//rpc.ttdbserver$/&#x20;{&#x20;sub&#40;/^#/,&#x20;&quot;&quot;&#41;&#x20;}&#x20;{&#x20;print&#x20;}&#x20;&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.8\"]}]'),(30011,'Only&#x20;enable&#x20;Kerberos-related&#x20;daemons&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;Kerberos-related&#x20;daemons.&#x20;Kerberized&#x20;rlogin/remsh&#x20;offers&#x20;a&#x20;higher&#x20;degree&#x20;of&#x20;security&#x20;than&#x20;traditional&#x20;rlogin,&#x20;remsh,&#x20;or&#x20;telnet&#x20;by&#x20;eliminating&#x20;many&#x20;clear-text&#x20;password&#x20;exchanges&#x20;from&#x20;the&#x20;network.&#x20;However&#x20;it&#x20;is&#x20;still&#x20;not&#x20;as&#x20;secure&#x20;as&#x20;SSH,&#x20;which&#x20;encrypts&#x20;all&#x20;traffic.&#x20;Given&#x20;the&#x20;wide&#x20;availability&#x20;of&#x20;free&#x20;SSH&#x20;implementations,&#x20;there&#x20;are&#x20;few&#x20;cases&#x20;where&#x20;these&#x20;tools&#x20;cannot&#x20;be&#x20;replaced&#x20;with&#x20;SSH.','The&#x20;Kerberos&#x20;security&#x20;system&#x20;is&#x20;in&#x20;use&#x20;at&#x20;this&#x20;site&#x20;and&#x20;there&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;that&#x20;requires&#x20;users&#x20;to&#x20;access&#x20;this&#x20;system&#x20;via&#x20;Kerberized&#x20;rlogin/remsh,&#x20;rather&#x20;than&#x20;the&#x20;more&#x20;secure&#x20;SSH&#x20;protocol.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;Kerberos-related&#x20;daemons:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;klogin&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#kshell/kshell/;&#x20;s/^#klogin/klogin/&#039;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf.new','[{\"cis\": [\"1.2.9\"]}]'),(30012,'Only&#x20;enable&#x20;BOOTP/DHCP&#x20;daemon&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;BOOTP/DHCP&#x20;services.&#x20;BOOTP/DHCP&#x20;is&#x20;a&#x20;popular&#x20;protocol&#x20;for&#x20;dynamically&#x20;assigning&#x20;IP&#x20;addresses&#x20;and&#x20;other&#x20;network&#x20;information&#x20;to&#x20;systems&#x20;on&#x20;the&#x20;network&#x20;&#40;rather&#x20;than&#x20;having&#x20;administrators&#x20;manually&#x20;manage&#x20;this&#x20;information&#x20;on&#x20;each&#x20;host&#41;.&#x20;However,&#x20;if&#x20;this&#x20;system&#x20;is&#x20;not&#x20;a&#x20;BOOTP/DHCP&#x20;server&#x20;for&#x20;the&#x20;network,&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;be&#x20;running&#x20;this&#x20;service.','This&#x20;server&#x20;a&#x20;BOOTP/DHCP&#x20;server&#x20;for&#x20;the&#x20;network.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;BOOTP/DHCP&#x20;services:&#x20;1.&#x20;Open&#x20;/etc/inetd.conf.&#x20;2.&#x20;Delete&#x20;the&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;from&#x20;the&#x20;bootps&#x20;definition.&#x20;3.&#x20;Save&#x20;/etc/inetd.conf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;sed&#x20;&#039;s/^#bootps/bootps/&#039;&#x20;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.new&#x20;cp&#x20;inetd.conf.new&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;/etc/inetd.conf','[{\"cis\": [\"1.2.10\"]}]'),(30013,'Disable&#x20;login:&#x20;prompts&#x20;on&#x20;serial&#x20;ports.','Disable&#x20;the&#x20;login:&#x20;prompt&#x20;on&#x20;the&#x20;system&#x20;serial&#x20;devices&#x20;to&#x20;make&#x20;it&#x20;more&#x20;difficult&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;attach&#x20;modems,&#x20;terminals,&#x20;and&#x20;other&#x20;remote&#x20;access&#x20;devices&#x20;to&#x20;these&#x20;ports.','If&#x20;there&#x20;is&#x20;not&#x20;a&#x20;mission-critical&#x20;need&#x20;to&#x20;provide&#x20;login&#x20;capability&#x20;from&#x20;any&#x20;serial&#x20;ports&#x20;&#40;such&#x20;as&#x20;for&#x20;a&#x20;modem&#41;&#x20;then&#x20;disabling&#x20;the&#x20;login:&#x20;prompt&#x20;on&#x20;the&#x20;system&#x20;serial&#x20;devices&#x20;reduces&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;via&#x20;these&#x20;ports.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;login:&#x20;prompt&#x20;on&#x20;the&#x20;system&#x20;serial&#x20;devices:&#x20;1.&#x20;Open&#x20;/etc/inittab.&#x20;2.&#x20;Disable&#x20;each&#x20;getty&#x20;instance&#x20;associated&#x20;with&#x20;a&#x20;tty&#x20;device&#x20;by&#x20;adding&#x20;a&#x20;comment&#x20;character&#x20;&#40;#&#41;&#x20;to&#x20;the&#x20;beginning&#x20;of&#x20;the&#x20;line.&#x20;3.&#x20;Save&#x20;/etc/inittab.*&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;cp&#x20;-p&#x20;/etc/inittab&#x20;/etc/inittab.tmp&#x20;sed&#x20;&#039;s/^[^#].*getty.*tty.*$/#&amp;/&#039;&#x20;&#x20;/etc/inittab.tmp&#x20;&#x20;&gt;&#x20;/etc/inittab&#x20;rm&#x20;-f&#x20;/etc/inittab.tmp&#x20;-&#x20;Note&#x20;that&#x20;this&#x20;action&#x20;may&#x20;safely&#x20;be&#x20;performed&#x20;even&#x20;if&#x20;console&#x20;access&#x20;to&#x20;the&#x20;system&#x20;is&#x20;provided&#x20;via&#x20;the&#x20;serial&#x20;ports,&#x20;as&#x20;the&#x20;line&#x20;in&#x20;the&#x20;/etc/inittab&#x20;file&#x20;that&#x20;corresponds&#x20;to&#x20;the&#x20;console&#x20;does&#x20;not&#x20;match&#x20;the&#x20;supplied&#x20;pattern&#x20;&#40;i.e.,&#x20;it&#x20;doesn&#039;t&#x20;contain&#x20;the&#x20;string&#x20;&#039;tty&#039;&#41;.&#x20;-&#x20;Note&#x20;that&#x20;when&#x20;serial&#x20;port&#x20;connectivity&#x20;is&#x20;needed,&#x20;/etc/dialups&#x20;and&#x20;/etc/d_passwd&#x20;can&#x20;be&#x20;set&#x20;to&#x20;require&#x20;an&#x20;extra&#x20;password&#x20;for&#x20;serial&#x20;port&#x20;access.&#x20;See&#x20;the&#x20;dialups&#40;4&#41;&#x20;manual&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;-&#x20;Note&#x20;that&#x20;by&#x20;default&#x20;in&#x20;HP-UX&#x20;11i,&#x20;only&#x20;the&#x20;console&#x20;has&#x20;a&#x20;getty&#x20;instance&#x20;running&#x20;on&#x20;it.','[{\"cis\": [\"1.3.1\"]}, {\"cis_level\": [\"1\"]}]'),(30014,'Disable&#x20;NIS/NIS+&#x20;related&#x20;processes,&#x20;if&#x20;possible.','Disable&#x20;NIS/NIS+&#x20;related&#x20;processes.&#x20;Network&#x20;Information&#x20;Service&#x20;&#40;NIS&#41;&#x20;is&#x20;a&#x20;distributed&#x20;database&#x20;providing&#x20;centralized&#x20;control&#x20;of&#x20;names,&#x20;addresses,&#x20;services,&#x20;and&#x20;key&#x20;configuration&#x20;files&#x20;throughout&#x20;a&#x20;network&#x20;of&#x20;servers&#x20;and&#x20;clients.&#x20;NIS&#x20;was&#x20;formerly&#x20;known&#x20;as&#x20;Yellow&#x20;Pages&#x20;&#40;YP&#41;.&#x20;NIS+&#x20;is&#x20;a&#x20;replacement&#x20;for&#x20;NIS&#x20;services,&#x20;and&#x20;is&#x20;more&#x20;scalable,&#x20;flexible,&#x20;and&#x20;secure.&#x20;It&#x20;adds&#x20;a&#x20;security&#x20;system&#x20;with&#x20;authentication&#x20;and&#x20;authorization&#x20;services&#x20;to&#x20;validate&#x20;users&#x20;on&#x20;the&#x20;network&#x20;and&#x20;to&#x20;determine&#x20;if&#x20;they&#x20;allowed&#x20;to&#x20;access&#x20;or&#x20;modify&#x20;the&#x20;information&#x20;requested.&#x20;However,&#x20;both&#x20;systems&#x20;have&#x20;known&#x20;security&#x20;vulnerabilities,&#x20;and&#x20;have&#x20;been&#x20;an&#x20;entry&#x20;point&#x20;for&#x20;security&#x20;attacks.','Eliminate&#x20;exposure&#x20;to&#x20;NIS/NIS+&#x20;vulnerabilities&#x20;by&#x20;not&#x20;running&#x20;related&#x20;daemons&#x20;on&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;NIS/NIS+&#x20;servers&#x20;or&#x20;clients.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;startup&#x20;of&#x20;NIS/NIS+&#x20;related&#x20;processes:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NIS_MASTER_SERVER=0&#x20;-p&#x20;NIS_SLAVE_SERVER=0&#x20;&#x20;-p&#x20;NIS_CLIENT=0&#x20;-p&#x20;NISPLUS_SERVER=0&#x20;&#x20;-p&#x20;NISPLUS_CLIENT=0&#x20;/etc/rc.config.d/namesvrs','[{\"cis\": [\"1.3.2\"]}, {\"cis_level\": [\"1\"]}]'),(30015,'Disable&#x20;printer&#x20;daemons,&#x20;if&#x20;possible.','Disable&#x20;printer&#x20;daemons.&#x20;The&#x20;Technical&#x20;Print&#x20;Service&#x20;&#40;TPS&#41;&#x20;is&#x20;a&#x20;printer&#x20;service&#x20;used&#x20;in&#x20;the&#x20;X-Windows&#x20;and/or&#x20;CDE&#x20;environment.&#x20;It&#x20;is&#x20;recommended&#x20;that&#x20;this&#x20;service&#x20;be&#x20;disabled&#x20;if&#x20;the&#x20;hosting&#x20;system&#x20;does&#x20;not&#x20;participate&#x20;in&#x20;print&#x20;services&#x20;The&#x20;administrator&#x20;may&#x20;wish&#x20;to&#x20;consider&#x20;converting&#x20;to&#x20;the&#x20;LPRng&#x20;print&#x20;system&#x20;&#40;see&#x20;http://www.lprng.org/&#41;&#x20;which&#x20;was&#x20;designed&#x20;with&#x20;security&#x20;in&#x20;mind&#x20;and&#x20;is&#x20;widely&#x20;portable&#x20;across&#x20;many&#x20;different&#x20;Unix&#x20;platforms.&#x20;Note,&#x20;however,&#x20;that&#x20;LPRng&#x20;is&#x20;not&#x20;supported&#x20;by&#x20;Hewlett-Packard.','Disabling&#x20;unused&#x20;services,&#x20;such&#x20;as&#x20;TPS,&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;and&#x20;local&#x20;attack&#x20;surfaces&#x20;of&#x20;the&#x20;hosting&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;printer&#x20;daemons:&#x20;1.&#x20;Set&#x20;the&#x20;LP&#x20;parameter&#x20;to&#x20;zero&#x20;in&#x20;the&#x20;lp&#x20;system&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/lp&#x20;2.&#x20;Set&#x20;the&#x20;XPRINTSERVERS&#x20;parameter&#x20;to&#x20;an&#x20;empty&#x20;string&#x20;in&#x20;the&#x20;tps&#x20;system&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/tps&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;&#x20;ch_rc&#x20;-a&#x20;-p&#x20;XPRINTSERVERS=&quot;&#039;&#039;&quot;&#x20;/etc/rc.config.d/tps&#x20;ch_rc&#x20;-a&#x20;-p&#x20;LP=0&#x20;/etc/rc.config.d/lp','[{\"cis\": [\"1.3.3\"]}, {\"cis_level\": [\"1\"]}]'),(30016,'Disable&#x20;the&#x20;CDE&#x20;GUI&#x20;login,&#x20;if&#x20;possible.','CDE&#x20;stands&#x20;for&#x20;&#039;Common&#x20;Desktop&#x20;Environment,&#039;&#x20;and&#x20;is&#x20;an&#x20;environment&#x20;for&#x20;logging&#x20;on&#x20;to&#x20;and&#x20;interacting&#x20;with&#x20;your&#x20;system&#x20;via&#x20;an&#x20;X-windows&#x20;type&#x20;GUI&#x20;interface&#x20;from&#x20;the&#x20;console.&#x20;Intended&#x20;for&#x20;use&#x20;with&#x20;workstation&#x20;or&#x20;desktop&#x20;systems,&#x20;this&#x20;service&#x20;is&#x20;not&#x20;commonly&#x20;used&#x20;with&#x20;the&#x20;server-class&#x20;systems&#x20;or&#x20;in&#x20;large&#x20;enterprise&#x20;environments.&#x20;The&#x20;X&#x20;Windows-based&#x20;CDE&#x20;GUI&#x20;services&#x20;were&#x20;developed&#x20;with&#x20;a&#x20;different&#x20;set&#x20;of&#x20;security&#x20;expecations&#x20;from&#x20;those&#x20;expected&#x20;in&#x20;many&#x20;enterprise&#x20;deployments,&#x20;and&#x20;have&#x20;had&#x20;a&#x20;history&#x20;of&#x20;security&#x20;issues.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;mission-critical&#x20;need&#x20;for&#x20;a&#x20;CDE&#x20;GUI&#x20;login&#x20;to&#x20;the&#x20;system,&#x20;this&#x20;service&#x20;should&#x20;not&#x20;be&#x20;run&#x20;to&#x20;further&#x20;reduce&#x20;opportunities&#x20;for&#x20;security&#x20;attacks.','The&#x20;X&#x20;Windows-based&#x20;CDE&#x20;GUI&#x20;on&#x20;HP-UX&#x20;systems&#x20;has&#x20;had&#x20;a&#x20;history&#x20;of&#x20;security&#x20;issues,&#x20;and&#x20;should&#x20;be&#x20;disabled&#x20;if&#x20;unused.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;GUI&#x20;login:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;DESKTOP=&quot;&quot;&#x20;/etc/rc.config.d/desktop','[{\"cis\": [\"1.3.4\"]}, {\"cis_level\": [\"1\"]}]'),(30017,'Disable&#x20;email&#x20;server,&#x20;if&#x20;possible.','Disable&#x20;the&#x20;sendmail&#x20;daemon&#x20;to&#x20;avoid&#x20;processing&#x20;incoming&#x20;email.&#x20;It&#x20;is&#x20;possible&#x20;to&#x20;run&#x20;a&#x20;Unix&#x20;system&#x20;with&#x20;the&#x20;Sendmail&#x20;daemon&#x20;disabled&#x20;and&#x20;still&#x20;allow&#x20;users&#x20;on&#x20;that&#x20;system&#x20;to&#x20;send&#x20;email&#x20;out&#x20;from&#x20;that&#x20;machine.&#x20;Running&#x20;Sendmail&#x20;in&#x20;&#039;daemon&#x20;mode&#039;&#x20;&#40;with&#x20;the&#x20;-bd&#x20;command-line&#x20;option&#41;&#x20;is&#x20;only&#x20;required&#x20;on&#x20;machines&#x20;that&#x20;act&#x20;as&#x20;mail&#x20;servers,&#x20;receiving&#x20;and&#x20;processing&#x20;email&#x20;from&#x20;other&#x20;hosts&#x20;on&#x20;the&#x20;network.&#x20;The&#x20;remediation&#x20;below&#x20;will&#x20;result&#x20;in&#x20;a&#x20;machine&#x20;that&#x20;can&#x20;send&#x20;email&#x20;but&#x20;not&#x20;receive&#x20;it.&#x20;-&#x20;Note&#x20;that&#x20;after&#x20;disabling&#x20;the&#x20;-bd&#x20;option&#x20;on&#x20;the&#x20;local&#x20;mail&#x20;server&#x20;on&#x20;systems&#x20;running&#x20;Sendmail&#x20;v8.12&#x20;or&#x20;later&#x20;&#40;8.13&#x20;is&#x20;currently&#x20;shipped&#x20;as&#x20;part&#x20;of&#x20;HP-UX&#x20;11iv3&#41;,&#x20;it&#x20;is&#x20;also&#x20;necessary&#x20;to&#x20;modify&#x20;the&#x20;/etc/mail/submit.cf&#x20;file.&#x20;Find&#x20;the&#x20;line&#x20;that&#x20;reads&#x20;&#039;D{MTAHost}localhost&#039;&#x20;and&#x20;change&#x20;localhost&#x20;to&#x20;the&#x20;name&#x20;of&#x20;some&#x20;other&#x20;local&#x20;mail&#x20;server&#x20;for&#x20;the&#x20;organization.&#x20;This&#x20;will&#x20;cause&#x20;email&#x20;generated&#x20;on&#x20;the&#x20;local&#x20;system&#x20;to&#x20;be&#x20;relayed&#x20;to&#x20;that&#x20;mail&#x20;server&#x20;for&#x20;further&#x20;processing&#x20;and&#x20;delivery.&#x20;-&#x20;Note&#x20;that&#x20;if&#x20;the&#x20;system&#x20;is&#x20;an&#x20;email&#x20;server,&#x20;the&#x20;administrator&#x20;is&#x20;encouraged&#x20;to&#x20;search&#x20;the&#x20;Web&#x20;for&#x20;additional&#x20;documentation&#x20;on&#x20;Sendmail&#x20;security&#x20;issues.','Avoid&#x20;potential&#x20;vulnerabilities&#x20;in&#x20;the&#x20;sendmail&#x20;server&#x20;if&#x20;incoming&#x20;email&#x20;service&#x20;is&#x20;not&#x20;used.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;sendmail&#x20;server:&#x20;1.&#x20;Set&#x20;the&#x20;SENDMAIL_SERVER&#x20;parameter&#x20;to&#x20;zero&#x20;in&#x20;the&#x20;mailservs&#x20;system&#x20;configuration&#x20;file.&#x20;2.&#x20;Setup&#x20;a&#x20;cron&#x20;job&#x20;to&#x20;run&#x20;sendmail&#x20;at&#x20;regular&#x20;intervals&#x20;&#40;e.g.&#x20;every&#x20;hour&#41;&#x20;in&#x20;order&#x20;to&#x20;process&#x20;queued,&#x20;outgoing&#x20;mail.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SENDMAIL_SERVER=0&#x20;/etc/rc.config.d/mailservs&#x20;cd&#x20;/var/spool/cron/crontabs&#x20;crontab&#x20;-l&#x20;&gt;root.tmp&#x20;echo&#x20;&#039;0&#x20;*&#x20;*&#x20;*&#x20;*&#x20;/usr/lib/sendmail&#x20;-q&#039;&#x20;&gt;&gt;root.tmp&#x20;crontab&#x20;root.tmp&#x20;rm&#x20;-f&#x20;root.tmp','[{\"cis\": [\"1.3.5\"]}, {\"cis_level\": [\"1\"]}]'),(30018,'Disable&#x20;SNMP&#x20;and&#x20;OpenView&#x20;Agents,&#x20;if&#x20;remote&#x20;management&#x20;or&#x20;monitoring&#x20;are&#x20;not&#x20;needed.','Disable&#x20;SNMP&#x20;and&#x20;OpenView&#x20;agents&#x20;if&#x20;they&#x20;are&#x20;not&#x20;needed.&#x20;Note:&#x20;If&#x20;SNMP&#x20;is&#x20;used,&#x20;it&#x20;is&#x20;recommended&#x20;to&#x20;change&#x20;the&#x20;default&#x20;SNMP&#x20;community&#x20;string&#x20;by&#x20;modifying&#x20;the&#x20;get-community&#x20;and&#x20;set-community&#x20;parameters&#x20;in&#x20;the&#x20;SNMP&#x20;configuration&#x20;file&#x20;/etc/SnmpAgent.d/snmpd.conf.','If&#x20;SNMP&#x20;and&#x20;OpenView&#x20;agents&#x20;are&#x20;not&#x20;needed,&#x20;avoid&#x20;potential&#x20;security&#x20;vulnerabilities&#x20;in&#x20;these&#x20;programs&#x20;by&#x20;disabling&#x20;them.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;SNMP&#x20;and&#x20;OpenView&#x20;Agents:&#x20;cd&#x20;/sbin/rc2.d&#x20;mv&#x20;-f&#x20;S570SnmpFddi&#x20;.NOS570SnmpFddi&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_HPUNIX_START=0&#x20;&#x20;/etc/rc.config.d/SnmpHpunix&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_MASTER_START=0&#x20;&#x20;/etc/rc.config.d/SnmpMaster&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_MIB2_START=0&#x20;&#x20;/etc/rc.config.d/SnmpMib2&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SNMP_TRAPDEST_START=0&#x20;&#x20;/etc/rc.config.d/SnmpTrpDst&#x20;ch_rc&#x20;-a&#x20;-p&#x20;OSPFMIB=0&#x20;&#x20;/etc/rc.config.d/netdaemons&#x20;ch_rc&#x20;-a&#x20;-p&#x20;OPCAGT=0&#x20;&#x20;/etc/rc.config.d/opcagt','[{\"cis\": [\"1.3.6\"]}, {\"cis_level\": [\"1\"]}]'),(30019,'Disable&#x20;rarely&#x20;used&#x20;standard&#x20;boot&#x20;services.','Disable&#x20;other&#x20;standard&#x20;boot&#x20;services.&#x20;Setting&#x20;these&#x20;variables&#x20;in&#x20;the&#x20;/etc/rc.config.d&#x20;configuration&#x20;files&#x20;will&#x20;effectively&#x20;disable&#x20;a&#x20;wide&#x20;variety&#x20;of&#x20;infrequently&#x20;used&#x20;subsystems.&#x20;Variables&#x20;are&#x20;merely&#x20;set&#x20;&#40;rather&#x20;than&#x20;renaming&#x20;or&#x20;removing&#x20;startup&#x20;scripts&#41;&#x20;so&#x20;that&#x20;the&#x20;local&#x20;administrator&#x20;can&#x20;easily&#x20;&quot;restore&quot;&#x20;any&#x20;of&#x20;these&#x20;services&#x20;if&#x20;they&#x20;discover&#x20;a&#x20;mission-critical&#x20;need&#x20;to&#x20;have&#x20;it.&#x20;Additionally,&#x20;HP-UX&#x20;patches&#x20;tend&#x20;to&#x20;supply&#x20;fresh&#x20;copies&#x20;of&#x20;the&#x20;startup&#x20;scripts,&#x20;so&#x20;they&#x20;may&#x20;get&#x20;inadvertently&#x20;re-&#x20;enabled,&#x20;whereas&#x20;setting&#x20;configuration&#x20;variables&#x20;usually&#x20;survives&#x20;patch&#x20;installs.&#x20;Finally,&#x20;setting&#x20;configuration&#x20;variables&#x20;is&#x20;the&#x20;method&#x20;recommended&#x20;and&#x20;supported&#x20;by&#x20;HP.&#x20;Note&#x20;that&#x20;not&#x20;all&#x20;of&#x20;the&#x20;configuration&#x20;files&#x20;listed&#x20;above&#x20;will&#x20;exist&#x20;on&#x20;all&#x20;systems&#x20;&#40;some&#x20;are&#x20;only&#x20;valid&#x20;for&#x20;certain&#x20;releases,&#x20;others&#x20;only&#x20;exist&#x20;if&#x20;certain&#x20;OEM&#x20;vendor&#x20;software&#x20;is&#x20;installed&#41;.&#x20;The&#x20;rest&#x20;of&#x20;the&#x20;actions&#x20;in&#x20;this&#x20;section&#x20;give&#x20;the&#x20;administrator&#x20;the&#x20;option&#x20;of&#x20;re-enabling&#x20;certain&#x20;services&#x20;-&#x20;in&#x20;particular,&#x20;the&#x20;services&#x20;that&#x20;are&#x20;disabled&#x20;in&#x20;the&#x20;second&#x20;block&#x20;of&#x20;the&#x20;remediation&#x20;section&#x20;below.&#x20;Rather&#x20;than&#x20;disabling&#x20;and&#x20;then&#x20;re-enabling&#x20;these&#x20;services,&#x20;experienced&#x20;administrators&#x20;may&#x20;wish&#x20;to&#x20;simply&#x20;disable&#x20;only&#x20;those&#x20;services&#x20;that&#x20;they&#x20;know&#x20;are&#x20;unnecessary&#x20;for&#x20;their&#x20;systems.&#x20;Note:&#x20;that&#x20;HP-UX&#x20;11.31&#x20;was&#x20;the&#x20;first&#x20;version&#x20;to&#x20;support&#x20;disablement&#x20;of&#x20;the&#x20;NFS&#x20;core&#x20;services.&#x20;Disablement&#x20;on&#x20;earlier&#x20;versions&#x20;is&#x20;possible&#x20;by&#x20;moving&#x20;/sbin/rc2.d/S400nfs.core&#x20;to&#x20;/sbin/rc2.d/.NOS400nfs.core,&#x20;but&#x20;there&#x20;is&#x20;some&#x20;risk&#x20;of&#x20;system&#x20;instability.','Avoid&#x20;potential&#x20;security&#x20;vulnerabilities&#x20;in&#x20;infrequently&#x20;used&#x20;subsystems&#x20;by&#x20;disabling&#x20;them.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;START_SNAPLUS=0&#x20;-p&#x20;START_SNANODE=0&#x20;&#x20;-p&#x20;START_SNAINETD=0&#x20;/etc/rc.config.d/snaplus2&#x20;ch_rc&#x20;-a&#x20;-p&#x20;MROUTED=0&#x20;-p&#x20;RWHOD=0&#x20;-p&#x20;DDFA=0&#x20;&#x20;-p&#x20;START_RBOOTD=0&#x20;/etc/rc.config.d/netdaemons&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RARPD=0&#x20;-p&#x20;RDPD=0&#x20;/etc/rc.config.d/netconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PTYDAEMON_START=0&#x20;/etc/rc.config.d/ptydaemon&#x20;ch_rc&#x20;-a&#x20;-p&#x20;VTDAEMON_START=0&#x20;/etc/rc.config.d/vt&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NAMED=0&#x20;/etc/rc.config.d/namesvrs&#x20;ch_rc&#x20;-a&#x20;-p&#x20;START_I4LMD=0&#x20;/etc/rc.config.d/i4lmd&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_X_FONT_SERVER=0&#x20;/etc/rc.config.d/xfs&#x20;ch_rc&#x20;-a&#x20;-p&#x20;AUDIO_SERVER=0&#x20;/etc/rc.config.d/audio&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SLSD_DAEMON=0&#x20;/etc/rc.config.d/slsd&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_SAMBA=0&#x20;/etc/rc.config.d/samba&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_CIFSCLIENT=0&#x20;&#x20;/etc/rc.config.d/cifsclient&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_SERVER=0&#x20;&#x20;-p&#x20;NFS_CLIENT=0&#x20;/etc/rc.config.d/nfsconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_APACHE_START=0&#x20;/etc/rc.config.d/hpws_apacheconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_CORE=0&#x20;/etc/rc.config.d/nfsconf','[{\"cis\": [\"1.3.7\"]}, {\"cis_level\": [\"1\"]}]'),(30020,'Only&#x20;enable&#x20;Windows-compatibility&#x20;server&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;CIFS&#x20;Server&#x20;&#40;Samba&#41;&#x20;services.&#x20;HP-UX&#x20;11i&#x20;includes&#x20;the&#x20;popular&#x20;Open&#x20;Source&#x20;Samba&#x20;server&#x20;&#40;HP-UX&#x20;CIFS&#x20;Server&#41;&#x20;for&#x20;providing&#x20;file&#x20;and&#x20;print&#x20;services&#x20;to&#x20;Windows-based&#x20;systems.&#x20;This&#x20;allows&#x20;an&#x20;HP-UX&#x20;system&#x20;to&#x20;act&#x20;as&#x20;a&#x20;file&#x20;or&#x20;print&#x20;server&#x20;on&#x20;a&#x20;Windows&#x20;network,&#x20;and&#x20;even&#x20;act&#x20;as&#x20;a&#x20;Domain&#x20;Controller&#x20;&#40;authentication&#x20;server&#41;&#x20;to&#x20;older&#x20;Windows&#x20;operating&#x20;systems.&#x20;However,&#x20;if&#x20;this&#x20;functionality&#x20;is&#x20;not&#x20;required&#x20;by&#x20;the&#x20;site,&#x20;this&#x20;service&#x20;should&#x20;be&#x20;disabled.','This&#x20;machine&#x20;provides&#x20;authentication,&#x20;file&#x20;sharing,&#x20;or&#x20;printer&#x20;sharing&#x20;services&#x20;to&#x20;systems&#x20;running&#x20;Microsoft&#x20;Windows&#x20;operating&#x20;systems.','','Perform&#x20;the&#x20;following&#x20;to&#x20;re-enable&#x20;CIFS&#x20;Server:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_SAMBA=1&#x20;/etc/rc.config.d/samba','[{\"cis\": [\"1.3.8\"]}]'),(30021,'Only&#x20;enable&#x20;Windows-compatibility&#x20;client&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;HP&#x20;CIFS&#x20;Client&#x20;service.','This&#x20;system&#x20;requires&#x20;access&#x20;to&#x20;file&#x20;systems&#x20;from&#x20;remote&#x20;servers&#x20;via&#x20;the&#x20;Windows&#x20;&#40;SMB&#41;&#x20;file&#x20;services.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;RUN_CIFSCLIENT=1&#x20;/etc/rc.config.d/cifsclient','[{\"cis\": [\"1.3.9\"]}]'),(30022,'Only&#x20;enable&#x20;NFS&#x20;server&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;NFS&#x20;file&#x20;service.&#x20;NFS&#x20;is&#x20;frequently&#x20;exploited&#x20;to&#x20;gain&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;and&#x20;systems.&#x20;Clearly&#x20;there&#x20;is&#x20;no&#x20;need&#x20;to&#x20;run&#x20;the&#x20;NFS&#x20;server-related&#x20;daemons&#x20;on&#x20;hosts&#x20;that&#x20;are&#x20;not&#x20;NFS&#x20;servers.&#x20;If&#x20;the&#x20;system&#x20;is&#x20;an&#x20;NFS&#x20;server,&#x20;the&#x20;admin&#x20;should&#x20;take&#x20;reasonable&#x20;precautions&#x20;when&#x20;exporting&#x20;file&#x20;systems,&#x20;including&#x20;restricting&#x20;NFS&#x20;access&#x20;to&#x20;a&#x20;specific&#x20;range&#x20;of&#x20;local&#x20;IP&#x20;addresses&#x20;and&#x20;exporting&#x20;file&#x20;systems&#x20;&quot;read-only&quot;&#x20;and&#x20;&quot;nosuid&quot;&#x20;where&#x20;appropriate.&#x20;For&#x20;more&#x20;information&#x20;consult&#x20;the&#x20;exportfs&#40;1M&#41;&#x20;manual&#x20;page.&#x20;Much&#x20;higher&#x20;levels&#x20;of&#x20;security&#x20;can&#x20;be&#x20;achieved&#x20;by&#x20;combining&#x20;NFS&#x20;with&#x20;secure&#x20;RPC&#x20;or&#x20;Kerberos,&#x20;although&#x20;there&#x20;is&#x20;significant&#x20;administrative&#x20;overhead&#x20;involved&#x20;in&#x20;this&#x20;transition.&#x20;Note&#x20;that&#x20;since&#x20;this&#x20;service&#x20;uses&#x20;ONC&#x20;RPC&#x20;mechanisms,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;system&#039;s&#x20;RPC&#x20;portmapper&#x20;&#40;rpcbind&#41;&#x20;also&#x20;be&#x20;enabled&#x20;when&#x20;this&#x20;service&#x20;is&#x20;turned&#x20;on.&#x20;For&#x20;more&#x20;information&#x20;see&#x20;Item&#x20;1.3.12&#x20;below.&#x20;Also,&#x20;note&#x20;that&#x20;some&#x20;releases&#x20;of&#x20;Oracle&#x20;software&#x20;for&#x20;HP-UX&#x20;require&#x20;NFS&#x20;services&#x20;in&#x20;order&#x20;to&#x20;install&#x20;properly.&#x20;Therefore,&#x20;the&#x20;NFS&#x20;server&#x20;process&#x20;may&#x20;need&#x20;to&#x20;be&#x20;started&#x20;by&#x20;hand&#x20;on&#x20;systems&#x20;on&#x20;which&#x20;Oracle&#x20;software&#x20;is&#x20;to&#x20;be&#x20;installed/updated.&#x20;This&#x20;can&#x20;be&#x20;accomplished&#x20;by&#x20;performing&#x20;the&#x20;following:&#x20;1.&#x20;Temporarily&#x20;set&#x20;NFS_SERVER=1,&#x20;/etc/rc.config.d/nfsconf&#x20;2.&#x20;Execute:&#x20;&#x20;/sbin/init.d/nfs.core&#x20;start&#x20;/sbin/init.d/nfs.server&#x20;start&#x20;3.&#x20;Install&#x20;Oracle&#x20;4.&#x20;Stop&#x20;the&#x20;NFS&#x20;services:&#x20;&#x20;/sbin/init.d/nfs.core&#x20;stop&#x20;/sbin/init.d/nfs.server&#x20;stop&#x20;5.&#x20;Disable&#x20;the&#x20;NFS&#x20;services&#x20;by&#x20;resetting&#x20;NFS_SERVER=0,&#x20;NUM_NFSD=0,&#x20;and&#x20;NUM_NFSIOD=0&#x20;in&#x20;/etc/rc.config.d/nfsconf.','This&#x20;machine&#x20;is&#x20;a&#x20;NFS&#x20;file&#x20;server.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_SERVER=1&#x20;/etc/rc.config.d/nfsconf','[{\"cis\": [\"1.3.10\"]}]'),(30023,'Only&#x20;enable&#x20;NFS&#x20;client&#x20;processes&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;NFS&#x20;Client&#x20;service.&#x20;Again,&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;significant&#x20;need&#x20;for&#x20;this&#x20;system&#x20;to&#x20;acquire&#x20;data&#x20;via&#x20;NFS,&#x20;administrators&#x20;should&#x20;disable&#x20;NFS-related&#x20;services.&#x20;Note&#x20;that&#x20;other&#x20;file&#x20;transfer&#x20;schemes&#x20;&#40;such&#x20;as&#x20;rdist&#x20;via&#x20;SSH&#41;&#x20;can&#x20;often&#x20;be&#x20;more&#x20;secure&#x20;than&#x20;NFS&#x20;for&#x20;certain&#x20;applications,&#x20;although&#x20;again&#x20;the&#x20;use&#x20;of&#x20;secure&#x20;RPC&#x20;or&#x20;Kerberos&#x20;can&#x20;significantly&#x20;improve&#x20;NFS&#x20;security.&#x20;Also&#x20;note&#x20;that&#x20;if&#x20;the&#x20;machine&#x20;will&#x20;be&#x20;an&#x20;NFS&#x20;client,&#x20;then&#x20;the&#x20;rpcbind&#x20;process&#x20;must&#x20;be&#x20;running&#x20;&#40;see&#x20;Item&#x20;3.12&#x20;below&#41;.&#x20;-&#x20;Note&#x20;that&#x20;since&#x20;this&#x20;service&#x20;uses&#x20;ONC&#x20;RPC&#x20;mechanisms,&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;system&#039;s&#x20;RPC&#x20;portmapper&#x20;&#40;rpcbind&#41;&#x20;also&#x20;be&#x20;enabled&#x20;when&#x20;this&#x20;service&#x20;is&#x20;turned&#x20;on.&#x20;For&#x20;more&#x20;information&#x20;see&#x20;Item&#x20;3.12&#x20;below.','This&#x20;system&#x20;must&#x20;access&#x20;file&#x20;systems&#x20;from&#x20;remote&#x20;servers&#x20;via&#x20;NFS.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_CLIENT=1&#x20;/etc/rc.config.d/nfsconf','[{\"cis\": [\"1.3.11\"]}]'),(30024,'Only&#x20;enable&#x20;RPC-based&#x20;services&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;RPC-based&#x20;services.&#x20;RPC-based&#x20;services&#x20;typically&#x20;use&#x20;very&#x20;weak&#x20;or&#x20;non-existent&#x20;authentication&#x20;and&#x20;yet&#x20;may&#x20;share&#x20;very&#x20;sensitive&#x20;information.&#x20;Unless&#x20;one&#x20;of&#x20;the&#x20;services&#x20;listed&#x20;above&#x20;is&#x20;required&#x20;on&#x20;this&#x20;machine,&#x20;it&#x20;is&#x20;best&#x20;to&#x20;disable&#x20;RPC-based&#x20;tools&#x20;completely.&#x20;If&#x20;you&#x20;are&#x20;unsure&#x20;whether&#x20;or&#x20;not&#x20;a&#x20;particular&#x20;third-party&#x20;application&#x20;requires&#x20;RPC&#x20;services,&#x20;consult&#x20;with&#x20;the&#x20;application&#x20;vendor.&#x20;Note&#x20;that&#x20;disabling&#x20;this&#x20;service&#x20;by&#x20;renaming&#x20;the&#x20;startup&#x20;file&#x20;may&#x20;not&#x20;survive&#x20;the&#x20;install&#x20;of&#x20;RPC-related&#x20;patches.','RPC-based&#x20;services&#x20;are&#x20;used&#x20;such&#x20;as:&#x20;-&#x20;This&#x20;machine&#x20;is&#x20;an&#x20;NFS&#x20;client&#x20;or&#x20;server.&#x20;-&#x20;This&#x20;machine&#x20;is&#x20;an&#x20;NIS&#x20;&#40;YP&#41;&#x20;or&#x20;NIS+&#x20;client&#x20;or&#x20;server.&#x20;-&#x20;This&#x20;machine&#x20;runs&#x20;a&#x20;GUI&#x20;or&#x20;GUI-based&#x20;administration&#x20;tool.&#x20;-&#x20;The&#x20;machine&#x20;runs&#x20;a&#x20;third-party&#x20;software&#x20;application&#x20;which&#x20;is&#x20;dependent&#x20;on&#x20;RPC&#x20;support&#x20;&#40;example:&#x20;FlexLM&#x20;License&#x20;managers&#41;.','','Perform&#x20;the&#x20;following&#x20;for&#x20;11.31&#x20;and&#x20;later:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NFS_CORE=1&#x20;/etc/rc.config.d/nfsconf&#x20;For&#x20;11.23&#x20;and&#x20;prior:&#x20;&#x20;mv&#x20;-f&#x20;/sbin/rc2.d/.NOS400nfs.core&#x20;&#x20;/sbin/rc2.d/400nfs.core','[{\"cis\": [\"1.3.12\"]}]'),(30025,'Only&#x20;enable&#x20;Web&#x20;server&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;Web&#x20;server&#x20;suite.&#x20;Even&#x20;if&#x20;this&#x20;machine&#x20;is&#x20;a&#x20;Web&#x20;server,&#x20;the&#x20;local&#x20;site&#x20;may&#x20;choose&#x20;not&#x20;to&#x20;use&#x20;the&#x20;Web&#x20;server&#x20;provided&#x20;with&#x20;HP-UX&#x20;in&#x20;favor&#x20;of&#x20;a&#x20;locally&#x20;developed&#x20;and&#x20;supported&#x20;Web&#x20;environment.&#x20;If&#x20;the&#x20;machine&#x20;is&#x20;a&#x20;Web&#x20;server,&#x20;the&#x20;administrator&#x20;is&#x20;encouraged&#x20;to&#x20;search&#x20;the&#x20;Web&#x20;for&#x20;additional&#x20;documentation&#x20;on&#x20;Web&#x20;server&#x20;security.&#x20;A&#x20;good&#x20;starting&#x20;point&#x20;is&#x20;http://httpd.apache.org/docs-2.0/misc/security_tips.html.&#x20;Note&#x20;that&#x20;this&#x20;action&#x20;only&#x20;disables&#x20;the&#x20;default&#x20;web&#x20;server&#x20;shipped&#x20;with&#x20;the&#x20;system.&#x20;Other&#x20;webservers&#x20;instances&#x20;may&#x20;still&#x20;be&#x20;running.','There&#x20;is&#x20;a&#x20;mission-critical&#x20;reason&#x20;why&#x20;this&#x20;system&#x20;must&#x20;run&#x20;a&#x20;Web&#x20;server.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NS_FTRACK=1&#x20;/etc/rc.config.d/ns-ftrack&#x20;ch_rc&#x20;-a&#x20;-p&#x20;APACHE_START=1&#x20;/etc/rc.config.d/apacheconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_APACHE32_START=1&#x20;/etc/rc.config.d/hpws_apache32conf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_TOMCAT_START=1&#x20;/etc/rc.config.d/hpws_tomcatconf&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NS_FTRACK=1&#x20;/etc/rc.config.d/ns-ftrack&#x20;ch_rc&#x20;-a&#x20;-p&#x20;HPWS_WEBMIN_START=1&#x20;/etc/rc.config.d/hpws_webminconf','[{\"cis\": [\"1.3.13\"]}]'),(30026,'Only&#x20;enable&#x20;BIND&#x20;DNS&#x20;server&#x20;if&#x20;absolutely&#x20;necessary.','Re-enable&#x20;the&#x20;BIND&#x20;DNS&#x20;service.&#x20;The&#x20;BIND&#x20;DNS&#x20;server,&#x20;or&#x20;named,&#x20;maps&#x20;IP&#x20;addresses&#x20;to&#x20;hostnames&#x20;across&#x20;the&#x20;Internet&#x20;and&#x20;supplies&#x20;these&#x20;services&#x20;to&#x20;other&#x20;hosts&#x20;on&#x20;the&#x20;local&#x20;local&#x20;network.&#x20;Though&#x20;it&#x20;has&#x20;been&#x20;widely&#x20;implemented,&#x20;BIND&#x20;has&#x20;a&#x20;long&#x20;history&#x20;of&#x20;security&#x20;flaws,&#x20;especially&#x20;in&#x20;the&#x20;BIND&#x20;8.x&#x20;release&#x20;tree&#x20;generally&#x20;shipped&#x20;with&#x20;HP-UX&#x20;11.x&#x20;systems.&#x20;Therefore,&#x20;if&#x20;you&#x20;are&#x20;going&#x20;to&#x20;run&#x20;BIND,&#x20;you&#x20;should&#x20;strongly&#x20;consider&#x20;moving&#x20;to&#x20;the&#x20;BIND&#x20;9.x&#x20;release-tree.&#x20;HP&#x20;has&#x20;supported&#x20;BIND&#x20;9&#x20;packages&#x20;available&#x20;from&#x20;http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=BIND9.2&#x20;.&#x20;Or&#x20;it&#x20;is&#x20;available&#x20;directly&#x20;from&#x20;the&#x20;Internet&#x20;Software&#x20;Consortium&#x20;&#40;the&#x20;developers&#x20;of&#x20;BIND&#41;,&#x20;whose&#x20;website&#x20;is&#x20;at&#x20;http://www.isc.org.','There&#x20;exists&#x20;a&#x20;mission-critical&#x20;reason&#x20;why&#x20;this&#x20;system&#x20;must&#x20;run&#x20;a&#x20;DNS&#x20;server.','','Perform&#x20;the&#x20;following:&#x20;11.23&#x20;and&#x20;prior:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NAMED=1&#x20;/etc/rc.config.d/namesvrs&#x20;11.31&#x20;and&#x20;later:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;NAMED=1&#x20;/etc/rc.config.d/namesvrs_dns','[{\"cis\": [\"1.3.14\"]}]'),(30027,'Enable&#x20;stack&#x20;protection.','Enabling&#x20;stack&#x20;protection&#x20;prevents&#x20;certain&#x20;classes&#x20;of&#x20;buffer&#x20;overflow&#x20;attacks&#x20;and&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;enhancement.&#x20;-&#x20;Note&#x20;that&#x20;HP-UX&#x20;11i&#x20;is&#x20;much&#x20;more&#x20;capable&#x20;in&#x20;this&#x20;and&#x20;other&#x20;security&#x20;areas&#x20;than&#x20;older&#x20;releases;&#x20;therefore,&#x20;administrators&#x20;should&#x20;strongly&#x20;consider&#x20;upgrading&#x20;from&#x20;older&#x20;releases.&#x20;-&#x20;Note&#x20;that&#x20;this&#x20;action&#x20;requires&#x20;a&#x20;subsequent&#x20;reboot&#x20;to&#x20;take&#x20;effect&#x20;in&#x20;some&#x20;versions&#x20;of&#x20;HP-UX.','Buffer&#x20;overflow&#x20;exploits&#x20;have&#x20;been&#x20;the&#x20;basis&#x20;for&#x20;many&#x20;of&#x20;the&#x20;recent&#x20;highly&#x20;publicized&#x20;compromises&#x20;and&#x20;defacements&#x20;of&#x20;large&#x20;numbers&#x20;of&#x20;Internet&#x20;connected&#x20;systems.&#x20;Many&#x20;of&#x20;the&#x20;automated&#x20;tools&#x20;in&#x20;use&#x20;by&#x20;system&#x20;crackers&#x20;exploit&#x20;well-known&#x20;buffer&#x20;overflow&#x20;problems&#x20;in&#x20;vendor-supplied&#x20;and&#x20;third-party&#x20;software.&#x20;Enabling&#x20;stack&#x20;protection&#x20;prevents&#x20;certain&#x20;classes&#x20;of&#x20;buffer&#x20;overflow&#x20;attacks&#x20;and&#x20;is&#x20;a&#x20;significant&#x20;security&#x20;enhancement.','','For&#x20;11i&#x20;v2&#x20;and&#x20;later:&#x20;kctune&#x20;-K&#x20;executable_stack=0&#x20;For&#x20;11i&#x20;v1:&#x20;/usr/sbin/kmtune&#x20;-s&#x20;executable_stack=0&#x20;&amp;&amp;&#x20;mk_kernel&#x20;&amp;&amp;&#x20;kmupdate','[{\"cis\": [\"1.4.1\"]}, {\"cis_level\": [\"1\"]}]'),(30028,'Network&#x20;parameter&#x20;modifications.','Modify&#x20;the&#x20;network&#x20;parameter&#x20;boot&#x20;configuration&#x20;file&#x20;to&#x20;meet&#x20;current&#x20;best&#x20;practices.&#x20;Note:&#x20;HP-UX&#x20;11.11&#x20;systems&#x20;require&#x20;patch&#x20;PHNE_25644&#x20;for&#x20;ndd&#x20;to&#x20;set&#x20;arp_cleanup_interval&#x20;from&#x20;/etc/rc.config.d/nddconf.&#x20;-&#x20;Bastille&#x20;Note:&#x20;Bastille&#x20;performs&#x20;a&#x20;similar&#x20;action&#x20;but&#x20;does&#x20;not&#x20;support&#x20;the&#x20;exact&#x20;same&#x20;changes.','Network&#x20;parameter&#x20;default&#x20;values&#x20;should&#x20;align&#x20;with&#x20;current&#x20;best&#x20;practices&#x20;unless&#x20;there&#x20;is&#x20;a&#x20;specific&#x20;need&#x20;to&#x20;use&#x20;other&#x20;values.','','Perform&#x20;the&#x20;following&#x20;to&#x20;update&#x20;the&#x20;default&#x20;network&#x20;parameter&#x20;values:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/etc/rc.config.d&#x20;directory&#x20;2.&#x20;Open&#x20;nddconf&#x20;and&#x20;review&#x20;the&#x20;comment&#x20;lines&#x20;on&#x20;how&#x20;to&#x20;use&#x20;the&#x20;configuration&#x20;file&#x20;3.&#x20;Set&#x20;each&#x20;of&#x20;the&#x20;following&#x20;network&#x20;parameters&#x20;to&#x20;the&#x20;recommended&#x20;value.&#x20;If&#x20;a&#x20;parameter&#x20;does&#x20;not&#x20;have&#x20;an&#x20;entry&#x20;in&#x20;nddconf&#x20;then&#x20;add&#x20;a&#x20;new&#x20;entry&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file&#x20;while&#x20;properly&#x20;incrementing&#x20;the&#x20;parameter&#x20;index.&#x20;4.&#x20;Save&#x20;nddconf.&#x20;-&#x20;If&#x20;creating&#x20;this&#x20;file&#x20;for&#x20;the&#x20;first&#x20;time:&#x20;1.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;nddconf.&#x20;2.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;nddconf.&#x20;3.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;nddconf&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;4.&#x20;Remove&#x20;the&#x20;executable&#x20;and&#x20;sticky&#x20;bit&#x20;from&#x20;nddconf.&#x20;If&#x20;the&#x20;existing&#x20;nddconf&#x20;file&#x20;contains&#x20;no&#x20;entries,&#x20;then&#x20;the&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure:&#x20;cd&#x20;/etc/rc.config.d&#x20;cat&#x20;&lt;&lt;EOF&#x20;&gt;&#x20;nddconf&#x20;#&#x20;Increase&#x20;size&#x20;of&#x20;half-open&#x20;connection&#x20;queue&#x20;TRANSPORT_NAME[0]=tcp&#x20;NDD_NAME[0]=tcp_syn_rcvd_max&#x20;NDD_VALUE[0]=4096&#x20;#&#x20;Reduce&#x20;timeouts&#x20;on&#x20;ARP&#x20;cache&#x20;TRANSPORT_NAME[1]=arp&#x20;NDD_NAME[1]=arp_cleanup_interval&#x20;NDD_VALUE[1]=60000&#x20;#&#x20;Drop&#x20;source-routed&#x20;packets&#x20;TRANSPORT_NAME[2]=ip&#x20;NDD_NAME[2]=ip_forward_src_routed&#x20;NDD_VALUE[2]=0&#x20;#&#x20;Don&#039;t&#x20;forward&#x20;directed&#x20;broadcasts&#x20;TRANSPORT_NAME[3]=ip&#x20;NDD_NAME[3]=ip_forward_directed_broadcasts&#x20;NDD_VALUE[3]=0&#x20;#&#x20;Don&#039;t&#x20;respond&#x20;to&#x20;unicast&#x20;ICMP&#x20;timestamp&#x20;requests&#x20;TRANSPORT_NAME[4]=ip&#x20;NDD_NAME[4]=ip_respond_to_timestamp&#x20;NDD_VALUE[4]=0&#x20;#&#x20;Don&#039;t&#x20;respond&#x20;to&#x20;broadcast&#x20;ICMP&#x20;tstamp&#x20;reqs&#x20;TRANSPORT_NAME[5]=ip&#x20;NDD_NAME[5]=ip_respond_to_timestamp_broadcast&#x20;NDD_VALUE[5]=0&#x20;#&#x20;Don&#039;t&#x20;respond&#x20;to&#x20;ICMP&#x20;address&#x20;mask&#x20;requests&#x20;TRANSPORT_NAME[6]=ip&#x20;NDD_NAME[6]=ip_respond_to_address_mask_broadcast&#x20;NDD_VALUE[6]=0&#x20;#&#x20;Don‟t&#x20;respond&#x20;to&#x20;broadcast&#x20;echo&#x20;requests&#x20;TRANSPORT_NAME[7]=ip&#x20;NDD_NAME[7]=ip_respond_to_echo_broadcast&#x20;NDD_VALUE[7]=0&#x20;EOF&#x20;chown&#x20;root:sys&#x20;nddconf&#x20;chmod&#x20;go-w,ug-s&#x20;nddconf','[{\"cis\": [\"1.4.2\"]}, {\"cis_level\": [\"1\"]}]'),(30029,'Use&#x20;more&#x20;random&#x20;TCP&#x20;sequence&#x20;numbers.','Generate&#x20;initial&#x20;TCP&#x20;sequence&#x20;numbers&#x20;that&#x20;comply&#x20;with&#x20;RFC1948.&#x20;-&#x20;Note:&#x20;In&#x20;HP-UX&#x20;11i&#x20;v1&#x20;and&#x20;later,&#x20;an&#x20;algorithm&#x20;largely&#x20;compliant&#x20;with&#x20;RFC1948&#x20;is&#x20;already&#x20;used.&#x20;However,&#x20;setting&#x20;the&#x20;isn&#x20;passphrase&#x20;closes&#x20;the&#x20;small&#x20;remaining&#x20;gap,&#x20;and&#x20;adds&#x20;entropy&#x20;to&#x20;the&#x20;seed.','Makes&#x20;remote&#x20;off-net&#x20;session&#x20;hijacking&#x20;attacks&#x20;more&#x20;difficult.','','Perform&#x20;the&#x20;following&#x20;to&#x20;use&#x20;more&#x20;random&#x20;TCP&#x20;sequence&#x20;numbers&#x20;upon&#x20;system&#x20;startup:&#x20;1.&#x20;Create/open&#x20;the&#x20;file&#x20;/sbin/rc2.d/S999tcpisn&#x20;2.&#x20;Add&#x20;the&#x20;following&#x20;line:&#x20;ndd&#x20;-set&#x20;/dev/tcp&#x20;tcp_isn_passprase=&lt;random&#x20;string&gt;&#x20;replacing&#x20;&lt;random&#x20;string&gt;&#x20;with&#x20;a&#x20;string&#x20;of&#x20;random&#x20;characters.&#x20;3.&#x20;Save&#x20;the&#x20;file.&#x20;4.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;and&#x20;bin&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;the&#x20;file.&#x20;5.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;the&#x20;file.&#x20;6.&#x20;Set&#x20;the&#x20;execution&#x20;bit&#x20;for&#x20;the&#x20;file.','[{\"cis\": [\"1.4.3\"]}, {\"cis_level\": [\"1\"]}]'),(30030,'Additional&#x20;network&#x20;parameter&#x20;modifications.','Configure&#x20;networking&#x20;to&#x20;NOT&#x20;forward&#x20;TCP/IP&#x20;packets&#x20;between&#x20;multiple&#x20;networks,&#x20;even&#x20;if&#x20;the&#x20;machine&#x20;has&#x20;multiple&#x20;network&#x20;adapters&#x20;connected&#x20;to&#x20;multiple&#x20;networks.','System&#x20;is&#x20;not&#x20;going&#x20;to&#x20;be&#x20;used&#x20;as&#x20;a&#x20;firewall&#x20;or&#x20;gateway&#x20;to&#x20;pass&#x20;network&#x20;traffic&#x20;between&#x20;different&#x20;networks.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;forwarding&#x20;TCP/IP&#x20;packets&#x20;between&#x20;networks:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/etc/rc.config.d&#x20;directory&#x20;2.&#x20;Open&#x20;nddconf&#x20;and&#x20;review&#x20;the&#x20;comment&#x20;lines&#x20;on&#x20;how&#x20;to&#x20;use&#x20;the&#x20;configuration&#x20;file&#x20;3.&#x20;Set&#x20;each&#x20;of&#x20;the&#x20;following&#x20;network&#x20;parameters&#x20;to&#x20;the&#x20;recommended&#x20;value.&#x20;If&#x20;a&#x20;parameter&#x20;does&#x20;not&#x20;have&#x20;an&#x20;entry&#x20;in&#x20;nddconf&#x20;then&#x20;add&#x20;a&#x20;new&#x20;entry&#x20;to&#x20;the&#x20;end&#x20;of&#x20;the&#x20;file&#x20;while&#x20;properly&#x20;incrementing&#x20;the&#x20;parameter&#x20;index.&#x20;4.&#x20;Save&#x20;nddconf.&#x20;If&#x20;creating&#x20;this&#x20;file&#x20;for&#x20;the&#x20;first&#x20;time:&#x20;5.&#x20;Set&#x20;root&#x20;as&#x20;the&#x20;owner&#x20;of&#x20;nddconf.&#x20;6.&#x20;Set&#x20;sys&#x20;as&#x20;the&#x20;group&#x20;owner&#x20;of&#x20;nddconf.&#x20;7.&#x20;Restrict&#x20;write&#x20;access&#x20;to&#x20;nddconf&#x20;to&#x20;the&#x20;file&#x20;owner.&#x20;8.&#x20;Remove&#x20;the&#x20;executable&#x20;and&#x20;sticky&#x20;bit&#x20;from&#x20;nddconf.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;above&#x20;procedure&#x20;properly&#x20;if&#x20;used&#x20;as&#x20;a&#x20;follow-on&#x20;from&#x20;the&#x20;script&#x20;in&#x20;item&#x20;1.4.2:&#x20;cat&#x20;&lt;&lt;EOF&#x20;&gt;&gt;&#x20;/etc/rc.config.d/nddconf&#x20;#&#x20;Don‟t&#x20;act&#x20;as&#x20;a&#x20;router&#x20;TRANSPORT_NAME[8]=ip&#x20;NDD_NAME[8]=ip_forwarding&#x20;NDD_VALUE[8]=0&#x20;TRANSPORT_NAME[9]=ip&#x20;NDD_NAME[9]=ip_send_redirects&#x20;NDD_VALUE[9]=0&#x20;EOF','[{\"cis\": [\"1.4.4\"]}, {\"cis_level\": [\"1\"]}]'),(30032,'Enable&#x20;Hidden&#x20;Passwords.','Enable&#x20;hidden&#x20;passwords&#x20;by&#x20;converting&#x20;the&#x20;system&#x20;to&#x20;a&#x20;Trusted&#x20;System&#x20;or&#x20;to&#x20;use&#x20;Shadow&#x20;Passwords.&#x20;-&#x20;Note:&#x20;do&#x20;not&#x20;perform&#x20;this&#x20;if&#x20;the&#x20;system&#x20;runs&#x20;applications&#x20;that&#x20;read&#x20;the&#x20;encrypted&#x20;password&#x20;entries&#x20;in&#x20;/etc/passwd&#x20;directly.','Without&#x20;hidden&#x20;passwords,&#x20;an&#x20;intruder&#x20;could&#x20;use&#x20;any&#x20;user&#039;s&#x20;account&#x20;to&#x20;obtain&#x20;hashed&#x20;passwords&#x20;and&#x20;use&#x20;crack&#x20;or&#x20;similar&#x20;utilities&#x20;to&#x20;find&#x20;easily&#x20;guessed&#x20;passwords.&#x20;Password&#x20;aging&#x20;&#40;covered&#x20;in&#x20;item&#x20;1.8.3&#41;&#x20;ensures&#x20;that&#x20;users&#x20;change&#x20;their&#x20;passwords&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;helps&#x20;stop&#x20;the&#x20;use&#x20;of&#x20;stolen&#x20;passwords.','','Perform&#x20;one&#x20;of&#x20;the&#x20;following&#x20;to&#x20;convert&#x20;the&#x20;system&#x20;to&#x20;trusted&#x20;mode&#x20;or&#x20;shadowed&#x20;mode:&#x20;A.&#x20;Use&#x20;the&#x20;system&#x20;management&#x20;program&#x20;smh&#x20;or&#x20;sam&#x20;to&#x20;convert&#x20;to&#x20;a&#x20;trusted&#x20;system&#x20;-or-&#x20;B.&#x20;Use&#x20;the&#x20;command&#x20;pwconv&#x20;to&#x20;convert&#x20;to&#x20;shadowed&#x20;passwords.','[{\"cis\": [\"1.6.1\"]}, {\"cis_level\": [\"1\"]}]'),(30033,'Restrict&#x20;users&#x20;who&#x20;can&#x20;access&#x20;to&#x20;FTP.','Configure&#x20;FTP&#x20;to&#x20;prevent&#x20;certain&#x20;users&#x20;from&#x20;accessing&#x20;the&#x20;system&#x20;via&#x20;FTP.&#x20;The&#x20;file&#x20;ftpusers&#x20;contains&#x20;a&#x20;list&#x20;of&#x20;users&#x20;who&#x20;are&#x20;not&#x20;allowed&#x20;to&#x20;access&#x20;the&#x20;system&#x20;via&#x20;FTP.&#x20;Generally,&#x20;only&#x20;normal&#x20;users&#x20;should&#x20;ever&#x20;access&#x20;the&#x20;system&#x20;via&#x20;FTP&#x20;-&#x20;there&#x20;should&#x20;be&#x20;no&#x20;reason&#x20;for&#x20;&#039;system&#039;&#x20;type&#x20;accounts&#x20;to&#x20;be&#x20;transferring&#x20;information&#x20;via&#x20;this&#x20;mechanism.&#x20;Certainly,&#x20;the&#x20;root&#x20;account&#x20;should&#x20;never&#x20;be&#x20;allowed&#x20;to&#x20;transfer&#x20;files&#x20;directly&#x20;via&#x20;FTP.&#x20;-&#x20;Note:&#x20;more&#x20;fine-grained&#x20;FTP&#x20;access&#x20;controls&#x20;can&#x20;be&#x20;placed&#x20;in&#x20;/etc/ftpd/ftpaccess.','Privileged&#x20;users&#x20;such&#x20;as&#x20;root&#x20;and&#x20;other&#x20;&#039;system&#039;&#x20;type&#x20;accounts&#x20;should&#x20;never&#x20;be&#x20;transferring&#x20;information&#x20;via&#x20;such&#x20;an&#x20;insecure&#x20;service&#x20;as&#x20;FTP.','','Perform&#x20;the&#x20;following&#x20;to&#x20;restrict&#x20;default&#x20;priviledged&#x20;users&#x20;from&#x20;access&#x20;to&#x20;FTP:&#x20;1.&#x20;Add&#x20;the&#x20;users&#x20;root&#x20;daemon&#x20;bin&#x20;sys&#x20;adm&#x20;lp&#x20;uucp&#x20;nuucp&#x20;nobody&#x20;hpdb&#x20;useradm&#x20;to&#x20;the&#x20;file&#x20;/etc/ftpd/ftpusers&#x20;&#40;each&#x20;user&#x20;on&#x20;a&#x20;single&#x20;line&#41;.&#x20;2.&#x20;Set&#x20;the&#x20;file&#x20;owner&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;the&#x20;user&#x20;bin.&#x20;3.&#x20;Set&#x20;the&#x20;file&#x20;permissions&#x20;so&#x20;that&#x20;only&#x20;the&#x20;file&#x20;owner&#x20;has&#x20;read&#x20;or&#x20;write&#x20;perms&#x20;and&#x20;no&#x20;user&#x20;has&#x20;execute&#x20;permission&#x20;&#40;600&#41;.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;create&#x20;and&#x20;populate&#x20;the&#x20;ftpusers&#x20;file&#x20;as&#x20;described&#x20;above:&#x20;for&#x20;name&#x20;in&#x20;root&#x20;daemon&#x20;bin&#x20;sys&#x20;adm&#x20;lp&#x20;&#x20;uucp&#x20;nuucp&#x20;nobody&#x20;hpdb&#x20;useradm&#x20;do&#x20;echo&#x20;$name&#x20;done&#x20;&gt;&gt;&#x20;$ftpusers&#x20;sort&#x20;-u&#x20;$ftpusers&#x20;&gt;&#x20;$ftpusers.tmp&#x20;cp&#x20;$ftpusers.tmp&#x20;$ftpusers&#x20;rm&#x20;-f&#x20;$ftpusers.tmp&#x20;chown&#x20;bin:bin&#x20;$ftpusers&#x20;chmod&#x20;600&#x20;$ftpusers','[{\"cis\": [\"1.6.2\"]}, {\"cis_level\": [\"1\"]}]'),(30034,'Prevent&#x20;Syslog&#x20;from&#x20;accepting&#x20;messages&#x20;from&#x20;the&#x20;network.','Prevent&#x20;syslogd&#x20;from&#x20;accepting&#x20;messages&#x20;from&#x20;the&#x20;network.&#x20;By&#x20;default&#x20;the&#x20;system&#x20;logging&#x20;daemon,&#x20;syslogd,&#x20;listens&#x20;for&#x20;log&#x20;messages&#x20;from&#x20;other&#x20;systems&#x20;on&#x20;network&#x20;port&#x20;514/udp.&#x20;Unfortunately,&#x20;the&#x20;protocol&#x20;used&#x20;to&#x20;transfer&#x20;these&#x20;messages&#x20;does&#x20;not&#x20;include&#x20;any&#x20;form&#x20;of&#x20;authentication,&#x20;so&#x20;a&#x20;malicious&#x20;outsider&#x20;could&#x20;simply&#x20;barrage&#x20;the&#x20;local&#x20;system&#039;s&#x20;Syslog&#x20;port&#x20;with&#x20;spurious&#x20;traffic&mdash;either&#x20;as&#x20;a&#x20;denial-of-service&#x20;attack&#x20;on&#x20;the&#x20;system,&#x20;or&#x20;to&#x20;fill&#x20;up&#x20;the&#x20;local&#x20;system&#039;s&#x20;logging&#x20;file&#x20;systems&#x20;so&#x20;that&#x20;subsequent&#x20;attacks&#x20;will&#x20;not&#x20;be&#x20;logged.&#x20;-&#x20;Note:&#x20;Do&#x20;not&#x20;perform&#x20;this&#x20;action&#x20;if&#x20;this&#x20;machine&#x20;is&#x20;a&#x20;log&#x20;server,&#x20;or&#x20;needs&#x20;to&#x20;receive&#x20;Syslog&#x20;messages&#x20;via&#x20;the&#x20;network&#x20;from&#x20;other&#x20;systems.&#x20;-&#x20;Note:&#x20;It&#x20;is&#x20;considered&#x20;good&#x20;practice&#x20;to&#x20;setup&#x20;one&#x20;or&#x20;more&#x20;machines&#x20;as&#x20;central&#x20;&#039;log&#x20;servers&#039;&#x20;to&#x20;aggregate&#x20;log&#x20;traffic&#x20;from&#x20;all&#x20;machines&#x20;at&#x20;a&#x20;site.&#x20;However,&#x20;unless&#x20;a&#x20;system&#x20;is&#x20;set&#x20;up&#x20;to&#x20;be&#x20;one&#x20;of&#x20;these&#x20;&#039;log&#x20;server&#039;&#x20;systems,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;on&#x20;514/udp&#x20;for&#x20;incoming&#x20;log&#x20;messages.','Disabling&#x20;unused&#x20;network&#x20;services&#x20;will&#x20;reduce&#x20;the&#x20;remote&#x20;attack&#x20;surfaces&#x20;of&#x20;the&#x20;hosting&#x20;system.','','Disable&#x20;the&#x20;syslog&#x20;network&#x20;option&#x20;by&#x20;doing&#x20;the&#x20;following:&#x20;1.&#x20;Open&#x20;the&#x20;syslogd&#x20;startup&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/syslogd&#x20;2.&#x20;Add&#x20;the&#x20;parameter&#x20;&quot;-N&quot;&#x20;to&#x20;the&#x20;SYSLOGD_OPTS=&#x20;line&#x20;if&#x20;it&#x20;is&#x20;not&#x20;already&#x20;present&#x20;3.&#x20;Save&#x20;and&#x20;close&#x20;the&#x20;file.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;SYSLOGD_OPTS=&quot;`sh&#x20;-c&#x20;&quot;.&#x20;/etc/rc.config.d/syslogd&#x20;;&#x20;&#x20;echo&#x20;&quot;$SYSLOGD_OPTS&quot;&#039;`&quot;&#x20;if&#x20;[[&#x20;&quot;$SYSLOGD_OPTS&quot;&#x20;=&#x20;*-N*&#x20;]];&#x20;then&#x20;ch_rc&#x20;-a&#x20;-p&#x20;SYSLOGD_OPTS=&quot;-N&#x20;$SYSLOGD_OPTS&quot;&#x20;&#x20;/etc/rc.config.d/syslogd&#x20;fi','[{\"cis\": [\"1.6.3\"]}, {\"cis_level\": [\"1\"]}]'),(30035,'Disable&#x20;XDMCP&#x20;port.','Disable&#x20;the&#x20;XDMCP&#x20;port&#x20;for&#x20;remote&#x20;login&#x20;services.&#x20;The&#x20;standard&#x20;GUI&#x20;login&#x20;provided&#x20;on&#x20;most&#x20;Unix&#x20;systems&#x20;can&#x20;act&#x20;as&#x20;a&#x20;remote&#x20;login&#x20;server&#x20;to&#x20;other&#x20;devices&#x20;&#40;including&#x20;X&#x20;terminals&#x20;and&#x20;other&#x20;workstations&#41;.&#x20;Access&#x20;control&#x20;is&#x20;handled&#x20;via&#x20;the&#x20;Xaccess&#x20;file&mdash;by&#x20;default&#x20;under&#x20;HP-UX,&#x20;this&#x20;file&#x20;allows&#x20;any&#x20;system&#x20;on&#x20;the&#x20;network&#x20;to&#x20;get&#x20;a&#x20;remote&#x20;login&#x20;screen&#x20;from&#x20;the&#x20;local&#x20;system.&#x20;This&#x20;behavior&#x20;can&#x20;be&#x20;overridden&#x20;in&#x20;the&#x20;/etc/dt/config/Xaccess&#x20;file.','XDMCP&#x20;is&#x20;an&#x20;unencrypted&#x20;protocol&#x20;that&#x20;may&#x20;reduce&#x20;the&#x20;confidentiality&#x20;and&#x20;integrity&#x20;of&#x20;data&#x20;that&#x20;traverses&#x20;it.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;the&#x20;XDMCP&#x20;port:&#x20;1.&#x20;Open&#x20;the&#x20;file&#x20;/etc/dt/config/Xconfig.&#x20;If&#x20;it&#x20;does&#x20;not&#x20;exist,&#x20;copy&#x20;it&#x20;from&#x20;/usr/dt/config/Xconfig.&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;Dtlogin.requestPort:0&#x20;to&#x20;the&#x20;file&#x20;and&#x20;close.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;if&#x20;[&#x20;!&#x20;-f&#x20;/etc/dt/config/Xconfig&#x20;];&#x20;then&#x20;mkdir&#x20;-p&#x20;/etc/dt/config&#x20;cp&#x20;-p&#x20;/usr/dt/config/Xconfig&#x20;/etc/dt/config&#x20;fi&#x20;cd&#x20;/etc/dt/config&#x20;awk&#x20;&#039;/Dtlogin.requestPort:/&#x20;&#x20;{&#x20;print&#x20;&quot;Dtlogin.requestPort:&#x20;0&quot;;&#x20;next&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;Xconfig&#x20;&gt;&#x20;Xconfig.new&#x20;cp&#x20;Xconfig.new&#x20;Xconfig&#x20;rm&#x20;-f&#x20;Xconfig.new','[{\"cis\": [\"1.6.4\"]}, {\"cis_level\": [\"1\"]}]'),(30036,'Set&#x20;default&#x20;locking&#x20;screensaver&#x20;timeout.','The&#x20;default&#x20;timeout&#x20;is&#x20;between&#x20;10&#x20;and&#x20;30&#x20;minutes&#x20;of&#x20;keyboard/mouse&#x20;inactivity&#x20;before&#x20;a&#x20;password-protected&#x20;screen&#x20;saver&#x20;is&#x20;invoked&#x20;by&#x20;the&#x20;CDE&#x20;session&#x20;manager&#x20;depending&#x20;on&#x20;the&#x20;OS&#x20;release&#x20;and&#x20;the&#x20;locale.&#x20;Uniformly&#x20;reduce&#x20;this&#x20;default&#x20;timeout&#x20;value&#x20;to&#x20;10&#x20;minutes&#x20;&#40;this&#x20;setting&#x20;can&#x20;still&#x20;be&#x20;overridden&#x20;by&#x20;individual&#x20;users&#x20;in&#x20;their&#x20;own&#x20;environment.&#41;','Setting&#x20;the&#x20;inactivity&#x20;timer&#x20;to&#x20;a&#x20;low&#x20;value&#x20;will&#x20;reduce&#x20;the&#x20;probability&#x20;of&#x20;a&#x20;malicious&#x20;entity&#x20;compromising&#x20;the&#x20;system&#x20;via&#x20;the&#x20;console.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;a&#x20;default&#x20;screensaver&#x20;timeout&#x20;for&#x20;all&#x20;environments:&#x20;1.&#x20;For&#x20;every&#x20;sys.resources&#x20;file&#x20;in&#x20;each&#x20;directory&#x20;in&#x20;/usr/dt/config/&#x20;create&#x20;a&#x20;corresponding&#x20;/etc/dt/config&#47;&#42;/sys.resources&#x20;file&#x20;if&#x20;it&#x20;does&#x20;not&#x20;already&#x20;exist.&#x20;2.&#x20;Append&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;each&#x20;/etc/dt/config&#47;&#42;/sys.resources&#x20;dtsession*saverTimeout:&#x20;10&#x20;dtsession*lockTimeout:&#x20;10&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;for&#x20;file&#x20;in&#x20;/usr/dt/config&#47;&#42;/sys.resources;&#x20;do&#x20;dir=&quot;$&#40;dirname&#x20;&quot;$file&quot;&#x20;|&#x20;sed&#x20;&#039;s|^/usr/|/etc/|&#039;&#41;&quot;&#x20;mkdir&#x20;-p&#x20;&quot;$dir&quot;&#x20;echo&#x20;&#039;dtsession*saverTimeout:&#x20;10&#039;&#x20;&gt;&gt;&quot;$dir/sys.resources&quot;&#x20;echo&#x20;&#039;dtsession*lockTimeout:&#x20;10&#039;&#x20;&gt;&gt;&quot;$dir/sys.resources&quot;&#x20;done','[{\"cis\": [\"1.6.5\"]}, {\"cis_level\": [\"1\"]}]'),(30037,'Configure&#x20;IPFilter&#x20;to&#x20;allow&#x20;only&#x20;select&#x20;communication.','HP-UX&#x20;IPFilter&#x20;&#40;B9901AA&#41;&#x20;is&#x20;a&#x20;stateful&#x20;system&#x20;firewall&#x20;that&#x20;controls&#x20;IP&#x20;packet&#x20;flow&#x20;in&#x20;or&#x20;out&#x20;of&#x20;a&#x20;machine.&#x20;It&#x20;is&#x20;installed&#x20;by&#x20;default&#x20;on&#x20;HP-UX&#x20;11iv2&#x20;&#40;11.23&#41;&#x20;and&#x20;later.&#x20;On&#x20;older&#x20;systems,&#x20;IPFilter&#x20;can&#x20;be&#x20;obtained&#x20;from&#x20;http://www.hp.com/go/ipfilter.&#x20;The&#x20;rules&#x20;below&#x20;will&#x20;work&#x20;in&#x20;an&#x20;otherwise-empty&#x20;ipf.conf&#x20;file,&#x20;or,&#x20;if&#x20;there&#x20;are&#x20;rules&#x20;already&#x20;present,&#x20;it&#x20;will&#x20;block&#x20;all&#x20;that&#x20;were&#x20;not&#x20;passed&#x20;earlier&#x20;in&#x20;the&#x20;ruleset.&#x20;This&#x20;is&#x20;less&#x20;likely&#x20;to&#x20;break&#x20;things,&#x20;but&#x20;will&#x20;allow&#x20;more&#x20;traffic&#x20;through.&#x20;Alternatively,&#x20;you&#x20;can&#x20;instead&#x20;take&#x20;the&#x20;pass&#x20;lines&#x20;below&#x20;&#40;not&#x20;using&#x20;the&#x20;block&#x20;rule&#41;,&#x20;and&#x20;change&#x20;them&#x20;into&#x20;&#039;block&#x20;in&#x20;quick&#039;&#x20;rules,&#x20;and&#x20;place&#x20;those&#x20;at&#x20;the&#x20;top&#x20;of&#x20;the&#x20;file.&#x20;This&#x20;will&#x20;error&#x20;on&#x20;the&#x20;side&#x20;of&#x20;blocking&#x20;traffic.&#x20;See&#x20;ipf&#40;5&#41;&#x20;for&#x20;detail.&#x20;Your&#x20;ruleset&#x20;can&#x20;be&#x20;tested&#x20;using&#x20;ipftest&#40;1&#41;.&#x20;Bastille&#x20;note:&#x20;if&#x20;using&#x20;to&#x20;change&#x20;and&#x20;monitor&#x20;the&#x20;IPFilter&#x20;firewall,&#x20;ensure&#x20;that&#x20;rules&#x20;are&#x20;added&#x20;to&#x20;/etc/opt/sec_mgmt/bastille/ipf.customrules,&#x20;and&#x20;that&#x20;Bastille&#x20;is&#x20;rerun&#x20;with&#x20;the&#x20;last&#x20;config&#x20;file,&#x20;so&#x20;they&#x20;will&#x20;not&#x20;be&#x20;overwritten&#x20;in&#x20;a&#x20;subsequent&#x20;lockdown.','Restricting&#x20;incoming&#x20;network&#x20;traffic&#x20;to&#x20;explicitly&#x20;allowed&#x20;hosts&#x20;will&#x20;help&#x20;prevent&#x20;unauthorized&#x20;access&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;add&#x20;enable&#x20;ipfilter&#x20;and&#x20;install&#x20;a&#x20;default&#x20;ruleset&#x20;to&#x20;block&#x20;unauthorized&#x20;incoming&#x20;connections:&#x20;1.&#x20;Enable&#x20;ipfilter:&#x20;ipfilter&#x20;-e&#x20;2.&#x20;Append&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;/etc/opt/ipf/ipf.conf:&#x20;&#x20;block&#x20;in&#x20;all&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;replacing&#x20;each&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;with&#x20;an&#x20;authorized&#x20;IP&#x20;address&#x20;and&#x20;mask.&#x20;3.&#x20;Flush&#x20;the&#x20;old&#x20;rules&#x20;and&#x20;read&#x20;in&#x20;the&#x20;updated&#x20;rules:&#x20;ipf&#x20;-Fa&#x20;-f&#x20;/etc/opt/ipf/ipf.conf&#x20;The&#x20;following&#x20;script&#x20;can&#x20;be&#x20;used&#x20;to&#x20;as&#x20;a&#x20;template&#x20;for&#x20;creating&#x20;your&#x20;own&#x20;script&#x20;to&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;ipfilter&#x20;-e&#x20;cat&#x20;&lt;&lt;EOF&#x20;&gt;&gt;&#x20;/etc/opt/ipf/ipf.conf&#x20;block&#x20;in&#x20;all&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;pass&#x20;in&#x20;from&#x20;&lt;allowed&#x20;net&gt;/&lt;mask&gt;&#x20;EOF&#x20;ipf&#x20;-Fa&#x20;-f&#x20;/etc/opt/ipf/ipf.conf','[{\"cis\": [\"1.6.6\"]}, {\"cis_level\": [\"1\"]}]'),(30038,'Restrict&#x20;at/cron&#x20;to&#x20;authorized&#x20;users.','The&#x20;cron.allow&#x20;and&#x20;at.allow&#x20;files&#x20;are&#x20;a&#x20;list&#x20;of&#x20;users&#x20;who&#x20;are&#x20;allowed&#x20;to&#x20;run&#x20;the&#x20;crontab&#x20;and&#x20;at&#x20;commands&#x20;to&#x20;submit&#x20;jobs&#x20;to&#x20;be&#x20;run&#x20;at&#x20;scheduled&#x20;intervals.&#x20;-&#x20;Note&#x20;that&#x20;even&#x20;though&#x20;a&#x20;given&#x20;user&#x20;is&#x20;not&#x20;listed&#x20;in&#x20;cron.allow,&#x20;cron&#x20;jobs&#x20;can&#x20;still&#x20;be&#x20;run&#x20;as&#x20;that&#x20;user.&#x20;cron.allow&#x20;only&#x20;controls&#x20;administrative&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;command&#x20;for&#x20;scheduling&#x20;and&#x20;modifying&#x20;cron&#x20;jobs.','On&#x20;many&#x20;systems,&#x20;only&#x20;the&#x20;system&#x20;administrator&#x20;needs&#x20;the&#x20;ability&#x20;to&#x20;schedule&#x20;jobs.','','Perform&#x20;the&#x20;following&#x20;to&#x20;restrict&#x20;at/cron&#x20;to&#x20;root&#x20;only:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/var/adm/cron&#x20;directory&#x20;2.&#x20;Archive&#x20;or&#x20;delete&#x20;any&#x20;existing&#x20;cron.deny&#x20;and&#x20;at.deny&#x20;files&#x20;3.&#x20;Create&#x20;or&#x20;replace&#x20;the&#x20;cron.allow&#x20;and&#x20;at.allow&#x20;files&#x20;with&#x20;a&#x20;single&#x20;line&#x20;file&#x20;containing&#x20;just&#x20;root&#x20;4.&#x20;Ensure&#x20;that&#x20;the&#x20;files&#x20;are&#x20;owned&#x20;by&#x20;root&#x20;and&#x20;group&#x20;owned&#x20;by&#x20;sys&#x20;5.&#x20;Ensure&#x20;that&#x20;no&#x20;users&#x20;have&#x20;write/execute&#x20;permission&#x20;to&#x20;the&#x20;files,&#x20;and&#x20;that&#x20;only&#x20;root&#x20;has&#x20;read&#x20;access&#x20;to&#x20;the&#x20;files.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedures&#x20;above:&#x20;cd&#x20;/var/adm/cron&#x20;rm&#x20;-f&#x20;cron.deny&#x20;at.deny&#x20;echo&#x20;root&#x20;&gt;cron.allow&#x20;echo&#x20;root&#x20;&gt;at.allow&#x20;chown&#x20;root:sys&#x20;cron.allow&#x20;at.allow&#x20;chmod&#x20;400&#x20;cron.allow&#x20;at.allow','[{\"cis\": [\"1.6.7\"]}, {\"cis_level\": [\"1\"]}]'),(30039,'Restrict&#x20;crontab&#x20;file&#x20;permissions.','The&#x20;system&#x20;crontab&#x20;files&#x20;are&#x20;only&#x20;accessed&#x20;by&#x20;the&#x20;cron&#x20;daemon&#x20;&#40;which&#x20;runs&#x20;with&#x20;superuser&#x20;privileges&#41;&#x20;and&#x20;the&#x20;crontab&#x20;command&#x20;&#40;which&#x20;is&#x20;set-UID&#x20;to&#x20;root&#41;.','Allowing&#x20;unprivileged&#x20;users&#x20;to&#x20;read&#x20;or&#x20;&#40;even&#x20;worse&#41;&#x20;modify&#x20;system&#x20;crontab&#x20;files&#x20;can&#x20;create&#x20;the&#x20;potential&#x20;for&#x20;a&#x20;local&#x20;user&#x20;on&#x20;the&#x20;system&#x20;to&#x20;gain&#x20;elevated&#x20;privileges.','','Perform&#x20;the&#x20;following&#x20;so&#x20;that&#x20;only&#x20;root&#x20;has&#x20;access&#x20;to&#x20;the&#x20;crontab&#x20;files:&#x20;1.&#x20;Change&#x20;to&#x20;the&#x20;/var/spool/cron/crontabs&#x20;directory&#x20;2.&#x20;Change&#x20;the&#x20;file&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;file&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;3.&#x20;Set&#x20;file&#x20;permissions&#x20;so&#x20;that&#x20;only&#x20;root&#x20;has&#x20;access&#x20;to&#x20;the&#x20;files.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;cd&#x20;/var/spool/cron/crontabs&#x20;chown&#x20;root:sys&#x20;*&#x20;chmod&#x20;og-rwx&#x20;*','[{\"cis\": [\"1.6.8\"]}, {\"cis_level\": [\"1\"]}]'),(30040,'Restrict&#x20;root&#x20;logins&#x20;to&#x20;system&#x20;console.','Anonymous&#x20;root&#x20;logins&#x20;should&#x20;never&#x20;be&#x20;allowed&#x20;except&#x20;on&#x20;the&#x20;system&#x20;console&#x20;in&#x20;emergency&#x20;situations.&#x20;At&#x20;all&#x20;other&#x20;times,&#x20;the&#x20;administrator&#x20;should&#x20;access&#x20;the&#x20;system&#x20;via&#x20;an&#x20;unprivileged&#x20;account&#x20;and&#x20;use&#x20;some&#x20;authorized&#x20;mechanism&#x20;to&#x20;gain&#x20;additional&#x20;privilege,&#x20;such&#x20;as&#x20;the&#x20;su&#x20;command,&#x20;the&#x20;freely-available&#x20;sudo&#x20;package&#x20;discussed&#x20;in&#x20;item&#x20;SN.6,&#x20;or&#x20;the&#x20;HP&#x20;Role&#x20;Based&#x20;Authorization&#x20;system&#x20;also&#x20;discussed&#x20;in&#x20;item&#x20;SN.6.&#x20;These&#x20;mechanisms&#x20;provide&#x20;at&#x20;least&#x20;a&#x20;limited&#x20;audit&#x20;trail&#x20;in&#x20;the&#x20;event&#x20;of&#x20;problems.','Anonymous&#x20;root&#x20;logins&#x20;do&#x20;not&#x20;provide&#x20;an&#x20;audit&#x20;trail,&#x20;nor&#x20;are&#x20;subject&#x20;to&#x20;additional&#x20;authorization&#x20;provisions.','','Perform&#x20;the&#x20;following&#x20;to&#x20;restrict&#x20;root&#x20;logins&#x20;to&#x20;the&#x20;system&#x20;console&#x20;only:&#x20;1.&#x20;Replace&#x20;the&#x20;file&#x20;/etc/securetty&#x20;with&#x20;a&#x20;single&#x20;line&#x20;file&#x20;containing&#x20;console&#x20;2.&#x20;Change&#x20;the&#x20;file&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;file&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;3.&#x20;Set&#x20;file&#x20;permissions&#x20;so&#x20;that&#x20;only&#x20;root&#x20;has&#x20;access&#x20;to&#x20;the&#x20;file.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;&#x20;echo&#x20;console&#x20;&gt;&#x20;/etc/securetty&#x20;chown&#x20;root:sys&#x20;/etc/securetty&#x20;chmod&#x20;og-rwx&#x20;/etc/securetty','[{\"cis\": [\"1.6.9\"]}, {\"cis_level\": [\"1\"]}]'),(30041,'Disable&#x20;nobody&#x20;access&#x20;for&#x20;secure&#x20;RPC.','The&#x20;keyserv&#x20;process&#x20;stores&#x20;user&#x20;keys&#x20;that&#x20;are&#x20;utilized&#x20;with&#x20;the&#x20;ONC&#x20;secure&#x20;RPC&#x20;mechanism.&#x20;The&#x20;action&#x20;below&#x20;prevents&#x20;keyserv&#x20;from&#x20;using&#x20;default&#x20;keys&#x20;for&#x20;the&#x20;&quot;nobody&quot;&#x20;user,&#x20;effectively&#x20;stopping&#x20;this&#x20;user&#x20;from&#x20;accessing&#x20;information&#x20;via&#x20;secure&#x20;RPC.','The&#x20;default&#x20;&#039;nobody&#039;&#x20;user&#x20;should&#x20;not&#x20;be&#x20;accessing&#x20;information&#x20;via&#x20;secure&#x20;RPC.','','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;nobody&#x20;access&#x20;for&#x20;secure&#x20;RPC:&#x20;1.&#x20;Add&#x20;the&#x20;&#039;-d&#039;&#x20;option&#x20;to&#x20;the&#x20;KEYSERV_OPTIONS&#x20;parameter&#x20;in&#x20;the&#x20;system&#x20;startup&#x20;configuration&#x20;file&#x20;/etc/rc.config.d/namesvrs&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;KEYSERV_OPTIONS=&quot;`sh&#x20;-c&#x20;&#039;.&#x20;/etc/rc.config.d/namesvrs&#x20;;&#x20;echo&#x20;&quot;$KEYSERV_OPTIONS&quot;&#039;`&quot;&#x20;ch_rc&#x20;-a&#x20;-p&#x20;KEYSERV_OPTIONS=&quot;-d&#x20;$KEYSERV_OPTIONS&#x20;&quot;&#x20;&#x20;/etc/rc.config.d/namesvrs','[{\"cis\": [\"1.6.11\"]}, {\"cis_level\": [\"1\"]}]'),(30042,'Enable&#x20;kernel-level&#x20;auditing.','If&#x20;inetd&#x20;is&#x20;running,&#x20;it&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;make&#x20;use&#x20;of&#x20;the&#x20;&#039;logging&#039;&#x20;&#40;-l&#41;&#x20;feature&#x20;of&#x20;the&#x20;HP-UX&#x20;inetd&#x20;that&#x20;logs&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;any&#x20;network&#x20;connections&#x20;seen&#x20;by&#x20;the&#x20;daemon,&#x20;allowing&#x20;the&#x20;administrator&#x20;&#40;or&#x20;software&#41;&#x20;to&#x20;scan&#x20;the&#x20;logs&#x20;for&#x20;unusual&#x20;activity.&#x20;This&#x20;is&#x20;especially&#x20;powerful&#x20;when&#x20;combined&#x20;with&#x20;the&#x20;access&#x20;control&#x20;capabilities&#x20;accessible&#x20;through&#x20;inetd‟s&#x20;/var/adm/inetd.sec&#x20;configuration&#x20;file.&#x20;This&#x20;information&#x20;is&#x20;logged&#x20;via&#x20;Syslog&#x20;and&#x20;by&#x20;default&#x20;HP-UX&#x20;systemsdeposit&#x20;this&#x20;logging&#x20;information&#x20;in&#x20;var/adm/syslog/syslog.log&#x20;with&#x20;other&#x20;system&#x20;log&#x20;messages.&#x20;Should&#x20;the&#x20;administrator&#x20;wish&#x20;to&#x20;capture&#x20;this&#x20;information&#x20;in&#x20;a&#x20;separate&#x20;file,&#x20;simply&#x20;modify&#x20;/etc/syslog.conf&#x20;to&#x20;log&#x20;daemon.notice&#x20;to&#x20;some&#x20;other&#x20;log&#x20;file&#x20;destination.&#x20;IPFilter,&#x20;which&#x20;comes&#x20;with&#x20;HP-UX,&#x20;can&#x20;log&#x20;inetd&#x20;and&#x20;other&#x20;connections&#x20;or&#x20;attempted&#x20;connections&#x20;with&#x20;its&#x20;&#039;ipmon&#039;&#x20;daemon&#x20;as&#x20;either&#x20;a&#x20;compliment&#x20;or&#x20;alternative&#x20;to&#x20;inetd&#x20;logging.','By&#x20;recording&#x20;key&#x20;system&#x20;events&#x20;in&#x20;log&#x20;files,&#x20;kernel-level&#x20;auditing&#x20;provides&#x20;a&#x20;trail&#x20;to&#x20;detect&#x20;and&#x20;analyze&#x20;security&#x20;breaches.&#x20;Moreover,&#x20;this&#x20;data&#x20;can&#x20;be&#x20;used&#x20;to&#x20;detect&#x20;potential&#x20;security&#x20;weakness,&#x20;and&#x20;also&#x20;serves&#x20;as&#x20;a&#x20;deterrent&#x20;against&#x20;system&#x20;abuses.','','Use&#x20;the&#x20;Systems&#x20;Management&#x20;Homepage&#x20;&#40;SMH&#41;&#x20;facility&#x20;to&#x20;configure&#x20;and&#x20;enable&#x20;the&#x20;type&#x20;and&#x20;level&#x20;of&#x20;auditing&#x20;appropriate&#x20;for&#x20;your&#x20;environment.','[{\"cis\": [\"1.7.1\"]}, {\"cis_level\": [\"1\"]}]'),(30043,'Enable&#x20;logging&#x20;from&#x20;inetd.','If&#x20;inetd&#x20;is&#x20;running,&#x20;it&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;make&#x20;use&#x20;of&#x20;the&#x20;&quot;logging&quot;&#x20;&#40;-l&#41;&#x20;feature&#x20;of&#x20;the&#x20;HP-UX&#x20;inetd&#x20;that&#x20;logs&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;any&#x20;network&#x20;connections&#x20;seen&#x20;by&#x20;the&#x20;daemon,&#x20;allowing&#x20;the&#x20;administrator&#x20;&#40;or&#x20;software&#41;&#x20;to&#x20;scan&#x20;the&#x20;logs&#x20;for&#x20;unusual&#x20;activity.&#x20;This&#x20;is&#x20;especially&#x20;powerful&#x20;when&#x20;combined&#x20;with&#x20;the&#x20;access&#x20;control&#x20;capabilities&#x20;accessible&#x20;through&#x20;inetd&#039;s&#x20;/var/adm/inetd.sec&#x20;configuration&#x20;file.&#x20;This&#x20;information&#x20;is&#x20;logged&#x20;via&#x20;Syslog&#x20;and&#x20;by&#x20;default&#x20;HP-UX&#x20;systems&#x20;deposit&#x20;this&#x20;logging&#x20;information&#x20;in&#x20;var/adm/syslog/syslog.log&#x20;with&#x20;other&#x20;system&#x20;log&#x20;messages.&#x20;Should&#x20;the&#x20;administrator&#x20;wish&#x20;to&#x20;capture&#x20;this&#x20;information&#x20;in&#x20;a&#x20;separate&#x20;file,&#x20;simply&#x20;modify&#x20;/etc/syslog.conf&#x20;to&#x20;log&#x20;daemon.notice&#x20;to&#x20;some&#x20;other&#x20;log&#x20;file&#x20;destination.&#x20;IPFilter,&#x20;which&#x20;comes&#x20;with&#x20;HP-UX,&#x20;can&#x20;log&#x20;inetd&#x20;and&#x20;other&#x20;connections&#x20;or&#x20;attempted&#x20;connections&#x20;with&#x20;its&#x20;&quot;ipmon&quot;&#x20;daemon&#x20;as&#x20;either&#x20;a&#x20;compliment&#x20;or&#x20;alternative&#x20;to&#x20;inetd&#x20;logging.','Logging&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;inetd&#x20;network&#x20;connections&#x20;assists&#x20;in&#x20;the&#x20;detection&#x20;and&#x20;identification&#x20;of&#x20;unusual&#x20;activity&#x20;that&#x20;may&#x20;be&#x20;associated&#x20;with&#x20;security&#x20;intrusions.','','Perform&#x20;the&#x20;following:&#x20;ch_rc&#x20;-a&#x20;-p&#x20;INETD_ARGS=-l&#x20;/etc/rc.config.d/netdaemons','[{\"cis\": [\"1.7.2\"]}, {\"cis_level\": [\"1\"]}]'),(30045,'Block&#x20;system&#x20;accounts.','Accounts&#x20;that&#x20;are&#x20;not&#x20;being&#x20;used&#x20;by&#x20;regular&#x20;users&#x20;should&#x20;be&#x20;locked.&#x20;Not&#x20;only&#x20;should&#x20;the&#x20;password&#x20;field&#x20;for&#x20;the&#x20;account&#x20;be&#x20;set&#x20;to&#x20;an&#x20;invalid&#x20;string,&#x20;but&#x20;the&#x20;shell&#x20;field&#x20;in&#x20;the&#x20;password&#x20;file&#x20;should&#x20;contain&#x20;an&#x20;invalid&#x20;shell.&#x20;Access&#x20;to&#x20;the&#x20;uucp&#x20;and&#x20;nuucp&#x20;accounts&#x20;is&#x20;only&#x20;needed&#x20;when&#x20;the&#x20;deprecated&#x20;Unix&#x20;to&#x20;Unix&#x20;Copy&#x20;&#40;UUCP&#41;&#x20;service&#x20;is&#x20;in&#x20;use.&#x20;The&#x20;other&#x20;listed&#x20;accounts&#x20;should&#x20;never&#x20;require&#x20;direct&#x20;access.&#x20;The&#x20;actions&#x20;below&#x20;locks&#x20;the&#x20;passwords&#x20;to&#x20;these&#x20;accounts&#x20;&#40;on&#x20;systems&#x20;converted&#x20;to&#x20;Trusted&#x20;Mode&#x20;only&#41;&#x20;and&#x20;sets&#x20;the&#x20;login&#x20;shell&#x20;to&#x20;/bin/false.&#x20;Note&#x20;that&#x20;the&#x20;above&#x20;is&#x20;not&#x20;an&#x20;exhaustive&#x20;list&#x20;of&#x20;possible&#x20;system/application&#x20;accounts&#x20;that&#x20;could&#x20;be&#x20;installed&#x20;on&#x20;the&#x20;system.&#x20;An&#x20;audit&#x20;of&#x20;all&#x20;users&#x20;on&#x20;the&#x20;system&#x20;is&#x20;the&#x20;only&#x20;way&#x20;to&#x20;be&#x20;sure&#x20;that&#x20;only&#x20;authorized&#x20;accounts&#x20;are&#x20;in&#x20;place.','System&#x20;accounts&#x20;are&#x20;not&#x20;used&#x20;by&#x20;regular&#x20;users,&#x20;and&#x20;almost&#x20;never&#x20;require&#x20;direct&#x20;access;&#x20;thus,&#x20;they&#x20;should&#x20;be&#x20;locked&#x20;to&#x20;prevent&#x20;accidental&#x20;or&#x20;malicious&#x20;usage.','','Perform&#x20;the&#x20;following&#x20;to&#x20;properly&#x20;lock&#x20;the&#x20;following&#x20;known&#x20;system&#x20;users:&#x20;www&#x20;sys&#x20;smbnull&#x20;iwww&#x20;owww&#x20;sshd&#x20;hpsmh&#x20;named&#x20;uucp&#x20;nuucp&#x20;adm&#x20;daemon&#x20;bin&#x20;lp&#x20;nobody&#x20;noaccess&#x20;hpdb&#x20;useradm&#x20;1.&#x20;Lock&#x20;the&#x20;account:&#x20;passwd&#x20;-l&#x20;&lt;user&gt;&#x20;2.&#x20;Set&#x20;the&#x20;login&#x20;shell&#x20;to&#x20;an&#x20;invalid&#x20;program:&#x20;/usr/sbin/usermod&#x20;-s&#x20;/bin/false&#x20;&lt;user&gt;&#x20;3.&#x20;If&#x20;a&#x20;trusted&#x20;system,&#x20;set&#x20;the&#x20;adminstrator&#x20;lock:&#x20;/usr/lbin/modprpw&#x20;-m&#x20;alock=YES&#x20;&lt;user&gt;&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;for&#x20;user&#x20;in&#x20;www&#x20;sys&#x20;smbnull&#x20;iwww&#x20;owww&#x20;sshd&#x20;&#x20;hpsmh&#x20;named&#x20;uucp&#x20;nuucp&#x20;adm&#x20;daemon&#x20;bin&#x20;lp&#x20;&#x20;nobody&#x20;noaccess&#x20;hpdb&#x20;useradm;&#x20;do&#x20;passwd&#x20;-l&#x20;&quot;$user&quot;&#x20;/usr/sbin/usermod&#x20;-s&#x20;/bin/false&#x20;&quot;$user&quot;&#x20;if&#x20;[[&#x20;-f&#x20;/tcb&#x20;]];&#x20;then&#x20;/usr/lbin/modprpw&#x20;-m&#x20;alock=YES&#x20;&quot;$user&quot;&#x20;fi&#x20;done','[{\"cis\": [\"1.8.1\"]}, {\"cis_level\": [\"1\"]}]'),(30046,'Verify&#x20;that&#x20;there&#x20;are&#x20;no&#x20;accounts&#x20;with&#x20;empty&#x20;password&#x20;fields.','An&#x20;account&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field&#x20;means&#x20;that&#x20;anybody&#x20;may&#x20;log&#x20;in&#x20;as&#x20;that&#x20;user&#x20;without&#x20;providing&#x20;a&#x20;password&#x20;at&#x20;all.&#x20;All&#x20;accounts&#x20;should&#x20;have&#x20;strong&#x20;passwords&#x20;or&#x20;should&#x20;be&#x20;locked&#x20;by&#x20;using&#x20;a&#x20;password&#x20;string&#x20;like&#x20;&quot;*&quot;,&#x20;&quot;NP&quot;,&#x20;or&#x20;&quot;*LOCKED*&quot;','User&#x20;accounts&#x20;should&#x20;have&#x20;passwords,&#x20;or&#x20;be&#x20;locked.','','Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;no&#x20;accounts&#x20;have&#x20;an&#x20;empty&#x20;password&#x20;field:&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts&#x20;with&#x20;an&#x20;empty&#x20;password&#x20;field:&#x20;logins&#x20;-p&#x20;2.&#x20;Lock&#x20;each&#x20;account:&#x20;passwd&#x20;-l&#x20;&lt;user&gt;&#x20;3.&#x20;If&#x20;a&#x20;trusted&#x20;system,&#x20;set&#x20;the&#x20;administrator&#x20;lock:&#x20;/usr/lbin/modprpw&#x20;-m&#x20;alock=YES&#x20;&lt;user&gt;','[{\"cis\": [\"1.8.2\"]}, {\"cis_level\": [\"1\"]}]'),(30047,'Set&#x20;account&#x20;expiration&#x20;parameters&#x20;on&#x20;active&#x20;accounts.','The&#x20;commands&#x20;below&#x20;will&#x20;set&#x20;all&#x20;active&#x20;accounts&#x20;&#40;except&#x20;the&#x20;root&#x20;account&#41;&#x20;to&#x20;force&#x20;password&#x20;changes&#x20;every&#x20;90&#x20;days&#x20;&#40;91&#x20;days&#x20;when&#x20;not&#x20;running&#x20;in&#x20;HP-UX&#x20;Trusted&#x20;Mode&#41;&#x20;and&#x20;then&#x20;prevent&#x20;password&#x20;changes&#x20;for&#x20;seven&#x20;days&#x20;&#40;one&#x20;week&#41;&#x20;thereafter.&#x20;Users&#x20;will&#x20;begin&#x20;receiving&#x20;warnings&#x20;30&#x20;days&#x20;&#40;28&#x20;days&#x20;when&#x20;not&#x20;running&#x20;in&#x20;HP-UX&#x20;Trusted&#x20;Mode&#41;&#x20;before&#x20;their&#x20;password&#x20;expires.&#x20;Sites&#x20;also&#x20;have&#x20;the&#x20;option&#x20;of&#x20;expiring&#x20;idle&#x20;accounts&#x20;after&#x20;a&#x20;certain&#x20;number&#x20;of&#x20;days&#x20;&#40;see&#x20;the&#x20;on-line&#x20;manual&#x20;page&#x20;for&#x20;the&#x20;usermod&#x20;command,&#x20;particularly&#x20;the&#x20;-f&#x20;option&#41;.&#x20;These&#x20;are&#x20;recommended&#x20;starting&#x20;values,&#x20;but&#x20;sites&#x20;may&#x20;choose&#x20;to&#x20;make&#x20;them&#x20;more&#x20;restrictive&#x20;depending&#x20;on&#x20;local&#x20;policies.','It&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;force&#x20;users&#x20;to&#x20;change&#x20;passwords&#x20;on&#x20;a&#x20;regular&#x20;basis.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;password&#x20;expiration&#x20;parameters&#x20;on&#x20;all&#x20;active&#x20;accounts:&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts&#x20;excluding&#x20;root&#x20;that&#x20;are&#x20;not&#x20;locked,&#x20;and&#x20;for&#x20;each:&#x20;2.&#x20;Set&#x20;password&#x20;expiration&#x20;parameters&#x20;for&#x20;the&#x20;account&#x20;&#40;logname&#41;&#x20;by&#x20;executing&#x20;the&#x20;following:&#x20;passwd&#x20;-x&#x20;91&#x20;-n&#x20;7&#x20;-w&#x20;28&#x20;&lt;logname&gt;&#x20;for&#x20;trusted&#x20;systems,&#x20;perform&#x20;the&#x20;following:&#x20;/usr/lbin/modprpw&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30&#x20;&lt;logname&gt;&#x20;3.&#x20;Set&#x20;the&#x20;default&#x20;account&#x20;expiration&#x20;parameters&#x20;by&#x20;appending&#x20;the&#x20;following&#x20;lines&#x20;to&#x20;/etc/default/security:&#x20;a.&#x20;PASSWORD_MAXDAYS=91&#x20;b.&#x20;PASSWORD_MINDAYS=7&#x20;c.&#x20;PASSWORD_WARNDAYS=28&#x20;4.&#x20;Set&#x20;the&#x20;default&#x20;parameters&#x20;for&#x20;trusted&#x20;systems&#x20;with:&#x20;/usr/lbin/modprdef&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above.&#x20;logins&#x20;-ox&#x20;&#x20;|&#x20;awk&#x20;-F:&#x20;&#039;&#40;$8&#x20;!=&#x20;&quot;LK&quot;&#x20;&amp;&amp;&#x20;$1&#x20;!=&#x20;&quot;root&quot;&#41;&#x20;{&#x20;print&#x20;$1&#x20;}&#039;&#x20;&#x20;|&#x20;while&#x20;read&#x20;logname;&#x20;do&#x20;passwd&#x20;-x&#x20;91&#x20;-n&#x20;7&#x20;-w&#x20;28&#x20;&quot;$logname&quot;&#x20;/usr/lbin/modprpw&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30&#x20;&#x20;&quot;$logname&quot;&#x20;done&#x20;echo&#x20;PASSWORD_MAXDAYS=91&#x20;&gt;&gt;&#x20;/etc/default/security&#x20;echo&#x20;PASSWORD_MINDAYS=7&#x20;&gt;&gt;&#x20;/etc/default/security&#x20;echo&#x20;PASSWORD_WARNDAYS=28&#x20;&gt;&gt;&#x20;/etc/default/security&#x20;/usr/lbin/modprdef&#x20;-m&#x20;exptm=90,mintm=7,expwarn=30','[{\"cis\": [\"1.8.3\"]}, {\"cis_level\": [\"1\"]}]'),(30048,'Set&#x20;strong&#x20;password&#x20;enforcement&#x20;policies.','The&#x20;policies&#x20;set&#x20;here&#x20;are&#x20;designed&#x20;to&#x20;force&#x20;users&#x20;to&#x20;make&#x20;better&#x20;password&#x20;choices&#x20;when&#x20;changing&#x20;their&#x20;passwords.&#x20;Sites&#x20;often&#x20;have&#x20;differing&#x20;opinions&#x20;on&#x20;the&#x20;optimal&#x20;value&#x20;of&#x20;the&#x20;MIN_PASSWORD_LENGTH&#x20;and&#x20;PASSWORD_HISTORY_DEPTH&#x20;parameters.&#x20;A&#x20;minimum&#x20;password&#x20;length&#x20;of&#x20;seven&#x20;is&#x20;in&#x20;line&#x20;with&#x20;industry&#x20;standards,&#x20;especially&#x20;the&#x20;Payment&#x20;Card&#x20;Industry&#x20;&#40;PCI&#41;&#x20;Security&#x20;Standard;&#x20;however,&#x20;a&#x20;longer&#x20;value&#x20;may&#x20;be&#x20;warranted&#x20;if&#x20;account&#x20;locks&#x20;are&#x20;not&#x20;enabled&#x20;&#40;item&#x20;1.6.10&#41;.&#x20;A&#x20;password&#x20;history&#x20;depth&#x20;of&#x20;ten&#x20;combined&#x20;with&#x20;passwords&#x20;that&#x20;expire&#x20;four&#x20;times&#x20;per&#x20;year&#x20;&#40;item&#x20;1.8.3&#41;&#x20;means&#x20;users&#x20;will&#x20;typically&#x20;not&#x20;re-use&#x20;the&#x20;same&#x20;password&#x20;in&#x20;any&#x20;given&#x20;year.&#x20;Requiring&#x20;an&#x20;upper/lowercase&#x20;and&#x20;special&#x20;character&#x20;password&#x20;will&#x20;dramatically&#x20;increase&#x20;the&#x20;password&#x20;search&#x20;space&#x20;and&#x20;lower&#x20;the&#x20;chances&#x20;for&#x20;brute-force&#x20;attack&#x20;significantly.&#x20;-&#x20;Note:&#x20;these&#x20;settings&#x20;are&#x20;known&#x20;to&#x20;exist&#x20;for&#x20;HP-UX&#x20;11iv2,&#x20;0512&#x20;and&#x20;later.&#x20;The&#x20;man&#x20;page&#x20;for&#x20;security&#40;5&#41;&#x20;will&#x20;indicate&#x20;if&#x20;these&#x20;exist&#x20;on&#x20;your&#x20;particular&#x20;system.&#x20;Be&#x20;sure&#x20;to&#x20;consult&#x20;you&#x20;local&#x20;security&#x20;standards&#x20;before&#x20;adopting&#x20;the&#x20;values&#x20;given&#x20;above.','All&#x20;users&#x20;should&#x20;use&#x20;strong&#x20;passwords.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;strong&#x20;password&#x20;enforcement&#x20;policies:&#x20;1.&#x20;Change&#x20;the&#x20;following&#x20;parameters&#x20;in&#x20;the&#x20;/etc/default/security&#x20;file&#x20;to&#x20;establish&#x20;default&#x20;password&#x20;policies&#x20;for&#x20;new&#x20;users:&#x20;a.&#x20;MIN_PASSORD_LENGTH=7&#x20;b.&#x20;PASSWORD_HISTORY_DEPTH=10&#x20;c.&#x20;PASSWORD_MIN_UPPER_CASE_CHARS=1&#x20;d.&#x20;PASSWORD_MIN_DIGIT_CHARS=1&#x20;e.&#x20;PASSWORD_MIN_SPECIAL_CHARS=1&#x20;f.&#x20;PASSWORD_MIN_LOWER_CASE_CHARS=1&#x20;2.&#x20;If&#x20;using&#x20;a&#x20;trusted&#x20;system,&#x20;issue&#x20;the&#x20;following&#x20;modprdef&#x20;commands&#x20;to&#x20;disallow&#x20;null&#x20;or&#x20;trivial&#x20;passwords:&#x20;&#x20;modprdef&#x20;-m&#x20;nullpw=NO&#x20;modprdef&#x20;-m&#x20;rstrpw=YES&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;modprdef&#x20;-m&#x20;nullpw=NO&#x20;modprdef&#x20;-m&#x20;rstrpw=YES&#x20;ch_rc&#x20;-a&#x20;-p&#x20;MIN_PASSORD_LENGTH=7&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_HISTORY_DEPTH=10&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_UPPER_CASE_CHARS=1&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_DIGIT_CHARS=1&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_SPECIAL_CHARS=1&#x20;&#x20;/etc/default/security&#x20;ch_rc&#x20;-a&#x20;-p&#x20;PASSWORD_MIN_LOWER_CASE_CHARS=1&#x20;&#x20;/etc/default/security&#x20;modprdef&#x20;-m&#x20;nullpw=NO&#x20;modprdef&#x20;-m&#x20;rstrpw=YES','[{\"cis\": [\"1.8.4\"]}, {\"cis_level\": [\"1\"]}]'),(30049,'Verify&#x20;no&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;exist&#x20;in&#x20;passwd&#x20;and&#x20;group&#x20;files.','&#039;+&#039;&#x20;entries&#x20;in&#x20;various&#x20;passwd&#x20;and&#x20;group&#x20;files&#x20;served&#x20;as&#x20;markers&#x20;for&#x20;systems&#x20;to&#x20;insert&#x20;data&#x20;from&#x20;NIS&#x20;maps&#x20;at&#x20;a&#x20;certain&#x20;point&#x20;in&#x20;a&#x20;system&#x20;configuration&#x20;file.&#x20;HP-UX&#x20;does&#x20;not&#x20;use&#x20;these&#x20;markers,&#x20;but&#x20;they&#x20;may&#x20;exist&#x20;in&#x20;files&#x20;that&#x20;have&#x20;been&#x20;imported&#x20;from&#x20;other&#x20;platforms.&#x20;They&#x20;should&#x20;be&#x20;deleted&#x20;if&#x20;they&#x20;exist.','Legacy&#x20;&#039;+&#039;&#x20;entries&#x20;are&#x20;no&#x20;longer&#x20;required&#x20;on&#x20;HP-UX&#x20;systems,&#x20;and&#x20;may&#x20;provide&#x20;an&#x20;avenue&#x20;for&#x20;attackers&#x20;to&#x20;gain&#x20;privileged&#x20;access&#x20;on&#x20;the&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;remove&#x20;any&#x20;legacy&#x20;&#039;+&#039;&#x20;entries&#x20;in&#x20;passwd&#x20;and&#x20;group&#x20;files:&#x20;1.&#x20;Display&#x20;legacy&#x20;&#039;+&#039;&#x20;entries:&#x20;grep&#x20;&#039;^+:&#039;&#x20;/etc/passwd&#x20;/etc/group&#x20;2.&#x20;Remove&#x20;any&#x20;entries&#x20;found&#x20;from&#x20;the&#x20;passwd&#x20;and&#x20;group&#x20;files.','[{\"cis\": [\"1.8.5\"]}, {\"cis_level\": [\"1\"]}]'),(30050,'No&#x20;&#039;.&#039;&#x20;or&#x20;group/world-writable&#x20;directory&#x20;in&#x20;root&#x20;$PATH.','Remove&#x20;the&#x20;current&#x20;working&#x20;directory&#x20;&#40;&#039;.&#039;&#41;&#x20;or&#x20;other&#x20;world-writable&#x20;directories&#x20;from&#x20;the&#x20;root&#x20;user&#039;s&#x20;execution&#x20;path.&#x20;To&#x20;execute&#x20;a&#x20;file&#x20;in&#x20;the&#x20;current&#x20;directory&#x20;when&#x20;&bdquo;.‟&#x20;is&#x20;not&#x20;in&#x20;the&#x20;$PATH,&#x20;use&#x20;the&#x20;format&#x20;&ldquo;./filename&rdquo;.','Including&#x20;these&#x20;paths&#x20;in&#x20;the&#x20;root&#039;s&#x20;executable&#x20;path&#x20;allows&#x20;an&#x20;attacker&#x20;to&#x20;gain&#x20;superuser&#x20;access&#x20;if&#x20;an&#x20;administrator&#x20;operating&#x20;as&#x20;root&#x20;executes&#x20;a&#x20;Trojan&#x20;horse&#x20;program.','','Remove&#x20;the&#x20;following&#x20;path&#x20;components&#x20;if&#x20;they&#x20;exist&#x20;in&#x20;the&#x20;root&#x20;user&#039;s&#x20;$PATH:&#x20;1.&#x20;current&#x20;working&#x20;directory&#x20;&#40;&#039;.&#039;&#41;&#x20;2.&#x20;empty&#x20;directories&#x20;&#40;&bdquo;::‟&#41;&#x20;3.&#x20;a&#x20;trailing&#x20;path&#x20;seperator&#x20;at&#x20;the&#x20;end&#x20;of&#x20;the&#x20;$PATH&#x20;&#40;&#039;:&#039;&#41;&#x20;4.&#x20;any&#x20;directory&#x20;with&#x20;world&#x20;or&#x20;group&#x20;-write&#x20;permissions&#x20;set','[{\"cis\": [\"1.8.6\"]}, {\"cis_level\": [\"1\"]}]'),(30051,'Secure&#x20;user&#x20;home&#x20;directories.','Remove&#x20;group&#x20;write&#x20;and&#x20;world&#x20;access&#x20;to&#x20;all&#x20;user&#x20;home&#x20;directories.&#x20;While&#x20;the&#x20;modifications&#x20;below&#x20;are&#x20;relatively&#x20;benign,&#x20;making&#x20;global&#x20;modifications&#x20;to&#x20;user&#x20;home&#x20;directories&#x20;without&#x20;alerting&#x20;your&#x20;user&#x20;community&#x20;can&#x20;result&#x20;in&#x20;unexpected&#x20;outages&#x20;and&#x20;unhappy&#x20;users.','Group&#x20;or&#x20;world-writable&#x20;user&#x20;home&#x20;directories&#x20;may&#x20;enable&#x20;malicious&#x20;users&#x20;to&#x20;steal&#x20;or&#x20;modify&#x20;other&#x20;users&#039;&#x20;data&#x20;or&#x20;to&#x20;gain&#x20;another&#x20;user&#039;s&#x20;system&#x20;privileges.','','Perform&#x20;the&#x20;following&#x20;to&#x20;secure&#x20;user&#x20;home&#x20;directories:&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts&#x20;excluding&#x20;root&#x20;that&#x20;are&#x20;not&#x20;locked,&#x20;and&#x20;for&#x20;each&#x20;of&#x20;these&#x20;user&#x20;home&#x20;directories:&#x20;2.&#x20;Remove&#x20;group&#x20;write&#x20;permission&#x20;&#40;g-w&#41;&#x20;and&#x20;all&#x20;other&#x20;permissions&#x20;&#40;o-rwx&#41;&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;logins&#x20;-ox&#x20;&#x20;|&#x20;awk&#x20;-F:&#x20;&#039;&#40;$8&#x20;==&#x20;&quot;PS&quot;&#x20;&amp;&amp;&#x20;$1&#x20;!=&#x20;&quot;root&quot;&#41;&#x20;{&#x20;print&#x20;$6&#x20;}&#039;&#x20;&#x20;|&#x20;grep&#x20;/home/&#x20;&#x20;|&#x20;while&#x20;read&#x20;dir&#x20;do&#x20;&#x20;chmod&#x20;g-w,o-rwx&#x20;&quot;$dir&quot;&#x20;done','[{\"cis\": [\"1.8.7\"]}, {\"cis_level\": [\"1\"]}]'),(30052,'No&#x20;user&#x20;dot-files&#x20;should&#x20;be&#x20;group/world&#x20;writable.','Remove&#x20;group&#x20;and&#x20;world&#x20;write&#x20;permissions&#x20;from&#x20;user&#x20;dot-files.&#x20;While&#x20;the&#x20;modifications&#x20;below&#x20;are&#x20;relatively&#x20;benign,&#x20;making&#x20;global&#x20;modifications&#x20;to&#x20;user&#x20;dot-files&#x20;without&#x20;alerting&#x20;your&#x20;user&#x20;community&#x20;can&#x20;result&#x20;in&#x20;unexpected&#x20;outages&#x20;and&#x20;unhappy&#x20;users.','Group&#x20;or&#x20;world-writable&#x20;user&#x20;configuration&#x20;files&#x20;may&#x20;enable&#x20;malicious&#x20;users&#x20;to&#x20;steal&#x20;or&#x20;modify&#x20;other&#x20;users&#039;&#x20;data&#x20;or&#x20;to&#x20;gain&#x20;another&#x20;user&#039;s&#x20;system&#x20;privileges.','','Perform&#x20;the&#x20;following:&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts&#x20;excluding&#x20;root&#x20;that&#x20;are&#x20;not&#x20;locked,&#x20;and&#x20;for&#x20;each&#x20;of&#x20;these&#x20;user&#x20;home&#x20;directories:&#x20;2.&#x20;Remove&#x20;group/other&#x20;write&#x20;permissions&#x20;&#40;go-w&#41;&#x20;from&#x20;any&#x20;files&#x20;beginning&#x20;with&#x20;&#039;.&#039;&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;logins&#x20;-ox&#x20;&#x20;|&#x20;awk&#x20;-F:&#x20;&#039;&#40;$8&#x20;==&#x20;&quot;PS&quot;&#41;&#x20;{&#x20;print&#x20;$6&#x20;}&#039;&#x20;&#x20;|&#x20;while&#x20;read&#x20;dir&#x20;do&#x20;ls&#x20;-d&#x20;&quot;$dir/&quot;.[!.]*&#x20;|&#x20;while&#x20;read&#x20;file&#x20;do&#x20;&#x20;if&#x20;[&#x20;!&#x20;-h&#x20;&quot;$file&quot;&#x20;-a&#x20;-f&#x20;&quot;$file&quot;&#x20;]&#x20;then&#x20;chmod&#x20;go-w&#x20;&quot;$file&quot;&#x20;fi&#x20;done&#x20;done','[{\"cis\": [\"1.8.8\"]}, {\"cis_level\": [\"1\"]}]'),(30053,'Remove&#x20;user&#x20;.netrc,&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files.','Remove&#x20;user&#x20;.netrc,&#x20;.rhosts,&#x20;and&#x20;.shosts&#x20;files.&#x20;Note&#x20;that&#x20;making&#x20;global&#x20;modifications&#x20;to&#x20;user&#x20;security&#x20;files&#x20;in&#x20;their&#x20;home&#x20;directories&#x20;without&#x20;alerting&#x20;your&#x20;user&#x20;community&#x20;can&#x20;result&#x20;in&#x20;unexpected&#x20;outages&#x20;and&#x20;unhappy&#x20;users.','.netrc&#x20;files&#x20;may&#x20;contain&#x20;unencrypted&#x20;passwords&#x20;that&#x20;may&#x20;be&#x20;used&#x20;to&#x20;attack&#x20;other&#x20;systems,&#x20;while&#x20;.rhosts&#x20;and&#x20;.shosts&#x20;files&#x20;used&#x20;in&#x20;conjunction&#x20;with&#x20;the&#x20;BSD-style&#x20;&ldquo;r-commands&rdquo;&#x20;&#40;rlogin,&#x20;remsh,&#x20;rcp&#41;&#x20;or&#x20;SSH&#x20;implement&#x20;a&#x20;weak&#x20;form&#x20;of&#x20;authentication&#x20;based&#x20;on&#x20;the&#x20;network&#x20;address&#x20;or&#x20;host&#x20;name&#x20;of&#x20;the&#x20;remote&#x20;computer&#x20;&#40;which&#x20;can&#x20;be&#x20;spoofed&#x20;by&#x20;a&#x20;potential&#x20;attacker&#x20;to&#x20;exploit&#x20;the&#x20;local&#x20;system&#41;.','','Perform&#x20;the&#x20;following&#x20;to&#x20;remove&#x20;user&#x20;.netrc,&#x20;.rhosts,&#x20;and&#x20;.shosts&#x20;files.&#x20;1.&#x20;Identify&#x20;all&#x20;user&#x20;accounts,&#x20;and&#x20;for&#x20;each&#x20;existing&#x20;home&#x20;directory:&#x20;2.&#x20;Remove&#x20;.netrc,&#x20;.rhosts,&#x20;and&#x20;.shosts&#x20;files&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;logins&#x20;-ox&#x20;|&#x20;cut&#x20;-f6&#x20;-d:&#x20;|&#x20;while&#x20;read&#x20;h&#x20;do&#x20;for&#x20;file&#x20;in&#x20;&quot;$h/.netrc&quot;&#x20;&quot;$h/.rhosts&quot;&#x20;&quot;$h/.shosts&quot;&#x20;do&#x20;&#x20;if&#x20;[&#x20;-f&#x20;&quot;$file&quot;&#x20;]&#x20;then&#x20;&#x20;echo&#x20;&quot;removing&#x20;$file&quot;&#x20;rm&#x20;-f&#x20;&quot;$file&quot;&#x20;fi&#x20;done&#x20;done','[{\"cis\": [\"1.8.9\"]}, {\"cis_level\": [\"1\"]}]'),(30054,'Set&#x20;default&#x20;umask&#x20;for&#x20;users.','Set&#x20;the&#x20;default&#x20;umask&#x20;to&#x20;077&#x20;so&#x20;that&#x20;files&#x20;created&#x20;by&#x20;users&#x20;will&#x20;not&#x20;be&#x20;readable&#x20;by&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;A&#x20;umask&#x20;of&#x20;027&#x20;would&#x20;make&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;users&#x20;in&#x20;the&#x20;same&#x20;Unix&#x20;group,&#x20;while&#x20;a&#x20;umask&#x20;of&#x20;022&#x20;would&#x20;make&#x20;files&#x20;readable&#x20;by&#x20;every&#x20;user&#x20;on&#x20;the&#x20;system.&#x20;-&#x20;Bastille&#x20;Note:&#x20;sets&#x20;the&#x20;default&#x20;umask,&#x20;but&#x20;uses&#x20;a&#x20;umask&#x20;of&#x20;027&#x20;rather&#x20;than&#x20;the&#x20;077.','Restricting&#x20;access&#x20;to&#x20;files&#x20;and&#x20;directories&#x20;created&#x20;by&#x20;a&#x20;user&#x20;from&#x20;any&#x20;other&#x20;user&#x20;on&#x20;the&#x20;system&#x20;reduces&#x20;the&#x20;possibility&#x20;of&#x20;an&#x20;unauthorized&#x20;account&#x20;accessing&#x20;that&#x20;user&#039;s&#x20;files.&#x20;The&#x20;user&#x20;creating&#x20;the&#x20;file&#x20;has&#x20;the&#x20;discretion&#x20;of&#x20;making&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;readable&#x20;by&#x20;others&#x20;via&#x20;the&#x20;chmod&#x20;command.&#x20;Users&#x20;who&#x20;wish&#x20;to&#x20;allow&#x20;their&#x20;files&#x20;and&#x20;directories&#x20;to&#x20;be&#x20;readable&#x20;by&#x20;others&#x20;by&#x20;default&#x20;may&#x20;choose&#x20;a&#x20;different&#x20;default&#x20;umask&#x20;by&#x20;inserting&#x20;the&#x20;umask&#x20;command&#x20;into&#x20;the&#x20;standard&#x20;shell&#x20;configuration&#x20;files&#x20;&#40;.profile,&#x20;.cshrc,&#x20;etc.&#41;&#x20;in&#x20;their&#x20;home&#x20;directories.','','Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;a&#x20;default&#x20;umask&#x20;for&#x20;users:&#x20;1.&#x20;Change&#x20;directory&#x20;to&#x20;/etc&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;umask&#x20;077&#x20;to&#x20;the&#x20;following&#x20;files:&#x20;a.&#x20;profile&#x20;b.&#x20;csh.login&#x20;c.&#x20;d.profile&#x20;d.&#x20;d.login&#x20;3.&#x20;Update&#x20;the&#x20;UMASK&#x20;parameter&#x20;to&#x20;077&#x20;in&#x20;the&#x20;file&#x20;/etc/default/security&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;cd&#x20;/etc&#x20;for&#x20;file&#x20;in&#x20;profile&#x20;csh.login&#x20;d.profile&#x20;d.login&#x20;do&#x20;echo&#x20;umask&#x20;077&#x20;&gt;&gt;&#x20;&quot;$file&quot;&#x20;done&#x20;ch_rc&#x20;-a&#x20;-p&#x20;UMASK=077&#x20;/etc/default/security','[{\"cis\": [\"1.8.10\"]}, {\"cis_level\": [\"1\"]}]'),(30055,'Set&#x20;&#039;mesg&#x20;n&#039;&#x20;as&#x20;default&#x20;for&#x20;all&#x20;users.','Block&#x20;the&#x20;use&#x20;of&#x20;write&#x20;or&#x20;talk&#x20;commands&#x20;to&#x20;contact&#x20;the&#x20;user&#x20;at&#x20;their&#x20;terminal&#x20;in&#x20;order&#x20;to&#x20;slightly&#x20;strengthen&#x20;permissions&#x20;on&#x20;the&#x20;user&#039;s&#x20;tty&#x20;device.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;is&#x20;the&#x20;default&#x20;on&#x20;HP-UX&#x20;11i.','Since&#x20;write&#x20;and&#x20;talk&#x20;are&#x20;no&#x20;longer&#x20;widely&#x20;used&#x20;at&#x20;most&#x20;sites,&#x20;the&#x20;incremental&#x20;security&#x20;increase&#x20;is&#x20;worth&#x20;the&#x20;loss&#x20;of&#x20;functionality.','','Perform&#x20;the&#x20;following:&#x20;1.&#x20;Change&#x20;directory&#x20;to&#x20;/etc&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;mesg&#x20;n&#x20;to&#x20;the&#x20;following&#x20;files:&#x20;a.&#x20;profile&#x20;b.&#x20;csh.login&#x20;c.&#x20;d.profile&#x20;d.&#x20;d.login&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;&#x20;cd&#x20;/etc&#x20;for&#x20;file&#x20;in&#x20;profile&#x20;csh.login&#x20;d.profile&#x20;d.login&#x20;do&#x20;&#x20;echo&#x20;mesg&#x20;n&#x20;&gt;&gt;&#x20;&quot;$file&quot;&#x20;done','[{\"cis\": [\"1.8.11\"]}, {\"cis_level\": [\"1\"]}]'),(30056,'Create&#x20;warning&#x20;banners&#x20;for&#x20;terminal-session&#x20;logins.','The&#x20;contents&#x20;of&#x20;the&#x20;/etc/issue&#x20;file&#x20;are&#x20;displayed&#x20;prior&#x20;to&#x20;the&#x20;login&#x20;prompt&#x20;on&#x20;the&#x20;system&#039;s&#x20;console&#x20;and&#x20;serial&#x20;devices,&#x20;as&#x20;well&#x20;as&#x20;for&#x20;remote&#x20;terminal-session&#x20;logins&#x20;such&#x20;as&#x20;through&#x20;SSH&#x20;or&#x20;Telnet.&#x20;&#x20;/etc/motd&#x20;is&#x20;generally&#x20;displayed&#x20;after&#x20;all&#x20;successful&#x20;logins,&#x20;no&#x20;matter&#x20;where&#x20;the&#x20;user&#x20;is&#x20;logging&#x20;in&#x20;from,&#x20;but&#x20;is&#x20;thought&#x20;to&#x20;be&#x20;less&#x20;useful&#x20;because&#x20;it&#x20;only&#x20;provides&#x20;notification&#x20;to&#x20;the&#x20;user&#x20;after&#x20;the&#x20;machine&#x20;has&#x20;been&#x20;accessed.','Presenting&#x20;some&#x20;sort&#x20;of&#x20;statutory&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;logon&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.&#x20;Changing&#x20;some&#x20;of&#x20;these&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;hiding&#x20;OS&#x20;version&#x20;information&#x20;and&#x20;other&#x20;detailed&#x20;system&#x20;information&#x20;from&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;attacks&#x20;at&#x20;a&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;create&#x20;warning&#x20;banners&#x20;for&#x20;terminal-session&#x20;logins:&#x20;1.&#x20;Compose&#x20;a&#x20;default&#x20;banner&#x20;text&#x20;string&#x20;2.&#x20;Append&#x20;this&#x20;string&#x20;to&#x20;the&#x20;files&#x20;&#x20;/etc/motd&#x20;and&#x20;/etc/motd&#x20;3.&#x20;Change&#x20;the&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;&#x20;for&#x20;the&#x20;file&#x20;/etc/motd&#x20;4.&#x20;Change&#x20;the&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;root&#x20;for&#x20;the&#x20;file&#x20;/etc/issue&#x20;5.&#x20;Change&#x20;file&#x20;permissions&#x20;to&#x20;&#40;644&#41;&#x20;for&#x20;the&#x20;files&#x20;/etc/motd&#x20;and&#x20;/etc/issue','[{\"cis\": [\"1.9.1\"]}, {\"cis_level\": [\"1\"]}]'),(30057,'Create&#x20;warning&#x20;banners&#x20;for&#x20;GUI&#x20;logins.','The&#x20;standard&#x20;graphical&#x20;login&#x20;program&#x20;for&#x20;HP-UX&#x20;requires&#x20;the&#x20;user&#x20;to&#x20;enter&#x20;their&#x20;username&#x20;in&#x20;one&#x20;dialog&#x20;box&#x20;and&#x20;their&#x20;password&#x20;in&#x20;a&#x20;second&#x20;separate&#x20;dialog.&#x20;The&#x20;commands&#x20;below&#x20;set&#x20;the&#x20;warning&#x20;message&#x20;on&#x20;both&#x20;to&#x20;be&#x20;the&#x20;same&#x20;message,&#x20;but&#x20;the&#x20;site&#x20;has&#x20;the&#x20;option&#x20;of&#x20;using&#x20;different&#x20;messages&#x20;on&#x20;each&#x20;screen.&#x20;The&#x20;Dtlogin*greeting.labelString&#x20;is&#x20;the&#x20;message&#x20;for&#x20;the&#x20;first&#x20;dialog&#x20;where&#x20;the&#x20;user&#x20;is&#x20;prompted&#x20;for&#x20;their&#x20;username,&#x20;and&#x20;.perslabelString&#x20;is&#x20;the&#x20;message&#x20;on&#x20;the&#x20;second&#x20;dialog&#x20;box.&#x20;Note&#x20;that&#x20;system&#x20;administrators&#x20;may&#x20;wish&#x20;to&#x20;consult&#x20;with&#x20;their&#x20;site&rsquo;s&#x20;legal&#x20;council&#x20;about&#x20;the&#x20;specifics&#x20;of&#x20;any&#x20;warning&#x20;banners.','Presenting&#x20;some&#x20;sort&#x20;of&#x20;statutory&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;logon&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.&#x20;Changing&#x20;some&#x20;of&#x20;these&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;hiding&#x20;OS&#x20;version&#x20;information&#x20;and&#x20;other&#x20;detailed&#x20;system&#x20;information&#x20;from&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;attacks&#x20;at&#x20;a&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;install&#x20;default&#x20;warning&#x20;banners&#x20;for&#x20;GUI&#x20;logins:&#x20;1.&#x20;Create&#x20;a&#x20;default&#x20;banner&#x20;text&#x20;string&#x20;&#40;$banner&#41;&#x20;2.&#x20;For&#x20;each&#x20;directory&#x20;in&#x20;/usr/dt/config&#x20;that&#x20;contains&#x20;a&#x20;Xresources&#x20;file,&#x20;copy&#x20;that&#x20;Xresources&#x20;file&#x20;into&#x20;a&#x20;corresponding&#x20;directory&#x20;in&#x20;/etc/dt/config&#x20;&#40;creating&#x20;the&#x20;directory&#x20;if&#x20;needed&#41;&#x20;3.&#x20;Append&#x20;the&#x20;following&#x20;lines&#x20;&#40;replacing&#x20;$banner&#x20;with&#x20;the&#x20;string&#x20;in&#x20;step&#x20;1&#41;&#x20;to&#x20;each&#x20;/etc/dt/config&#47;&#42;/Xresources&#x20;file:&#x20;a.&#x20;Dtlogin*greeting.labelString:&#x20;$banner&#x20;b.&#x20;Dtlogin*greeting.persLabelString:&#x20;$banner&#x20;4.&#x20;Change&#x20;the&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;for&#x20;each&#x20;Xresource&#x20;file&#x20;5.&#x20;Change&#x20;the&#x20;file&#x20;permissions&#x20;to&#x20;644&#x20;for&#x20;each&#x20;Xresource&#x20;file&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;banner=&quot;Authorized&#x20;users&#x20;only.&#x20;All&#x20;activity&#x20;may&#x20;&#x20;be&#x20;monitored&#x20;and&#x20;reported.&quot;&#x20;for&#x20;file&#x20;in&#x20;/usr/dt/config&#47;&#42;/Xresources;&#x20;do&#x20;dir=&quot;$&#40;dirname&#x20;&quot;$file&quot;&#x20;|&#x20;sed&#x20;&#039;s|^/usr/|/etc/|&#039;&#41;&quot;&#x20;mkdir&#x20;-p&#x20;&quot;$dir&quot;&#x20;if&#x20;[&#x20;!&#x20;-f&#x20;&quot;$dir/Xresources&quot;&#x20;];&#x20;then&#x20;cp&#x20;-p&#x20;&quot;$file&quot;&#x20;&quot;$dir/Xresources&quot;&#x20;fi&#x20;echo&#x20;&quot;Dtlogin*greeting.labelString:&#x20;$banner&quot;&#x20;&#x20;&gt;&gt;&#x20;&quot;$dir/Xresources&quot;&#x20;echo&#x20;&quot;Dtlogin*greeting.persLabelString:&#x20;$banner&quot;&#x20;&#x20;&gt;&gt;&#x20;&quot;$dir/Xresources&quot;&#x20;done&#x20;chown&#x20;root:sys&#x20;/etc/dt/config&#47;&#42;/Xresources&#x20;chmod&#x20;644&#x20;/etc/dt/config&#47;&#42;/Xresources','[{\"cis\": [\"1.9.2\"]}, {\"cis_level\": [\"1\"]}]'),(30058,'Create&#x20;warning&#x20;banners&#x20;for&#x20;FTP&#x20;daemon.','The&#x20;FTP&#x20;daemon&#x20;in&#x20;HP-UX&#x20;11&#x20;is&#x20;based&#x20;on&#x20;the&#x20;popular&#x20;Washington&#x20;University&#x20;FTP&#x20;daemon&#x20;&#40;WU-FTPD&#41;,&#x20;which&#x20;is&#x20;an&#x20;Open&#x20;Source&#x20;program&#x20;widely&#x20;distributed&#x20;on&#x20;the&#x20;Internet.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;if&#x20;the&#x20;FTP&#x20;daemon&#x20;remains&#x20;de-activated&#x20;from&#x20;item&#x20;1.2.1.','Presenting&#x20;some&#x20;sort&#x20;of&#x20;statutory&#x20;warning&#x20;message&#x20;prior&#x20;to&#x20;the&#x20;normal&#x20;user&#x20;logon&#x20;may&#x20;assist&#x20;the&#x20;prosecution&#x20;of&#x20;trespassers&#x20;on&#x20;the&#x20;computer&#x20;system.&#x20;Changing&#x20;some&#x20;of&#x20;these&#x20;login&#x20;banners&#x20;also&#x20;has&#x20;the&#x20;side&#x20;effect&#x20;of&#x20;hiding&#x20;OS&#x20;version&#x20;information&#x20;and&#x20;other&#x20;detailed&#x20;system&#x20;information&#x20;from&#x20;attackers&#x20;attempting&#x20;to&#x20;target&#x20;specific&#x20;attacks&#x20;at&#x20;a&#x20;system.','','Perform&#x20;the&#x20;following&#x20;to&#x20;install&#x20;a&#x20;default&#x20;warning&#x20;banner&#x20;for&#x20;the&#x20;FTP&#x20;daemon:&#x20;1.&#x20;Ensure&#x20;that&#x20;an&#x20;appropriate&#x20;warning&#x20;message&#x20;exists&#x20;in&#x20;the&#x20;/etc/issue&#x20;file&#x20;.&#x20;2.&#x20;Append&#x20;the&#x20;line&#x20;&quot;banner&#x20;/etc/issue&quot;&#x20;to&#x20;the&#x20;file&#x20;/etc/ftpd/ftpaccess&#x20;3.&#x20;Change&#x20;file&#x20;permissions&#x20;to&#x20;600&#x20;for&#x20;/etc/ftpd/ftpaccess&#x20;4.&#x20;Change&#x20;owner&#x20;to&#x20;root&#x20;and&#x20;group&#x20;owner&#x20;to&#x20;sys&#x20;for&#x20;both&#x20;/etc/ftpd&#x20;and&#x20;/etc/ftpd/ftpaccess&#x20;The&#x20;following&#x20;script&#x20;performs&#x20;the&#x20;procedure&#x20;above:&#x20;if&#x20;[&#x20;-d&#x20;/etc/ftpd&#x20;];&#x20;then&#x20;echo&#x20;&quot;banner&#x20;/etc/issue&quot;&#x20;&gt;&gt;/etc/ftpd/ftpaccess&#x20;chmod&#x20;600&#x20;/etc/ftpd/ftpaccess&#x20;chown&#x20;root:sys&#x20;/etc/ftpd&#x20;/etc/ftpd/ftpaccess&#x20;fi','[{\"cis\": [\"1.9.3\"]}, {\"cis_level\": [\"1\"]}]'),(30131,'Resolve&#x20;&#039;unowned&#039;&#x20;files&#x20;and&#x20;directories.','Evaluate&#x20;ownership&#x20;of&#x20;any&#x20;files&#x20;that&#x20;are&#x20;not&#x20;owned&#x20;by&#x20;a&#x20;locally&#x20;defined&#x20;user,&#x20;and&#x20;consider&#x20;reassignment&#x20;to&#x20;an&#x20;active&#x20;user.','Sometimes&#x20;when&#x20;administrators&#x20;delete&#x20;users&#x20;from&#x20;the&#x20;system&#x20;they&#x20;neglect&#x20;to&#x20;remove&#x20;all&#x20;files&#x20;owned&#x20;by&#x20;those&#x20;users&#x20;from&#x20;the&#x20;system.&#x20;A&#x20;new&#x20;user&#x20;who&#x20;is&#x20;assigned&#x20;the&#x20;deleted&#x20;user&#039;s&#x20;user&#x20;ID&#x20;or&#x20;group&#x20;ID&#x20;may&#x20;then&#x20;end&#x20;up&#x20;&#039;owning&#039;&#x20;these&#x20;files,&#x20;and&#x20;thus&#x20;have&#x20;more&#x20;access&#x20;on&#x20;the&#x20;system&#x20;than&#x20;was&#x20;intended.&#x20;It&#x20;is&#x20;a&#x20;good&#x20;idea&#x20;to&#x20;locate&#x20;files&#x20;that&#x20;are&#x20;owned&#x20;by&#x20;users&#x20;or&#x20;groups&#x20;not&#x20;listed&#x20;in&#x20;the&#x20;system&#x20;configuration&#x20;files,&#x20;and&#x20;make&#x20;sure&#x20;to&#x20;reset&#x20;the&#x20;ownership&#x20;of&#x20;these&#x20;files&#x20;to&#x20;some&#x20;active&#x20;user&#x20;on&#x20;the&#x20;system&#x20;&#40;in&#x20;this&#x20;example,&#x20;&#039;bin&#039;&#41;&#x20;as&#x20;appropriate.','','Perform&#x20;the&#x20;following&#x20;to&#x20;identify&#x20;&quot;unowned&quot;&#x20;files&#x20;and&#x20;directories,&#x20;and&#x20;consider&#x20;resetting&#x20;ownership&#x20;to&#x20;a&#x20;default&#x20;owner&#x20;and&#x20;restricting&#x20;access&#x20;permissions:&#x20;1.&#x20;Locate&#x20;all&#x20;local&#x20;files&#x20;that&#x20;are&#x20;owned&#x20;by&#x20;users&#x20;or&#x20;groups&#x20;not&#x20;listed&#x20;in&#x20;the&#x20;system&#x20;configuration&#x20;files.&#x20;find&#x20;/&#x20;&#40;&#x20;-nouser&#x20;-o&#x20;-nogroup&#x20;&#41;&#x20;2.&#x20;Consider&#x20;resetting&#x20;user&#x20;and&#x20;group&#x20;ownership&#x20;of&#x20;these&#x20;files&#x20;to&#x20;a&#x20;default&#x20;active&#x20;user&#x20;&#40;e.g.&#x20;bin&#41;&#x20;chown&#x20;bin:bin&#x20;&lt;filename&gt;&#x20;3.&#x20;Consider&#x20;restricting&#x20;world-write&#x20;permissions,&#x20;and&#x20;removing&#x20;any&#x20;SUID/SGID&#x20;bits&#x20;on&#x20;these&#x20;files.&#x20;chmod&#x20;ug-s,o-w&#x20;&lt;filename&gt;&#x20;-&#x20;Note:&#x20;there&#x20;is&#x20;no&#x20;reason&#x20;for&#x20;an&#x20;application&#x20;to&#x20;require&#x20;an&#x20;unowned&#x20;file,&#x20;so&#x20;these&#x20;changes&#x20;should&#x20;be&#x20;application-safe.','[{\"cis\": [\"1.5.3\"]}, {\"cis_level\": [\"1\"]}]'),(30144,'Turn&#x20;on&#x20;additional&#x20;logging&#x20;for&#x20;FTP&#x20;daemon.','If&#x20;the&#x20;FTP&#x20;daemon&#x20;is&#x20;left&#x20;on,&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;the&#x20;command&#x20;logging&#x20;&#40;-L&#41;&#x20;and&#x20;connection&#x20;logging&#x20;&#40;-l&#41;&#x20;flags&#x20;also&#x20;be&#x20;enabled&#x20;to&#x20;track&#x20;FTP&#x20;activity&#x20;on&#x20;the&#x20;system,&#x20;allowing&#x20;the&#x20;administrator&#x20;&#40;or&#x20;software&#41;&#x20;to&#x20;scan&#x20;the&#x20;logs&#x20;for&#x20;unusual&#x20;activity.&#x20;This&#x20;is&#x20;especially&#x20;powerful&#x20;when&#x20;combined&#x20;with&#x20;the&#x20;access&#x20;control&#x20;capabilities&#x20;accessible&#x20;through&#x20;inetd&#039;s&#x20;/var/adm/inetd.sec&#x20;configuration&#x20;file.&#x20;Note&#x20;that&#x20;this&#x20;setting&#x20;has&#x20;no&#x20;effect&#x20;if&#x20;the&#x20;FTP&#x20;daemon&#x20;remains&#x20;de-activated&#x20;from&#x20;item&#x20;2.1.&#x20;Also&#x20;note&#x20;that&#x20;enabling&#x20;command&#x20;logging&#x20;on&#x20;the&#x20;FTP&#x20;daemon&#x20;&#40;HP-UX&#x20;11.x&#x20;only&#41;&#x20;can&#x20;cause&#x20;user&#x20;passwords&#x20;to&#x20;appear&#x20;in&#x20;clear-text&#x20;form&#x20;in&#x20;the&#x20;system&#x20;logs,&#x20;if&#x20;the&#x20;user&#x20;accidentally&#x20;types&#x20;their&#x20;password&#x20;at&#x20;the&#x20;username&#x20;prompt.&#x20;Information&#x20;about&#x20;FTP&#x20;sessions&#x20;will&#x20;be&#x20;logged&#x20;to&#x20;Syslog&#x20;and&#x20;by&#x20;default&#x20;HP-UX&#x20;systems&#x20;deposit&#x20;this&#x20;logging&#x20;information&#x20;in&#x20;/var/adm/syslog/syslog.log&#x20;with&#x20;other&#x20;system&#x20;log&#x20;messages.&#x20;Should&#x20;the&#x20;administrator&#x20;wish&#x20;to&#x20;capture&#x20;this&#x20;information&#x20;in&#x20;a&#x20;separate&#x20;file,&#x20;simply&#x20;modify&#x20;/etc/syslog.conf&#x20;to&#x20;log&#x20;daemon.notice&#x20;to&#x20;some&#x20;other&#x20;log&#x20;file&#x20;destination.','Logging&#x20;information&#x20;about&#x20;the&#x20;source&#x20;of&#x20;ftp&#x20;network&#x20;connections&#x20;assists&#x20;in&#x20;the&#x20;detection&#x20;and&#x20;identification&#x20;of&#x20;unusual&#x20;activity&#x20;that&#x20;may&#x20;be&#x20;associated&#x20;with&#x20;security&#x20;intrusions.','','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;logging&#x20;for&#x20;the&#x20;FTP&#x20;daemon:&#x20;1.&#x20;Change&#x20;directory&#x20;to&#x20;/etc.&#x20;2.&#x20;Open&#x20;the&#x20;inetd.conf&#x20;file&#x20;and&#x20;locate&#x20;the&#x20;ftpd&#x20;configuration&#x20;entry&#x20;line.&#x20;3.&#x20;Add&#x20;the&#x20;&quot;-L&quot;&#x20;and&#x20;&quot;-l&quot;&#x20;flags&#x20;to&#x20;the&#x20;ftpd&#x20;entry&#x20;if&#x20;not&#x20;already&#x20;present.&#x20;4.&#x20;Save&#x20;and&#x20;close&#x20;file.&#x20;The&#x20;following&#x20;script&#x20;will&#x20;perform&#x20;the&#x20;procedure&#x20;above:&#x20;cd&#x20;/etc&#x20;awk&#x20;&#039;/^ftpd/&#x20;&amp;&amp;&#x20;!/-L/&#x20;{&#x20;$NF&#x20;=&#x20;$NF&#x20;&quot;&#x20;-L&quot;&#x20;}&#x20;/^ftpd/&#x20;&amp;&amp;&#x20;!/-l/&#x20;{&#x20;$NF&#x20;=&#x20;$NF&#x20;&quot;&#x20;-l&quot;&#x20;}&#x20;{&#x20;print&#x20;}&#039;&#x20;inetd.conf&#x20;&gt;&#x20;inetd.conf.tmp&#x20;cp&#x20;inetd.conf.tmp&#x20;inetd.conf&#x20;rm&#x20;-f&#x20;inetd.conf.tmp','[{\"cis\": [\"1.7.3\"]}, {\"cis_level\": [\"1\"]}]'),(31000,'Ensure&#x20;All&#x20;Apple-provided&#x20;Software&#x20;Is&#x20;Current.','Software&#x20;vendors&#x20;release&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates&#x20;for&#x20;their&#x20;products&#x20;when&#x20;security&#x20;vulnerabilities&#x20;are&#x20;discovered.&#x20;There&#x20;is&#x20;no&#x20;simple&#x20;way&#x20;to&#x20;complete&#x20;this&#x20;action&#x20;without&#x20;a&#x20;network&#x20;connection&#x20;to&#x20;an&#x20;Apple&#x20;software&#x20;repository.&#x20;Please&#x20;ensure&#x20;appropriate&#x20;access&#x20;for&#x20;this&#x20;control.&#x20;This&#x20;check&#x20;is&#x20;only&#x20;for&#x20;what&#x20;Apple&#x20;provides&#x20;through&#x20;software&#x20;update.&#x20;Software&#x20;updates&#x20;should&#x20;be&#x20;run&#x20;at&#x20;minimum&#x20;every&#x20;30&#x20;days.&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;when&#x20;software&#x20;update&#x20;was&#x20;previously&#x20;run:&#x20;$&#x20;/usr/bin/sudo&#x20;defaults&#x20;read&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;|&#x20;grep&#x20;-e&#x20;LastFullSuccessfulDate.&#x20;The&#x20;response&#x20;should&#x20;be&#x20;in&#x20;the&#x20;last&#x20;30&#x20;days&#x20;&#40;Example&#41;:&#x20;LastFullSuccessfulDate&#x20;=&#x20;&quot;2020-07-30&#x20;12:45:25&#x20;+0000&quot;;.','It&#x20;is&#x20;important&#x20;that&#x20;these&#x20;updates&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;the&#x20;identified&#x20;vulnerabilities.','Missing&#x20;patches&#x20;can&#x20;lead&#x20;to&#x20;more&#x20;exploit&#x20;opportunities.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;install&#x20;all&#x20;available&#x20;software&#x20;updates:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Software&#x20;Update&#x20;4.&#x20;Select&#x20;Update&#x20;All&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;verify&#x20;what&#x20;packages&#x20;need&#x20;to&#x20;be&#x20;installed:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/softwareupdate&#x20;-l&#x20;The&#x20;output&#x20;will&#x20;include&#x20;the&#x20;following:&#x20;Software&#x20;Update&#x20;found&#x20;the&#x20;following&#x20;new&#x20;or&#x20;updated&#x20;software:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;all&#x20;the&#x20;packages&#x20;that&#x20;need&#x20;to&#x20;be&#x20;updated:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/softwareupdate&#x20;-i&#x20;-a&#x20;-R&#x20;Or&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;install&#x20;individual&#x20;packages:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/softwareupdate&#x20;-i&#x20;&#039;&lt;package&#x20;name&gt;&#039;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/softwareupdate&#x20;-l&#x20;Software&#x20;Update&#x20;Tool&#x20;Finding&#x20;available&#x20;software&#x20;Software&#x20;Update&#x20;found&#x20;the&#x20;following&#x20;new&#x20;or&#x20;updated&#x20;software:&#x20;*&#x20;iTunesX-12.8.2&#x20;iTunes&#x20;&#40;12.8.2&#41;,&#x20;273614K&#x20;[recommended]&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/softwareupdate&#x20;-i&#x20;&#039;iTunesX-12.8.2&#039;&#x20;Software&#x20;Update&#x20;Tool&#x20;Downloaded&#x20;iTunes&#x20;Installing&#x20;iTunes&#x20;Done&#x20;with&#x20;iTunes&#x20;Done.','[{\"cis\": [\"1.1\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"mitre_techniques\": [\"T1017\", \"T1019\", \"T1031\", \"T1034\", \"T1038\", \"T1044\", \"T1053\", \"T1068\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1078\", \"T1081\", \"T1088\", \"T1100\", \"T1103\", \"T1114\", \"T1137\", \"T1138\", \"T1145\", \"T1161\", \"T1176\", \"T1189\", \"T1190\", \"T1195\", \"T1210\", \"T1211\", \"T1212\", \"T1213\", \"T1214\", \"T1482\", \"T1484\", \"T1495\", \"T1505\", \"T1525\", \"T1527\", \"T1528\", \"T1530\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}]'),(31001,'Ensure&#x20;Auto&#x20;Update&#x20;Is&#x20;Enabled.','Auto&#x20;Update&#x20;verifies&#x20;that&#x20;your&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;security&#x20;patches&#x20;and&#x20;software&#x20;updates.&#x20;If&#x20;&quot;Automatically&#x20;check&#x20;for&#x20;updates&quot;&#x20;is&#x20;not&#x20;selected,&#x20;background&#x20;updates&#x20;for&#x20;new&#x20;malware&#x20;definition&#x20;files&#x20;from&#x20;Apple&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper&#x20;will&#x20;not&#x20;occur.&#x20;http://macops.ca/os-x-admins-your-clients-are-not-getting-background-security-updates/&#x20;https://derflounder.wordpress.com/2014/12/17/forcing-xprotect-blacklist-updates-on-mavericks-and-yosemite/.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;applied&#x20;so&#x20;as&#x20;to&#x20;prevent&#x20;unauthorized&#x20;persons&#x20;from&#x20;exploiting&#x20;identified&#x20;vulnerabilities.','Without&#x20;automatic&#x20;update,&#x20;updates&#x20;may&#x20;not&#x20;be&#x20;made&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;and&#x20;the&#x20;system&#x20;will&#x20;be&#x20;exposed&#x20;to&#x20;additional&#x20;risk.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;steps&#x20;following&#x20;to&#x20;enable&#x20;the&#x20;system&#x20;to&#x20;automatically&#x20;check&#x20;for&#x20;updates:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Software&#x20;Update&#x20;4.&#x20;Select&#x20;the&#x20;i&#x20;5.&#x20;Set&#x20;Check&#x20;for&#x20;updates&#x20;to&#x20;enabled&#x20;6.&#x20;Select&#x20;Done&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auto&#x20;update:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticCheckEnabled&#x20;-bool&#x20;true&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.SoftwareUpdate&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;AutomaticCheckEnabled&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"1.2\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31002,'Ensure&#x20;Download&#x20;New&#x20;Updates&#x20;When&#x20;Available&#x20;Is&#x20;Enabled.','In&#x20;the&#x20;GUI,&#x20;both&#x20;&quot;Install&#x20;macOS&#x20;updates&quot;&#x20;and&#x20;&quot;Install&#x20;app&#x20;updates&#x20;from&#x20;the&#x20;App&#x20;Store&quot;&#x20;are&#x20;dependent&#x20;on&#x20;whether&#x20;&quot;Download&#x20;new&#x20;updates&#x20;when&#x20;available&quot;&#x20;is&#x20;selected.','It&#x20;is&#x20;important&#x20;that&#x20;a&#x20;system&#x20;has&#x20;the&#x20;newest&#x20;updates&#x20;downloaded&#x20;so&#x20;that&#x20;they&#x20;can&#x20;be&#x20;applied.','If&#x20;&quot;Download&#x20;new&#x20;updates&#x20;when&#x20;available&quot;&#x20;is&#x20;not&#x20;selected,&#x20;updates&#x20;may&#x20;not&#x20;be&#x20;made&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;and&#x20;the&#x20;system&#x20;will&#x20;be&#x20;exposed&#x20;to&#x20;additional&#x20;risk.','Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;the&#x20;system&#x20;to&#x20;automatically&#x20;check&#x20;for&#x20;updates:&#x20;Graphical&#x20;Method:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Software&#x20;Update&#x20;4.&#x20;Select&#x20;the&#x20;i&#x20;5.&#x20;Set&#x20;Download&#x20;new&#x20;updates&#x20;when&#x20;available&#x20;to&#x20;enabled&#x20;6.&#x20;Select&#x20;Done&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;auto&#x20;update:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticDownload&#x20;-bool&#x20;true&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.SoftwareUpdate&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;AutomaticDownload&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"1.3\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31003,'Ensure&#x20;Install&#x20;of&#x20;macOS&#x20;Updates&#x20;Is&#x20;Enabled.','Ensure&#x20;that&#x20;macOS&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;macOS&#x20;updates&#x20;to&#x20;be&#x20;automatically&#x20;installed.&#x20;Some&#x20;environments&#x20;will&#x20;want&#x20;to&#x20;approve&#x20;and&#x20;test&#x20;updates&#x20;before&#x20;they&#x20;are&#x20;delivered.&#x20;It&#x20;is&#x20;best&#x20;practice&#x20;to&#x20;test&#x20;first&#x20;where&#x20;updates&#x20;can&#x20;and&#x20;have&#x20;caused&#x20;disruptions&#x20;to&#x20;operations.&#x20;Automatic&#x20;updates&#x20;should&#x20;be&#x20;turned&#x20;off&#x20;where&#x20;changes&#x20;are&#x20;tightly&#x20;controlled&#x20;and&#x20;there&#x20;are&#x20;mature&#x20;testing&#x20;and&#x20;approval&#x20;processes.&#x20;Automatic&#x20;updates&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off&#x20;simply&#x20;to&#x20;allow&#x20;the&#x20;administrator&#x20;to&#x20;contact&#x20;users&#x20;in&#x20;order&#x20;to&#x20;verify&#x20;installation.&#x20;A&#x20;dependable,&#x20;repeatable&#x20;process&#x20;involving&#x20;a&#x20;patch&#x20;agent&#x20;or&#x20;remote&#x20;management&#x20;tool&#x20;should&#x20;be&#x20;in&#x20;place&#x20;before&#x20;auto-updates&#x20;are&#x20;turned&#x20;off.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','Unpatched&#x20;software&#x20;may&#x20;be&#x20;exploited.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;macOS&#x20;updates&#x20;to&#x20;run&#x20;automatically:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Software&#x20;Update&#x20;4.&#x20;Select&#x20;the&#x20;i&#x20;5.&#x20;Set&#x20;Install&#x20;macOS&#x20;updates&#x20;to&#x20;enabled&#x20;6.&#x20;Select&#x20;Done&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;to&#x20;enable&#x20;automatic&#x20;checking&#x20;and&#x20;installing&#x20;of&#x20;macOS&#x20;updates:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;AutomaticallyInstallMacOSUpdates&#x20;-bool&#x20;TRUE&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.SoftwareUpdate&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;AutomaticallyInstallMacOSUpdates&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"1.4\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31004,'Ensure&#x20;Install&#x20;Application&#x20;Updates&#x20;from&#x20;the&#x20;App&#x20;Store&#x20;Is&#x20;Enabled.','Ensure&#x20;that&#x20;application&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;administrator&#x20;privileges&#x20;for&#x20;end&#x20;users.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','Unpatched&#x20;software&#x20;may&#x20;be&#x20;exploited.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;App&#x20;Store&#x20;updates&#x20;to&#x20;install&#x20;automatically:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Software&#x20;Update&#x20;4.&#x20;Select&#x20;the&#x20;i&#x20;5.&#x20;Set&#x20;Install&#x20;application&#x20;updates&#x20;from&#x20;the&#x20;App&#x20;Store&#x20;to&#x20;enabled&#x20;6.&#x20;Select&#x20;Done&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;on&#x20;App&#x20;Store&#x20;auto&#x20;updating:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.commerce&#x20;AutoUpdate&#x20;-bool&#x20;TRUE&#x20;Note:&#x20;This&#x20;remediation&#x20;requires&#x20;a&#x20;log&#x20;out&#x20;and&#x20;log&#x20;in&#x20;to&#x20;show&#x20;in&#x20;the&#x20;GUI.&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.SoftwareUpdate&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;AutomaticallyInstallAppUpdates&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"1.5\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31005,'Ensure&#x20;Install&#x20;Security&#x20;Responses&#x20;and&#x20;System&#x20;Files&#x20;Is&#x20;Enabled.','Ensure&#x20;that&#x20;system&#x20;and&#x20;security&#x20;updates&#x20;are&#x20;installed&#x20;after&#x20;they&#x20;are&#x20;available&#x20;from&#x20;Apple.&#x20;This&#x20;setting&#x20;enables&#x20;definition&#x20;updates&#x20;for&#x20;XProtect&#x20;and&#x20;Gatekeeper.&#x20;With&#x20;this&#x20;setting&#x20;in&#x20;place,&#x20;new&#x20;malware&#x20;and&#x20;adware&#x20;that&#x20;Apple&#x20;has&#x20;added&#x20;to&#x20;the&#x20;list&#x20;of&#x20;malware&#x20;or&#x20;untrusted&#x20;software&#x20;will&#x20;not&#x20;execute.&#x20;These&#x20;updates&#x20;do&#x20;not&#x20;require&#x20;reboots&#x20;or&#x20;end&#x20;user&#x20;admin&#x20;rights.','Patches&#x20;need&#x20;to&#x20;be&#x20;applied&#x20;in&#x20;a&#x20;timely&#x20;manner&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;vulnerabilities&#x20;being&#x20;exploited.','Unpatched&#x20;software&#x20;may&#x20;be&#x20;exploited.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates&#x20;to&#x20;install&#x20;automatically:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Software&#x20;Update&#x20;4.&#x20;Select&#x20;the&#x20;i&#x20;5.&#x20;Set&#x20;Install&#x20;Security&#x20;Responses&#x20;and&#x20;System&#x20;files&#x20;to&#x20;enabled&#x20;6.&#x20;Select&#x20;Done&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;automatic&#x20;checking&#x20;of&#x20;system&#x20;data&#x20;files&#x20;and&#x20;security&#x20;updates:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;ConfigDataInstall&#x20;-bool&#x20;true&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.SoftwareUpdate&#x20;CriticalUpdateInstall&#x20;-bool&#x20;true&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.SoftwareUpdate&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;ConfigDataInstall&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;4.&#x20;The&#x20;key&#x20;to&#x20;also&#x20;include&#x20;is&#x20;CriticalUpdateInstall&#x20;5.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"1.6\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\", \"7.7\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"CA.L2-3.12.2\", \"RA.L2-3.11.3\", \"SI.L1-3.14.1\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"pci_dss_v4.0\": [\"11.3.1\", \"11.3.2\", \"11.3.2.1\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31006,'Ensure&#x20;Software&#x20;Update&#x20;Deferment&#x20;Is&#x20;Less&#x20;Than&#x20;or&#x20;Equal&#x20;to&#x20;30&#x20;Days.','Apple&#x20;provides&#x20;the&#x20;capability&#x20;to&#x20;manage&#x20;software&#x20;updates&#x20;on&#x20;Apple&#x20;devices&#x20;through&#x20;mobile&#x20;device&#x20;management.&#x20;Part&#x20;of&#x20;those&#x20;capabilities&#x20;permit&#x20;organizations&#x20;to&#x20;defer&#x20;software&#x20;updates&#x20;and&#x20;allow&#x20;for&#x20;testing.&#x20;Many&#x20;organizations&#x20;have&#x20;specialized&#x20;software&#x20;and&#x20;configurations&#x20;that&#x20;may&#x20;be&#x20;negatively&#x20;impacted&#x20;by&#x20;Apple&#x20;updates.&#x20;If&#x20;software&#x20;updates&#x20;are&#x20;deferred,&#x20;they&#x20;should&#x20;not&#x20;be&#x20;deferred&#x20;for&#x20;more&#x20;than&#x20;30&#x20;days.&#x20;This&#x20;control&#x20;only&#x20;verifies&#x20;that&#x20;deferred&#x20;software&#x20;updates&#x20;are&#x20;not&#x20;deferred&#x20;for&#x20;more&#x20;than&#x20;30&#x20;days.','Apple&#x20;software&#x20;updates&#x20;almost&#x20;always&#x20;include&#x20;security&#x20;updates.&#x20;Attackers&#x20;evaluate&#x20;updates&#x20;to&#x20;create&#x20;exploit&#x20;code&#x20;in&#x20;order&#x20;to&#x20;attack&#x20;unpatched&#x20;systems.&#x20;The&#x20;longer&#x20;a&#x20;system&#x20;remains&#x20;unpatched,&#x20;the&#x20;greater&#x20;an&#x20;exploit&#x20;possibility&#x20;exists&#x20;in&#x20;which&#x20;there&#x20;are&#x20;publicly&#x20;reported&#x20;vulnerabilities.','Some&#x20;organizations&#x20;may&#x20;need&#x20;more&#x20;than&#x20;30&#x20;days&#x20;to&#x20;evaluate&#x20;the&#x20;impact&#x20;of&#x20;software&#x20;updates.','Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.applicationaccess&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;enforcedSoftwareUpdateDelay&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;&lt;1-30&gt;&lt;/integer&gt;.','[{\"cis\": [\"1.7\"]}, {\"cis_csc_v8\": [\"7.3\", \"7.4\"]}, {\"cis_csc_v7\": [\"3.4\", \"3.5\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.1\"]}, {\"nist_sp_800-53\": [\"SI-2(2)\"]}, {\"pci_dss_v3.2.1\": [\"6.2\"]}, {\"soc_2\": [\"CC7.1\"]}, {\"mitre_techniques\": [\"T1103\", \"T1017\", \"T1138\", \"T1189\", \"T1190\", \"T1212\", \"T1211\", \"T1068\", \"T1210\", \"T1495\", \"T1137\", \"T1075\", \"T1195\", \"T1019\", \"T1072\", \"T1100\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31007,'Ensure&#x20;Firewall&#x20;Is&#x20;Enabled.','A&#x20;firewall&#x20;is&#x20;a&#x20;piece&#x20;of&#x20;software&#x20;that&#x20;blocks&#x20;unwanted&#x20;incoming&#x20;connections&#x20;to&#x20;a&#x20;system.&#x20;Apple&#x20;has&#x20;posted&#x20;general&#x20;documentation&#x20;about&#x20;the&#x20;application&#x20;firewall:.','A&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;your&#x20;system&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','The&#x20;firewall&#x20;may&#x20;block&#x20;legitimate&#x20;traffic.&#x20;Applications&#x20;that&#x20;are&#x20;unsigned&#x20;will&#x20;require&#x20;special&#x20;handling.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;turn&#x20;the&#x20;firewall&#x20;on:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Network&#x20;3.&#x20;Select&#x20;Firewall&#x20;4.&#x20;Set&#x20;Firewall&#x20;to&#x20;enabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;firewall:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.alf&#x20;globalstate&#x20;-int&#x20;&lt;value&gt;&#x20;For&#x20;the&#x20;&lt;value&gt;,&#x20;use&#x20;either&#x20;1,&#x20;specific&#x20;services,&#x20;or&#x20;2,&#x20;essential&#x20;services&#x20;only.&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.security.firewall&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;EnableFirewall&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"2.2.1\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.5\", \"13.1\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.4\", \"9.5\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L1-3.1.20\", \"AU.L2-3.3.5\", \"AU.L2-3.3.6\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\", \"SI.L2-3.14.3\", \"SI.L2-3.14.7\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"AU-6(1)\", \"AU-7\", \"CM-7(1)\", \"CM-9\", \"IR-4(1)\", \"SA-10\", \"SC-7(5)\", \"SI-4(2)\", \"SI-4(5)\"]}, {\"pci_dss_v3.2.1\": [\"1.1.4\", \"1.4\", \"10.5.3\", \"10.6.1\", \"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"10.7\", \"10.7.1\", \"10.7.2\", \"10.7.3\", \"11.5\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC6.6\", \"CC7.1\", \"CC7.2\", \"CC8.1\"]}]'),(31008,'Ensure&#x20;Firewall&#x20;Stealth&#x20;Mode&#x20;Is&#x20;Enabled.','While&#x20;in&#x20;Stealth&#x20;mode,&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;respond&#x20;to&#x20;unsolicited&#x20;probes,&#x20;dropping&#x20;that&#x20;traffic.','Stealth&#x20;mode&#x20;on&#x20;the&#x20;firewall&#x20;minimizes&#x20;the&#x20;threat&#x20;of&#x20;system&#x20;discovery&#x20;tools&#x20;while&#x20;connected&#x20;to&#x20;a&#x20;network&#x20;or&#x20;the&#x20;Internet.','Traditional&#x20;network&#x20;discovery&#x20;tools&#x20;like&#x20;ping&#x20;will&#x20;not&#x20;succeed.&#x20;Other&#x20;network&#x20;tools&#x20;that&#x20;measure&#x20;activity&#x20;and&#x20;approved&#x20;applications&#x20;will&#x20;work&#x20;as&#x20;expected.&#x20;This&#x20;control&#x20;aligns&#x20;with&#x20;the&#x20;primary&#x20;macOS&#x20;use&#x20;case&#x20;of&#x20;a&#x20;laptop&#x20;that&#x20;is&#x20;often&#x20;connected&#x20;to&#x20;untrusted&#x20;networks&#x20;where&#x20;host&#x20;segregation&#x20;may&#x20;be&#x20;non-existent.&#x20;In&#x20;that&#x20;use&#x20;case,&#x20;hiding&#x20;from&#x20;the&#x20;other&#x20;inmates&#x20;is&#x20;likely&#x20;more&#x20;than&#x20;desirable.&#x20;In&#x20;use&#x20;cases&#x20;where&#x20;use&#x20;is&#x20;only&#x20;on&#x20;trusted&#x20;LANs&#x20;with&#x20;static&#x20;IP&#x20;addresses,&#x20;stealth&#x20;mode&#x20;may&#x20;not&#x20;be&#x20;desirable.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;firewall&#x20;stealth&#x20;mode:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Network&#x20;3.&#x20;Select&#x20;Firewall&#x20;4.&#x20;Select&#x20;Options...&#x20;5.&#x20;Set&#x20;Enabled&#x20;stealth&#x20;mode&#x20;to&#x20;enabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;stealth&#x20;mode:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/libexec/ApplicationFirewall/socketfilterfw&#x20;--setstealthmode&#x20;on&#x20;Stealth&#x20;mode&#x20;enabled&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.security.firewall&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;EnableStealthMode&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;Note:&#x20;This&#x20;key&#x20;must&#x20;be&#x20;set&#x20;in&#x20;the&#x20;same&#x20;configuration&#x20;profile&#x20;with&#x20;EnableFirewall&#x20;set&#x20;to&#x20;&lt;true/&gt;.&#x20;If&#x20;it&#x20;is&#x20;set&#x20;in&#x20;its&#x20;own&#x20;configuration&#x20;profile,&#x20;it&#x20;will&#x20;fail.','[{\"cis\": [\"2.2.2\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.5\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L1-3.1.20\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L1-3.13.1\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\", \"SC-7(5)\"]}, {\"pci_dss_v3.2.1\": [\"1.1.4\", \"1.1.6\", \"1.2.1\", \"1.4\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31009,'Ensure&#x20;Set&#x20;Time&#x20;and&#x20;Date&#x20;Automatically&#x20;Is&#x20;Enabled.','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates,&#x20;and&#x20;log&#x20;entries.&#x20;Note:&#x20;If&#x20;your&#x20;organization&#x20;has&#x20;internal&#x20;time&#x20;servers,&#x20;enter&#x20;them&#x20;here.&#x20;Enterprise&#x20;mobile&#x20;devices&#x20;may&#x20;need&#x20;to&#x20;use&#x20;a&#x20;mix&#x20;of&#x20;internal&#x20;and&#x20;external&#x20;time&#x20;servers.&#x20;If&#x20;multiple&#x20;servers&#x20;are&#x20;required,&#x20;use&#x20;the&#x20;Date&#x20;&amp;&#x20;Time&#x20;System&#x20;Preference&#x20;with&#x20;each&#x20;server&#x20;separated&#x20;by&#x20;a&#x20;space.&#x20;Additional&#x20;Note:&#x20;The&#x20;default&#x20;Apple&#x20;time&#x20;server&#x20;is&#x20;time.apple.com.&#x20;Variations&#x20;include&#x20;time.euro.apple.com.&#x20;While&#x20;it&#x20;is&#x20;certainly&#x20;more&#x20;efficient&#x20;to&#x20;use&#x20;internal&#x20;time&#x20;servers,&#x20;there&#x20;is&#x20;no&#x20;reason&#x20;to&#x20;block&#x20;access&#x20;to&#x20;global&#x20;Apple&#x20;time&#x20;servers&#x20;or&#x20;to&#x20;add&#x20;a&#x20;time.apple.com&#x20;alias&#x20;to&#x20;internal&#x20;DNS&#x20;records.&#x20;There&#x20;are&#x20;no&#x20;reports&#x20;that&#x20;Apple&#x20;gathers&#x20;any&#x20;information&#x20;from&#x20;NTP&#x20;synchronization,&#x20;as&#x20;the&#x20;computers&#x20;already&#x20;phone&#x20;home&#x20;to&#x20;Apple&#x20;for&#x20;Apple&#x20;services&#x20;including&#x20;iCloud&#x20;use&#x20;and&#x20;software&#x20;updates.&#x20;Best&#x20;practice&#x20;is&#x20;to&#x20;allow&#x20;DNS&#x20;resolution&#x20;to&#x20;an&#x20;authoritative&#x20;time&#x20;service&#x20;for&#x20;time.apple.com,&#x20;preferably&#x20;to&#x20;connect&#x20;to&#x20;Apple&#x20;servers,&#x20;but&#x20;local&#x20;servers&#x20;are&#x20;acceptable&#x20;as&#x20;well.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.','The&#x20;timed&#x20;service&#x20;will&#x20;periodically&#x20;synchronize&#x20;with&#x20;named&#x20;time&#x20;servers&#x20;and&#x20;will&#x20;make&#x20;the&#x20;computer&#x20;time&#x20;more&#x20;accurate.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;the&#x20;date&#x20;and&#x20;time&#x20;to&#x20;be&#x20;set&#x20;automatically:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Date&#x20;&amp;&#x20;Time&#x20;4.&#x20;Set&#x20;Set&#x20;time&#x20;and&#x20;date&#x20;automatically&#x20;to&#x20;enabled&#x20;Note:&#x20;By&#x20;default,&#x20;the&#x20;operating&#x20;system&#x20;will&#x20;use&#x20;time.apple.com&#x20;as&#x20;the&#x20;time&#x20;server.&#x20;You&#x20;can&#x20;change&#x20;to&#x20;any&#x20;time&#x20;server&#x20;that&#x20;meets&#x20;your&#x20;organization&#039;s&#x20;requirements.&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;the&#x20;date&#x20;and&#x20;time&#x20;setting&#x20;automatically:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-setnetworktimeserver&#x20;&lt;your.time.server&gt;&#x20;setNetworkTimeServer:&#x20;&lt;your.time.server&gt;&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-setusingnetworktime&#x20;on&#x20;setUsingNetworkTime:&#x20;On&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-setnetworktimeserver&#x20;time.apple.com&#x20;setNetworkTimeServer:&#x20;time.apple.com&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-setusingnetworktime&#x20;on&#x20;setUsingNetworkTime:&#x20;On&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;if&#x20;you&#x20;have&#x20;not&#x20;set,&#x20;or&#x20;need&#x20;to&#x20;set,&#x20;a&#x20;new&#x20;time&#x20;zone:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-listtimezones&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-settimezone&#x20;&lt;selected&#x20;time&#x20;zone&gt;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-listtimezones&#x20;Time&#x20;Zones:&#x20;Africa/Abidjan&#x20;Africa/Accra&#x20;Africa/Addis_Ababa&#x20;...&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-settimezone&#x20;America/New_York&#x20;Set&#x20;TimeZone:&#x20;America/New_York.','[{\"cis\": [\"2.3.2.1\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(31010,'Ensure&#x20;Time&#x20;Is&#x20;Set&#x20;Within&#x20;Appropriate&#x20;Limits.','Correct&#x20;date&#x20;and&#x20;time&#x20;settings&#x20;are&#x20;required&#x20;for&#x20;authentication&#x20;protocols,&#x20;file&#x20;creation,&#x20;modification&#x20;dates&#x20;and&#x20;log&#x20;entries.&#x20;Ensure&#x20;that&#x20;time&#x20;on&#x20;the&#x20;computer&#x20;is&#x20;within&#x20;acceptable&#x20;limits.&#x20;Truly&#x20;accurate&#x20;time&#x20;is&#x20;measured&#x20;within&#x20;milliseconds.&#x20;For&#x20;this&#x20;audit,&#x20;a&#x20;drift&#x20;under&#x20;four&#x20;and&#x20;a&#x20;half&#x20;minutes&#x20;passes&#x20;the&#x20;control&#x20;check.&#x20;Since&#x20;Kerberos&#x20;is&#x20;one&#x20;of&#x20;the&#x20;important&#x20;features&#x20;of&#x20;macOS&#x20;integration&#x20;into&#x20;Directory&#x20;systems,&#x20;the&#x20;guidance&#x20;here&#x20;is&#x20;to&#x20;warn&#x20;you&#x20;before&#x20;there&#x20;could&#x20;be&#x20;an&#x20;impact&#x20;to&#x20;operations.&#x20;From&#x20;the&#x20;perspective&#x20;of&#x20;accurate&#x20;time,&#x20;this&#x20;check&#x20;is&#x20;not&#x20;strict,&#x20;so&#x20;it&#x20;may&#x20;be&#x20;too&#x20;great&#x20;for&#x20;your&#x20;organization.&#x20;Your&#x20;organization&#x20;can&#x20;adjust&#x20;to&#x20;a&#x20;smaller&#x20;offset&#x20;value&#x20;as&#x20;needed.&#x20;If&#x20;there&#x20;are&#x20;consistent&#x20;drift&#x20;issues&#x20;on&#x20;the&#x20;OS,&#x20;some&#x20;of&#x20;the&#x20;most&#x20;common&#x20;drift&#x20;issues&#x20;should&#x20;be&#x20;investigated:&#x20;-&#x20;The&#x20;chosen&#x20;time&#x20;server&#x20;is&#x20;not&#x20;reachable&#x20;based&#x20;on&#x20;network&#x20;firewall&#x20;rules&#x20;on&#x20;the&#x20;current&#x20;network&#x20;-&#x20;The&#x20;computer&#x20;is&#x20;offline&#x20;often&#x20;and&#x20;the&#x20;battery&#x20;drains,&#x20;and&#x20;the&#x20;network&#x20;is&#x20;not&#x20;immediately&#x20;available&#x20;-&#x20;The&#x20;chosen&#x20;time&#x20;server&#x20;is&#x20;a&#x20;special&#x20;internal&#x20;or&#x20;non-public&#x20;time&#x20;server&#x20;that&#x20;does&#x20;not&#x20;provide&#x20;a&#x20;reliable&#x20;time&#x20;source&#x20;Note:&#x20;ntpdate&#x20;has&#x20;been&#x20;deprecated&#x20;with&#x20;10.14.&#x20;sntp&#x20;replaces&#x20;that&#x20;command.','Kerberos&#x20;may&#x20;not&#x20;operate&#x20;correctly&#x20;if&#x20;the&#x20;time&#x20;on&#x20;the&#x20;Mac&#x20;is&#x20;off&#x20;by&#x20;more&#x20;than&#x20;5&#x20;minutes.&#x20;This&#x20;in&#x20;turn&#x20;can&#x20;affect&#x20;Apple&#039;s&#x20;single&#x20;sign-on&#x20;feature,&#x20;Active&#x20;Directory&#x20;logons,&#x20;and&#x20;other&#x20;features.&#x20;Audit&#x20;check&#x20;is&#x20;for&#x20;more&#x20;than&#x20;4&#x20;minutes&#x20;and&#x20;30&#x20;seconds&#x20;ahead&#x20;or&#x20;behind.','Accurate&#x20;time&#x20;is&#x20;required&#x20;for&#x20;many&#x20;computer&#x20;functions.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;ensure&#x20;your&#x20;time&#x20;is&#x20;set&#x20;within&#x20;an&#x20;appropriate&#x20;limit:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-getnetworktimeserver&#x20;The&#x20;output&#x20;will&#x20;include&#x20;Network&#x20;Time&#x20;Server:&#x20;and&#x20;the&#x20;name&#x20;of&#x20;your&#x20;time&#x20;server&#x20;example:&#x20;Network&#x20;Time&#x20;Server:&#x20;time.apple.com.&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/sntp&#x20;-sS&#x20;&lt;your.time.server&gt;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-getnetworktimeserver&#x20;Network&#x20;Time&#x20;Server:&#x20;time.apple.com&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/sntp&#x20;-sS&#x20;time.apple.com.','[{\"cis\": [\"2.3.2.2\"]}, {\"cis_csc_v8\": [\"8.4\"]}, {\"cis_csc_v7\": [\"6.1\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.7\"]}, {\"iso_27001-2013\": [\"A.12.4.4\"]}, {\"nist_sp_800-53\": [\"AU-7\"]}, {\"pci_dss_v3.2.1\": [\"10.4\"]}, {\"pci_dss_v4.0\": [\"10.6\", \"10.6.1\", \"10.6.2\", \"10.6.3\"]}, {\"soc_2\": [\"CC4.1\", \"CC5.2\"]}]'),(31011,'Ensure&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;Is&#x20;Disabled.','DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;allows&#x20;users&#x20;to&#x20;remotely&#x20;access&#x20;the&#x20;system&#039;s&#x20;optical&#x20;drive.&#x20;While&#x20;Apple&#x20;does&#x20;not&#x20;ship&#x20;Macs&#x20;with&#x20;built-in&#x20;optical&#x20;drives&#x20;any&#x20;longer,&#x20;external&#x20;optical&#x20;drives&#x20;are&#x20;still&#x20;recognized&#x20;when&#x20;they&#x20;are&#x20;connected.&#x20;In&#x20;testing,&#x20;the&#x20;sharing&#x20;of&#x20;an&#x20;external&#x20;optical&#x20;drive&#x20;persists&#x20;when&#x20;a&#x20;drive&#x20;is&#x20;reconnected.','Disabling&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing&#x20;minimizes&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;using&#x20;the&#x20;optical&#x20;drive&#x20;as&#x20;a&#x20;vector&#x20;for&#x20;attack&#x20;and&#x20;exposure&#x20;of&#x20;sensitive&#x20;data.','Many&#x20;Apple&#x20;devices&#x20;are&#x20;now&#x20;sold&#x20;without&#x20;optical&#x20;drives,&#x20;however&#x20;drive&#x20;sharing&#x20;may&#x20;be&#x20;needed&#x20;for&#x20;legacy&#x20;optical&#x20;media.&#x20;The&#x20;media&#x20;should&#x20;be&#x20;explicitly&#x20;re-shared&#x20;as&#x20;needed&#x20;rather&#x20;than&#x20;using&#x20;a&#x20;persistent&#x20;share.&#x20;Optical&#x20;drives&#x20;should&#x20;not&#x20;be&#x20;used&#x20;for&#x20;long-term&#x20;storage.&#x20;To&#x20;store&#x20;necessary&#x20;data&#x20;from&#x20;an&#x20;optical&#x20;drive&#x20;it&#x20;should&#x20;be&#x20;copied&#x20;to&#x20;another&#x20;form&#x20;of&#x20;external&#x20;storage.&#x20;Optionally,&#x20;an&#x20;image&#x20;can&#x20;be&#x20;made&#x20;of&#x20;the&#x20;optical&#x20;drive&#x20;so&#x20;that&#x20;it&#x20;is&#x20;stored&#x20;in&#x20;its&#x20;original&#x20;form&#x20;on&#x20;another&#x20;form&#x20;of&#x20;external&#x20;storage.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;DVD&#x20;or&#x20;CD&#x20;sharing&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;DVD&#x20;or&#x20;CD&#x20;Sharing:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;disable&#x20;system/com.apple.ODSAgent&#x20;Note:&#x20;If&#x20;using&#x20;the&#x20;Terminal&#x20;method,&#x20;the&#x20;GUI&#x20;will&#x20;still&#x20;show&#x20;the&#x20;service&#x20;checked&#x20;until&#x20;after&#x20;a&#x20;reboot.','[{\"cis\": [\"2.3.3.1\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31012,'Ensure&#x20;Screen&#x20;Sharing&#x20;Is&#x20;Disabled.','Screen&#x20;Sharing&#x20;allows&#x20;a&#x20;computer&#x20;to&#x20;connect&#x20;to&#x20;another&#x20;computer&#x20;on&#x20;a&#x20;network&#x20;and&#x20;display&#x20;the&#x20;computer&#039;s&#x20;screen.&#x20;While&#x20;sharing&#x20;the&#x20;computer&#039;s&#x20;screen,&#x20;the&#x20;user&#x20;can&#x20;control&#x20;what&#x20;happens&#x20;on&#x20;that&#x20;computer,&#x20;such&#x20;as&#x20;opening&#x20;documents&#x20;or&#x20;applications,&#x20;opening,&#x20;moving,&#x20;or&#x20;closing&#x20;windows,&#x20;and&#x20;even&#x20;shutting&#x20;down&#x20;the&#x20;computer.&#x20;While&#x20;mature&#x20;administration&#x20;and&#x20;management&#x20;does&#x20;not&#x20;use&#x20;graphical&#x20;connections&#x20;for&#x20;standard&#x20;maintenance,&#x20;most&#x20;help&#x20;desks&#x20;have&#x20;capabilities&#x20;to&#x20;assist&#x20;users&#x20;in&#x20;performing&#x20;their&#x20;work&#x20;when&#x20;they&#x20;have&#x20;technical&#x20;issues&#x20;and&#x20;need&#x20;support.&#x20;Help&#x20;desks&#x20;use&#x20;graphical&#x20;remote&#x20;tools&#x20;to&#x20;understand&#x20;what&#x20;the&#x20;user&#x20;sees&#x20;and&#x20;assist&#x20;them&#x20;so&#x20;they&#x20;can&#x20;get&#x20;back&#x20;to&#x20;work.&#x20;For&#x20;MacOS,&#x20;some&#x20;of&#x20;these&#x20;remote&#x20;capabilities&#x20;can&#x20;use&#x20;Apple&#039;s&#x20;OS&#x20;tools.&#x20;Control&#x20;is&#x20;therefore&#x20;not&#x20;meant&#x20;to&#x20;prohibit&#x20;the&#x20;use&#x20;of&#x20;a&#x20;just-in-time&#x20;graphical&#x20;view&#x20;from&#x20;authorized&#x20;personnel&#x20;with&#x20;authentication&#x20;controls.&#x20;Sharing&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;except&#x20;in&#x20;narrow&#x20;windows&#x20;when&#x20;help&#x20;desk&#x20;support&#x20;is&#x20;required.','Disabling&#x20;Screen&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;remote&#x20;connections&#x20;being&#x20;made&#x20;without&#x20;the&#x20;user&#x20;of&#x20;the&#x20;console&#x20;knowing&#x20;that&#x20;they&#x20;are&#x20;sharing&#x20;the&#x20;computer.','Help&#x20;desks&#x20;may&#x20;require&#x20;the&#x20;periodic&#x20;use&#x20;of&#x20;a&#x20;graphical&#x20;connection&#x20;mechanism&#x20;to&#x20;assist&#x20;users.&#x20;Any&#x20;support&#x20;that&#x20;relies&#x20;on&#x20;native&#x20;MacOS&#x20;components&#x20;will&#x20;not&#x20;work&#x20;unless&#x20;a&#x20;scripted&#x20;solution&#x20;to&#x20;enable&#x20;and&#x20;disable&#x20;sharing&#x20;as&#x20;neccessary.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Screen&#x20;Sharing:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Screen&#x20;Sharing&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Screen&#x20;Sharing:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;disable&#x20;system/com.apple.screensharing.','[{\"cis\": [\"2.3.3.2\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31013,'Ensure&#x20;File&#x20;Sharing&#x20;Is&#x20;Disabled.','File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;workstation&#x20;creates&#x20;additional&#x20;risks,&#x20;such&#x20;as:&#x20;-&#x20;Open&#x20;ports&#x20;are&#x20;created&#x20;that&#x20;can&#x20;be&#x20;probed&#x20;and&#x20;attacked&#x20;-&#x20;Passwords&#x20;are&#x20;attached&#x20;to&#x20;user&#x20;accounts&#x20;for&#x20;access&#x20;that&#x20;may&#x20;be&#x20;exposed&#x20;and&#x20;endanger&#x20;other&#x20;parts&#x20;of&#x20;the&#x20;organizational&#x20;environment,&#x20;including&#x20;directory&#x20;accounts&#x20;Increased&#x20;complexity&#x20;makes&#x20;security&#x20;more&#x20;difficult&#x20;and&#x20;may&#x20;expose&#x20;additional&#x20;attack&#x20;vectors&#x20;-&#x20;Apple&#039;s&#x20;File&#x20;Sharing&#x20;uses&#x20;the&#x20;Server&#x20;Message&#x20;Block&#x20;&#40;SMB&#41;&#x20;protocol&#x20;to&#x20;share&#x20;to&#x20;other&#x20;computers&#x20;that&#x20;can&#x20;mount&#x20;SMB&#x20;shares.&#x20;This&#x20;includes&#x20;other&#x20;macOS&#x20;computers.&#x20;Apple&#x20;warns&#x20;that&#x20;SMB&#x20;sharing&#x20;stored&#x20;passwords&#x20;is&#x20;less&#x20;secure,&#x20;and&#x20;anyone&#x20;with&#x20;system&#x20;access&#x20;can&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;password&#x20;for&#x20;that&#x20;account.&#x20;When&#x20;sharing&#x20;with&#x20;SMB,&#x20;each&#x20;user&#x20;accessing&#x20;the&#x20;Mac&#x20;must&#x20;have&#x20;SMB&#x20;enabled.&#x20;Storing&#x20;passwords,&#x20;especially&#x20;copies&#x20;of&#x20;valid&#x20;directory&#x20;passwords,&#x20;decrease&#x20;security&#x20;for&#x20;the&#x20;directory&#x20;account&#x20;and&#x20;should&#x20;not&#x20;be&#x20;used.','By&#x20;disabling&#x20;File&#x20;Sharing,&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;and&#x20;risk&#x20;of&#x20;unauthorized&#x20;access&#x20;to&#x20;files&#x20;stored&#x20;on&#x20;the&#x20;system&#x20;is&#x20;reduced.','File&#x20;Sharing&#x20;can&#x20;be&#x20;used&#x20;to&#x20;share&#x20;documents&#x20;with&#x20;other&#x20;users,&#x20;but&#x20;hardened&#x20;servers&#x20;should&#x20;be&#x20;used&#x20;rather&#x20;than&#x20;user&#x20;endpoints.&#x20;Turning&#x20;on&#x20;File&#x20;Sharing&#x20;increases&#x20;the&#x20;visibility&#x20;and&#x20;attack&#x20;surface&#x20;of&#x20;a&#x20;system&#x20;unnecessarily.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;File&#x20;Sharing:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;File&#x20;Sharing&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;File&#x20;Sharing:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;disable&#x20;system/com.apple.smbd.','[{\"cis\": [\"2.3.3.3\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\", \"5.4\"]}, {\"cis_csc_v7\": [\"4.3\", \"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.3\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\", \"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\", \"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\", \"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31014,'Ensure&#x20;Printer&#x20;Sharing&#x20;Is&#x20;Disabled.','By&#x20;enabling&#x20;Printer&#x20;Sharing,&#x20;the&#x20;computer&#x20;is&#x20;set&#x20;up&#x20;as&#x20;a&#x20;print&#x20;server&#x20;to&#x20;accept&#x20;print&#x20;jobs&#x20;from&#x20;other&#x20;computers.&#x20;Dedicated&#x20;print&#x20;servers&#x20;or&#x20;direct&#x20;IP&#x20;printing&#x20;should&#x20;be&#x20;used&#x20;instead.','Disabling&#x20;Printer&#x20;Sharing&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;attackers&#x20;attempting&#x20;to&#x20;exploit&#x20;the&#x20;print&#x20;server&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Printer&#x20;Sharing:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Printer&#x20;Sharing&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Printer&#x20;Sharing:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/cupsctl&#x20;--no-share-printers.','[{\"cis\": [\"2.3.3.4\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31015,'Ensure&#x20;Remote&#x20;Login&#x20;Is&#x20;Disabled.','Remote&#x20;Login&#x20;allows&#x20;an&#x20;interactive&#x20;terminal&#x20;connection&#x20;to&#x20;a&#x20;computer.','Disabling&#x20;Remote&#x20;Login&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system&#x20;via&#x20;Secure&#x20;Shell&#x20;&#40;SSH&#41;.&#x20;While&#x20;SSH&#x20;is&#x20;an&#x20;industry&#x20;standard&#x20;to&#x20;connect&#x20;to&#x20;posix&#x20;servers,&#x20;the&#x20;scope&#x20;of&#x20;the&#x20;benchmark&#x20;is&#x20;for&#x20;Apple&#x20;macOS&#x20;clients,&#x20;not&#x20;servers.&#x20;macOS&#x20;does&#x20;have&#x20;an&#x20;IP-based&#x20;firewall&#x20;available&#x20;&#40;pf,&#x20;ipfw&#x20;has&#x20;been&#x20;deprecated&#41;&#x20;that&#x20;is&#x20;not&#x20;enabled&#x20;or&#x20;configured.&#x20;There&#x20;are&#x20;more&#x20;details&#x20;and&#x20;links&#x20;in&#x20;the&#x20;Network&#x20;sub-section.&#x20;macOS&#x20;no&#x20;longer&#x20;has&#x20;TCP&#x20;Wrappers&#x20;support&#x20;built&#x20;in&#x20;and&#x20;does&#x20;not&#x20;have&#x20;strong&#x20;Brute-Force&#x20;password&#x20;guessing&#x20;mitigations,&#x20;or&#x20;frequent&#x20;patching&#x20;of&#x20;openssh&#x20;by&#x20;Apple.&#x20;Since&#x20;most&#x20;macOS&#x20;computers&#x20;are&#x20;mobile&#x20;workstations,&#x20;managing&#x20;IP-based&#x20;firewall&#x20;rules&#x20;on&#x20;mobile&#x20;devices&#x20;can&#x20;be&#x20;very&#x20;resource&#x20;intensive.&#x20;All&#x20;of&#x20;these&#x20;factors&#x20;can&#x20;be&#x20;parts&#x20;of&#x20;running&#x20;a&#x20;hardened&#x20;SSH&#x20;server.','The&#x20;SSH&#x20;server&#x20;built&#x20;into&#x20;macOS&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;a&#x20;standard&#x20;user&#x20;computer,&#x20;particularly&#x20;one&#x20;that&#x20;changes&#x20;locations&#x20;and&#x20;IP&#x20;addresses.&#x20;A&#x20;standard&#x20;user&#x20;that&#x20;runs&#x20;local&#x20;applications,&#x20;including&#x20;email,&#x20;web&#x20;browser,&#x20;and&#x20;productivity&#x20;tools,&#x20;should&#x20;not&#x20;use&#x20;the&#x20;same&#x20;device&#x20;as&#x20;a&#x20;server.&#x20;There&#x20;are&#x20;Enterprise&#x20;management&#x20;toolsets&#x20;that&#x20;do&#x20;utilize&#x20;SSH.&#x20;If&#x20;they&#x20;are&#x20;in&#x20;use,&#x20;the&#x20;computer&#x20;should&#x20;be&#x20;locked&#x20;down&#x20;to&#x20;only&#x20;respond&#x20;to&#x20;known,&#x20;trusted&#x20;IP&#x20;addresses&#x20;and&#x20;appropriate&#x20;administrator&#x20;service&#x20;accounts.&#x20;For&#x20;macOS&#x20;computers&#x20;that&#x20;are&#x20;being&#x20;used&#x20;for&#x20;specialized&#x20;functions,&#x20;there&#x20;are&#x20;several&#x20;options&#x20;to&#x20;harden&#x20;the&#x20;SSH&#x20;server&#x20;to&#x20;protect&#x20;against&#x20;unauthorized&#x20;access&#x20;including&#x20;brute&#x20;force&#x20;attacks.&#x20;There&#x20;are&#x20;some&#x20;basic&#x20;criteria&#x20;that&#x20;need&#x20;to&#x20;be&#x20;considered:&#x20;-&#x20;Do&#x20;not&#x20;open&#x20;an&#x20;SSH&#x20;server&#x20;to&#x20;the&#x20;internet&#x20;without&#x20;controls&#x20;in&#x20;place&#x20;to&#x20;mitigate&#x20;SSH&#x20;brute&#x20;force&#x20;attacks.&#x20;This&#x20;is&#x20;particularly&#x20;important&#x20;for&#x20;systems&#x20;bound&#x20;to&#x20;Directory&#x20;environments.&#x20;It&#x20;is&#x20;great&#x20;to&#x20;have&#x20;controls&#x20;in&#x20;place&#x20;to&#x20;protect&#x20;the&#x20;system,&#x20;but&#x20;if&#x20;they&#x20;trigger&#x20;after&#x20;the&#x20;user&#x20;is&#x20;already&#x20;locked&#x20;out&#x20;of&#x20;their&#x20;account,&#x20;they&#x20;are&#x20;not&#x20;optimal.&#x20;If&#x20;authorization&#x20;happens&#x20;after&#x20;authentication,&#x20;directory&#x20;accounts&#x20;for&#x20;users&#x20;that&#x20;don&#039;t&#x20;even&#x20;use&#x20;the&#x20;system&#x20;can&#x20;be&#x20;locked&#x20;out.&#x20;-&#x20;Do&#x20;not&#x20;use&#x20;SSH&#x20;key&#x20;pairs&#x20;when&#x20;there&#x20;is&#x20;no&#x20;insight&#x20;to&#x20;the&#x20;security&#x20;on&#x20;the&#x20;client&#x20;system&#x20;that&#x20;will&#x20;authenticate&#x20;into&#x20;the&#x20;server&#x20;with&#x20;a&#x20;private&#x20;key.&#x20;If&#x20;an&#x20;attacker&#x20;gets&#x20;access&#x20;to&#x20;the&#x20;remote&#x20;system&#x20;and&#x20;can&#x20;find&#x20;the&#x20;key,&#x20;they&#x20;may&#x20;not&#x20;need&#x20;a&#x20;password&#x20;or&#x20;a&#x20;key&#x20;logger&#x20;to&#x20;access&#x20;the&#x20;SSH&#x20;server.&#x20;-&#x20;Detailed&#x20;instructions&#x20;on&#x20;hardening&#x20;an&#x20;SSH&#x20;server,&#x20;if&#x20;needed,&#x20;are&#x20;available&#x20;in&#x20;the&#x20;CIS&#x20;Linux&#x20;Benchmarks,&#x20;but&#x20;it&#x20;is&#x20;beyond&#x20;the&#x20;scope&#x20;of&#x20;this&#x20;benchmark.','Perform&#x20;the&#x20;following&#x20;to&#x20;disable&#x20;Remote&#x20;Login:&#x20;Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Remote&#x20;Login:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Remote&#x20;Login&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Remote&#x20;Login:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-setremotelogin&#x20;off&#x20;Do&#x20;you&#x20;really&#x20;want&#x20;to&#x20;turn&#x20;remote&#x20;login&#x20;off?&#x20;If&#x20;you&#x20;do,&#x20;you&#x20;will&#x20;lose&#x20;this&#x20;connection&#x20;and&#x20;can&#x20;only&#x20;turn&#x20;it&#x20;back&#x20;on&#x20;locally&#x20;at&#x20;the&#x20;server&#x20;&#40;yes/no&#41;?&#x20;Entering&#x20;yes&#x20;will&#x20;disable&#x20;remote&#x20;login.','[{\"cis\": [\"2.3.3.5\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31016,'Ensure&#x20;Remote&#x20;Management&#x20;Is&#x20;Disabled.','Remote&#x20;Management&#x20;is&#x20;the&#x20;client&#x20;portion&#x20;of&#x20;Apple&#x20;Remote&#x20;Desktop&#x20;&#40;ARD&#41;.&#x20;Remote&#x20;Management&#x20;can&#x20;be&#x20;used&#x20;by&#x20;remote&#x20;administrators&#x20;to&#x20;view&#x20;the&#x20;current&#x20;screen,&#x20;install&#x20;software,&#x20;report&#x20;on,&#x20;and&#x20;generally&#x20;manage&#x20;client&#x20;Macs.&#x20;The&#x20;screen&#x20;sharing&#x20;options&#x20;in&#x20;Remote&#x20;Management&#x20;are&#x20;identical&#x20;to&#x20;those&#x20;in&#x20;the&#x20;Screen&#x20;Sharing&#x20;section.&#x20;In&#x20;fact,&#x20;only&#x20;one&#x20;of&#x20;the&#x20;two&#x20;can&#x20;be&#x20;configured.&#x20;If&#x20;Remote&#x20;Management&#x20;is&#x20;used,&#x20;refer&#x20;to&#x20;the&#x20;Screen&#x20;Sharing&#x20;section&#x20;above&#x20;on&#x20;issues&#x20;regard&#x20;screen&#x20;sharing.&#x20;Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;when&#x20;a&#x20;Directory&#x20;is&#x20;in&#x20;place&#x20;to&#x20;manage&#x20;the&#x20;accounts&#x20;with&#x20;access.&#x20;Computers&#x20;will&#x20;be&#x20;available&#x20;on&#x20;port&#x20;5900&#x20;on&#x20;a&#x20;macOS&#x20;System&#x20;and&#x20;could&#x20;accept&#x20;connections&#x20;from&#x20;untrusted&#x20;hosts&#x20;depending&#x20;on&#x20;the&#x20;configuration,&#x20;which&#x20;is&#x20;a&#x20;major&#x20;concern&#x20;for&#x20;mobile&#x20;systems.&#x20;As&#x20;with&#x20;other&#x20;sharing&#x20;options,&#x20;an&#x20;open&#x20;port&#x20;even&#x20;for&#x20;authorized&#x20;management&#x20;functions&#x20;can&#x20;be&#x20;attacked,&#x20;and&#x20;both&#x20;unauthorized&#x20;access&#x20;and&#x20;Denial-of-Service&#x20;vulnerabilities&#x20;could&#x20;be&#x20;exploited.&#x20;If&#x20;remote&#x20;management&#x20;is&#x20;required,&#x20;the&#x20;pf&#x20;firewall&#x20;should&#x20;restrict&#x20;access&#x20;only&#x20;to&#x20;known,&#x20;trusted&#x20;management&#x20;consoles.&#x20;Remote&#x20;management&#x20;should&#x20;not&#x20;be&#x20;used&#x20;across&#x20;the&#x20;Internet&#x20;without&#x20;the&#x20;use&#x20;of&#x20;a&#x20;VPN&#x20;tunnel.','Remote&#x20;Management&#x20;should&#x20;only&#x20;be&#x20;enabled&#x20;on&#x20;trusted&#x20;networks&#x20;with&#x20;strong&#x20;user&#x20;controls&#x20;present&#x20;in&#x20;a&#x20;Directory&#x20;system.&#x20;Mobile&#x20;devices&#x20;without&#x20;strict&#x20;controls&#x20;are&#x20;vulnerable&#x20;to&#x20;exploit&#x20;and&#x20;monitoring.','Many&#x20;organizations&#x20;utilize&#x20;ARD&#x20;for&#x20;client&#x20;management.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Remote&#x20;Management:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Remote&#x20;Management&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Remote&#x20;Management:&#x20;$&#x20;/usr/bin/sudo&#x20;/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources&#x20;/kickstart&#x20;-deactivate&#x20;-stop&#x20;Starting...&#x20;Removed&#x20;preference&#x20;to&#x20;start&#x20;ARD&#x20;after&#x20;reboot.&#x20;Done.','[{\"cis\": [\"2.3.3.6\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\", \"5.4\"]}, {\"cis_csc_v7\": [\"4.3\", \"9.2\", \"14.3\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.3\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.1\", \"A.13.1.3\", \"A.9.2.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1133\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1176\", \"T1184\", \"T1190\", \"T1200\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\", \"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\", \"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31017,'Ensure&#x20;Remote&#x20;Apple&#x20;Events&#x20;Is&#x20;Disabled.','Apple&#x20;Events&#x20;is&#x20;a&#x20;technology&#x20;that&#x20;allows&#x20;one&#x20;program&#x20;to&#x20;communicate&#x20;with&#x20;other&#x20;programs.&#x20;Remote&#x20;Apple&#x20;Events&#x20;allows&#x20;a&#x20;program&#x20;on&#x20;one&#x20;computer&#x20;to&#x20;communicate&#x20;with&#x20;a&#x20;program&#x20;on&#x20;a&#x20;different&#x20;computer.','Disabling&#x20;Remote&#x20;Apple&#x20;Events&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;unauthorized&#x20;program&#x20;gaining&#x20;access&#x20;to&#x20;the&#x20;system.','With&#x20;remote&#x20;Apple&#x20;events&#x20;turned&#x20;on,&#x20;an&#x20;AppleScript&#x20;program&#x20;running&#x20;on&#x20;another&#x20;Mac&#x20;can&#x20;interact&#x20;with&#x20;the&#x20;local&#x20;computer.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Remote&#x20;Apple&#x20;Events:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Remote&#x20;Apple&#x20;Events&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;Remote&#x20;Apple&#x20;Events&#x20;to&#x20;Off:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/systemsetup&#x20;-setremoteappleevents&#x20;off&#x20;setremoteappleevents:&#x20;Off.','[{\"cis\": [\"2.3.3.7\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31018,'Ensure&#x20;Internet&#x20;Sharing&#x20;Is&#x20;Disabled.','Internet&#x20;Sharing&#x20;uses&#x20;the&#x20;open&#x20;source&#x20;natd&#x20;process&#x20;to&#x20;share&#x20;an&#x20;internet&#x20;connection&#x20;with&#x20;other&#x20;computers&#x20;and&#x20;devices&#x20;on&#x20;a&#x20;local&#x20;network.&#x20;This&#x20;allows&#x20;the&#x20;Mac&#x20;to&#x20;function&#x20;as&#x20;a&#x20;router&#x20;and&#x20;share&#x20;the&#x20;connection&#x20;to&#x20;other,&#x20;possibly&#x20;unauthorized,&#x20;devices.','Disabling&#x20;Internet&#x20;Sharing&#x20;reduces&#x20;the&#x20;remote&#x20;attack&#x20;surface&#x20;of&#x20;the&#x20;system.','Internet&#x20;Sharing&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;function&#x20;as&#x20;a&#x20;router&#x20;and&#x20;other&#x20;computers&#x20;to&#x20;use&#x20;it&#x20;for&#x20;access.&#x20;This&#x20;can&#x20;expose&#x20;both&#x20;the&#x20;computer&#x20;itself&#x20;and&#x20;the&#x20;networks&#x20;it&#x20;is&#x20;accessing&#x20;to&#x20;unacceptable&#x20;access&#x20;from&#x20;unapproved&#x20;devices.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Internet&#x20;Sharing:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Internet&#x20;Sharing&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;turn&#x20;off&#x20;Internet&#x20;Sharing:&#x20;$&#x20;usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/SystemConfiguration/com.apple.nat&#x20;NAT&#x20;-dict&#x20;Enabled&#x20;-int&#x20;0&#x20;Note:&#x20;Using&#x20;the&#x20;Terminal&#x20;Method&#x20;will&#x20;not&#x20;be&#x20;reflected&#x20;in&#x20;the&#x20;GUI,&#x20;but&#x20;will&#x20;disable&#x20;the&#x20;underlying&#x20;service.&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.MCX&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;forceInternetSharingOff&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"2.3.3.8\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31019,'Ensure&#x20;Content&#x20;Caching&#x20;Is&#x20;Disabled.','Starting&#x20;with&#x20;10.13&#x20;&#40;macOS&#x20;High&#x20;Sierra&#41;,&#x20;Apple&#x20;introduced&#x20;a&#x20;service&#x20;to&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;deploy&#x20;data&#x20;from&#x20;Apple,&#x20;including&#x20;software&#x20;updates,&#x20;where&#x20;there&#x20;are&#x20;bandwidth&#x20;constraints&#x20;to&#x20;the&#x20;Internet&#x20;and&#x20;fewer&#x20;constraints&#x20;or&#x20;greater&#x20;bandwidth&#x20;exist&#x20;on&#x20;the&#x20;local&#x20;subnet.&#x20;This&#x20;capability&#x20;can&#x20;be&#x20;very&#x20;valuable&#x20;for&#x20;organizations&#x20;that&#x20;have&#x20;throttled&#x20;and&#x20;possibly&#x20;metered&#x20;Internet&#x20;connections.&#x20;In&#x20;heterogeneous&#x20;enterprise&#x20;networks&#x20;with&#x20;multiple&#x20;subnets,&#x20;the&#x20;effectiveness&#x20;of&#x20;this&#x20;capability&#x20;would&#x20;be&#x20;determined&#x20;by&#x20;how&#x20;many&#x20;Macs&#x20;were&#x20;on&#x20;each&#x20;subnet&#x20;at&#x20;the&#x20;time&#x20;new,&#x20;large&#x20;updates&#x20;were&#x20;made&#x20;available&#x20;upstream.&#x20;This&#x20;capability&#x20;requires&#x20;the&#x20;use&#x20;of&#x20;mac&#x20;OS&#x20;clients&#x20;as&#x20;P2P&#x20;nodes&#x20;for&#x20;updated&#x20;Apple&#x20;content.&#x20;Unless&#x20;there&#x20;is&#x20;a&#x20;business&#x20;requirement&#x20;to&#x20;manage&#x20;operational&#x20;Internet&#x20;connectivity&#x20;and&#x20;bandwidth&#x20;user&#x20;endpoints&#x20;should&#x20;not&#x20;store&#x20;content&#x20;and&#x20;act&#x20;as&#x20;a&#x20;cluster&#x20;to&#x20;provision&#x20;data.&#x20;Content&#x20;types&#x20;supported&#x20;by&#x20;Content&#x20;Caching&#x20;in&#x20;macOS.','The&#x20;main&#x20;use&#x20;case&#x20;for&#x20;Mac&#x20;computers&#x20;is&#x20;as&#x20;mobile&#x20;user&#x20;endpoints.&#x20;P2P&#x20;sharing&#x20;services&#x20;should&#x20;not&#x20;be&#x20;enabled&#x20;on&#x20;laptops&#x20;that&#x20;are&#x20;using&#x20;untrusted&#x20;networks.&#x20;Content&#x20;Caching&#x20;can&#x20;allow&#x20;a&#x20;computer&#x20;to&#x20;be&#x20;a&#x20;server&#x20;for&#x20;local&#x20;nodes&#x20;on&#x20;an&#x20;untrusted&#x20;network.&#x20;While&#x20;there&#x20;are&#x20;certainly&#x20;logical&#x20;controls&#x20;that&#x20;could&#x20;be&#x20;used&#x20;to&#x20;mitigate&#x20;risk,&#x20;they&#x20;add&#x20;to&#x20;the&#x20;management&#x20;complexity.&#x20;Since&#x20;the&#x20;value&#x20;of&#x20;the&#x20;service&#x20;is&#x20;in&#x20;specific&#x20;use&#x20;cases&#x20;organizations&#x20;with&#x20;the&#x20;use&#x20;case&#x20;described&#x20;above&#x20;can&#x20;accept&#x20;risk&#x20;as&#x20;necessary.','This&#x20;setting&#x20;will&#x20;adversely&#x20;affect&#x20;bandwidth&#x20;usage&#x20;between&#x20;local&#x20;subnets&#x20;and&#x20;the&#x20;Internet.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Content&#x20;Caching:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Sharing&#x20;4.&#x20;Set&#x20;Content&#x20;Caching&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Content&#x20;Caching:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/AssetCacheManagerUtil&#x20;deactivate&#x20;The&#x20;output&#x20;will&#x20;include&#x20;Content&#x20;caching&#x20;deactivated&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.applicationaccess&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;allowContentCaching&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;false/&gt;.','[{\"cis\": [\"2.3.3.9\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1051\", \"T1076\", \"T1133\", \"T1200\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(31020,'Ensure&#x20;Backup&#x20;Automatically&#x20;is&#x20;Enabled&#x20;If&#x20;Time&#x20;Machine&#x20;Is&#x20;Enabled.','Backup&#x20;solutions&#x20;are&#x20;only&#x20;effective&#x20;if&#x20;the&#x20;backups&#x20;run&#x20;on&#x20;a&#x20;regular&#x20;basis.&#x20;The&#x20;time&#x20;to&#x20;check&#x20;for&#x20;backups&#x20;is&#x20;before&#x20;the&#x20;hard&#x20;drive&#x20;fails&#x20;or&#x20;the&#x20;computer&#x20;goes&#x20;missing.&#x20;In&#x20;order&#x20;to&#x20;simplify&#x20;the&#x20;user&#x20;experience&#x20;so&#x20;that&#x20;backups&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;occur,&#x20;Time&#x20;Machine&#x20;should&#x20;be&#x20;on&#x20;and&#x20;set&#x20;to&#x20;Back&#x20;Up&#x20;Automatically&#x20;whenever&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;available.&#x20;Operational&#x20;staff&#x20;should&#x20;ensure&#x20;that&#x20;backups&#x20;complete&#x20;on&#x20;a&#x20;regular&#x20;basis&#x20;and&#x20;the&#x20;backups&#x20;are&#x20;tested&#x20;to&#x20;ensure&#x20;that&#x20;file&#x20;restoration&#x20;from&#x20;backup&#x20;is&#x20;possible&#x20;when&#x20;needed.&#x20;Backup&#x20;dates&#x20;are&#x20;available&#x20;even&#x20;when&#x20;the&#x20;target&#x20;volume&#x20;is&#x20;not&#x20;available&#x20;in&#x20;the&#x20;Time&#x20;Machine&#x20;plist.&#x20;SnapshotDates&#x20;=&#x20;&#40;&#x20;&quot;2012-08-20&#x20;12:10:22&#x20;+0000&quot;,&#x20;&quot;2013-02-03&#x20;23:43:22&#x20;+0000&quot;,&#x20;&quot;2014-02-19&#x20;21:37:21&#x20;+0000&quot;,&#x20;&quot;2015-02-22&#x20;13:07:25&#x20;+0000&quot;,&#x20;&quot;2016-08-20&#x20;14:07:14&#x20;+0000&quot;&#x20;When&#x20;the&#x20;backup&#x20;volume&#x20;is&#x20;connected&#x20;to&#x20;the&#x20;computer&#x20;more&#x20;extensive&#x20;information&#x20;is&#x20;available&#x20;through&#x20;tmutil.&#x20;See&#x20;man&#x20;tmutil.','Backups&#x20;should&#x20;automatically&#x20;run&#x20;whenever&#x20;the&#x20;backup&#x20;drive&#x20;is&#x20;available.','The&#x20;backup&#x20;will&#x20;run&#x20;periodically&#x20;in&#x20;the&#x20;background&#x20;and&#x20;could&#x20;have&#x20;user&#x20;impact&#x20;while&#x20;running.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;Time&#x20;Machine&#x20;automatic&#x20;backup:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Time&#x20;Machine&#x20;4.&#x20;Select&#x20;Options...&#x20;5.&#x20;Set&#x20;Back&#x20;up&#x20;frequency&#x20;to&#x20;Automatically&#x20;&lt;every&#x20;hour/every&#x20;day/every&#x20;week&gt;&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;automatic&#x20;backups&#x20;if&#x20;Time&#x20;Machine&#x20;is&#x20;enabled:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.TimeMachine.plist&#x20;AutoBackup&#x20;-bool&#x20;true&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.TimeMachine&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;Forced&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to:&#x20;&lt;array&gt;&#x20;&lt;dict&gt;&#x20;&lt;key&gt;mcx_preference_settings&lt;/key&gt;&#x20;&lt;dict&gt;&#x20;&lt;key&gt;AutoBackup&lt;/key&gt;&#x20;&lt;true/&gt;&#x20;&lt;/dict&gt;&#x20;&lt;/dict&gt;&#x20;&lt;/array&gt;.','[{\"cis\": [\"2.3.4.1\"]}, {\"cis_csc_v8\": [\"11.2\"]}, {\"cis_csc_v7\": [\"10.1\"]}, {\"hipaa\": [\"164.308(a)(7)(ii)(A)\"]}, {\"iso_27001-2013\": [\"A.12.3.1\"]}, {\"mitre_techniques\": [\"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1490\", \"T1491\"]}, {\"pci_dss_v3.2.1\": [\"12.10.1\"]}]'),(31021,'Ensure&#x20;Time&#x20;Machine&#x20;Volumes&#x20;Are&#x20;Encrypted&#x20;If&#x20;Time&#x20;Machine&#x20;Is&#x20;Enabled.','One&#x20;of&#x20;the&#x20;most&#x20;important&#x20;security&#x20;tools&#x20;for&#x20;data&#x20;protection&#x20;on&#x20;macOS&#x20;is&#x20;FileVault.&#x20;With&#x20;encryption&#x20;in&#x20;place&#x20;it&#x20;makes&#x20;it&#x20;difficult&#x20;for&#x20;an&#x20;outside&#x20;party&#x20;to&#x20;access&#x20;your&#x20;data&#x20;if&#x20;they&#x20;get&#x20;physical&#x20;possession&#x20;of&#x20;the&#x20;computer.&#x20;One&#x20;very&#x20;large&#x20;weakness&#x20;in&#x20;data&#x20;protection&#x20;with&#x20;FileVault&#x20;is&#x20;the&#x20;level&#x20;of&#x20;protection&#x20;on&#x20;backup&#x20;volumes.&#x20;If&#x20;the&#x20;internal&#x20;drive&#x20;is&#x20;encrypted&#x20;but&#x20;the&#x20;external&#x20;backup&#x20;volume&#x20;that&#x20;goes&#x20;home&#x20;in&#x20;the&#x20;same&#x20;laptop&#x20;bag&#x20;is&#x20;not&#x20;it&#x20;is&#x20;self-defeating.&#x20;Apple&#x20;tries&#x20;to&#x20;make&#x20;this&#x20;mistake&#x20;easily&#x20;avoided&#x20;by&#x20;providing&#x20;a&#x20;checkbox&#x20;to&#x20;enable&#x20;encryption&#x20;when&#x20;setting-up&#x20;a&#x20;Time&#x20;Machine&#x20;backup.&#x20;Using&#x20;this&#x20;option&#x20;does&#x20;require&#x20;some&#x20;password&#x20;management,&#x20;particularly&#x20;if&#x20;a&#x20;large&#x20;drive&#x20;is&#x20;used&#x20;with&#x20;multiple&#x20;computers.&#x20;A&#x20;unique&#x20;complex&#x20;password&#x20;to&#x20;unlock&#x20;the&#x20;drive&#x20;can&#x20;be&#x20;stored&#x20;in&#x20;keychains&#x20;on&#x20;multiple&#x20;systems&#x20;for&#x20;ease&#x20;of&#x20;use.&#x20;While&#x20;some&#x20;portable&#x20;drives&#x20;may&#x20;contain&#x20;non-sensitive&#x20;data&#x20;and&#x20;encryption&#x20;may&#x20;make&#x20;interoperability&#x20;with&#x20;other&#x20;systems&#x20;difficult&#x20;backup&#x20;volumes&#x20;should&#x20;be&#x20;protected&#x20;just&#x20;like&#x20;boot&#x20;volumes.','Backup&#x20;volumes&#x20;need&#x20;to&#x20;be&#x20;encrypted.','','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;encryption&#x20;on&#x20;the&#x20;Time&#x20;Machine&#x20;drive:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;General&#x20;3.&#x20;Select&#x20;Time&#x20;Machine&#x20;4.&#x20;Select&#x20;the&#x20;unencrypted&#x20;drive&#x20;5.&#x20;Select&#x20;-&#x20;to&#x20;forget&#x20;that&#x20;drive&#x20;as&#x20;a&#x20;destination&#x20;6.&#x20;Select&#x20;+&#x20;to&#x20;add&#x20;a&#x20;different&#x20;drive&#x20;as&#x20;the&#x20;destination&#x20;7.&#x20;Select&#x20;Set&#x20;Up&#x20;Disk...&#x20;8.&#x20;Set&#x20;Encrypt&#x20;Backup&#x20;to&#x20;enabled&#x20;9.&#x20;Enter&#x20;a&#x20;password&#x20;in&#x20;the&#x20;New&#x20;Password&#x20;and&#x20;the&#x20;same&#x20;password&#x20;in&#x20;the&#x20;Re-enter&#x20;Password&#x20;fields&#x20;10.&#x20;A&#x20;password&#x20;hint&#x20;is&#x20;required,&#x20;but&#x20;it&#x20;is&#x20;recommended&#x20;that&#x20;you&#x20;do&#x20;not&#x20;use&#x20;any&#x20;identifying&#x20;information&#x20;for&#x20;the&#x20;password&#x20;Note:&#x20;In&#x20;macOS&#x20;12.0&#x20;Monterey&#x20;and&#x20;previous,&#x20;the&#x20;existing&#x20;Time&#x20;Machine&#x20;drive&#x20;could&#x20;have&#x20;encryption&#x20;added&#x20;without&#x20;formatting&#x20;it.&#x20;This&#x20;is&#x20;no&#x20;longer&#x20;possible&#x20;in&#x20;macOS&#x20;13.0&#x20;Ventura.&#x20;If&#x20;you&#x20;with&#x20;to&#x20;keep&#x20;previous&#x20;backups&#x20;from&#x20;the&#x20;unencrypted&#x20;volume,&#x20;you&#x20;will&#x20;need&#x20;to&#x20;manually&#x20;move&#x20;those&#x20;files&#x20;over&#x20;to&#x20;the&#x20;new&#x20;encrypted&#x20;drive.','[{\"cis\": [\"2.3.4.2\"]}, {\"cis_csc_v8\": [\"3.6\", \"3.11\", \"11.3\"]}, {\"cis_csc_v7\": [\"10.4\", \"13.6\", \"14.8\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"MP.L2-3.8.9\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"iso_27001-2013\": [\"A.10.1.1\", \"A.12.3.1\", \"A.6.2.1\"]}, {\"mitre_techniques\": [\"T1040\", \"T1070\", \"T1072\", \"T1114\", \"T1119\", \"T1145\", \"T1208\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1490\", \"T1491\", \"T1492\", \"T1493\", \"T1527\", \"T1530\"]}, {\"nist_sp_800-53\": [\"CP-9(8)\", \"SC-28\", \"SC-28(1)\"]}, {\"pci_dss_v3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\", \"9.5\", \"9.5.1\"]}, {\"pci_dss_v4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"soc_2\": [\"A1.2\", \"CC6.1\", \"CC6.4\", \"CC6.7\"]}]'),(31022,'Ensure&#x20;Location&#x20;Services&#x20;Is&#x20;Enabled.','macOS&#x20;uses&#x20;location&#x20;information&#x20;gathered&#x20;through&#x20;local&#x20;Wi-Fi&#x20;networks&#x20;to&#x20;enable&#x20;applications&#x20;to&#x20;supply&#x20;relevant&#x20;information&#x20;to&#x20;users.&#x20;With&#x20;the&#x20;operating&#x20;system&#x20;verifying&#x20;the&#x20;location,&#x20;users&#x20;do&#x20;not&#x20;need&#x20;to&#x20;change&#x20;the&#x20;time&#x20;or&#x20;the&#x20;time&#x20;zone.&#x20;The&#x20;computer&#x20;will&#x20;change&#x20;them&#x20;based&#x20;on&#x20;the&#x20;user&#039;s&#x20;location.&#x20;They&#x20;do&#x20;not&#x20;need&#x20;to&#x20;specify&#x20;their&#x20;location&#x20;for&#x20;weather&#x20;or&#x20;travel&#x20;times,&#x20;and&#x20;they&#x20;will&#x20;receive&#x20;alerts&#x20;on&#x20;travel&#x20;times&#x20;to&#x20;meetings&#x20;and&#x20;appointment&#x20;where&#x20;location&#x20;information&#x20;is&#x20;supplied.&#x20;Location&#x20;Services&#x20;simplify&#x20;some&#x20;processes&#x20;with&#x20;mobile&#x20;computers,&#x20;such&#x20;as&#x20;asset&#x20;management&#x20;and&#x20;time&#x20;or&#x20;log&#x20;management.&#x20;There&#x20;are&#x20;some&#x20;use&#x20;cases&#x20;where&#x20;it&#x20;is&#x20;important&#x20;that&#x20;the&#x20;computer&#x20;not&#x20;be&#x20;able&#x20;to&#x20;report&#x20;its&#x20;exact&#x20;location.&#x20;While&#x20;the&#x20;general&#x20;use&#x20;case&#x20;is&#x20;to&#x20;enable&#x20;Location&#x20;Services,&#x20;it&#x20;should&#x20;not&#x20;be&#x20;allowed&#x20;if&#x20;the&#x20;physical&#x20;location&#x20;of&#x20;the&#x20;computer&#x20;and&#x20;the&#x20;user&#x20;should&#x20;not&#x20;be&#x20;public&#x20;knowledge.','Location&#x20;Services&#x20;are&#x20;helpful&#x20;in&#x20;most&#x20;use&#x20;cases&#x20;and&#x20;can&#x20;simplify&#x20;log&#x20;and&#x20;time&#x20;management&#x20;where&#x20;computers&#x20;change&#x20;time&#x20;zones.','','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;Location&#x20;Services:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Privacy&#x20;&amp;&#x20;Security&#x20;3.&#x20;Select&#x20;Location&#x20;Services&#x20;4.&#x20;Set&#x20;Location&#x20;Services&#x20;to&#x20;enabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;Location&#x20;Services:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.locationd.plist&#x20;If&#x20;the&#x20;com.apple.locationd.plist&#x20;outputs&#x20;0,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;also&#x20;ensure&#x20;Location&#x20;Services&#x20;is&#x20;running:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd&#x20;LocationServicesEnabled&#x20;-bool&#x20;false&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;kickstart&#x20;-k&#x20;system/com.apple.locationd&#x20;Note:&#x20;In&#x20;some&#x20;use&#x20;cases,&#x20;organizations&#x20;may&#x20;not&#x20;want&#x20;Location&#x20;Services&#x20;running.&#x20;To&#x20;disable&#x20;Location&#x20;Services,&#x20;System&#x20;Integrity&#x20;Protection&#x20;must&#x20;be&#x20;disabled.','[{\"cis\": [\"2.6.1.1\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31023,'Ensure&#x20;Location&#x20;Services&#x20;Is&#x20;in&#x20;the&#x20;Menu&#x20;Bar.','This&#x20;setting&#x20;provides&#x20;the&#x20;user&#x20;to&#x20;understand&#x20;the&#x20;current&#x20;status&#x20;of&#x20;Location&#x20;Services&#x20;and&#x20;which&#x20;applications&#x20;are&#x20;using&#x20;it.','Apple&#x20;has&#x20;fully&#x20;integrated&#x20;location&#x20;services&#x20;into&#x20;macOS.&#x20;Where&#x20;the&#x20;computer&#x20;is&#x20;currently&#x20;located&#x20;is&#x20;used&#x20;for&#x20;Timezones,&#x20;weather,&#x20;travel&#x20;times,&#x20;geolocation,&#x20;&quot;Find&#x20;my&#x20;Mac&quot;&#x20;and&#x20;advertising&#x20;services.&#x20;This&#x20;benchmark&#x20;recommends&#x20;that&#x20;location&#x20;services&#x20;are&#x20;enabled&#x20;for&#x20;most&#x20;users.&#x20;Many&#x20;users&#x20;may&#x20;have&#x20;occasions&#x20;when&#x20;they&#x20;do&#x20;not&#x20;want&#x20;to&#x20;share&#x20;their&#x20;current&#x20;locations,&#x20;some&#x20;users&#x20;may&#x20;need&#x20;to&#x20;rarely&#x20;share&#x20;their&#x20;locations.&#x20;The&#x20;immediate&#x20;availability&#x20;of&#x20;Location&#x20;Services&#x20;in&#x20;the&#x20;menu&#x20;bar&#x20;provides&#x20;easy&#x20;access&#x20;to&#x20;the&#x20;current&#x20;status,&#x20;which&#x20;applications&#x20;are&#x20;using&#x20;the&#x20;service&#x20;and&#x20;a&#x20;quick&#x20;shortcut&#x20;to&#x20;making&#x20;changes.&#x20;This&#x20;setting&#x20;provides&#x20;better&#x20;user&#x20;control&#x20;in&#x20;managing&#x20;user&#x20;privacy.','Users&#x20;may&#x20;be&#x20;provided&#x20;visibility&#x20;to&#x20;a&#x20;setting&#x20;they&#x20;cannot&#x20;control&#x20;if&#x20;organizations&#x20;control&#x20;Location&#x20;Services&#x20;globally&#x20;by&#x20;policy.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;set&#x20;whether&#x20;the&#x20;location&#x20;services&#x20;icon&#x20;is&#x20;in&#x20;the&#x20;menu&#x20;bar:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Privacy&#x20;&amp;&#x20;Security&#x20;3.&#x20;Select&#x20;Location&#x20;Services&#x20;4.&#x20;Select&#x20;Details...&#x20;5.&#x20;Set&#x20;Show&#x20;location&#x20;icon&#x20;in&#x20;menu&#x20;bar&#x20;when&#x20;System&#x20;Services&#x20;request&#x20;your&#x20;location&#x20;to&#x20;your&#x20;organization&#039;s&#x20;parameters&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;set&#x20;the&#x20;option&#x20;of&#x20;the&#x20;location&#x20;services&#x20;icon&#x20;being&#x20;in&#x20;the&#x20;menu&#x20;bar:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.locationmenu.plist&#x20;ShowSystemServices&#x20;-bool&#x20;&lt;true/false&gt;.','[{\"cis\": [\"2.6.1.2\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31024,'Ensure&#x20;Gatekeeper&#x20;Is&#x20;Enabled.','Gatekeeper&#x20;is&#x20;Apple&#039;s&#x20;application&#x20;that&#x20;utilizes&#x20;allowlisting&#x20;to&#x20;restrict&#x20;downloaded&#x20;applications&#x20;from&#x20;launching.&#x20;It&#x20;functions&#x20;as&#x20;a&#x20;control&#x20;to&#x20;limit&#x20;applications&#x20;from&#x20;unverified&#x20;sources&#x20;from&#x20;running&#x20;without&#x20;authorization.&#x20;In&#x20;an&#x20;update&#x20;to&#x20;Gatekeeper&#x20;in&#x20;macOS&#x20;13&#x20;Ventura,&#x20;Gatekeeper&#x20;checks&#x20;every&#x20;application&#x20;on&#x20;every&#x20;launch,&#x20;not&#x20;just&#x20;quarantined&#x20;apps.','Disallowing&#x20;unsigned&#x20;software&#x20;will&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;unauthorized&#x20;or&#x20;malicious&#x20;applications&#x20;from&#x20;running&#x20;on&#x20;the&#x20;system.','','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;Gatekeeper:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Privacy&#x20;&amp;&#x20;Security&#x20;3.&#x20;Set&#x20;&#039;Allow&#x20;apps&#x20;downloaded&#x20;from&#039;&#x20;to&#x20;&#039;App&#x20;Store&#x20;and&#x20;identified&#x20;developers&#039;&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;Gatekeeper&#x20;to&#x20;allow&#x20;applications&#x20;from&#x20;App&#x20;Store&#x20;and&#x20;identified&#x20;developers:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/spctl&#x20;--master-enable&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.systempolicy.control&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;AllowIdentifiedDevelopers&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;4.&#x20;The&#x20;key&#x20;to&#x20;also&#x20;include&#x20;is&#x20;EnableAssessment&#x20;5.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"2.6.4\"]}, {\"cis_csc_v8\": [\"10.1\", \"10.2\", \"10.5\"]}, {\"cis_csc_v7\": [\"8.2\", \"8.4\"]}, {\"cmmc_v2.0\": [\"SI.L1-3.14.2\", \"SI.L1-3.14.4\"]}, {\"hipaa\": [\"164.308(a)(5)(ii)(B)\"]}, {\"iso_27001-2013\": [\"A.12.2.1\"]}, {\"mitre_techniques\": [\"T1017\", \"T1019\", \"T1027\", \"T1045\", \"T1068\", \"T1072\", \"T1073\", \"T1075\", \"T1091\", \"T1100\", \"T1103\", \"T1137\", \"T1138\", \"T1189\", \"T1190\", \"T1193\", \"T1194\", \"T1195\", \"T1200\", \"T1210\", \"T1211\", \"T1212\", \"T1215\", \"T1221\", \"T1495\"]}, {\"nist_sp_800-53\": [\"SI-16\"]}, {\"pci_dss_v3.2.1\": [\"1.4\", \"11.4\", \"5.1\", \"5.1.1\", \"5.2\"]}, {\"pci_dss_v4.0\": [\"5.1.1\", \"5.2.1\", \"5.2.2\", \"5.3.1\", \"5.3.2\"]}, {\"soc_2\": [\"CC6.8\"]}]'),(31025,'Ensure&#x20;FileVault&#x20;Is&#x20;Enabled.','FileVault&#x20;secures&#x20;a&#x20;system&#039;s&#x20;data&#x20;by&#x20;automatically&#x20;encrypting&#x20;its&#x20;boot&#x20;volume&#x20;and&#x20;requiring&#x20;a&#x20;password&#x20;or&#x20;recovery&#x20;key&#x20;to&#x20;access&#x20;it.&#x20;FileVault&#x20;should&#x20;be&#x20;used&#x20;with&#x20;a&#x20;saved&#x20;escrow&#x20;key&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;owner&#x20;can&#x20;decrypt&#x20;their&#x20;data&#x20;if&#x20;the&#x20;password&#x20;is&#x20;lost.&#x20;FileVault&#x20;may&#x20;also&#x20;be&#x20;enabled&#x20;using&#x20;command&#x20;line&#x20;using&#x20;the&#x20;fdesetup&#x20;command.&#x20;To&#x20;use&#x20;this&#x20;functionality,&#x20;consult&#x20;the&#x20;Der&#x20;Flounder&#x20;blog&#x20;for&#x20;more&#x20;details&#x20;&#40;see&#x20;link&#x20;below&#x20;under&#x20;References&#41;.','Encrypting&#x20;sensitive&#x20;data&#x20;minimizes&#x20;the&#x20;likelihood&#x20;of&#x20;unauthorized&#x20;users&#x20;gaining&#x20;access&#x20;to&#x20;it.','Mounting&#x20;a&#x20;FileVault&#x20;encrypted&#x20;volume&#x20;from&#x20;an&#x20;alternate&#x20;boot&#x20;source&#x20;will&#x20;require&#x20;a&#x20;valid&#x20;password&#x20;to&#x20;decrypt&#x20;it.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;FileVault:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Security&#x20;&amp;&#x20;Privacy&#x20;3.&#x20;Select&#x20;Turn&#x20;On...&#x20;Note:&#x20;This&#x20;will&#x20;allow&#x20;you&#x20;to&#x20;create&#x20;a&#x20;recovery&#x20;key&#x20;for&#x20;FileVault.&#x20;Keep&#x20;the&#x20;key&#x20;saved&#x20;securely&#x20;in&#x20;case&#x20;it&#x20;is&#x20;needed&#x20;at&#x20;a&#x20;later&#x20;date.&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.MCX&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;dontAllowFDEDisable&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;Note:&#x20;This&#x20;profile&#x20;is&#x20;required&#x20;to&#x20;pass&#x20;the&#x20;audit.','[{\"cis\": [\"2.6.5\"]}, {\"cis_csc_v8\": [\"3.6\", \"3.11\"]}, {\"cis_csc_v7\": [\"13.6\", \"14.8\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"iso_27001-2013\": [\"A.10.1.1\", \"A.6.2.1\"]}, {\"mitre_techniques\": [\"T1040\", \"T1070\", \"T1072\", \"T1114\", \"T1119\", \"T1145\", \"T1208\", \"T1492\", \"T1493\", \"T1527\", \"T1530\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"pci_dss_v3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_v4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(31026,'Ensure&#x20;an&#x20;Administrator&#x20;Password&#x20;Is&#x20;Required&#x20;to&#x20;Access&#x20;System-Wide&#x20;Preferences.','System&#x20;Preferences&#x20;controls&#x20;system&#x20;and&#x20;user&#x20;settings&#x20;on&#x20;a&#x20;macOS&#x20;Computer.&#x20;System&#x20;Preferences&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;tailor&#x20;their&#x20;experience&#x20;on&#x20;the&#x20;computer&#x20;as&#x20;well&#x20;as&#x20;allowing&#x20;the&#x20;System&#x20;Administrator&#x20;to&#x20;configure&#x20;global&#x20;security&#x20;settings.&#x20;Some&#x20;of&#x20;the&#x20;settings&#x20;should&#x20;only&#x20;be&#x20;altered&#x20;by&#x20;the&#x20;person&#x20;responsible&#x20;for&#x20;the&#x20;computer.','By&#x20;requiring&#x20;a&#x20;password&#x20;to&#x20;unlock&#x20;system-wide&#x20;System&#x20;Preferences,&#x20;the&#x20;risk&#x20;is&#x20;mitigated&#x20;of&#x20;a&#x20;user&#x20;changing&#x20;configurations&#x20;that&#x20;affect&#x20;the&#x20;entire&#x20;system&#x20;and&#x20;requires&#x20;an&#x20;admin&#x20;user&#x20;to&#x20;re-authenticate&#x20;to&#x20;make&#x20;changes.','Users&#x20;will&#x20;need&#x20;to&#x20;enter&#x20;their&#x20;password&#x20;to&#x20;unlock&#x20;some&#x20;additional&#x20;preference&#x20;panes&#x20;that&#x20;are&#x20;unlocked&#x20;by&#x20;default&#x20;like&#x20;Network,&#x20;Startup&#x20;and&#x20;Printers&#x20;&amp;&#x20;Scanners.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;verify&#x20;that&#x20;an&#x20;administrator&#x20;password&#x20;is&#x20;required&#x20;to&#x20;access&#x20;system-wide&#x20;preferences:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Privacy&#x20;&amp;&#x20;Security&#x20;3.&#x20;Select&#x20;Advanced&#x20;4.&#x20;Set&#x20;Require&#x20;an&#x20;administrator&#x20;password&#x20;to&#x20;access&#x20;system-wide&#x20;settings&#x20;to&#x20;enabled.&#x20;Terminal&#x20;Method:&#x20;The&#x20;authorizationdb&#x20;settings&#x20;cannot&#x20;be&#x20;written&#x20;to&#x20;directly,&#x20;so&#x20;the&#x20;plist&#x20;must&#x20;be&#x20;exported&#x20;out&#x20;to&#x20;temporary&#x20;file.&#x20;Changes&#x20;can&#x20;be&#x20;made&#x20;to&#x20;the&#x20;temporary&#x20;plist,&#x20;then&#x20;imported&#x20;back&#x20;into&#x20;the&#x20;authorizationdb&#x20;settings.&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;enable&#x20;that&#x20;an&#x20;administrator&#x20;password&#x20;is&#x20;required&#x20;to&#x20;access&#x20;system-wide&#x20;preferences:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/security&#x20;authorizationdb&#x20;read&#x20;system.preferences&#x20;&gt;&#x20;/tmp/system.preferences.plist&#x20;YES&#x20;&#40;0&#41;&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/tmp/system.preferences.plist&#x20;shared&#x20;-bool&#x20;false&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/security&#x20;authorizationdb&#x20;write&#x20;system.preferences&#x20;&lt;&#x20;/tmp/system.preferences.plist&#x20;YES&#x20;&#40;0&#41;.','[{\"cis\": [\"2.6.7\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(31027,'Ensure&#x20;Power&#x20;Nap&#x20;Is&#x20;Disabled&#x20;for&#x20;Intel&#x20;Macs.','Power&#x20;Nap&#x20;allows&#x20;the&#x20;system&#x20;to&#x20;stay&#x20;in&#x20;low&#x20;power&#x20;mode,&#x20;especially&#x20;while&#x20;on&#x20;battery&#x20;power,&#x20;and&#x20;periodically&#x20;connect&#x20;to&#x20;previously&#x20;known&#x20;networks&#x20;with&#x20;stored&#x20;credentials&#x20;for&#x20;user&#x20;applications&#x20;to&#x20;phone&#x20;home&#x20;and&#x20;get&#x20;updates.&#x20;This&#x20;capability&#x20;requires&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;the&#x20;use&#x20;of&#x20;previously&#x20;joined&#x20;networks&#x20;to&#x20;be&#x20;risk&#x20;accepted&#x20;based&#x20;on&#x20;the&#x20;SSID&#x20;without&#x20;user&#x20;input.&#x20;This&#x20;control&#x20;has&#x20;been&#x20;updated&#x20;to&#x20;check&#x20;the&#x20;status&#x20;on&#x20;both&#x20;battery&#x20;and&#x20;AC&#x20;Power.&#x20;The&#x20;presence&#x20;of&#x20;an&#x20;electrical&#x20;outlet&#x20;does&#x20;not&#x20;completely&#x20;correlate&#x20;with&#x20;logical&#x20;and&#x20;physical&#x20;security&#x20;of&#x20;the&#x20;device&#x20;or&#x20;available&#x20;networks.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.&#x20;The&#x20;use&#x20;of&#x20;Power&#x20;Nap&#x20;adds&#x20;to&#x20;the&#x20;risk&#x20;of&#x20;compromised&#x20;physical&#x20;and&#x20;logical&#x20;security.&#x20;The&#x20;user&#x20;should&#x20;be&#x20;able&#x20;to&#x20;decrypt&#x20;FileVault&#x20;and&#x20;have&#x20;the&#x20;applications&#x20;download&#x20;what&#x20;is&#x20;required&#x20;when&#x20;the&#x20;computer&#x20;is&#x20;actively&#x20;used.&#x20;The&#x20;control&#x20;to&#x20;prevent&#x20;computer&#x20;sleep&#x20;has&#x20;been&#x20;retired&#x20;for&#x20;this&#x20;version&#x20;of&#x20;the&#x20;Benchmark.&#x20;Forcing&#x20;the&#x20;computer&#x20;to&#x20;stay&#x20;on&#x20;and&#x20;use&#x20;energy&#x20;in&#x20;case&#x20;a&#x20;management&#x20;push&#x20;is&#x20;needed&#x20;is&#x20;contrary&#x20;to&#x20;most&#x20;current&#x20;management&#x20;processes.&#x20;Only&#x20;keep&#x20;computers&#x20;unslept&#x20;if&#x20;after&#x20;hours&#x20;pushes&#x20;are&#x20;required&#x20;on&#x20;closed&#x20;LANs.','Power&#x20;Nap&#x20;exists&#x20;for&#x20;unattended&#x20;user&#x20;application&#x20;updates&#x20;like&#x20;email&#x20;and&#x20;social&#x20;media&#x20;clients.&#x20;With&#x20;Power&#x20;Nap&#x20;disabled,&#x20;the&#x20;computer&#x20;will&#x20;not&#x20;wake&#x20;and&#x20;reconnect&#x20;to&#x20;known&#x20;wireless&#x20;SSIDs&#x20;intermittently&#x20;when&#x20;slept.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Power&#x20;Nap:&#x20;Desktop&#x20;Instructions:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Energy&#x20;Saver&#x20;3.&#x20;Set&#x20;Power&#x20;Nap&#x20;to&#x20;disabled&#x20;4.&#x20;Select&#x20;UPS&#x20;&#40;if&#x20;applicable&#41;&#x20;5.&#x20;Set&#x20;Power&#x20;Nap&#x20;to&#x20;disabled&#x20;Laptop&#x20;Instructions:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Battery&#x20;3.&#x20;Select&#x20;Power&#x20;Adapter&#x20;&#40;for&#x20;laptops&#x20;only&#41;&#x20;4.&#x20;Set&#x20;Power&#x20;Nap&#x20;to&#x20;disabled&#x20;5.&#x20;Select&#x20;Battery&#x20;6.&#x20;Set&#x20;Power&#x20;Nap&#x20;to&#x20;disabled&#x20;7.&#x20;Select&#x20;UPS&#x20;&#40;if&#x20;applicable&#41;&#x20;8.&#x20;Set&#x20;Power&#x20;Nap&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Power&#x20;Nap:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pmset&#x20;-a&#x20;powernap&#x20;0.','[{\"cis\": [\"2.9.1\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31028,'Ensure&#x20;Wake&#x20;for&#x20;Network&#x20;Access&#x20;Is&#x20;Disabled.','This&#x20;feature&#x20;allows&#x20;the&#x20;computer&#x20;to&#x20;take&#x20;action&#x20;when&#x20;the&#x20;user&#x20;is&#x20;not&#x20;present&#x20;and&#x20;the&#x20;computer&#x20;is&#x20;in&#x20;energy&#x20;saving&#x20;mode.&#x20;These&#x20;tools&#x20;require&#x20;FileVault&#x20;to&#x20;remain&#x20;unlocked&#x20;and&#x20;fully&#x20;rejoin&#x20;known&#x20;networks.&#x20;This&#x20;macOS&#x20;feature&#x20;is&#x20;meant&#x20;to&#x20;allow&#x20;the&#x20;computer&#x20;to&#x20;resume&#x20;activity&#x20;as&#x20;needed&#x20;regardless&#x20;of&#x20;physical&#x20;security&#x20;controls.&#x20;This&#x20;feature&#x20;allows&#x20;other&#x20;users&#x20;to&#x20;be&#x20;able&#x20;to&#x20;access&#x20;your&#x20;computer&#039;s&#x20;shared&#x20;resources,&#x20;such&#x20;as&#x20;shared&#x20;printers&#x20;or&#x20;Apple&#x20;Music&#x20;playlists,&#x20;even&#x20;when&#x20;your&#x20;computer&#x20;is&#x20;in&#x20;sleep&#x20;mode.&#x20;In&#x20;a&#x20;closed&#x20;network&#x20;when&#x20;only&#x20;authorized&#x20;devices&#x20;could&#x20;wake&#x20;a&#x20;computer,&#x20;it&#x20;could&#x20;be&#x20;valuable&#x20;to&#x20;wake&#x20;computers&#x20;in&#x20;order&#x20;to&#x20;do&#x20;management&#x20;push&#x20;activity.&#x20;Where&#x20;mobile&#x20;workstations&#x20;and&#x20;agents&#x20;exist,&#x20;the&#x20;device&#x20;will&#x20;more&#x20;likely&#x20;check&#x20;in&#x20;to&#x20;receive&#x20;updates&#x20;when&#x20;already&#x20;awake.&#x20;Mobile&#x20;devices&#x20;should&#x20;not&#x20;be&#x20;listening&#x20;for&#x20;signals&#x20;on&#x20;any&#x20;unmanaged&#x20;network&#x20;or&#x20;where&#x20;untrusted&#x20;devices&#x20;exist&#x20;that&#x20;could&#x20;send&#x20;wake&#x20;signals.','Disabling&#x20;this&#x20;feature&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;attacker&#x20;remotely&#x20;waking&#x20;the&#x20;system&#x20;and&#x20;gaining&#x20;access.','Management&#x20;programs&#x20;like&#x20;Apple&#x20;Remote&#x20;Desktop&#x20;Administrator&#x20;use&#x20;wake-on-LAN&#x20;to&#x20;connect&#x20;with&#x20;computers.&#x20;If&#x20;turned&#x20;off,&#x20;such&#x20;management&#x20;programs&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;wake&#x20;a&#x20;computer&#x20;over&#x20;the&#x20;LAN.&#x20;If&#x20;the&#x20;wake-on-LAN&#x20;feature&#x20;is&#x20;needed,&#x20;do&#x20;not&#x20;turn&#x20;off&#x20;this&#x20;feature.&#x20;The&#x20;control&#x20;to&#x20;prevent&#x20;computer&#x20;sleep&#x20;has&#x20;been&#x20;retired&#x20;for&#x20;this&#x20;version&#x20;of&#x20;the&#x20;Benchmark.&#x20;Forcing&#x20;the&#x20;computer&#x20;to&#x20;stay&#x20;on&#x20;and&#x20;use&#x20;energy&#x20;in&#x20;case&#x20;a&#x20;management&#x20;push&#x20;is&#x20;needed&#x20;is&#x20;contrary&#x20;to&#x20;most&#x20;current&#x20;management&#x20;processes.&#x20;Only&#x20;keep&#x20;computers&#x20;unslept&#x20;if&#x20;after&#x20;hours&#x20;pushes&#x20;are&#x20;required&#x20;on&#x20;closed&#x20;LANs.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access:&#x20;Desktop&#x20;Instructions:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Energy&#x20;Saver&#x20;3.&#x20;Set&#x20;Wake&#x20;for&#x20;network&#x20;access&#x20;to&#x20;disabled&#x20;Laptop&#x20;Instructions:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Battery&#x20;3.&#x20;Select&#x20;Options...&#x20;4.&#x20;Set&#x20;Wake&#x20;for&#x20;network&#x20;access&#x20;to&#x20;Never&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Wake&#x20;for&#x20;network&#x20;access:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pmset&#x20;-a&#x20;womp&#x20;0&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.MCX&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;com.apple.EnergySaver.desktop.ACPower&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to:&#x20;&lt;dict&gt;&#x20;&lt;key&gt;Wake&#x20;On&#x20;LAN&lt;/key&gt;&#x20;&lt;integer&gt;0&lt;/integer&gt;&#x20;&lt;key&gt;Wake&#x20;On&#x20;Modem&#x20;Ring&lt;/key&gt;&#x20;&lt;integer&gt;0&lt;/integer&gt;&#x20;&lt;/dict&gt;&#x20;4.&#x20;The&#x20;key&#x20;to&#x20;also&#x20;include&#x20;is&#x20;com.apple.EnergySaver.portable.ACPower&#x20;5.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to:&#x20;&lt;dict&gt;&#x20;&lt;key&gt;Wake&#x20;On&#x20;LAN&lt;/key&gt;&#x20;&lt;integer&gt;0&lt;/integer&gt;&#x20;&lt;key&gt;Wake&#x20;On&#x20;Modem&#x20;Ring&lt;/key&gt;&#x20;&lt;integer&gt;0&lt;/integer&gt;&#x20;&lt;/dict&gt;&#x20;6.&#x20;The&#x20;key&#x20;to&#x20;also&#x20;include&#x20;is&#x20;com.apple.EnergySaver.portable.BatteryPower&#x20;7.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to:&#x20;&lt;dict&gt;&#x20;&lt;key&gt;Wake&#x20;On&#x20;LAN&lt;/key&gt;&#x20;&lt;integer&gt;0&lt;/integer&gt;&#x20;&lt;key&gt;Wake&#x20;On&#x20;Modem&#x20;Ring&lt;/key&gt;&#x20;&lt;integer&gt;0&lt;/integer&gt;&#x20;&lt;/dict&gt;&#x20;Note:&#x20;Both&#x20;Wake&#x20;on&#x20;LAN&#x20;and&#x20;Wake&#x20;on&#x20;Modem&#x20;Ring&#x20;need&#x20;to&#x20;be&#x20;set.&#x20;Only&#x20;setting&#x20;Wake&#x20;On&#x20;LAN&#x20;will&#x20;allow&#x20;the&#x20;profile&#x20;to&#x20;install&#x20;but&#x20;not&#x20;set&#x20;any&#x20;settings.&#x20;This&#x20;profile&#x20;will&#x20;only&#x20;apply&#x20;the&#x20;setting&#x20;at&#x20;installation&#x20;and&#x20;is&#x20;not&#x20;sticky.','[{\"cis\": [\"2.9.2\"]}, {\"cis_csc_v8\": [\"4.8\"]}, {\"cis_csc_v7\": [\"9.2\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\"]}, {\"mitre_techniques\": [\"T1015\", \"T1051\", \"T1076\", \"T1133\", \"T1200\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\"]}]'),(31029,'Ensure&#x20;a&#x20;Password&#x20;is&#x20;Required&#x20;to&#x20;Wake&#x20;the&#x20;Computer&#x20;From&#x20;Sleep&#x20;or&#x20;Screen&#x20;Saver&#x20;Is&#x20;Enabled.','Sleep&#x20;and&#x20;screen&#x20;saver&#x20;modes&#x20;are&#x20;low&#x20;power&#x20;modes&#x20;that&#x20;reduce&#x20;electrical&#x20;consumption&#x20;while&#x20;the&#x20;system&#x20;is&#x20;not&#x20;in&#x20;use.','Prompting&#x20;for&#x20;a&#x20;password&#x20;when&#x20;waking&#x20;from&#x20;sleep&#x20;or&#x20;screen&#x20;saver&#x20;mode&#x20;mitigates&#x20;the&#x20;threat&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system&#x20;in&#x20;the&#x20;user&#039;s&#x20;absence.','Without&#x20;a&#x20;screenlock&#x20;in&#x20;place&#x20;anyone&#x20;with&#x20;physical&#x20;access&#x20;to&#x20;the&#x20;computer&#x20;would&#x20;be&#x20;logged&#x20;in&#x20;and&#x20;able&#x20;to&#x20;use&#x20;the&#x20;active&#x20;user&#039;s&#x20;session.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;a&#x20;password&#x20;for&#x20;unlock&#x20;after&#x20;a&#x20;screen&#x20;saver&#x20;begins&#x20;or&#x20;after&#x20;sleep:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Lock&#x20;Screen&#x20;3.&#x20;Set&#x20;Require&#x20;password&#x20;after&#x20;screensaver&#x20;begins&#x20;or&#x20;display&#x20;is&#x20;turned&#x20;off&#x20;to&#x20;either&#x20;After&#x20;0&#x20;seconds&#x20;or&#x20;After&#x20;5&#x20;seconds&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;require&#x20;a&#x20;password&#x20;to&#x20;unlock&#x20;the&#x20;computer&#x20;after&#x20;the&#x20;screen&#x20;saver&#x20;engages&#x20;or&#x20;the&#x20;computer&#x20;sleeps:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/sysadminctl&#x20;-screenLock&#x20;immediate&#x20;-password&#x20;&lt;administrator&#x20;password&gt;&#x20;or&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/sysadminctl&#x20;-screenLock&#x20;5&#x20;seconds&#x20;-password&#x20;&lt;administrator&#x20;password&gt;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.screensaver&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;askForPassword&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;4.&#x20;The&#x20;key&#x20;to&#x20;also&#x20;include&#x20;is&#x20;askForPasswordDelay&#x20;5.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;&lt;0,5&gt;&lt;/integer&gt;.','[{\"cis\": [\"2.10.2\"]}, {\"cis_csc_v8\": [\"4.7\"]}, {\"cis_csc_v7\": [\"4.2\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"pci_dss_v3.2.1\": [\"2.1\", \"2.1.1\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"2.3.1\"]}, {\"soc_2\": [\"CC6.3\"]}]'),(31030,'Ensure&#x20;a&#x20;Custom&#x20;Message&#x20;for&#x20;the&#x20;Login&#x20;Screen&#x20;Is&#x20;Enabled.','An&#x20;access&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only,&#x20;and&#x20;that&#x20;the&#x20;use&#x20;of&#x20;the&#x20;system&#x20;may&#x20;be&#x20;monitored.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','If&#x20;users&#x20;are&#x20;not&#x20;informed&#x20;of&#x20;their&#x20;responsibilities,&#x20;unapproved&#x20;activities&#x20;may&#x20;occur.&#x20;Users&#x20;that&#x20;are&#x20;not&#x20;approved&#x20;for&#x20;access&#x20;may&#x20;take&#x20;the&#x20;lack&#x20;of&#x20;a&#x20;warning&#x20;banner&#x20;as&#x20;implied&#x20;consent&#x20;to&#x20;access.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;a&#x20;login&#x20;banner&#x20;set&#x20;to&#x20;your&#x20;organization&#039;s&#x20;required&#x20;text:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Lock&#x20;Screen&#x20;3.&#x20;Set&#x20;Show&#x20;message&#x20;when&#x20;locked&#x20;to&#x20;enabled&#x20;4.&#x20;Select&#x20;Set&#x20;5.&#x20;Insert&#x20;text&#x20;in&#x20;the&#x20;Set&#x20;a&#x20;message&#x20;to&#x20;appear&#x20;on&#x20;the&#x20;lock&#x20;screen&#x20;that&#x20;matches&#x20;your&#x20;organization&#039;s&#x20;required&#x20;text&#x20;6.&#x20;Select&#x20;Done&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;a&#x20;custom&#x20;login&#x20;screen&#x20;message:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;LoginwindowText&#x20;&quot;&lt;custom&#x20;message&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;LoginwindowText&#x20;&quot;Center&#x20;for&#x20;Internet&#x20;Security&#x20;Test&#x20;Message&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.loginwindow&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;LoginwindowText&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;string&gt;&lt;Your&#x20;organization&#039;s&#x20;required&#x20;text&gt;&lt;/string&gt;.','[{\"cis\": [\"2.10.3\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(31031,'Ensure&#x20;Login&#x20;Window&#x20;Displays&#x20;as&#x20;Name&#x20;and&#x20;Password&#x20;Is&#x20;Enabled.','The&#x20;login&#x20;window&#x20;prompts&#x20;a&#x20;user&#x20;for&#x20;his/her&#x20;credentials,&#x20;verifies&#x20;their&#x20;authorization&#x20;level,&#x20;and&#x20;then&#x20;allows&#x20;or&#x20;denies&#x20;the&#x20;user&#x20;access&#x20;to&#x20;the&#x20;system.','Prompting&#x20;the&#x20;user&#x20;to&#x20;enter&#x20;both&#x20;their&#x20;username&#x20;and&#x20;password&#x20;makes&#x20;it&#x20;twice&#x20;as&#x20;hard&#x20;for&#x20;unauthorized&#x20;users&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;since&#x20;they&#x20;must&#x20;discover&#x20;two&#x20;attributes.','','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;ensure&#x20;the&#x20;login&#x20;window&#x20;display&#x20;name&#x20;and&#x20;password:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Lock&#x20;Screen&#x20;3.&#x20;Set&#x20;&#039;Login&#x20;window&#x20;showstoName&#x20;and&#x20;Password`&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;login&#x20;window&#x20;to&#x20;display&#x20;name&#x20;and&#x20;password:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;SHOWFULLNAME&#x20;-bool&#x20;true&#x20;Note:&#x20;The&#x20;GUI&#x20;will&#x20;not&#x20;display&#x20;the&#x20;updated&#x20;setting&#x20;until&#x20;the&#x20;current&#x20;user&#40;s&#41;&#x20;logs&#x20;out.&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.loginwindow&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;SHOWFULLNAME&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"2.10.4\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(31032,'Ensure&#x20;Show&#x20;Password&#x20;Hints&#x20;Is&#x20;Disabled.','Password&#x20;hints&#x20;are&#x20;user-created&#x20;text&#x20;displayed&#x20;when&#x20;an&#x20;incorrect&#x20;password&#x20;is&#x20;used&#x20;for&#x20;an&#x20;account.','Password&#x20;hints&#x20;make&#x20;it&#x20;easier&#x20;for&#x20;unauthorized&#x20;persons&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;systems&#x20;by&#x20;displaying&#x20;information&#x20;provided&#x20;by&#x20;the&#x20;user&#x20;to&#x20;assist&#x20;in&#x20;remembering&#x20;the&#x20;password.&#x20;This&#x20;info&#x20;could&#x20;include&#x20;the&#x20;password&#x20;itself&#x20;or&#x20;other&#x20;information&#x20;that&#x20;might&#x20;be&#x20;readily&#x20;discerned&#x20;with&#x20;basic&#x20;knowledge&#x20;of&#x20;the&#x20;end&#x20;user.','The&#x20;user&#x20;can&#x20;set&#x20;the&#x20;hint&#x20;to&#x20;any&#x20;value,&#x20;including&#x20;the&#x20;password&#x20;itself&#x20;or&#x20;clues&#x20;that&#x20;allow&#x20;trivial&#x20;social&#x20;engineering&#x20;attacks.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;password&#x20;hints&#x20;from&#x20;being&#x20;shown:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Lock&#x20;Screen&#x20;3.&#x20;Set&#x20;&#039;Show&#x20;password&#x20;hints`&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;password&#x20;hints:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;RetriesUntilHint&#x20;-int&#x20;0&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.loginwindow&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;RetriesUntilHint&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;0&lt;/integer&gt;.','[{\"cis\": [\"2.10.5\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}]'),(31033,'Ensure&#x20;Users&#039;&#x20;Accounts&#x20;Do&#x20;Not&#x20;Have&#x20;a&#x20;Password&#x20;Hint.','Password&#x20;hints&#x20;help&#x20;the&#x20;user&#x20;recall&#x20;their&#x20;passwords&#x20;for&#x20;various&#x20;systems&#x20;and/or&#x20;accounts.&#x20;In&#x20;most&#x20;cases,&#x20;password&#x20;hints&#x20;are&#x20;simple&#x20;and&#x20;closely&#x20;related&#x20;to&#x20;the&#x20;user&#039;s&#x20;password.','Password&#x20;hints&#x20;that&#x20;are&#x20;closely&#x20;related&#x20;to&#x20;the&#x20;user&#039;s&#x20;password&#x20;are&#x20;a&#x20;security&#x20;vulnerability,&#x20;especially&#x20;in&#x20;the&#x20;social&#x20;media&#x20;age.&#x20;Unauthorized&#x20;users&#x20;are&#x20;more&#x20;likely&#x20;to&#x20;guess&#x20;a&#x20;user&#039;s&#x20;password&#x20;if&#x20;there&#x20;is&#x20;a&#x20;password&#x20;hint.&#x20;The&#x20;password&#x20;hint&#x20;is&#x20;very&#x20;susceptible&#x20;to&#x20;social&#x20;engineering&#x20;attacks&#x20;and&#x20;information&#x20;exposure&#x20;on&#x20;social&#x20;media&#x20;networks.','','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;remove&#x20;a&#x20;user&#039;s&#x20;password&#x20;hint:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Touch&#x20;ID&#x20;&amp;&#x20;Passwords&#x20;&#40;or&#x20;Login&#x20;Password&#x20;on&#x20;non-Touch&#x20;ID&#x20;Macs&#41;&#x20;3.&#x20;Select&#x20;Change...&#x20;4.&#x20;Change&#x20;the&#x20;password&#x20;and&#x20;ensure&#x20;that&#x20;no&#x20;text&#x20;is&#x20;entered&#x20;in&#x20;the&#x20;Password&#x20;hint&#x20;box&#x20;Note:&#x20;This&#x20;will&#x20;only&#x20;change&#x20;the&#x20;currently&#x20;logged-in&#x20;user&#039;s&#x20;password,&#x20;and&#x20;not&#x20;any&#x20;others&#x20;that&#x20;are&#x20;not&#x20;compliant&#x20;on&#x20;the&#x20;Mac.&#x20;Use&#x20;the&#x20;terminal&#x20;method&#x20;if&#x20;multiple&#x20;users&#x20;are&#x20;not&#x20;in&#x20;compliance.&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;a&#x20;user&#039;s&#x20;password&#x20;hint:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/dscl&#x20;.&#x20;-list&#x20;/Users&#x20;hint&#x20;.&#x20;-delete&#x20;/Users/&lt;username&gt;&#x20;hint&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/dscl&#x20;.&#x20;-list&#x20;/Users&#x20;hint&#x20;.&#x20;-delete&#x20;/Users/firstuser&#x20;hint&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/dscl&#x20;.&#x20;-list&#x20;/Users&#x20;hint&#x20;.&#x20;-delete&#x20;/Users/seconduser&#x20;hint.','[{\"cis\": [\"2.11.1\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(31034,'Ensure&#x20;Guest&#x20;Account&#x20;Is&#x20;Disabled.','The&#x20;guest&#x20;account&#x20;allows&#x20;users&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;having&#x20;to&#x20;create&#x20;an&#x20;account&#x20;or&#x20;password.&#x20;Guest&#x20;users&#x20;are&#x20;unable&#x20;to&#x20;make&#x20;setting&#x20;changes&#x20;and&#x20;cannot&#x20;remotely&#x20;login&#x20;to&#x20;the&#x20;system.&#x20;All&#x20;files,&#x20;caches,&#x20;and&#x20;passwords&#x20;created&#x20;by&#x20;the&#x20;guest&#x20;user&#x20;are&#x20;deleted&#x20;upon&#x20;logging&#x20;out.','Disabling&#x20;the&#x20;guest&#x20;account&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;using&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','A&#x20;guest&#x20;user&#x20;can&#x20;use&#x20;that&#x20;access&#x20;to&#x20;find&#x20;out&#x20;additional&#x20;information&#x20;about&#x20;the&#x20;system&#x20;and&#x20;might&#x20;be&#x20;able&#x20;to&#x20;use&#x20;privilege&#x20;escalation&#x20;vulnerabilities&#x20;to&#x20;establish&#x20;greater&#x20;access.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;disable&#x20;guest&#x20;account&#x20;availability:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Users&#x20;&amp;&#x20;Groups&#x20;3.&#x20;Select&#x20;the&#x20;i&#x20;next&#x20;to&#x20;the&#x20;Guest&#x20;User&#x20;4.&#x20;Set&#x20;Allow&#x20;guests&#x20;to&#x20;log&#x20;in&#x20;to&#x20;this&#x20;computer&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;guest&#x20;account:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.loginwindow&#x20;GuestEnabled&#x20;-bool&#x20;false&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.MCX&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;DisableGuestAccount&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;.','[{\"cis\": [\"2.12.1\"]}, {\"cis_csc_v8\": [\"5.2\", \"6.2\", \"6.8\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.4\", \"AC.L2-3.1.5\", \"IA.L2-3.5.7\", \"SC.L2-3.13.3\"]}, {\"hipaa\": [\"164.308(a)(3)(ii)(B)\", \"164.308(a)(3)(ii)(C)\", \"164.308(a)(4)(i)\", \"164.308(a)(4)(ii)(C)\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"nist_sp_800-53\": [\"AC-2(1)\", \"AC-5\", \"AC-6\", \"AC-6(1)\", \"AC-6(7)\", \"AU-9(4)\"]}, {\"pci_dss_v3.2.1\": [\"8.1.3\"]}, {\"pci_dss_v4.0\": [\"10.3.1\", \"2.2.2\", \"7.1\", \"7.1.1\", \"7.2\", \"7.2.1\", \"7.2.2\", \"7.2.4\", \"7.2.6\", \"7.3\", \"7.3.1\", \"7.3.2\", \"8.2.4\", \"8.2.5\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\", \"CC6.2\", \"CC6.3\"]}]'),(31035,'Ensure&#x20;Guest&#x20;Access&#x20;to&#x20;Shared&#x20;Folders&#x20;Is&#x20;Disabled.','Allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;enables&#x20;users&#x20;to&#x20;access&#x20;selected&#x20;shared&#x20;folders&#x20;and&#x20;their&#x20;contents&#x20;from&#x20;different&#x20;computers&#x20;on&#x20;a&#x20;network.','Not&#x20;allowing&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;mitigates&#x20;the&#x20;risk&#x20;of&#x20;an&#x20;untrusted&#x20;user&#x20;doing&#x20;basic&#x20;reconnaissance&#x20;and&#x20;possibly&#x20;use&#x20;privilege&#x20;escalation&#x20;attacks&#x20;to&#x20;take&#x20;control&#x20;of&#x20;the&#x20;system.','Unauthorized&#x20;users&#x20;could&#x20;access&#x20;shared&#x20;files&#x20;on&#x20;the&#x20;system.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;no&#x20;longer&#x20;allow&#x20;guest&#x20;user&#x20;access&#x20;to&#x20;shared&#x20;folders:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Users&#x20;&amp;&#x20;Groups&#x20;3.&#x20;Select&#x20;the&#x20;i&#x20;next&#x20;to&#x20;the&#x20;Guest&#x20;User&#x20;4.&#x20;Set&#x20;Allow&#x20;guests&#x20;to&#x20;connect&#x20;to&#x20;shared&#x20;folders&#x20;to&#x20;disabled&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;verify&#x20;that&#x20;shared&#x20;folders&#x20;are&#x20;not&#x20;accessible&#x20;to&#x20;guest&#x20;users:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/sysadminctl&#x20;-smbGuestAccess&#x20;off.','[{\"cis\": [\"2.12.2\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.3\", \"AC.L2-3.1.5\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1004\", \"T1015\", \"T1021\", \"T1023\", \"T1031\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1050\", \"T1051\", \"T1053\", \"T1054\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1089\", \"T1096\", \"T1097\", \"T1133\", \"T1134\", \"T1145\", \"T1146\", \"T1150\", \"T1152\", \"T1156\", \"T1157\", \"T1159\", \"T1160\", \"T1162\", \"T1163\", \"T1165\", \"T1168\", \"T1169\", \"T1184\", \"T1185\", \"T1196\", \"T1197\", \"T1198\", \"T1200\", \"T1209\", \"T1213\", \"T1484\", \"T1489\", \"T1492\", \"T1494\", \"T1501\", \"T1504\", \"T1528\", \"T1530\", \"T1537\", \"T1538\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(31036,'Ensure&#x20;Automatic&#x20;Login&#x20;Is&#x20;Disabled.','The&#x20;automatic&#x20;login&#x20;feature&#x20;saves&#x20;a&#x20;user&#039;s&#x20;system&#x20;access&#x20;credentials&#x20;and&#x20;bypasses&#x20;the&#x20;login&#x20;screen.&#x20;Instead,&#x20;the&#x20;system&#x20;automatically&#x20;loads&#x20;to&#x20;the&#x20;user&#039;s&#x20;desktop&#x20;screen.','Disabling&#x20;automatic&#x20;login&#x20;decreases&#x20;the&#x20;likelihood&#x20;of&#x20;an&#x20;unauthorized&#x20;person&#x20;gaining&#x20;access&#x20;to&#x20;a&#x20;system.','If&#x20;automatic&#x20;login&#x20;is&#x20;not&#x20;disabled,&#x20;an&#x20;unauthorized&#x20;user&#x20;could&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system&#x20;without&#x20;supplying&#x20;any&#x20;credentials.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;set&#x20;automatic&#x20;login&#x20;to&#x20;off:&#x20;1.&#x20;Open&#x20;System&#x20;Settings&#x20;2.&#x20;Select&#x20;Users&#x20;&amp;&#x20;Groups&#x20;3.&#x20;Set&#x20;Automatic&#x20;login&#x20;in&#x20;as...&#x20;to&#x20;Off&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;automatic&#x20;login:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;delete&#x20;/Library/Preferences/com.apple.loginwindow&#x20;autoLoginUser&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.loginwindow&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;com.apple.login.mcx.DisableAutoLoginClient&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;Note:&#x20;If&#x20;both&#x20;the&#x20;profile&#x20;is&#x20;enabled&#x20;and&#x20;a&#x20;user&#x20;is&#x20;set&#x20;to&#x20;autologin,&#x20;the&#x20;profile&#x20;will&#x20;take&#x20;precedent.&#x20;In&#x20;this&#x20;case,&#x20;the&#x20;graphical&#x20;or&#x20;terminal&#x20;remediation&#x20;method&#x20;should&#x20;also&#x20;be&#x20;applied&#x20;in&#x20;case&#x20;the&#x20;profile&#x20;is&#x20;ever&#x20;removed.','[{\"cis\": [\"2.12.3\"]}, {\"cis_csc_v8\": [\"4.7\"]}, {\"cis_csc_v7\": [\"4.2\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"pci_dss_v3.2.1\": [\"2.1\", \"2.1.1\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"2.3.1\"]}, {\"soc_2\": [\"CC6.3\"]}]'),(31037,'Ensure&#x20;Security&#x20;Auditing&#x20;Is&#x20;Enabled.','macOS&#039;s&#x20;audit&#x20;facility,&#x20;auditd,&#x20;receives&#x20;notifications&#x20;from&#x20;the&#x20;kernel&#x20;when&#x20;certain&#x20;system&#x20;calls,&#x20;such&#x20;as&#x20;open,&#x20;fork,&#x20;and&#x20;exit,&#x20;are&#x20;made.&#x20;These&#x20;notifications&#x20;are&#x20;captured&#x20;and&#x20;written&#x20;to&#x20;an&#x20;audit&#x20;log.','Logs&#x20;generated&#x20;by&#x20;auditd&#x20;may&#x20;be&#x20;useful&#x20;when&#x20;investigating&#x20;a&#x20;security&#x20;incident&#x20;as&#x20;they&#x20;may&#x20;help&#x20;reveal&#x20;the&#x20;vulnerable&#x20;application&#x20;and&#x20;the&#x20;actions&#x20;taken&#x20;by&#x20;a&#x20;malicious&#x20;actor.','','Terminal&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;enable&#x20;security&#x20;auditing:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;load&#x20;auditd:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;load&#x20;-w&#x20;/System/Library/LaunchDaemons/com.apple.auditd.plist.','[{\"cis\": [\"3.1\"]}, {\"cis_csc_v8\": [\"8.2\", \"8.5\"]}, {\"cis_csc_v7\": [\"4.9\", \"6.2\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.9.4.2\"]}, {\"nist_sp_800-53\": [\"AU-3(1)\", \"AU-7\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\"]}, {\"pci_dss_v4.0\": [\"10.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"9.4.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.2\"]}, {\"mitre_techniques\": [\"T1110\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1146\", \"T1196\", \"T1081\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1145\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\"]}]'),(31038,'Ensure&#x20;Security&#x20;Auditing&#x20;Flags&#x20;For&#x20;User-Attributable&#x20;Events&#x20;Are&#x20;Configured&#x20;Per&#x20;Local&#x20;Organizational&#x20;Requirements.','Auditing&#x20;is&#x20;the&#x20;capture&#x20;and&#x20;maintenance&#x20;of&#x20;information&#x20;about&#x20;security-related&#x20;events.&#x20;Auditable&#x20;events&#x20;often&#x20;depend&#x20;on&#x20;differing&#x20;organizational&#x20;requirements.','Maintaining&#x20;an&#x20;audit&#x20;trail&#x20;of&#x20;system&#x20;activity&#x20;logs&#x20;can&#x20;help&#x20;identify&#x20;configuration&#x20;errors,&#x20;troubleshoot&#x20;service&#x20;disruptions,&#x20;and&#x20;analyze&#x20;compromises&#x20;or&#x20;attacks&#x20;that&#x20;have&#x20;occurred,&#x20;have&#x20;begun,&#x20;or&#x20;are&#x20;about&#x20;to&#x20;begin.&#x20;Audit&#x20;logs&#x20;are&#x20;necessary&#x20;to&#x20;provide&#x20;a&#x20;trail&#x20;of&#x20;evidence&#x20;in&#x20;case&#x20;the&#x20;system&#x20;or&#x20;network&#x20;is&#x20;compromised.&#x20;Depending&#x20;on&#x20;the&#x20;governing&#x20;authority,&#x20;organizations&#x20;can&#x20;have&#x20;vastly&#x20;different&#x20;auditing&#x20;requirements.&#x20;In&#x20;this&#x20;control&#x20;we&#x20;have&#x20;selected&#x20;a&#x20;minimal&#x20;set&#x20;of&#x20;audit&#x20;flags&#x20;that&#x20;should&#x20;be&#x20;a&#x20;part&#x20;of&#x20;any&#x20;organizational&#x20;requirements.&#x20;The&#x20;flags&#x20;selected&#x20;below&#x20;may&#x20;not&#x20;adequately&#x20;meet&#x20;organizational&#x20;requirements&#x20;for&#x20;users&#x20;of&#x20;this&#x20;benchmark.&#x20;The&#x20;auditing&#x20;checks&#x20;for&#x20;the&#x20;flags&#x20;proposed&#x20;here&#x20;will&#x20;not&#x20;impact&#x20;additional&#x20;flags&#x20;that&#x20;are&#x20;selected.','','Terminal&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;the&#x20;required&#x20;Security&#x20;Auditing&#x20;Flags:&#x20;Edit&#x20;the&#x20;/etc/security/audit_control&#x20;file&#x20;and&#x20;add&#x20;-fm,&#x20;ad,&#x20;-ex,&#x20;aa,&#x20;-fr,&#x20;lo,&#x20;and&#x20;-fw&#x20;to&#x20;flags.&#x20;You&#x20;can&#x20;also&#x20;substitute&#x20;-all&#x20;for&#x20;-fm,&#x20;-ex,&#x20;-fr,&#x20;and&#x20;-fw.','[{\"cis\": [\"3.2\"]}, {\"cis_csc_v8\": [\"3.14\", \"8.2\", \"8.5\"]}, {\"cis_csc_v7\": [\"6.2\", \"14.9\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.7\", \"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\", \"164.312(c)(1)\", \"164.312(c)(2)\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.12.4.3\"]}, {\"nist_sp_800-53\": [\"AC-6(9)\", \"AU-3(1)\", \"AU-7\"]}, {\"pci_dss_v3.2.1\": [\"10.1\", \"10.2\", \"10.2.1\", \"10.2.2\", \"10.2.4\", \"10.2.5\", \"10.3\", \"11.5\"]}, {\"pci_dss_v4.0\": [\"10.2\", \"10.2.1\", \"10.2.1.1\", \"10.2.1.2\", \"10.2.1.3\", \"10.2.1.4\", \"10.2.1.5\", \"10.2.1.6\", \"10.2.1.7\", \"10.2.2\", \"5.3.4\", \"6.4.1\", \"6.4.2\", \"9.4.5\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\", \"CC7.2\"]}]'),(31039,'Ensure&#x20;install.log&#x20;Is&#x20;Retained&#x20;for&#x20;365&#x20;or&#x20;More&#x20;Days&#x20;and&#x20;No&#x20;Maximum&#x20;Size.','macOS&#x20;writes&#x20;information&#x20;pertaining&#x20;to&#x20;system-related&#x20;events&#x20;to&#x20;the&#x20;file&#x20;/var/log/install.log&#x20;and&#x20;has&#x20;a&#x20;configurable&#x20;retention&#x20;policy&#x20;for&#x20;this&#x20;file.&#x20;The&#x20;default&#x20;logging&#x20;setting&#x20;limits&#x20;the&#x20;file&#x20;size&#x20;of&#x20;the&#x20;logs&#x20;and&#x20;the&#x20;maximum&#x20;size&#x20;for&#x20;all&#x20;logs.&#x20;The&#x20;default&#x20;allows&#x20;for&#x20;an&#x20;errant&#x20;application&#x20;to&#x20;fill&#x20;the&#x20;log&#x20;files&#x20;and&#x20;does&#x20;not&#x20;enforce&#x20;sufficient&#x20;log&#x20;retention.&#x20;The&#x20;Benchmark&#x20;recommends&#x20;a&#x20;value&#x20;based&#x20;on&#x20;standard&#x20;use&#x20;cases.&#x20;The&#x20;value&#x20;should&#x20;align&#x20;with&#x20;local&#x20;requirements&#x20;within&#x20;the&#x20;organization.&#x20;The&#x20;default&#x20;value&#x20;has&#x20;an&#x20;&quot;all_max&quot;&#x20;file&#x20;limitation,&#x20;no&#x20;reference&#x20;to&#x20;a&#x20;minimum&#x20;retention,&#x20;and&#x20;a&#x20;less&#x20;precise&#x20;rotation&#x20;argument.&#x20;The&#x20;all_max&#x20;flag&#x20;control&#x20;will&#x20;remove&#x20;old&#x20;log&#x20;entries&#x20;based&#x20;only&#x20;on&#x20;the&#x20;size&#x20;of&#x20;the&#x20;log&#x20;files.&#x20;Log&#x20;size&#x20;can&#x20;vary&#x20;widely&#x20;depending&#x20;on&#x20;how&#x20;verbose&#x20;installing&#x20;applications&#x20;are&#x20;in&#x20;their&#x20;log&#x20;entries.&#x20;The&#x20;decision&#x20;here&#x20;is&#x20;to&#x20;ensure&#x20;that&#x20;logs&#x20;go&#x20;back&#x20;a&#x20;year,&#x20;and&#x20;depending&#x20;on&#x20;the&#x20;applications&#x20;a&#x20;size&#x20;restriction&#x20;could&#x20;compromise&#x20;the&#x20;ability&#x20;to&#x20;store&#x20;a&#x20;full&#x20;year.&#x20;While&#x20;this&#x20;Benchmark&#x20;is&#x20;not&#x20;scoring&#x20;for&#x20;a&#x20;rotation&#x20;flag,&#x20;the&#x20;default&#x20;rotation&#x20;is&#x20;sequential&#x20;rather&#x20;than&#x20;using&#x20;a&#x20;timestamp.&#x20;Auditors&#x20;may&#x20;prefer&#x20;timestamps&#x20;in&#x20;order&#x20;to&#x20;simply&#x20;review&#x20;specific&#x20;dates&#x20;where&#x20;event&#x20;information&#x20;is&#x20;desired.&#x20;Please&#x20;review&#x20;the&#x20;File&#x20;Rotation&#x20;section&#x20;in&#x20;the&#x20;man&#x20;page&#x20;for&#x20;more&#x20;information.&#x20;man&#x20;asl.conf&#x20;-&#x20;The&#x20;maximum&#x20;file&#x20;size&#x20;limitation&#x20;string&#x20;should&#x20;be&#x20;removed&#x20;&quot;all_max=&quot;&#x20;-&#x20;An&#x20;organization&#x20;appropriate&#x20;retention&#x20;should&#x20;be&#x20;added&#x20;&quot;ttl=&quot;&#x20;-&#x20;The&#x20;rotation&#x20;should&#x20;be&#x20;set&#x20;with&#x20;timestamps&#x20;&quot;rotate=utc&quot;&#x20;or&#x20;&quot;rotate=local&quot;.','Archiving&#x20;and&#x20;retaining&#x20;install.log&#x20;for&#x20;at&#x20;least&#x20;a&#x20;year&#x20;is&#x20;beneficial&#x20;in&#x20;the&#x20;event&#x20;of&#x20;an&#x20;incident&#x20;as&#x20;it&#x20;will&#x20;allow&#x20;the&#x20;user&#x20;to&#x20;view&#x20;the&#x20;various&#x20;changes&#x20;to&#x20;the&#x20;system&#x20;along&#x20;with&#x20;the&#x20;date&#x20;and&#x20;time&#x20;they&#x20;occurred.','Without&#x20;log&#x20;files&#x20;system&#x20;maintenance&#x20;and&#x20;security&#x20;forensics&#x20;cannot&#x20;be&#x20;properly&#x20;performed.','Terminal&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;ensure&#x20;that&#x20;install&#x20;logs&#x20;are&#x20;retained&#x20;for&#x20;at&#x20;least&#x20;365&#x20;days:&#x20;Edit&#x20;the&#x20;/etc/asl/com.apple.install&#x20;file&#x20;and&#x20;add&#x20;or&#x20;modify&#x20;the&#x20;ttl&#x20;value&#x20;to&#x20;365&#x20;or&#x20;greater&#x20;on&#x20;the&#x20;file&#x20;line.&#x20;Also,&#x20;remove&#x20;the&#x20;all_max=&#x20;setting&#x20;and&#x20;value&#x20;from&#x20;the&#x20;file&#x20;line.','[{\"cis\": [\"3.3\"]}, {\"cis_csc_v8\": [\"8.1\", \"8.3\"]}, {\"cis_csc_v7\": [\"6.4\", \"6.7\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.12.4.3\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}, {\"pci_dss_v4.0\": [\"10.1\", \"10.1.1\"]}, {\"soc_2\": [\"A1.1\"]}]'),(31040,'Ensure&#x20;Security&#x20;Auditing&#x20;Retention&#x20;Is&#x20;Enabled.','The&#x20;macOS&#x20;audit&#x20;capability&#x20;contains&#x20;important&#x20;information&#x20;to&#x20;investigate&#x20;security&#x20;or&#x20;operational&#x20;issues.&#x20;This&#x20;resource&#x20;is&#x20;only&#x20;completely&#x20;useful&#x20;if&#x20;it&#x20;is&#x20;retained&#x20;long&#x20;enough&#x20;to&#x20;allow&#x20;technical&#x20;staff&#x20;to&#x20;find&#x20;the&#x20;root&#x20;cause&#x20;of&#x20;anomalies&#x20;in&#x20;the&#x20;records.&#x20;Retention&#x20;can&#x20;be&#x20;set&#x20;to&#x20;respect&#x20;both&#x20;size&#x20;and&#x20;longevity.&#x20;To&#x20;retain&#x20;as&#x20;much&#x20;as&#x20;possible&#x20;under&#x20;a&#x20;certain&#x20;size,&#x20;the&#x20;recommendation&#x20;is&#x20;to&#x20;use&#x20;the&#x20;following:&#x20;expire-after:60d&#x20;OR&#x20;5G&#x20;This&#x20;recomendation&#x20;is&#x20;based&#x20;on&#x20;minimum&#x20;storage&#x20;for&#x20;review&#x20;and&#x20;investigation.&#x20;When&#x20;a&#x20;third&#x20;party&#x20;tool&#x20;is&#x20;in&#x20;use&#x20;to&#x20;allow&#x20;remote&#x20;logging&#x20;or&#x20;the&#x20;store&#x20;and&#x20;forwarding&#x20;of&#x20;logs,&#x20;this&#x20;local&#x20;storage&#x20;requirement&#x20;is&#x20;not&#x20;required.','The&#x20;audit&#x20;records&#x20;need&#x20;to&#x20;be&#x20;retained&#x20;long&#x20;enough&#x20;to&#x20;be&#x20;reviewed&#x20;as&#x20;necessary.','The&#x20;recommendation&#x20;is&#x20;that&#x20;at&#x20;least&#x20;60&#x20;days&#x20;or&#x20;5&#x20;gigabytes&#x20;of&#x20;audit&#x20;records&#x20;are&#x20;retained.&#x20;Systems&#x20;that&#x20;have&#x20;very&#x20;little&#x20;remaining&#x20;disk&#x20;space&#x20;may&#x20;have&#x20;issues&#x20;retaining&#x20;sufficient&#x20;data.','Terminal&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;the&#x20;audit&#x20;retention&#x20;length:&#x20;Edit&#x20;the&#x20;/etc/security/audit_control&#x20;file&#x20;so&#x20;that&#x20;expire-after:&#x20;is&#x20;at&#x20;least&#x20;60d&#x20;OR&#x20;5G.','[{\"cis\": [\"3.4\"]}, {\"cis_csc_v8\": [\"8.1\", \"8.3\"]}, {\"cis_csc_v7\": [\"6.4\", \"6.7\"]}, {\"cmmc_v2.0\": [\"AU.L2-3.3.1\"]}, {\"hipaa\": [\"164.312(b)\"]}, {\"iso_27001-2013\": [\"A.12.4.1\", \"A.12.4.3\"]}, {\"pci_dss_v3.2.1\": [\"10.7\"]}, {\"pci_dss_v4.0\": [\"10.1\", \"10.1.1\"]}, {\"soc_2\": [\"A1.1\"]}]'),(31041,'Ensure&#x20;Bonjour&#x20;Advertising&#x20;Services&#x20;Is&#x20;Disabled.','Bonjour&#x20;is&#x20;an&#x20;auto-discovery&#x20;mechanism&#x20;for&#x20;TCP/IP&#x20;devices&#x20;which&#x20;enumerate&#x20;devices&#x20;and&#x20;services&#x20;within&#x20;a&#x20;local&#x20;subnet.&#x20;DNS&#x20;on&#x20;macOS&#x20;is&#x20;integrated&#x20;with&#x20;Bonjour&#x20;and&#x20;should&#x20;not&#x20;be&#x20;turned&#x20;off,&#x20;but&#x20;the&#x20;Bonjour&#x20;advertising&#x20;service&#x20;can&#x20;be&#x20;disabled.','Bonjour&#x20;can&#x20;simplify&#x20;device&#x20;discovery&#x20;from&#x20;an&#x20;internal&#x20;rogue&#x20;or&#x20;compromised&#x20;host.&#x20;An&#x20;attacker&#x20;could&#x20;use&#x20;Bonjour&#039;s&#x20;multicast&#x20;DNS&#x20;feature&#x20;to&#x20;discover&#x20;a&#x20;vulnerable&#x20;or&#x20;poorly-configured&#x20;service&#x20;or&#x20;additional&#x20;information&#x20;to&#x20;aid&#x20;a&#x20;targeted&#x20;attack.&#x20;Implementing&#x20;this&#x20;control&#x20;disables&#x20;the&#x20;continuous&#x20;broadcasting&#x20;of&#x20;&quot;I&#039;m&#x20;here!&quot;&#x20;messages.&#x20;Typical&#x20;end-user&#x20;endpoints&#x20;should&#x20;not&#x20;have&#x20;to&#x20;advertise&#x20;services&#x20;to&#x20;other&#x20;computers.&#x20;This&#x20;setting&#x20;does&#x20;not&#x20;stop&#x20;the&#x20;computer&#x20;from&#x20;sending&#x20;out&#x20;service&#x20;discovery&#x20;messages&#x20;when&#x20;looking&#x20;for&#x20;services&#x20;on&#x20;an&#x20;internal&#x20;subnet,&#x20;if&#x20;the&#x20;computer&#x20;is&#x20;looking&#x20;for&#x20;a&#x20;printer&#x20;or&#x20;server&#x20;and&#x20;using&#x20;service&#x20;discovery.&#x20;To&#x20;block&#x20;all&#x20;Bonjour&#x20;traffic&#x20;except&#x20;to&#x20;approved&#x20;devices,&#x20;the&#x20;pf&#x20;or&#x20;other&#x20;firewall&#x20;would&#x20;be&#x20;needed.','Some&#x20;applications,&#x20;like&#x20;Final&#x20;Cut&#x20;Studio&#x20;and&#x20;AirPort&#x20;Base&#x20;Station&#x20;management,&#x20;may&#x20;not&#x20;operate&#x20;properly&#x20;if&#x20;the&#x20;mDNSResponder&#x20;is&#x20;turned&#x20;off.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;Bonjour&#x20;Advertising&#x20;services:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/defaults&#x20;write&#x20;/Library/Preferences/com.apple.mDNSResponder.plist&#x20;NoMulticastAdvertisements&#x20;-bool&#x20;true&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mDNSResponder&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;NoMulticastAdvertisements.','[{\"cis\": [\"4.1\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31042,'Ensure&#x20;HTTP&#x20;Server&#x20;Is&#x20;Disabled.','macOS&#x20;used&#x20;to&#x20;have&#x20;a&#x20;graphical&#x20;front-end&#x20;to&#x20;the&#x20;embedded&#x20;Apache&#x20;web&#x20;server&#x20;in&#x20;the&#x20;Operating&#x20;System.&#x20;Personal&#x20;web&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;download&#x20;files&#x20;or&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;Personal&#x20;web&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable,&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;Apache,&#x20;however,&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;share&#x20;files&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end-user&#x20;computer.&#x20;Web&#x20;sharing&#x20;should&#x20;only&#x20;be&#x20;done&#x20;through&#x20;hardened&#x20;web&#x20;servers&#x20;and&#x20;appropriate&#x20;cloud&#x20;services.','Web&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;webservers&#x20;or&#x20;appropriate&#x20;cloud&#x20;storage&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','The&#x20;web&#x20;server&#x20;is&#x20;both&#x20;a&#x20;point&#x20;of&#x20;attack&#x20;for&#x20;the&#x20;system&#x20;and&#x20;a&#x20;means&#x20;for&#x20;unauthorized&#x20;file&#x20;transfers.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;HTTP&#x20;server&#x20;services:&#x20;$&#x20;sudo&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;unload&#x20;-w&#x20;/System/Library/LaunchDaemons/org.apache.httpd.plist.','[{\"cis\": [\"4.2\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31043,'Ensure&#x20;NFS&#x20;Server&#x20;Is&#x20;Disabled.','macOS&#x20;can&#x20;act&#x20;as&#x20;an&#x20;NFS&#x20;fileserver.&#x20;NFS&#x20;sharing&#x20;could&#x20;be&#x20;enabled&#x20;to&#x20;allow&#x20;someone&#x20;on&#x20;another&#x20;computer&#x20;to&#x20;mount&#x20;shares&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;information&#x20;from&#x20;the&#x20;user&#039;s&#x20;computer.&#x20;File&#x20;sharing&#x20;from&#x20;a&#x20;user&#x20;endpoint&#x20;has&#x20;long&#x20;been&#x20;considered&#x20;questionable,&#x20;and&#x20;Apple&#x20;has&#x20;removed&#x20;that&#x20;capability&#x20;from&#x20;the&#x20;GUI.&#x20;NFSD&#x20;is&#x20;still&#x20;part&#x20;of&#x20;the&#x20;Operating&#x20;System&#x20;and&#x20;can&#x20;be&#x20;easily&#x20;turned&#x20;on&#x20;to&#x20;export&#x20;shares&#x20;and&#x20;provide&#x20;remote&#x20;connectivity&#x20;to&#x20;an&#x20;end-user&#x20;computer.&#x20;The&#x20;etc/exports&#x20;file&#x20;contains&#x20;the&#x20;list&#x20;of&#x20;NFS&#x20;shared&#x20;directories.&#x20;If&#x20;the&#x20;file&#x20;exists,&#x20;it&#x20;is&#x20;likely&#x20;that&#x20;NFS&#x20;sharing&#x20;has&#x20;been&#x20;enabled&#x20;in&#x20;the&#x20;past&#x20;or&#x20;may&#x20;be&#x20;available&#x20;periodically.&#x20;As&#x20;an&#x20;additional&#x20;check,&#x20;the&#x20;audit&#x20;verifies&#x20;that&#x20;there&#x20;is&#x20;no&#x20;/etc/exports&#x20;file.','File&#x20;serving&#x20;should&#x20;not&#x20;be&#x20;done&#x20;from&#x20;a&#x20;user&#x20;desktop.&#x20;Dedicated&#x20;servers&#x20;should&#x20;be&#x20;used.&#x20;Open&#x20;ports&#x20;make&#x20;it&#x20;easier&#x20;to&#x20;exploit&#x20;the&#x20;computer.','The&#x20;nfs&#x20;server&#x20;is&#x20;both&#x20;a&#x20;point&#x20;of&#x20;attack&#x20;for&#x20;the&#x20;system&#x20;and&#x20;a&#x20;means&#x20;for&#x20;unauthorized&#x20;file&#x20;transfers.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;nfsd&#x20;fileserver&#x20;services:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/launchctl&#x20;disable&#x20;system/com.apple.nfsd&#x20;Remove&#x20;the&#x20;exported&#x20;Directory&#x20;listing.&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/rm&#x20;/etc/exports.','[{\"cis\": [\"4.3\"]}, {\"cis_csc_v8\": [\"4.1\", \"4.8\"]}, {\"cis_csc_v7\": [\"5.1\", \"9.2\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\", \"CM.L2-3.4.8\", \"SC.L2-3.13.6\"]}, {\"iso_27001-2013\": [\"A.13.1.3\", \"A.14.2.5\", \"A.8.1.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1011\", \"T1015\", \"T1017\", \"T1019\", \"T1028\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1051\", \"T1053\", \"T1054\", \"T1055\", \"T1058\", \"T1067\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1086\", \"T1087\", \"T1088\", \"T1089\", \"T1092\", \"T1096\", \"T1097\", \"T1098\", \"T1100\", \"T1110\", \"T1112\", \"T1130\", \"T1133\", \"T1134\", \"T1136\", \"T1137\", \"T1138\", \"T1139\", \"T1142\", \"T1145\", \"T1146\", \"T1147\", \"T1148\", \"T1150\", \"T1156\", \"T1157\", \"T1165\", \"T1166\", \"T1169\", \"T1173\", \"T1174\", \"T1175\", \"T1176\", \"T1177\", \"T1178\", \"T1184\", \"T1187\", \"T1190\", \"T1196\", \"T1197\", \"T1198\", \"T1199\", \"T1200\", \"T1201\", \"T1206\", \"T1208\", \"T1209\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1485\", \"T1486\", \"T1487\", \"T1488\", \"T1489\", \"T1490\", \"T1491\", \"T1492\", \"T1494\", \"T1495\", \"T1501\", \"T1503\", \"T1504\", \"T1505\", \"T1506\", \"T1525\", \"T1530\", \"T1535\", \"T1537\", \"T1539\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"1.1.6\", \"1.2.1\", \"11.5\", \"2.2\", \"2.2.2\", \"2.2.5\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.5\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\", \"2.2.4\", \"6.4.1\"]}, {\"soc_2\": [\"CC6.3\", \"CC6.6\", \"CC7.1\", \"CC8.1\"]}]'),(31044,'Ensure&#x20;Home&#x20;Folders&#x20;Are&#x20;Secure.','By&#x20;default,&#x20;macOS&#x20;allows&#x20;all&#x20;valid&#x20;users&#x20;into&#x20;the&#x20;top&#x20;level&#x20;of&#x20;every&#x20;other&#x20;user&#039;s&#x20;home&#x20;folder&#x20;and&#x20;restricts&#x20;access&#x20;to&#x20;the&#x20;Apple&#x20;default&#x20;folders&#x20;within.&#x20;Another&#x20;user&#x20;on&#x20;the&#x20;same&#x20;system&#x20;can&#x20;see&#x20;you&#x20;have&#x20;a&#x20;&quot;Documents&quot;&#x20;folder&#x20;but&#x20;cannot&#x20;see&#x20;inside&#x20;it.&#x20;This&#x20;configuration&#x20;does&#x20;work&#x20;for&#x20;personal&#x20;file&#x20;sharing&#x20;but&#x20;can&#x20;expose&#x20;user&#x20;files&#x20;to&#x20;standard&#x20;accounts&#x20;on&#x20;the&#x20;system.&#x20;The&#x20;best&#x20;parallel&#x20;for&#x20;Enterprise&#x20;environments&#x20;is&#x20;that&#x20;everyone&#x20;who&#x20;has&#x20;a&#x20;Dropbox&#x20;account&#x20;can&#x20;see&#x20;everything&#x20;that&#x20;is&#x20;at&#x20;the&#x20;top&#x20;level&#x20;but&#x20;can&#039;t&#x20;see&#x20;your&#x20;pictures.&#x20;Similarly&#x20;with&#x20;macOS,&#x20;users&#x20;can&#x20;see&#x20;into&#x20;every&#x20;new&#x20;Directory&#x20;that&#x20;is&#x20;created&#x20;because&#x20;of&#x20;the&#x20;default&#x20;permissions.&#x20;Home&#x20;folders&#x20;should&#x20;be&#x20;restricted&#x20;to&#x20;access&#x20;only&#x20;by&#x20;the&#x20;user.&#x20;Sharing&#x20;should&#x20;be&#x20;used&#x20;on&#x20;dedicated&#x20;servers&#x20;or&#x20;cloud&#x20;instances&#x20;that&#x20;are&#x20;managing&#x20;access&#x20;controls.&#x20;Some&#x20;environments&#x20;may&#x20;encounter&#x20;problems&#x20;if&#x20;execute&#x20;rights&#x20;are&#x20;removed&#x20;as&#x20;well&#x20;as&#x20;read&#x20;and&#x20;write.&#x20;Either&#x20;no&#x20;access&#x20;or&#x20;execute&#x20;only&#x20;for&#x20;group&#x20;or&#x20;others&#x20;is&#x20;acceptable.','Allowing&#x20;all&#x20;users&#x20;to&#x20;view&#x20;the&#x20;top&#x20;level&#x20;of&#x20;all&#x20;networked&#x20;users&#039;&#x20;home&#x20;folder&#x20;may&#x20;not&#x20;be&#x20;desirable&#x20;since&#x20;it&#x20;may&#x20;lead&#x20;to&#x20;the&#x20;revelation&#x20;of&#x20;sensitive&#x20;information.','If&#x20;implemented,&#x20;users&#x20;will&#x20;not&#x20;be&#x20;able&#x20;to&#x20;use&#x20;the&#x20;&quot;Public&quot;&#x20;folders&#x20;in&#x20;other&#x20;users&#039;&#x20;home&#x20;folders.&#x20;&quot;Public&quot;&#x20;folders&#x20;with&#x20;appropriate&#x20;permissions&#x20;would&#x20;need&#x20;to&#x20;be&#x20;set&#x20;up&#x20;in&#x20;the&#x20;/Shared&#x20;folder.','Terminal&#x20;Method:&#x20;For&#x20;each&#x20;user,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;secure&#x20;all&#x20;home&#x20;folders:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/chmod&#x20;-R&#x20;og-rwx&#x20;/Users/&lt;username&gt;&#x20;Alternately,&#x20;run&#x20;the&#x20;following&#x20;command&#x20;if&#x20;there&#x20;needs&#x20;to&#x20;be&#x20;executable&#x20;access&#x20;for&#x20;a&#x20;home&#x20;folder:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/chmod&#x20;-R&#x20;og-rw&#x20;/Users/&lt;username&gt;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/chmod&#x20;-R&#x20;og-rw&#x20;/Users/thirduser/&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/chmod&#x20;-R&#x20;og-rwx&#x20;/Users/fourthuser/&#x20;#&#x20;/bin/ls&#x20;-l&#x20;/Users/&#x20;total&#x20;0&#x20;drwxr-xr-x+&#x20;12&#x20;Guest&#x20;_guest&#x20;384&#x20;24&#x20;Jul&#x20;13:42&#x20;Guest&#x20;drwxrwxrwt&#x20;4&#x20;root&#x20;wheel&#x20;128&#x20;22&#x20;Jul&#x20;11:00&#x20;Shared&#x20;drwx--x--x+&#x20;18&#x20;firstuser&#x20;staff&#x20;576&#x20;10&#x20;Aug&#x20;14:36&#x20;firstuser&#x20;drwx--x--x+&#x20;15&#x20;seconduser&#x20;staff&#x20;480&#x20;10&#x20;Aug&#x20;09:16&#x20;seconduser&#x20;drwx--x--x+&#x20;11&#x20;thirduser&#x20;staff&#x20;352&#x20;10&#x20;Aug&#x20;14:53&#x20;thirduser&#x20;drwx------+&#x20;11&#x20;fourthuser&#x20;staff&#x20;352&#x20;10&#x20;Aug&#x20;14:53&#x20;fourthuser.','[{\"cis\": [\"5.1.1\"]}, {\"cis_csc_v8\": [\"3.3\"]}, {\"cis_csc_v7\": [\"14.6\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"AC.L2-3.1.3\", \"AC.L2-3.1.5\", \"MP.L2-3.8.2\"]}, {\"hipaa\": [\"164.308(a)(3)(i)\", \"164.308(a)(3)(ii)(A)\", \"164.312(a)(1)\"]}, {\"iso_27001-2013\": [\"A.9.1.1\"]}, {\"mitre_techniques\": [\"T1004\", \"T1015\", \"T1021\", \"T1023\", \"T1031\", \"T1034\", \"T1035\", \"T1036\", \"T1037\", \"T1044\", \"T1047\", \"T1050\", \"T1051\", \"T1053\", \"T1054\", \"T1070\", \"T1072\", \"T1073\", \"T1075\", \"T1076\", \"T1078\", \"T1080\", \"T1081\", \"T1084\", \"T1089\", \"T1096\", \"T1097\", \"T1133\", \"T1134\", \"T1145\", \"T1146\", \"T1150\", \"T1152\", \"T1156\", \"T1157\", \"T1159\", \"T1160\", \"T1162\", \"T1163\", \"T1165\", \"T1168\", \"T1169\", \"T1184\", \"T1185\", \"T1196\", \"T1197\", \"T1198\", \"T1200\", \"T1209\", \"T1213\", \"T1484\", \"T1489\", \"T1492\", \"T1494\", \"T1501\", \"T1504\", \"T1528\", \"T1530\", \"T1537\", \"T1538\"]}, {\"nist_sp_800-53\": [\"AC-5\", \"AC-6\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"pci_dss_v4.0\": [\"1.3.1\", \"7.1\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.1\"]}]'),(31045,'Ensure&#x20;System&#x20;Integrity&#x20;Protection&#x20;Status&#x20;&#40;SIP&#41;&#x20;Is&#x20;Enabled.','System&#x20;Integrity&#x20;Protection&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;OS&#x20;X&#x20;10.11&#x20;El&#x20;Capitan.&#x20;System&#x20;Integrity&#x20;Protection&#x20;restricts&#x20;access&#x20;to&#x20;System&#x20;domain&#x20;locations&#x20;and&#x20;restricts&#x20;runtime&#x20;attachment&#x20;to&#x20;system&#x20;processes.&#x20;Any&#x20;attempt&#x20;to&#x20;inspect&#x20;or&#x20;attach&#x20;to&#x20;a&#x20;system&#x20;process&#x20;will&#x20;fail.&#x20;Kernel&#x20;Extensions&#x20;are&#x20;now&#x20;restricted&#x20;to&#x20;/Library/Extensions&#x20;and&#x20;are&#x20;required&#x20;to&#x20;be&#x20;signed&#x20;with&#x20;a&#x20;Developer&#x20;ID.','Running&#x20;without&#x20;System&#x20;Integrity&#x20;Protection&#x20;on&#x20;a&#x20;production&#x20;system&#x20;runs&#x20;the&#x20;risk&#x20;of&#x20;the&#x20;modification&#x20;of&#x20;system&#x20;binaries&#x20;or&#x20;code&#x20;injection&#x20;of&#x20;system&#x20;processes&#x20;that&#x20;would&#x20;otherwise&#x20;be&#x20;protected&#x20;by&#x20;SIP.','System&#x20;binaries&#x20;and&#x20;processes&#x20;could&#x20;become&#x20;compromised.','Terminal&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;enable&#x20;System&#x20;Integrity&#x20;Protection:&#x20;1.&#x20;Reboot&#x20;into&#x20;the&#x20;Recovery&#x20;Partition&#x20;&#40;reboot&#x20;and&#x20;hold&#x20;down&#x20;Command&#x20;+&#x20;R&#41;&#x20;2.&#x20;Select&#x20;Utilities&#x20;3.&#x20;Select&#x20;Terminal&#x20;4.&#x20;Run&#x20;the&#x20;following&#x20;command:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/csrutil&#x20;enable&#x20;Successfully&#x20;enabled&#x20;System&#x20;Integrity&#x20;Protection.&#x20;Please&#x20;restart&#x20;the&#x20;machine&#x20;for&#x20;the&#x20;changes&#x20;to&#x20;take&#x20;effect.&#x20;5.&#x20;Reboot&#x20;the&#x20;computer&#x20;Note:&#x20;You&#x20;should&#x20;research&#x20;why&#x20;the&#x20;system&#x20;had&#x20;SIP&#x20;disabled.&#x20;It&#x20;might&#x20;be&#x20;a&#x20;better&#x20;option&#x20;to&#x20;erase&#x20;the&#x20;Mac&#x20;and&#x20;reinstall&#x20;the&#x20;operating&#x20;system.&#x20;That&#x20;is&#x20;at&#x20;your&#x20;discretion.&#x20;Note:&#x20;You&#x20;cannot&#x20;enable&#x20;System&#x20;Integrity&#x20;Protection&#x20;from&#x20;the&#x20;booted&#x20;operating&#x20;system.&#x20;If&#x20;the&#x20;remediation&#x20;is&#x20;attempted&#x20;in&#x20;the&#x20;booted&#x20;OS&#x20;and&#x20;not&#x20;the&#x20;Recovery&#x20;Partition&#x20;the&#x20;output&#x20;will&#x20;give&#x20;the&#x20;error&#x20;csrutil:&#x20;failed&#x20;to&#x20;modify&#x20;system&#x20;integrity&#x20;configuration.&#x20;This&#x20;tool&#x20;needs&#x20;to&#x20;be&#x20;executed&#x20;from&#x20;the&#x20;Recovery&#x20;OS.','[{\"cis\": [\"5.1.2\"]}, {\"cis_csc_v8\": [\"2.3\", \"2.6\", \"10.5\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.9\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"nist_sp_800-53\": [\"CM-10\", \"CM-7(1)\", \"CM-7(2)\", \"CM-8(3)\", \"SI-16\"]}, {\"pci_dss_v3.2.1\": [\"1.4\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"12.3.4\", \"2.2.4\"]}, {\"soc_2\": [\"CC5.2\", \"CC6.8\", \"CC7.1\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}]'),(31046,'Ensure&#x20;Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;&#40;AMFI&#41;&#x20;Is&#x20;Enabled.','Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;&#40;AMFI&#41;&#x20;was&#x20;first&#x20;released&#x20;in&#x20;macOS&#x20;10.12.&#x20;The&#x20;daemon&#x20;and&#x20;service&#x20;block&#x20;attempts&#x20;to&#x20;run&#x20;unsigned&#x20;code.&#x20;AMFI&#x20;uses&#x20;lanchd,&#x20;code&#x20;signatures,&#x20;certificates,&#x20;entitlements,&#x20;and&#x20;provisioning&#x20;profiles&#x20;to&#x20;create&#x20;a&#x20;filtered&#x20;entitlement&#x20;dictionary&#x20;for&#x20;an&#x20;app.&#x20;AMFI&#x20;is&#x20;the&#x20;macOS&#x20;kernel&#x20;module&#x20;that&#x20;enforces&#x20;code-signing&#x20;and&#x20;library&#x20;validation.','Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;validates&#x20;that&#x20;application&#x20;code&#x20;is&#x20;validated.','Applications&#x20;could&#x20;be&#x20;compromised&#x20;with&#x20;malicious&#x20;code.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;enable&#x20;the&#x20;Apple&#x20;Mobile&#x20;File&#x20;Integrity&#x20;service:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/nvram&#x20;boot-args=&quot;&quot;.','[{\"cis\": [\"5.1.3\"]}, {\"cis_csc_v8\": [\"2.3\", \"2.6\"]}, {\"cis_csc_v7\": [\"2.6\"]}, {\"cmmc_v2.0\": [\"CM.L2-3.4.7\", \"CM.L2-3.4.9\"]}, {\"iso_27001-2013\": [\"A.12.5.1\", \"A.12.6.2\"]}, {\"nist_sp_800-53\": [\"CM-10\", \"CM-7(1)\", \"CM-7(2)\", \"CM-8(3)\"]}, {\"pci_dss_v4.0\": [\"1.2.5\", \"12.3.4\", \"2.2.4\"]}, {\"soc_2\": [\"CC5.2\", \"CC7.1\"]}, {\"mitre_techniques\": [\"T1191\", \"T1092\", \"T1175\", \"T1173\", \"T1519\", \"T1052\", \"T1210\", \"T1133\", \"T1118\", \"T1171\", \"T1170\", \"T1046\", \"T1137\", \"T1086\", \"T1164\", \"T1121\", \"T1076\", \"T1091\", \"T1180\", \"T1064\", \"T1184\", \"T1221\", \"T1127\", \"T1028\"]}]'),(31047,'Ensure&#x20;Sealed&#x20;System&#x20;Volume&#x20;&#40;SSV&#41;&#x20;Is&#x20;Enabled.','Sealed&#x20;System&#x20;Volume&#x20;is&#x20;a&#x20;security&#x20;feature&#x20;introduced&#x20;in&#x20;macOS&#x20;11.0&#x20;Big&#x20;Sur.&#x20;During&#x20;system&#x20;installation,&#x20;a&#x20;SHA-256&#x20;cryptographic&#x20;hash&#x20;is&#x20;calculated&#x20;for&#x20;all&#x20;immutable&#x20;system&#x20;files&#x20;and&#x20;stored&#x20;in&#x20;a&#x20;Merkle&#x20;tree&#x20;which&#x20;itself&#x20;is&#x20;hashed&#x20;as&#x20;the&#x20;Seal.&#x20;Both&#x20;are&#x20;stored&#x20;in&#x20;the&#x20;metadata&#x20;of&#x20;the&#x20;snapshot&#x20;created&#x20;of&#x20;the&#x20;System&#x20;volume.&#x20;The&#x20;seal&#x20;is&#x20;verified&#x20;by&#x20;the&#x20;boot&#x20;loader&#x20;at&#x20;startup.&#x20;macOS&#x20;will&#x20;not&#x20;boot&#x20;if&#x20;system&#x20;files&#x20;have&#x20;been&#x20;tampered&#x20;with.&#x20;If&#x20;validation&#x20;fails,&#x20;the&#x20;user&#x20;will&#x20;be&#x20;instructed&#x20;to&#x20;reinstall&#x20;the&#x20;operating&#x20;system.&#x20;During&#x20;read&#x20;operations&#x20;for&#x20;files&#x20;located&#x20;in&#x20;the&#x20;Sealed&#x20;System&#x20;Volume,&#x20;a&#x20;hash&#x20;is&#x20;calculated&#x20;and&#x20;compared&#x20;to&#x20;the&#x20;value&#x20;stored&#x20;in&#x20;the&#x20;Merkle&#x20;tree.','Running&#x20;without&#x20;Sealed&#x20;System&#x20;Volume&#x20;on&#x20;a&#x20;production&#x20;system&#x20;could&#x20;run&#x20;the&#x20;risk&#x20;of&#x20;Apple&#x20;software&#x20;that&#x20;integrates&#x20;directly&#x20;with&#x20;macOS&#x20;being&#x20;modified.','Apple&#x20;Software&#x20;that&#x20;integrates&#x20;with&#x20;the&#x20;operating&#x20;system&#x20;could&#x20;become&#x20;compromised.','If&#x20;SSV&#x20;has&#x20;been&#x20;disabled,&#x20;assume&#x20;that&#x20;the&#x20;operating&#x20;system&#x20;has&#x20;been&#x20;compromised.&#x20;Back&#x20;up&#x20;any&#x20;files,&#x20;and&#x20;do&#x20;a&#x20;clean&#x20;install&#x20;to&#x20;a&#x20;known&#x20;good&#x20;Operating&#x20;System.','[{\"cis\": [\"5.1.4\"]}, {\"cis_csc_v8\": [\"3.6\", \"3.11\"]}, {\"cis_csc_v7\": [\"13.6\", \"14.8\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.19\", \"IA.L2-3.5.10\", \"MP.L2-3.8.1\", \"SC.L2-3.13.11\", \"SC.L2-3.13.16\"]}, {\"hipaa\": [\"164.312(a)(2)(iv)\", \"164.312(e)(2)(ii)\"]}, {\"iso_27001-2013\": [\"A.10.1.1\", \"A.6.2.1\"]}, {\"nist_sp_800-53\": [\"SC-28\", \"SC-28(1)\"]}, {\"pci_dss_v3.2.1\": [\"3.4\", \"3.4.1\", \"8.2.1\"]}, {\"pci_dss_v4.0\": [\"3.1.1\", \"3.3.2\", \"3.3.3\", \"3.5.1\", \"3.5.1.2\", \"3.5.1.3\", \"8.3.2\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"mitre_techniques\": [\"T1527\", \"T1119\", \"T1530\", \"T1114\", \"T1070\", \"T1208\", \"T1040\", \"T1145\", \"T1492\", \"T1493\", \"T1072\"]}]'),(31048,'Ensure&#x20;Password&#x20;Account&#x20;Lockout&#x20;Threshold&#x20;Is&#x20;Configured.','The&#x20;account&#x20;lockout&#x20;threshold&#x20;specifies&#x20;the&#x20;amount&#x20;of&#x20;times&#x20;a&#x20;user&#x20;can&#x20;enter&#x20;an&#x20;incorrect&#x20;password&#x20;before&#x20;a&#x20;lockout&#x20;will&#x20;occur.&#x20;Ensure&#x20;that&#x20;a&#x20;lockout&#x20;threshold&#x20;is&#x20;part&#x20;of&#x20;the&#x20;password&#x20;policy&#x20;on&#x20;the&#x20;computer.','The&#x20;account&#x20;lockout&#x20;feature&#x20;mitigates&#x20;brute-force&#x20;password&#x20;attacks&#x20;on&#x20;the&#x20;system.','The&#x20;number&#x20;of&#x20;incorrect&#x20;log&#x20;on&#x20;attempts&#x20;should&#x20;be&#x20;reasonably&#x20;small&#x20;to&#x20;minimize&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;successful&#x20;password&#x20;attack,&#x20;while&#x20;allowing&#x20;for&#x20;honest&#x20;errors&#x20;made&#x20;during&#x20;a&#x20;normal&#x20;user&#x20;log&#x20;on.&#x20;The&#x20;locked&#x20;account&#x20;will&#x20;auto-unlock&#x20;after&#x20;a&#x20;few&#x20;minutes&#x20;when&#x20;bad&#x20;password&#x20;attempts&#x20;stop.&#x20;The&#x20;computer&#x20;will&#x20;accept&#x20;the&#x20;still-valid&#x20;password&#x20;if&#x20;remembered&#x20;or&#x20;recovered.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;maximum&#x20;number&#x20;of&#x20;failed&#x20;login&#x20;attempts&#x20;to&#x20;less&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;5:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;maxFailedLoginAttempts=&lt;value=&lt;5&gt;&quot;&#x20;Note:&#x20;When&#x20;the&#x20;account&#x20;lockout&#x20;threshold&#x20;is&#x20;set&#x20;with&#x20;pwpolicy,&#x20;it&#x20;will&#x20;also&#x20;set&#x20;a&#x20;reset&#x20;value&#x20;to&#x20;policyAttributeMinutesUntilFailedAuthenticationReset&#x20;that&#x20;defaults&#x20;to&#x20;1&#x20;minute.&#x20;You&#x20;can&#x20;change&#x20;this&#x20;value&#x20;with&#x20;the&#x20;command:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;policyAttributeMinutesUntilFailedAuthenticationReset=&lt;value&#x20;in&#x20;minutes&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;maxFailedLoginAttempts=5&quot;&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;policyAttributeMinutesUntilFailedAuthenticationReset=10&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mobiledevice.passwordpolicy&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;maxFailedAttempts&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;&lt;value&lt;=5&gt;&lt;/integer&gt;&#x20;Note:&#x20;When&#x20;setting&#x20;the&#x20;lockout&#x20;threshold&#x20;with&#x20;a&#x20;mobile&#x20;configuration&#x20;profile&#x20;there&#x20;is&#x20;no&#x20;default&#x20;reset&#x20;to&#x20;the&#x20;lockout.&#x20;To&#x20;set&#x20;the&#x20;reset&#x20;value&#x20;use&#x20;the&#x20;key&#x20;autoEnableInSeconds&#x20;and&#x20;set&#x20;the&#x20;key&#x20;to&#x20;&lt;integer&gt;&lt;value&#x20;in&#x20;seconds&gt;&lt;/integer&gt;.&#x20;Note:&#x20;The&#x20;profile&#x20;method&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;setting&#x20;password&#x20;policy&#x20;since&#x20;-&#x20;setglobalpolicy&#x20;in&#x20;pwpolicy&#x20;is&#x20;deprecated&#x20;and&#x20;will&#x20;likely&#x20;be&#x20;removed&#x20;in&#x20;a&#x20;future&#x20;macOS&#x20;release.','[{\"cis\": [\"5.2.1\"]}, {\"cis_csc_v8\": [\"6.2\"]}, {\"cis_csc_v7\": [\"16.7\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\"]}, {\"hipaa\": [\"164.308(a)(3)(ii)(C)\"]}, {\"iso_27001-2013\": [\"A.9.2.6\"]}, {\"nist_sp_800-53\": [\"AC-2(1)\"]}, {\"pci_dss_v3.2.1\": [\"8.1.3\"]}, {\"pci_dss_v4.0\": [\"8.2.4\", \"8.2.5\"]}, {\"soc_2\": [\"CC6.2\", \"CC6.3\"]}, {\"mitre_techniques\": [\"T1134\", \"T1197\", \"T1538\", \"T1530\", \"T1213\", \"T1089\", \"T1157\", \"T1044\", \"T1484\", \"T1054\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1031\", \"T1050\", \"T1075\", \"T1097\", \"T1034\", \"T1163\", \"T1076\", \"T1021\", \"T1053\", \"T1489\", \"T1051\", \"T1023\", \"T1165\", \"T1528\", \"T1501\", \"T1072\", \"T1537\", \"T1078\", \"T1047\", \"T1084\", \"T1004\"]}]'),(31049,'Ensure&#x20;Password&#x20;Minimum&#x20;Length&#x20;Is&#x20;Configured.','A&#x20;minimum&#x20;password&#x20;length&#x20;is&#x20;the&#x20;fewest&#x20;number&#x20;of&#x20;characters&#x20;a&#x20;password&#x20;can&#x20;contain&#x20;to&#x20;meet&#x20;a&#x20;system&#039;s&#x20;requirements.&#x20;Ensure&#x20;that&#x20;a&#x20;minimum&#x20;of&#x20;a&#x20;15-character&#x20;password&#x20;is&#x20;part&#x20;of&#x20;the&#x20;password&#x20;policy&#x20;on&#x20;the&#x20;computer.&#x20;Where&#x20;the&#x20;confidentiality&#x20;of&#x20;encrypted&#x20;information&#x20;in&#x20;FileVault&#x20;is&#x20;more&#x20;of&#x20;a&#x20;concern,&#x20;requiring&#x20;a&#x20;longer&#x20;password&#x20;or&#x20;passphrase&#x20;may&#x20;be&#x20;sufficient&#x20;rather&#x20;than&#x20;imposing&#x20;additional&#x20;complexity&#x20;requirements&#x20;that&#x20;may&#x20;be&#x20;self-defeating.','Information&#x20;systems&#x20;that&#x20;are&#x20;not&#x20;protected&#x20;with&#x20;strong&#x20;password&#x20;schemes&#x20;including&#x20;passwords&#x20;of&#x20;minimum&#x20;length&#x20;provide&#x20;a&#x20;greater&#x20;opportunity&#x20;for&#x20;attackers&#x20;to&#x20;crack&#x20;the&#x20;password&#x20;and&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system.','Short&#x20;passwords&#x20;can&#x20;be&#x20;easily&#x20;attacked.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;password&#x20;length&#x20;to&#x20;greater&#x20;than&#x20;or&#x20;equal&#x20;to&#x20;15:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;minChars=&lt;value&gt;=15&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;minChars=15&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mobiledevice.passwordpolicy&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;minLength&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;&lt;value&gt;=15&gt;&lt;/integer&gt;&#x20;Note:&#x20;The&#x20;profile&#x20;method&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;setting&#x20;password&#x20;policy&#x20;since&#x20;-&#x20;setglobalpolicy&#x20;in&#x20;pwpolicy&#x20;is&#x20;deprecated&#x20;and&#x20;will&#x20;likely&#x20;be&#x20;removed&#x20;in&#x20;a&#x20;future&#x20;macOS&#x20;release.','[{\"cis\": [\"5.2.2\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}]'),(31050,'Ensure&#x20;Complex&#x20;Password&#x20;Must&#x20;Contain&#x20;Alphabetic&#x20;Characters&#x20;Is&#x20;Configured.','Complex&#x20;passwords&#x20;contain&#x20;one&#x20;character&#x20;from&#x20;each&#x20;of&#x20;the&#x20;following&#x20;classes:&#x20;English&#x20;uppercase&#x20;letters,&#x20;English&#x20;lowercase&#x20;letters,&#x20;Westernized&#x20;Arabic&#x20;numerals,&#x20;and&#x20;non-alphanumeric&#x20;characters.&#x20;Ensure&#x20;that&#x20;an&#x20;Alphabetic&#x20;character&#x20;is&#x20;part&#x20;of&#x20;the&#x20;password&#x20;policy&#x20;on&#x20;the&#x20;computer.','The&#x20;more&#x20;complex&#x20;a&#x20;password,&#x20;the&#x20;more&#x20;resistant&#x20;it&#x20;will&#x20;be&#x20;against&#x20;persons&#x20;seeking&#x20;unauthorized&#x20;access&#x20;to&#x20;a&#x20;system.','Password&#x20;policy&#x20;should&#x20;be&#x20;in&#x20;effect&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;exposed&#x20;services&#x20;being&#x20;compromised&#x20;easily&#x20;through&#x20;dictionary&#x20;attacks&#x20;or&#x20;other&#x20;social&#x20;engineering&#x20;attempts.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;the&#x20;that&#x20;passwords&#x20;must&#x20;contain&#x20;at&#x20;least&#x20;one&#x20;letter:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;-&#x20;setaccountpolicies&#x20;&quot;requiresAlpha=&lt;value&gt;=1&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;requiresAlpha=1&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mobiledevice.passwordpolicy&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;requireAlphanumeric&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;Note:&#x20;This&#x20;profile&#x20;sets&#x20;a&#x20;requirement&#x20;of&#x20;both&#x20;an&#x20;alphabetical&#x20;and&#x20;a&#x20;numeric&#x20;character.&#x20;Note:&#x20;The&#x20;profile&#x20;method&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;setting&#x20;password&#x20;policy&#x20;since&#x20;-&#x20;setglobalpolicy&#x20;in&#x20;pwpolicy&#x20;is&#x20;deprecated&#x20;and&#x20;will&#x20;likely&#x20;be&#x20;removed&#x20;in&#x20;a&#x20;future&#x20;macOS&#x20;release.','[{\"cis\": [\"5.2.3\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(31051,'Ensure&#x20;Complex&#x20;Password&#x20;Must&#x20;Contain&#x20;Numeric&#x20;Character&#x20;Is&#x20;Configured.','Complex&#x20;passwords&#x20;contain&#x20;one&#x20;character&#x20;from&#x20;each&#x20;of&#x20;the&#x20;following&#x20;classes:&#x20;English&#x20;uppercase&#x20;letters,&#x20;English&#x20;lowercase&#x20;letters,&#x20;Westernized&#x20;Arabic&#x20;numerals,&#x20;and&#x20;non-alphanumeric&#x20;characters.&#x20;Ensure&#x20;that&#x20;a&#x20;number&#x20;or&#x20;numeric&#x20;value&#x20;is&#x20;part&#x20;of&#x20;the&#x20;password&#x20;policy&#x20;on&#x20;the&#x20;computer.','The&#x20;more&#x20;complex&#x20;a&#x20;password,&#x20;the&#x20;more&#x20;resistant&#x20;it&#x20;will&#x20;be&#x20;against&#x20;persons&#x20;seeking&#x20;unauthorized&#x20;access&#x20;to&#x20;a&#x20;system.','Password&#x20;policy&#x20;should&#x20;be&#x20;in&#x20;effect&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;exposed&#x20;services&#x20;being&#x20;compromised&#x20;easily&#x20;through&#x20;dictionary&#x20;attacks&#x20;or&#x20;other&#x20;social&#x20;engineering&#x20;attempts.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;passwords&#x20;to&#x20;require&#x20;at&#x20;least&#x20;one&#x20;number:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;-&#x20;setaccountpolicies&#x20;&quot;requiresNumeric=&lt;value&gt;=1&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;requiresNumeric=2&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mobiledevice.passwordpolicy&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;requireAlphanumeric&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;true/&gt;&#x20;Note:&#x20;This&#x20;profile&#x20;sets&#x20;a&#x20;requirement&#x20;of&#x20;both&#x20;an&#x20;alphabetical&#x20;and&#x20;a&#x20;numeric&#x20;character.&#x20;Note:&#x20;The&#x20;profile&#x20;method&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;setting&#x20;password&#x20;policy&#x20;since&#x20;-&#x20;setglobalpolicy&#x20;in&#x20;pwpolicy&#x20;is&#x20;deprecated&#x20;and&#x20;will&#x20;likely&#x20;be&#x20;removed&#x20;in&#x20;a&#x20;future&#x20;macOS&#x20;release.','[{\"cis\": [\"5.2.4\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(31052,'Ensure&#x20;Complex&#x20;Password&#x20;Must&#x20;Contain&#x20;Uppercase&#x20;and&#x20;Lowercase&#x20;Characters&#x20;Is&#x20;Configured.','Complex&#x20;passwords&#x20;contain&#x20;one&#x20;character&#x20;from&#x20;each&#x20;of&#x20;the&#x20;following&#x20;classes:&#x20;English&#x20;uppercase&#x20;letters,&#x20;English&#x20;lowercase&#x20;letters,&#x20;Westernized&#x20;Arabic&#x20;numerals,&#x20;and&#x20;non-alphanumeric&#x20;characters.&#x20;Ensure&#x20;that&#x20;both&#x20;uppercase&#x20;and&#x20;lowercase&#x20;letters&#x20;are&#x20;part&#x20;of&#x20;the&#x20;password&#x20;policy&#x20;on&#x20;the&#x20;computer.','The&#x20;more&#x20;complex&#x20;a&#x20;password,&#x20;the&#x20;more&#x20;resistant&#x20;it&#x20;will&#x20;be&#x20;against&#x20;persons&#x20;seeking&#x20;unauthorized&#x20;access&#x20;to&#x20;a&#x20;system.','Password&#x20;policy&#x20;should&#x20;be&#x20;in&#x20;effect&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;exposed&#x20;services&#x20;being&#x20;compromised&#x20;easily&#x20;through&#x20;dictionary&#x20;attacks&#x20;or&#x20;other&#x20;social&#x20;engineering&#x20;attempts.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;set&#x20;passwords&#x20;to&#x20;require&#x20;at&#x20;upper&#x20;and&#x20;lower&#x20;case&#x20;letter:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;requiresMixedCase=&lt;value&gt;=1&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;requiresMixedCase=1&quot;.','[{\"cis\": [\"5.2.6\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"mitre_techniques\": [\"T1003\", \"T1017\", \"T1019\", \"T1028\", \"T1035\", \"T1047\", \"T1051\", \"T1053\", \"T1055\", \"T1067\", \"T1072\", \"T1075\", \"T1076\", \"T1077\", \"T1078\", \"T1084\", \"T1086\", \"T1088\", \"T1097\", \"T1098\", \"T1100\", \"T1134\", \"T1136\", \"T1169\", \"T1175\", \"T1184\", \"T1190\", \"T1206\", \"T1208\", \"T1210\", \"T1214\", \"T1215\", \"T1218\", \"T1495\", \"T1501\", \"T1505\", \"T1525\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}]'),(31053,'Ensure&#x20;Password&#x20;Age&#x20;Is&#x20;Configured.','Over&#x20;time,&#x20;passwords&#x20;can&#x20;be&#x20;captured&#x20;by&#x20;third&#x20;parties&#x20;through&#x20;mistakes,&#x20;phishing&#x20;attacks,&#x20;third-party&#x20;breaches,&#x20;or&#x20;merely&#x20;brute-force&#x20;attacks.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;exposure&#x20;and&#x20;to&#x20;decrease&#x20;the&#x20;incentives&#x20;of&#x20;password&#x20;reuse&#x20;&#40;passwords&#x20;that&#x20;are&#x20;not&#x20;forced&#x20;to&#x20;be&#x20;changed&#x20;periodically&#x20;generally&#x20;are&#x20;not&#x20;ever&#x20;changed&#41;,&#x20;users&#x20;should&#x20;reset&#x20;passwords&#x20;periodically.&#x20;This&#x20;control&#x20;uses&#x20;365&#x20;days&#x20;as&#x20;the&#x20;acceptable&#x20;value.&#x20;Some&#x20;organizations&#x20;may&#x20;be&#x20;more&#x20;or&#x20;less&#x20;restrictive.&#x20;This&#x20;control&#x20;mainly&#x20;exists&#x20;to&#x20;mitigate&#x20;against&#x20;password&#x20;reuse&#x20;of&#x20;the&#x20;macOS&#x20;account&#x20;password&#x20;in&#x20;other&#x20;realms&#x20;that&#x20;may&#x20;be&#x20;more&#x20;prone&#x20;to&#x20;compromise.&#x20;Attackers&#x20;take&#x20;advantage&#x20;of&#x20;exposed&#x20;information&#x20;to&#x20;attack&#x20;other&#x20;accounts.','Passwords&#x20;should&#x20;be&#x20;changed&#x20;periodically&#x20;to&#x20;reduce&#x20;exposure.','Required&#x20;password&#x20;changes&#x20;will&#x20;lead&#x20;to&#x20;some&#x20;locked&#x20;computers&#x20;requiring&#x20;admin&#x20;assistance.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;require&#x20;that&#x20;passwords&#x20;expire&#x20;after&#x20;at&#x20;most&#x20;365&#x20;days:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;maxMinutesUntilChangePassword=&lt;value&lt;=525600&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;maxMinutesUntilChangePassword=43200&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mobiledevice.passwordpolicy&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;maxPINAgeInDays&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;&lt;value&gt;=365&gt;&lt;/integer&gt;&#x20;Note:&#x20;The&#x20;profile&#x20;method&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;setting&#x20;password&#x20;policy&#x20;since&#x20;-&#x20;setglobalpolicy&#x20;in&#x20;pwpolicy&#x20;is&#x20;deprecated&#x20;and&#x20;will&#x20;likely&#x20;be&#x20;removed&#x20;in&#x20;a&#x20;future&#x20;macOS&#x20;release.','[{\"cis\": [\"5.2.7\"]}, {\"cis_csc_v8\": [\"5.3\"]}, {\"cis_csc_v7\": [\"16.9\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.6\"]}, {\"nist_sp_800-53\": [\"AC-2(3)\"]}, {\"pci_dss_v3.2.1\": [\"8.1.4\"]}, {\"pci_dss_v4.0\": [\"8.3.7\"]}, {\"mitre_techniques\": [\"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\", \"T1134\", \"T1197\", \"T1538\", \"T1089\", \"T1157\", \"T1054\", \"T1159\", \"T1160\", \"T1152\", \"T1168\", \"T1162\", \"T1185\", \"T1050\", \"T1075\", \"T1097\", \"T1163\", \"T1021\", \"T1489\", \"T1051\", \"T1023\", \"T1165\", \"T1501\", \"T1072\", \"T1537\", \"T1047\", \"T1084\", \"T1004\"]}]'),(31054,'Ensure&#x20;Password&#x20;History&#x20;Is&#x20;Configured.','Over&#x20;time,&#x20;passwords&#x20;can&#x20;be&#x20;captured&#x20;by&#x20;third&#x20;parties&#x20;through&#x20;mistakes,&#x20;phishing&#x20;attacks,&#x20;third-party&#x20;breaches,&#x20;or&#x20;merely&#x20;brute-force&#x20;attacks.&#x20;To&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;exposure&#x20;and&#x20;to&#x20;decrease&#x20;the&#x20;incentives&#x20;of&#x20;password&#x20;reuse&#x20;&#40;passwords&#x20;that&#x20;are&#x20;not&#x20;forced&#x20;to&#x20;be&#x20;changed&#x20;periodically&#x20;generally&#x20;are&#x20;not&#x20;ever&#x20;changed&#41;,&#x20;users&#x20;must&#x20;reset&#x20;passwords&#x20;periodically.&#x20;This&#x20;control&#x20;ensures&#x20;that&#x20;previous&#x20;passwords&#x20;are&#x20;not&#x20;reused&#x20;immediately&#x20;by&#x20;keeping&#x20;a&#x20;history&#x20;of&#x20;previous&#x20;password&#x20;hashes.&#x20;Ensure&#x20;that&#x20;password&#x20;history&#x20;checks&#x20;are&#x20;part&#x20;of&#x20;the&#x20;password&#x20;policy&#x20;on&#x20;the&#x20;computer.&#x20;This&#x20;control&#x20;checks&#x20;whether&#x20;a&#x20;new&#x20;password&#x20;is&#x20;different&#x20;than&#x20;the&#x20;previous&#x20;15.&#x20;The&#x20;latest&#x20;NIST&#x20;guidance&#x20;based&#x20;on&#x20;exploit&#x20;research&#x20;referenced&#x20;in&#x20;this&#x20;section&#x20;details&#x20;how&#x20;one&#x20;of&#x20;the&#x20;greatest&#x20;risks&#x20;is&#x20;password&#x20;exposure&#x20;rather&#x20;than&#x20;password&#x20;cracking.&#x20;Passwords&#x20;should&#x20;be&#x20;changed&#x20;to&#x20;a&#x20;new&#x20;unique&#x20;value&#x20;whenever&#x20;a&#x20;password&#x20;might&#x20;have&#x20;been&#x20;exposed&#x20;to&#x20;anyone&#x20;other&#x20;than&#x20;the&#x20;account&#x20;holder.&#x20;Attackers&#x20;have&#x20;maintained&#x20;persistent&#x20;control&#x20;based&#x20;on&#x20;predictable&#x20;password&#x20;change&#x20;patterns&#x20;and&#x20;substantially&#x20;different&#x20;patterns&#x20;should&#x20;be&#x20;used&#x20;in&#x20;case&#x20;of&#x20;a&#x20;leak.','Old&#x20;passwords&#x20;should&#x20;not&#x20;be&#x20;reused.','Required&#x20;password&#x20;changes&#x20;will&#x20;lead&#x20;to&#x20;some&#x20;locked&#x20;computers&#x20;requiring&#x20;admin&#x20;assistance.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;require&#x20;that&#x20;the&#x20;password&#x20;must&#x20;to&#x20;be&#x20;different&#x20;from&#x20;at&#x20;least&#x20;the&#x20;last&#x20;15&#x20;passwords:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;usingHistory=&lt;value&gt;=15&gt;&quot;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/pwpolicy&#x20;-n&#x20;/Local/Default&#x20;-setglobalpolicy&#x20;&quot;usingHistory=15&quot;&#x20;Profile&#x20;Method:&#x20;Create&#x20;or&#x20;edit&#x20;a&#x20;configuration&#x20;profile&#x20;with&#x20;the&#x20;following&#x20;information:&#x20;1.&#x20;The&#x20;PayloadType&#x20;string&#x20;is&#x20;com.apple.mobiledevice.passwordpolicy&#x20;2.&#x20;The&#x20;key&#x20;to&#x20;include&#x20;is&#x20;pinHistory&#x20;3.&#x20;The&#x20;key&#x20;must&#x20;be&#x20;set&#x20;to&#x20;&lt;integer&gt;&lt;value&gt;=15&gt;&lt;/integer&gt;&#x20;Note:&#x20;The&#x20;profile&#x20;method&#x20;is&#x20;the&#x20;preferred&#x20;method&#x20;for&#x20;setting&#x20;password&#x20;policy&#x20;since&#x20;-&#x20;setglobalpolicy&#x20;in&#x20;pwpolicy&#x20;is&#x20;deprecated&#x20;and&#x20;will&#x20;likely&#x20;be&#x20;removed&#x20;in&#x20;a&#x20;future&#x20;macOS&#x20;release.','[{\"cis\": [\"5.2.8\"]}, {\"cis_csc_v8\": [\"5.2\"]}, {\"cis_csc_v7\": [\"4.4\"]}, {\"cmmc_v2.0\": [\"IA.L2-3.5.7\"]}, {\"iso_27001-2013\": [\"A.9.4.3\"]}, {\"pci_dss_v4.0\": [\"2.2.2\", \"8.3.5\", \"8.3.6\", \"8.6.3\"]}, {\"soc_2\": [\"CC6.1\"]}, {\"mitre_techniques\": [\"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1501\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}]'),(31055,'Ensure&#x20;the&#x20;Sudo&#x20;Timeout&#x20;Period&#x20;Is&#x20;Set&#x20;to&#x20;Zero.','The&#x20;sudo&#x20;command&#x20;allows&#x20;the&#x20;user&#x20;to&#x20;run&#x20;programs&#x20;as&#x20;the&#x20;root&#x20;user.&#x20;Working&#x20;as&#x20;the&#x20;root&#x20;user&#x20;allows&#x20;the&#x20;user&#x20;an&#x20;extremely&#x20;high&#x20;level&#x20;of&#x20;configurability&#x20;within&#x20;the&#x20;system.&#x20;This&#x20;control,&#x20;along&#x20;with&#x20;the&#x20;control&#x20;to&#x20;use&#x20;a&#x20;separate&#x20;timestamp&#x20;for&#x20;each&#x20;tty,&#x20;limits&#x20;the&#x20;window&#x20;where&#x20;an&#x20;unauthorized&#x20;user,&#x20;process,&#x20;or&#x20;attacker&#x20;could&#x20;utilize&#x20;legitimate&#x20;credentials&#x20;that&#x20;are&#x20;valid&#x20;for&#x20;longer&#x20;than&#x20;required.','The&#x20;sudo&#x20;command&#x20;stays&#x20;logged&#x20;in&#x20;as&#x20;the&#x20;root&#x20;user&#x20;for&#x20;five&#x20;minutes&#x20;before&#x20;timing&#x20;out&#x20;and&#x20;re-requesting&#x20;a&#x20;password.&#x20;This&#x20;five-minute&#x20;window&#x20;should&#x20;be&#x20;eliminated&#x20;since&#x20;it&#x20;leaves&#x20;the&#x20;system&#x20;extremely&#x20;vulnerable.&#x20;This&#x20;is&#x20;especially&#x20;true&#x20;if&#x20;an&#x20;exploit&#x20;were&#x20;to&#x20;gain&#x20;access&#x20;to&#x20;the&#x20;system,&#x20;since&#x20;they&#x20;would&#x20;be&#x20;able&#x20;to&#x20;make&#x20;changes&#x20;as&#x20;a&#x20;root&#x20;user.','This&#x20;control&#x20;has&#x20;a&#x20;serious&#x20;impact&#x20;where&#x20;users&#x20;often&#x20;have&#x20;to&#x20;use&#x20;sudo.&#x20;It&#x20;is&#x20;even&#x20;more&#x20;of&#x20;an&#x20;impact&#x20;where&#x20;users&#x20;have&#x20;to&#x20;use&#x20;sudo&#x20;multiple&#x20;times&#x20;in&#x20;quick&#x20;succession&#x20;as&#x20;part&#x20;of&#x20;normal&#x20;work&#x20;processes.&#x20;Organizations&#x20;with&#x20;that&#x20;common&#x20;use&#x20;case&#x20;will&#x20;likely&#x20;find&#x20;this&#x20;control&#x20;too&#x20;onerous&#x20;and&#x20;are&#x20;better&#x20;to&#x20;accept&#x20;the&#x20;risk&#x20;of&#x20;not&#x20;requiring&#x20;a&#x20;0&#x20;grace&#x20;period.&#x20;In&#x20;some&#x20;ways&#x20;the&#x20;use&#x20;of&#x20;sudo&#x20;-s,&#x20;which&#x20;is&#x20;undesirable,&#x20;is&#x20;better&#x20;than&#x20;a&#x20;long&#x20;grace&#x20;period&#x20;since&#x20;that&#x20;use&#x20;does&#x20;change&#x20;the&#x20;hash&#x20;to&#x20;show&#x20;that&#x20;it&#x20;is&#x20;a&#x20;root&#x20;shell&#x20;rather&#x20;than&#x20;a&#x20;normal&#x20;shell&#x20;where&#x20;sudo&#x20;commands&#x20;will&#x20;be&#x20;implemented&#x20;without&#x20;a&#x20;password.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/visudo&#x20;-f&#x20;/etc/sudoers.d/&lt;configuration&#x20;file&#x20;name&gt;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/visudo&#x20;-f&#x20;/etc/sudoers.d/10_cissudoconfiguration&#x20;Note:&#x20;Unlike&#x20;other&#x20;Unix&#x20;and/or&#x20;Linux&#x20;distros,&#x20;macOS&#x20;will&#x20;ignore&#x20;configuration&#x20;files&#x20;in&#x20;the&#x20;sudoers.d&#x20;folder&#x20;that&#x20;contain&#x20;a&#x20;.&#x20;so&#x20;do&#x20;not&#x20;add&#x20;a&#x20;file&#x20;extension&#x20;to&#x20;the&#x20;configuration&#x20;file.&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_timeout=0&#x20;to&#x20;the&#x20;configuration&#x20;file.&#x20;If&#x20;/etc/sudoers.d/&#x20;is&#x20;not&#x20;owned&#x20;by&#x20;root&#x20;or&#x20;in&#x20;the&#x20;wheel&#x20;group,&#x20;run&#x20;the&#x20;following&#x20;to&#x20;change&#x20;ownership&#x20;and&#x20;group:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/chown&#x20;-R&#x20;root:wheel&#x20;/etc/security/sudoers.d/.','[{\"cis\": [\"5.4\"]}, {\"cis_csc_v8\": [\"4.3\"]}, {\"cis_csc_v7\": [\"16.11\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.10\", \"AC.L2-3.1.11\"]}, {\"hipaa\": [\"164.312(a)(2)(iii)\"]}, {\"nist_sp_800-53\": [\"AC-11\", \"AC-11(1)\", \"AC-12\", \"AC-2(5)\"]}, {\"iso_27001-2013\": [\"A.8.1.3\"]}, {\"pci_dss_v3.2.1\": [\"8.1.8\"]}, {\"pci_dss_v4.0\": [\"8.2.8\"]}, {\"mitre_techniques\": [\"T1110\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31056,'Ensure&#x20;a&#x20;Separate&#x20;Timestamp&#x20;Is&#x20;Enabled&#x20;for&#x20;Each&#x20;User/tty&#x20;Combo.','Using&#x20;tty&#x20;tickets&#x20;ensures&#x20;that&#x20;a&#x20;user&#x20;must&#x20;enter&#x20;the&#x20;sudo&#x20;password&#x20;in&#x20;each&#x20;Terminal&#x20;session.&#x20;With&#x20;sudo&#x20;versions&#x20;1.8&#x20;and&#x20;higher,&#x20;introduced&#x20;in&#x20;10.12,&#x20;the&#x20;default&#x20;value&#x20;is&#x20;to&#x20;have&#x20;tty&#x20;tickets&#x20;for&#x20;each&#x20;interface&#x20;so&#x20;that&#x20;root&#x20;access&#x20;is&#x20;limited&#x20;to&#x20;a&#x20;specific&#x20;terminal.&#x20;The&#x20;default&#x20;configuration&#x20;can&#x20;be&#x20;overwritten&#x20;or&#x20;not&#x20;configured&#x20;correctly&#x20;on&#x20;earlier&#x20;versions&#x20;of&#x20;macOS.','In&#x20;combination&#x20;with&#x20;removing&#x20;the&#x20;sudo&#x20;timeout&#x20;grace&#x20;period,&#x20;a&#x20;further&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;possibility&#x20;of&#x20;a&#x20;background&#x20;process&#x20;using&#x20;elevated&#x20;rights&#x20;when&#x20;a&#x20;user&#x20;elevates&#x20;to&#x20;root&#x20;in&#x20;an&#x20;explicit&#x20;context&#x20;or&#x20;tty.&#x20;Additional&#x20;mitigation&#x20;should&#x20;be&#x20;in&#x20;place&#x20;to&#x20;reduce&#x20;the&#x20;risk&#x20;of&#x20;privilege&#x20;escalation&#x20;of&#x20;background&#x20;processes.','This&#x20;control&#x20;should&#x20;have&#x20;no&#x20;user&#x20;impact.&#x20;Developers&#x20;or&#x20;installers&#x20;may&#x20;have&#x20;issues&#x20;if&#x20;background&#x20;processes&#x20;are&#x20;spawned&#x20;with&#x20;different&#x20;interfaces&#x20;than&#x20;where&#x20;sudo&#x20;was&#x20;executed.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;edit&#x20;the&#x20;sudo&#x20;settings:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/visudo&#x20;-f&#x20;/etc/sudoers.d/&lt;configuration&#x20;file&#x20;name&gt;&#x20;example:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/visudo&#x20;-f&#x20;/etc/sudoers.d/10_cissudoconfiguration&#x20;Note:&#x20;Unlike&#x20;other&#x20;Unix&#x20;and/or&#x20;Linux&#x20;distros,&#x20;macOS&#x20;will&#x20;ignore&#x20;configuration&#x20;files&#x20;in&#x20;the&#x20;sudoers.d&#x20;folder&#x20;that&#x20;contain&#x20;a&#x20;.&#x20;so&#x20;do&#x20;not&#x20;add&#x20;a&#x20;file&#x20;extension&#x20;to&#x20;the&#x20;configuration&#x20;file.&#x20;Add&#x20;the&#x20;line&#x20;Defaults&#x20;timestamp_type=tty&#x20;to&#x20;the&#x20;configuration&#x20;file.&#x20;Note:&#x20;The&#x20;Defaults&#x20;timestamp_type=tty&#x20;line&#x20;can&#x20;be&#x20;added&#x20;to&#x20;an&#x20;existing&#x20;configuration&#x20;file&#x20;or&#x20;a&#x20;new&#x20;one.&#x20;That&#x20;will&#x20;depend&#x20;on&#x20;your&#x20;organization&#039;s&#x20;preference&#x20;and&#x20;works&#x20;either&#x20;way.','[{\"cis\": [\"5.5\"]}, {\"cis_csc_v8\": [\"4.3\"]}, {\"cis_csc_v7\": [\"16.11\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.10\", \"AC.L2-3.1.11\"]}, {\"hipaa\": [\"164.312(a)(2)(iii)\"]}, {\"nist_sp_800-53\": [\"AC-11\", \"AC-11(1)\", \"AC-12\", \"AC-2(5)\"]}, {\"iso_27001-2013\": [\"A.8.1.3\"]}, {\"pci_dss_v3.2.1\": [\"8.1.8\"]}, {\"pci_dss_v4.0\": [\"8.2.8\"]}, {\"mitre_techniques\": [\"T1110\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31057,'Ensure&#x20;the&#x20;&quot;root&quot;&#x20;Account&#x20;Is&#x20;Disabled.','The&#x20;root&#x20;account&#x20;is&#x20;a&#x20;superuser&#x20;account&#x20;that&#x20;has&#x20;access&#x20;privileges&#x20;to&#x20;perform&#x20;any&#x20;actions&#x20;and&#x20;read/write&#x20;to&#x20;any&#x20;file&#x20;on&#x20;the&#x20;computer.&#x20;With&#x20;some&#x20;versions&#x20;of&#x20;Linux,&#x20;the&#x20;system&#x20;administrator&#x20;may&#x20;commonly&#x20;use&#x20;the&#x20;root&#x20;account&#x20;to&#x20;perform&#x20;administrative&#x20;functions.','Enabling&#x20;and&#x20;using&#x20;the&#x20;root&#x20;account&#x20;puts&#x20;the&#x20;system&#x20;at&#x20;risk&#x20;since&#x20;any&#x20;successful&#x20;exploit&#x20;or&#x20;mistake&#x20;while&#x20;the&#x20;root&#x20;account&#x20;is&#x20;in&#x20;use&#x20;could&#x20;have&#x20;unlimited&#x20;access&#x20;privileges&#x20;within&#x20;the&#x20;system.&#x20;Using&#x20;the&#x20;sudo&#x20;command&#x20;allows&#x20;users&#x20;to&#x20;perform&#x20;functions&#x20;as&#x20;a&#x20;root&#x20;user&#x20;while&#x20;limiting&#x20;and&#x20;password&#x20;protecting&#x20;the&#x20;access&#x20;privileges.&#x20;By&#x20;default&#x20;the&#x20;root&#x20;account&#x20;is&#x20;not&#x20;enabled&#x20;on&#x20;a&#x20;macOS&#x20;computer.&#x20;An&#x20;administrator&#x20;can&#x20;escalate&#x20;privileges&#x20;using&#x20;the&#x20;sudo&#x20;command&#x20;&#40;use&#x20;-s&#x20;or&#x20;-i&#x20;to&#x20;get&#x20;a&#x20;root&#x20;shell&#41;.','Some&#x20;legacy&#x20;POSIX&#x20;software&#x20;might&#x20;expect&#x20;an&#x20;available&#x20;root&#x20;account.','Graphical&#x20;Method:&#x20;Perform&#x20;the&#x20;following&#x20;steps&#x20;to&#x20;ensure&#x20;that&#x20;the&#x20;root&#x20;user&#x20;is&#x20;disabled:&#x20;1.&#x20;Open&#x20;/System/Library/CoreServices/Applications/Directory&#x20;Utility&#x20;2.&#x20;Click&#x20;the&#x20;lock&#x20;icon&#x20;to&#x20;unlock&#x20;the&#x20;service&#x20;3.&#x20;Click&#x20;Edit&#x20;in&#x20;the&#x20;menu&#x20;bar&#x20;4.&#x20;Click&#x20;Disable&#x20;Root&#x20;User&#x20;Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;the&#x20;root&#x20;user:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/dsenableroot&#x20;-d&#x20;username&#x20;=&#x20;root&#x20;user&#x20;password:.','[{\"cis\": [\"5.6\"]}, {\"cis_csc_v8\": [\"5.4\"]}, {\"cis_csc_v7\": [\"4.3\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.5\", \"AC.L2-3.1.6\", \"AC.L2-3.1.7\", \"SC.L2-3.13.3\"]}, {\"iso_27001-2013\": [\"A.9.2.3\"]}, {\"nist_sp_800-53\": [\"AC-6(2)\", \"AC-6(5)\"]}, {\"pci_dss_v3.2.1\": [\"7.1\", \"7.1.1\", \"7.1.2\", \"7.1.3\"]}, {\"soc_2\": [\"CC6.1\", \"CC6.3\"]}, {\"mitre_techniques\": [\"T1176\", \"T1501\", \"T1134\", \"T1098\", \"T1017\", \"T1067\", \"T1088\", \"T1175\", \"T1136\", \"T1003\", \"T1214\", \"T1190\", \"T1210\", \"T1495\", \"T1525\", \"T1208\", \"T1215\", \"T1075\", \"T1097\", \"T1086\", \"T1055\", \"T1076\", \"T1053\", \"T1505\", \"T1035\", \"T1051\", \"T1218\", \"T1184\", \"T1169\", \"T1206\", \"T1019\", \"T1072\", \"T1078\", \"T1100\", \"T1077\", \"T1047\", \"T1084\", \"T1028\"]}]'),(31058,'Ensure&#x20;an&#x20;Administrator&#x20;Account&#x20;Cannot&#x20;Login&#x20;to&#x20;Another&#x20;User&#039;s&#x20;Active&#x20;and&#x20;Locked&#x20;Session.','macOS&#x20;has&#x20;a&#x20;privilege&#x20;that&#x20;can&#x20;be&#x20;granted&#x20;to&#x20;any&#x20;user&#x20;that&#x20;will&#x20;allow&#x20;that&#x20;user&#x20;to&#x20;unlock&#x20;active&#x20;user&#039;s&#x20;sessions.','Disabling&#x20;the&#x20;administrator&#039;s&#x20;and/or&#x20;user&#039;s&#x20;ability&#x20;to&#x20;log&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and&#x20;locked&#x20;session&#x20;prevents&#x20;unauthorized&#x20;persons&#x20;from&#x20;viewing&#x20;potentially&#x20;sensitive&#x20;and/or&#x20;personal&#x20;information.','While&#x20;Fast&#x20;user&#x20;switching&#x20;is&#x20;a&#x20;workaround&#x20;for&#x20;some&#x20;lab&#x20;environments,&#x20;especially&#x20;where&#x20;there&#x20;is&#x20;even&#x20;less&#x20;of&#x20;an&#x20;expectation&#x20;of&#x20;privacy,&#x20;this&#x20;setting&#x20;change&#x20;may&#x20;impact&#x20;some&#x20;maintenance&#x20;workflows.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;disable&#x20;a&#x20;user&#x20;logging&#x20;into&#x20;another&#x20;user&#039;s&#x20;active&#x20;and/or&#x20;locked&#x20;session:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/bin/security&#x20;authorizationdb&#x20;write&#x20;system.login.screensaver&#x20;use-login-window-ui&#x20;YES&#x20;&#40;0&#41;.','[{\"cis\": [\"5.7\"]}, {\"cis_csc_v8\": [\"4.3\"]}, {\"cis_csc_v7\": [\"16.11\"]}, {\"cmmc_v2.0\": [\"AC.L2-3.1.10\", \"AC.L2-3.1.11\"]}, {\"hipaa\": [\"164.312(a)(2)(iii)\"]}, {\"nist_sp_800-53\": [\"AC-11\", \"AC-11(1)\", \"AC-12\", \"AC-2(5)\"]}, {\"iso_27001-2013\": [\"A.8.1.3\"]}, {\"pci_dss_v3.2.1\": [\"8.1.8\"]}, {\"pci_dss_v4.0\": [\"8.2.8\"]}, {\"mitre_techniques\": [\"T1110\", \"T1527\", \"T1176\", \"T1088\", \"T1081\", \"T1214\", \"T1530\", \"T1213\", \"T1038\", \"T1073\", \"T1482\", \"T1114\", \"T1044\", \"T1484\", \"T1525\", \"T1161\", \"T1031\", \"T1034\", \"T1145\", \"T1076\", \"T1053\", \"T1505\", \"T1528\", \"T1078\"]}]'),(31059,'Ensure&#x20;a&#x20;Login&#x20;Window&#x20;Banner&#x20;Exists.','A&#x20;Login&#x20;window&#x20;banner&#x20;warning&#x20;informs&#x20;the&#x20;user&#x20;that&#x20;the&#x20;system&#x20;is&#x20;reserved&#x20;for&#x20;authorized&#x20;use&#x20;only.&#x20;It&#x20;enforces&#x20;an&#x20;acknowledgment&#x20;by&#x20;the&#x20;user&#x20;that&#x20;they&#x20;have&#x20;been&#x20;informed&#x20;of&#x20;the&#x20;use&#x20;policy&#x20;in&#x20;the&#x20;banner&#x20;if&#x20;required.&#x20;The&#x20;system&#x20;recognizes&#x20;either&#x20;the&#x20;.txt&#x20;and&#x20;the&#x20;.rtf&#x20;formats.','An&#x20;access&#x20;warning&#x20;may&#x20;reduce&#x20;a&#x20;casual&#x20;attacker&#039;s&#x20;tendency&#x20;to&#x20;target&#x20;the&#x20;system.&#x20;Access&#x20;warnings&#x20;may&#x20;also&#x20;aid&#x20;in&#x20;the&#x20;prosecution&#x20;of&#x20;an&#x20;attacker&#x20;by&#x20;evincing&#x20;the&#x20;attacker&#039;s&#x20;knowledge&#x20;of&#x20;the&#x20;system&#039;s&#x20;private&#x20;status,&#x20;acceptable&#x20;use&#x20;policy,&#x20;and&#x20;authorization&#x20;requirements.','Users&#x20;will&#x20;have&#x20;to&#x20;click&#x20;on&#x20;the&#x20;window&#x20;with&#x20;the&#x20;Login&#x20;text&#x20;before&#x20;logging&#x20;into&#x20;the&#x20;computer.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;commands&#x20;to&#x20;create&#x20;or&#x20;edit&#x20;the&#x20;login&#x20;window&#x20;text&#x20;and&#x20;set&#x20;the&#x20;proper&#x20;permissions:&#x20;Edit&#x20;&#40;or&#x20;create&#41;&#x20;a&#x20;PolicyBanner.txt&#x20;or&#x20;PolicyBanner.rtf&#x20;file,&#x20;in&#x20;the&#x20;/Library/Security/&#x20;folder,&#x20;to&#x20;include&#x20;the&#x20;required&#x20;login&#x20;window&#x20;banner&#x20;text.&#x20;Perform&#x20;the&#x20;following&#x20;to&#x20;set&#x20;permissions&#x20;on&#x20;the&#x20;policy&#x20;banner&#x20;file:&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/chown&#x20;o+r&#x20;/Library/Security/PolicyBanner.txt&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/chown&#x20;o+r&#x20;/Library/Security/PolicyBanner.rtf&#x20;Note:&#x20;If&#x20;your&#x20;organization&#x20;uses&#x20;an&#x20;.rtfd&#x20;file&#x20;to&#x20;set&#x20;the&#x20;policy&#x20;banner,&#x20;run&#x20;$&#x20;/usr/bin/sudo&#x20;/usr/sbin/chown&#x20;-R&#x20;o+rx&#x20;/Library/Security/PolicyBanner.rtfd&#x20;to&#x20;update&#x20;the&#x20;permissions.','[{\"cis\": [\"5.8\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}]'),(31060,'Ensure&#x20;the&#x20;Guest&#x20;Home&#x20;Folder&#x20;Does&#x20;Not&#x20;Exist.','In&#x20;the&#x20;previous&#x20;two&#x20;controls,&#x20;the&#x20;guest&#x20;account&#x20;login&#x20;has&#x20;been&#x20;disabled&#x20;and&#x20;sharing&#x20;to&#x20;guests&#x20;has&#x20;been&#x20;disabled,&#x20;as&#x20;well.&#x20;There&#x20;is&#x20;no&#x20;need&#x20;for&#x20;the&#x20;legacy&#x20;Guest&#x20;home&#x20;folder&#x20;to&#x20;remain&#x20;in&#x20;the&#x20;file&#x20;system.&#x20;When&#x20;normal&#x20;user&#x20;accounts&#x20;are&#x20;removed,&#x20;you&#x20;have&#x20;the&#x20;option&#x20;to&#x20;archive&#x20;it,&#x20;leave&#x20;it&#x20;in&#x20;place,&#x20;or&#x20;delete.&#x20;In&#x20;the&#x20;case&#x20;of&#x20;the&#x20;guest&#x20;folder,&#x20;the&#x20;folder&#x20;remains&#x20;in&#x20;place&#x20;without&#x20;a&#x20;GUI&#x20;option&#x20;to&#x20;remove&#x20;it.&#x20;If&#x20;at&#x20;some&#x20;point&#x20;in&#x20;the&#x20;future&#x20;a&#x20;Guest&#x20;account&#x20;is&#x20;needed,&#x20;it&#x20;will&#x20;be&#x20;re-created.&#x20;The&#x20;presence&#x20;of&#x20;the&#x20;Guest&#x20;home&#x20;folder&#x20;can&#x20;cause&#x20;automated&#x20;audits&#x20;to&#x20;fail&#x20;when&#x20;looking&#x20;for&#x20;compliant&#x20;settings&#x20;within&#x20;all&#x20;User&#x20;folders,&#x20;as&#x20;well.&#x20;Rather&#x20;than&#x20;ignoring&#x20;the&#x20;folder&#039;s&#x20;continued&#x20;existence,&#x20;it&#x20;is&#x20;best&#x20;removed.','The&#x20;Guest&#x20;home&#x20;folders&#x20;are&#x20;unneeded&#x20;after&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;disabled&#x20;and&#x20;could&#x20;be&#x20;used&#x20;inappropriately.','The&#x20;Guest&#x20;account&#x20;should&#x20;not&#x20;be&#x20;necessary&#x20;after&#x20;it&#x20;is&#x20;disabled,&#x20;and&#x20;it&#x20;will&#x20;be&#x20;automatically&#x20;re-created&#x20;if&#x20;the&#x20;Guest&#x20;account&#x20;is&#x20;re-enabled.','Terminal&#x20;Method:&#x20;Run&#x20;the&#x20;following&#x20;command&#x20;to&#x20;remove&#x20;the&#x20;Guest&#x20;user&#x20;home&#x20;folder:&#x20;$&#x20;/usr/bin/sudo&#x20;/bin/rm&#x20;-R&#x20;/Users/Guest.','[{\"cis\": [\"5.10\"]}, {\"cis_csc_v8\": [\"4.1\"]}, {\"cis_csc_v7\": [\"5.1\"]}, {\"cmmc_v2.0\": [\"AC.L1-3.1.1\", \"AC.L1-3.1.2\", \"CM.L2-3.4.1\", \"CM.L2-3.4.2\", \"CM.L2-3.4.6\", \"CM.L2-3.4.7\"]}, {\"iso_27001-2013\": [\"A.14.2.5\", \"A.8.1.3\"]}, {\"nist_sp_800-53\": [\"CM-7(1)\", \"CM-9\", \"SA-10\"]}, {\"pci_dss_v3.2.1\": [\"11.5\", \"2.2\"]}, {\"pci_dss_v4.0\": [\"1.1.1\", \"1.2.1\", \"1.2.6\", \"1.2.7\", \"1.5.1\", \"2.1.1\", \"2.2.1\"]}, {\"soc_2\": [\"CC7.1\", \"CC8.1\"]}, {\"mitre_techniques\": [\"T1110\", \"T1003\", \"T1081\", \"T1097\", \"T1178\", \"T1072\", \"T1067\", \"T1495\", \"T1019\", \"T1177\", \"T1485\", \"T1486\", \"T1491\", \"T1488\", \"T1487\", \"T1490\", \"T1146\", \"T1148\", \"T1015\", \"T1133\", \"T1200\", \"T1076\", \"T1051\", \"T1176\", \"T1501\", \"T1087\", \"T1098\", \"T1139\", \"T1197\", \"T1092\", \"T1136\", \"T1011\", \"T1147\", \"T1130\", \"T1174\", \"T1053\", \"T1166\", \"T1206\", \"T1503\", \"T1214\", \"T1187\", \"T1208\", \"T1142\", \"T1075\", \"T1201\", \"T1145\", \"T1184\", \"T1537\", \"T1078\", \"T1077\", \"T1134\", \"T1017\", \"T1088\", \"T1175\", \"T1190\", \"T1210\", \"T1525\", \"T1215\", \"T1086\", \"T1055\", \"T1505\", \"T1035\", \"T1218\", \"T1169\", \"T1100\", \"T1047\", \"T1084\", \"T1028\", \"T1156\", \"T1196\", \"T1530\", \"T1089\", \"T1073\", \"T1157\", \"T1054\", \"T1070\", \"T1037\", \"T1036\", \"T1096\", \"T1034\", \"T1150\", \"T1504\", \"T1494\", \"T1489\", \"T1198\", \"T1165\", \"T1492\", \"T1080\", \"T1209\", \"T1112\", \"T1058\", \"T1173\", \"T1137\", \"T1539\", \"T1535\", \"T1506\", \"T1138\", \"T1044\", \"T1199\"]}]');

INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (41,1,'Security','Hardening&#x20;plugin&#x20;for&#x20;security&#x20;compliance&#x20;analysis','','ID;STATUS','',0,2);

INSERT INTO `tmodule_inventory` (`id_module_inventory`, `id_os`, `name`, `description`, `interpreter`, `data_format`, `code`, `block_mode`,`script_mode`) VALUES (42,9,'Security','Hardening&#x20;plugin&#x20;for&#x20;security&#x20;compliance&#x20;analysis','','ID;STATUS','',0,2);
